Functional Safety of Battery Management System

Abstract

In a particular embodiment, a functional safety method in a battery management system is disclosed, including: generating battery sensing data by a module monitoring system of the battery management system; generating integrity data by the module monitoring system based on the battery sensing data; sending the battery sensing data and the integrity data by the module monitoring system to a wireless network controller of the battery management system through a wireless black communication channel; and sending the battery sensing data to a vehicle control system through the wireless network controller.

Description

Background Art

[0001] Electric vehicles are powered by a high-voltage battery system including a plurality of battery cells. A battery management system is used to monitor various attributes of the battery cells, including voltage, temperature, and current, to ensure the correct and safe operation of the battery. In a traditional wired battery management system, the plurality of battery cells of the battery are grouped into modules, and each module has components for monitoring these attributes. Each of these components is connected to a central controller. Problems caused by this solution include a lack of flexibility in the packaging design, waste of space due to connectors and cables within the battery pack, and increased challenges in using the second life of the battery. Although wireless technologies can be used to connect the battery monitoring components to the central controller, these wireless technologies are vulnerable to interference from other systems or malicious parties and are also vulnerable to cyberattacks. Summary of the Invention

[0002] In a battery management system, a plurality of module monitoring systems can each be configured to monitor various attributes of a battery module. These attributes can be encoded as battery sensing data. Each module monitoring system can encode integrity data for its battery sensing data. Examples of integrity data can include error detection codes, message authentication codes, identifiers, timestamps, etc. Each module monitoring system can encode its battery sensing data and integrity data for transmission as a wireless signal. Then, each module monitoring system transmits its battery sensing data and integrity data to a wireless network controller via a wireless black communication channel. The wireless network controller can verify the received battery sensing data based on the corresponding integrity data and provide the verified battery sensing data to the vehicle control system.

[0003] The use of integrity data for battery sensing data allows the wireless network controller to verify that the battery sensing data has been received intact, undamaged, and from a valid source (e.g., the module monitoring system). In addition, using wireless communication via a black channel ensures that any intermediate components between the module monitoring system and the wireless network controller do not modify or corrupt the battery sensing data during transmission. In addition, the module monitoring system only needs to meet the ASIL-QM standard, and the wireless network controller only needs a wireless transceiver integrated circuit, which can reduce costs and complexity.

[0004] The above and other objects, features, and advantages of the present invention will become more apparent from the following more specific description of exemplary embodiments of the present invention as shown in the accompanying drawings, in which the same reference numerals generally represent the same parts of the exemplary embodiments of the present invention. Brief Description of the Drawings

[0005] Figure 1It is a block diagram of a functional safety system in a battery monitoring system according to an embodiment of the present disclosure;

[0006] Figure 2 It shows a block diagram of a module monitoring system for functional safety in a battery monitoring system according to an embodiment of the present disclosure;

[0007] Figure 3 It shows a reference diagram of a wireless network controller for functional safety in a battery monitoring system according to an embodiment of the present disclosure;

[0008] Figure 4 It is a flowchart showing the implementation of a functional safety method in a battery monitoring system according to the present disclosure;

[0009] Figure 5 It is a flowchart showing another implementation of a functional safety method in a battery monitoring system according to the present disclosure;

[0010] Figure 6 It is a flowchart showing another implementation of a functional safety method in a battery monitoring system according to the present disclosure;

[0011] Figure 7 It is a flowchart showing another implementation of a functional safety method in a battery monitoring system according to the present disclosure;

[0012] Figure 8 It is a flowchart showing another implementation of a functional safety method in a battery monitoring system according to the present disclosure;

[0013] Figure 9 It is a flowchart showing another implementation of a functional safety method in a battery monitoring system according to the present disclosure;

[0014] Figure 10 It is a flowchart showing another implementation of a functional safety method in a battery monitoring system according to the present disclosure; and

[0015] Figure 11 It is a flowchart showing another implementation of a functional safety method in a battery monitoring system according to the present disclosure. Detailed Description of the Invention

[0016] The terms used herein to describe particular examples are not intended to limit further examples. Whenever a singular form such as "a", "an", and "the" is used and only a single element is neither explicitly nor implicitly defined as mandatory, further examples may also implement the same functionality using multiple elements. Similarly, when a functionality is subsequently described as being implemented using multiple elements, further examples may implement the same functionality using a single element or processing entity. It will be further understood that the terms "comprises", "comprising", "includes", and / or "including", when used, specify the presence of the stated features, integers, steps, operations, processes, acts, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, processes, acts, elements, components, and / or any group thereof.

[0017] It should be understood that when an element is referred to as being "connected" or "coupled" to another element, these elements may be directly connected or coupled or connected or coupled through one or more intervening elements. If two elements A and B are combined using "or", it should be understood that all possible combinations are disclosed, i.e., only A, only B, and A and B. An alternative wording for the same combination is "at least one of A and B". This also applies to combinations of more than two elements.

[0018] Thus, while further examples are capable of various modifications and alternative forms, some of their specific examples are shown in the drawings and will subsequently be described in detail. However, this detailed description does not limit further examples to the particular forms described. Further examples may cover all modifications, equivalents, and alternatives falling within the scope of the present disclosure. The same numerals refer to the same or similar elements throughout the description of the drawings, and they may be the same or implemented in a modified form when compared to each other, while providing the same or similar functionality.

[0019] From Figure 1 the following, an exemplary method, system, apparatus, and computer program product for functional safety in a battery monitoring system according to the present disclosure will be described with reference to the accompanying drawings. Figure 1Schematic diagram of a system for functional safety in a battery monitoring system according to an embodiment of the present disclosure. The system includes a battery (102), such as a high-voltage battery for an electric vehicle. The battery (102) includes a plurality of battery cells (104a-n), such as lithium-ion (Li-ion) battery cells. The battery cells (104a-n) are grouped into modules (106a-n) such that each module (106a-n) includes a corresponding subset of the battery cells (104a-n). The battery cells (104a-n) can be physically grouped into modules (106a-n) using a housing, chassis, or other enclosure. The battery cells (104a-n) can also be logically grouped into modules (106a-n) according to different groupings of the battery cells (104a-n) monitored by different module monitoring systems (108a-n), as described below.

[0020] The system further includes a battery management system (110). The battery management system (110) monitors various properties of the battery cells (104a-n) and provides battery sensing data indicative of these properties to a vehicle control system (112). The battery management system (110) includes a plurality of module monitoring systems (MMSs) (108a-n). Each MMS (108a-n) is configured to monitor a corresponding module (106a-n) of the battery cells (104a-n). For example, each module (106a-n) can have an MMS (108a-n) attached to a chassis, base, tray, or other mechanism that holds the battery cells (104a-n) of the module (106a-n). Each MMS (108a-n) includes sensors to measure various properties of the battery cells (104a-n) of its corresponding module (106a-n). Such properties can include voltage, current, temperature, and potentially other properties. The properties are indicated in the battery sensing data generated by the MMS (108a-n). Each MMS (108a-n) is configured to operate at a specific Automotive Safety Integrity Level (ASIL), such as ASIL-D. For example, each MMS (108a-n) can be configured to at least meet the ASIL-QM standard, thereby reducing cost and complexity.

[0021] Each MMS (108a-n) encodes its battery sensing data for transmission as a wireless signal and transmits its battery sensing data to a wireless network controller (WNC) (114) (e.g., a 2.4Ghz wireless channel) using a wireless black communication channel. The WNC (114) can be implemented using a wireless transceiver integrated circuit to reduce cost and complexity. The wireless black communication channel has no intervening components between the MMS (108a-n) and the WNC (114), preventing faults from being introduced into the battery sensing data from intermediate communication components. The WNC (114) then uses a wired or wireless communication channel to send the battery sensing data received from the MMS (108a-n) to the vehicle control system (VCS) (112). The VCS (112) may include a central "computer" of the vehicle. The VCS (112) may be a central control unit or may be collectively referred to as one or more vehicle subsystems.

[0022] Wireless communications in the battery management system (110) are susceptible to data corruption or interference caused by wireless interference (e.g., signal interference) from other systems or malicious parties, and are also susceptible to network security attacks. In order to ensure the security and integrity of wireless communications between the MMS (108a-n) and the WNC (114), each MMS (108a-n) generates one or more parts of integrity data (114) for the battery sensing data before sending it to the WNC. The integrity data is sent to the WNC (114) along with the battery sensing data (e.g., as a header or a separate part of the data payload). The WNC (114) can then use the integrity data to verify the received battery sensing data. By using integrity data and black communication wireless communications, the battery management system (110) can achieve functional protection and safety while using components with lower cost and complexity (e.g., MMS (108a-n) that meet ASIL-QM standards, WNC (114) using wireless transceiver integrated circuits, etc.).

[0023] Integrity data may include error detection codes and / or message authentication codes for the battery sensing data. The error detection code may include, for example, Cyclical Redundancy Check (CRC), checksum, parity bit, hash code, or other error detection codes. The WNC (114) may verify the received battery sensing data by generating an error detection code and comparing the generated value with the error detection code included in the battery sensing data. The message authentication code may include a message authentication code generated by a key. For example, each MMS (108a-n) may share the same key, or each may have a different key for generating the message authentication code. The WNC (114) may then generate a message authentication code based on the battery sensing data using the appropriate key and compare the generated message authentication code with the received message authentication code.

[0024] Integrity data may include an identifier associated with the MMS (108a-n) that generated the battery sensing data. The identifier may include a user-defined identifier, a serial number, or other unique identifier for a particular MMS (108a-n). The WNC (114) may verify the battery sensing data by comparing the identifier with one or more known identifiers of each MMS (108a-n). The identifier may also include the memory address of the MMS (108a-n) where the battery sensing data was stored before being sent to the WNC (114). For example, assume that for a given MMS (108a-n), the battery sensing data indicating temperature is stored in one area of the memory, the battery sensing data indicating voltage is stored in another area of the memory, and the battery sensing data indicating current is stored in a third area of the memory. Each area of the memory may be defined by a specific address or address range. The WNC (114) verifies the battery sensing data by comparing the memory address of the identifier and the data type of the battery sensing data (e.g., current data, voltage data, temperature data) to determine whether the indicated memory address corresponds to the correct area of the memory for that data type.

[0025] The integrity data may also include a timestamp (e.g., corresponding to when the battery sensing data was generated or sent to the WNC (114)). The WNC (114) may verify the battery sensing data in response to a timestamp that complies with one or more rules (e.g., occurring after the timestamp of the previously received battery sensing data, occurring before the current time, etc.). The integrity data may also include a sequence identifier for the battery sensing data. For example, each MMS (108a-n) may maintain a counter that increments for each portion of the battery sensing data sent to the WNC (114). The counter may be configured to roll over when it reaches a specific value or threshold. The WNC (114) may verify the battery sensing data by determining that the sequence identifier has incremented once based on the sequence identifier previously received from the same MMC (108a-n).

[0026] To further ensure the integrity and validity of the battery sensing data transmission, each MMS (108a-n) may be configured to send the battery sensing data according to the order of data type transmission. For example, the MMS (108a-n) may be configured to send the battery sensing data in a repeating order of current data, voltage data, and temperature data. The WNC (114) may then verify the battery sensing data by determining that the received battery sensing data complies with the order of data type transmission. For example, assuming the above order of data type transmission, if the temperature data is received after the voltage data, the WNC (114) will verify the temperature data, and if the current data is received after the temperature data, it will verify the current data, and so on. Receiving the temperature data after the current data may indicate that the voltage data is missing and may need to be resent, or that the temperature data was sent to the WNC (114) by a malicious third party.

[0027] In the case where the WNC (114) determines that the battery sensing data is invalid, the WNC (114) may request the MMS (108a-n) from which the invalid battery sensing data was received to resend the battery sensing data. The MMS (108a-n) may then resend the battery sensing data. The battery sensing data may be sent by another communication channel other than the wireless black communication channel. For example, the battery sensing data may be sent using an optical transmission channel, a power line transmission channel, or another wireless black communication channel operating at a different frequency.

[0028] Due to the use of wireless communication, the battery management system (110) overcomes the disadvantages of a wired battery management system, such as a lack of flexibility in packaging design and wasted space due to connectors and cables within the battery pack. By using black channel communication and the data layer of integrity data, the battery management system (110) also overcomes the deficiencies of other wireless battery management systems, such as susceptibility to interference, data corruption in the communication channel, and attacks by malicious parties.

[0029] For further illustration, Figure 2 FIG. illustrates a modular monitoring system (MMS) (200) for functional safety in a battery monitoring system according to an embodiment of the present disclosure (e.g., Figure 1 the modular monitoring system (108a-n)). The MMS (200) includes a controller (201) coupled to a memory (203). The controller (201) is configured to obtain sensor readings from sensors (205) (e.g., voltage sensors, temperature sensors, current sensors) to generate battery sensing data (e.g., voltage data (207), temperature data (209), current data (211)). The controller (201) may include or implement a microcontroller, an application specific integrated circuit (ASIC), a digital signal processor (DSP), a programmable logic array (PLA) (e.g., a field programmable gate array (FPGA)) or other data computing unit according to the present disclosure. The battery sensing data (e.g., voltage data (207), temperature data (209), current data (211)) may be stored in the memory (203). The memory (203) may be a non-volatile memory, such as flash memory.

[0030] The sensors (205) are configured to measure properties (e.g., voltage, temperature, current) of battery cells (e.g., battery cells (104a-n) of modules (106a-n)) of the module in which the MMS (200) is installed. For two-way wireless communication with a wireless network controller (e.g., Figure 1 the WNC (114)), the MMS (200) includes a transceiver (213) coupled to the controller (201).

[0031] For further illustration, Figure 3 FIG. illustrates a wireless network controller (WNC) (300) for functional safety in a battery monitoring system according to an embodiment of the present disclosure (e.g., Figure 1Block diagram of a wireless network controller (114)). The WNC (300) includes a controller (301) coupled to a memory (303). The controller (301) is configured to receive sensed data (e.g., voltage data (307), temperature data (309), current data (311)) from a plurality of MMSs (200) via a transceiver (305). The controller (301) may include or implement a microcontroller, an application specific integrated circuit (ASIC), a digital signal processor (DSP), a programmable logic array (PLA) (e.g., a field programmable gate array (FPGA)), or other data computing units according to the present disclosure. The battery sensed data (e.g., voltage data (307), temperature data (309), current data (311)) may be stored in the memory (303). The memory (303) may be a non-volatile memory, such as flash memory.

[0032] The controller (301) is further configured to verify the battery sensed data received from the MMS (200) based on integrity data received together with the battery sensed data. The controller (301) is further configured to provide the verified battery sensed data to a vehicle control system (e.g., Figure 1 the VCS (112)) via a VCS interface (313). The VCS interface may include a bus or other wired connection to the VCS.

[0033] For further explanation, Figure 4 FIG. illustrates a flowchart of an exemplary method showing functional safety in a battery monitoring system according to an embodiment of the present disclosure, the method including generating (402) battery sensed data by a module monitoring system (200) of a battery management system. The battery sensed data indicates one or more attributes of one or more battery cells (e.g., Figure 1 the battery cells (104a-n) of the modules (106a-n)) of a battery (e.g., a battery of an electric vehicle). The one or more attributes may include current, temperature, voltage, or other attributes. For example, the MMS (200) may use one or more sensors (205) to measure the one or more attributes and use a controller (201) to encode the measured values into battery sensed data.

[0034] Figure 4It also includes generating (404) integrity data by the MMS (200) based on battery sensing data. When transmitted through the battery management system, the integrity data helps in the verification and validation of the battery sensing data. In other words, the integrity data ensures that the transmission of the battery sensing data is not corrupted and comes from a verified source. The integrity data can use a unique identifier or a Message Authentication Code (MAC) to identify the MMS (200). The integrity data can also include one or more error detection codes to determine whether the battery sensing data has been modified or corrupted during transmission. Examples of error detection codes can include hash codes, CRC codes, checksums, parity bits, or other codes. The integrity data can also include a sequence identifier or a timestamp to indicate when the battery sensing data is generated or transmitted.

[0035] Figure 4 The method also includes sending (406) the battery sensing data and the integrity data by the MMS (200) to the wireless network controller (300) of the battery management system via a wireless black communication channel. Sending (406) the battery sensing data and the integrity data can include encoding the sensor data and the integrity data into a wireless signal for transmission to the WNC (300). For example, the transceiver (213) of the MMS (200) can send the battery sensing data and the integrity data to the transceiver (305) of the WNC (300). The wireless black communication channel is considered a "dark channel" because no other device or channel acts as an intermediary between the MMS (200) and the WNC (300). Thus, any interference, corruption, or modification to the battery sensing data and / or the integrity data is caused by a source external to the battery management system. The wireless black communication channel can include a 2.4Ghz wireless channel or another channel that can be understood. The integrity data can be sent as a header of the battery sensing data or as another component of the data payload sent together with the battery sensing data.

[0036] Figure 4 The method also includes sending (408) the battery sensing data by the WNC (300) to the vehicle control system (VCS) (e.g., Figure 1 the VCS (112)). For example, the battery sensing data can be sent using a VCS interface (313) that couples the WNC (300) to the VCS via a wired connection. Those skilled in the art can understand that the WNC (300) can receive battery sensing data from multiple MMSs (200) corresponding to different modules of the battery and send the sensor data to the VCS.

[0037] For further illustration, Figure 5A flowchart illustrating an exemplary method of functional safety in a battery monitoring system according to an embodiment of the present disclosure, including generating (402) battery sensing data by a module monitoring system (200) of a battery management system; generating (404) integrity data by the MMS (200) based on the battery sensing data; the MMS (200) sending (406) the battery sensing data and the integrity data to a wireless network controller (300) of the battery management system via a wireless black communication channel; and sending (408) the battery sensing data by the WNC (300) to a vehicle control system (VCS).

[0038] Figure 5 The method of Figure 4 differs from Figure 5 in that the method of

[0039] For further illustration, Figure 6 A flowchart illustrating an exemplary method of functional safety in a battery monitoring system according to an embodiment of the present disclosure, the method including generating (402) battery sensing data by a module monitoring system (200) of a battery management system; generating (404) integrity data by the MMS (200) based on the battery sensing data; the MMS (200) sending (406) the battery sensing data and the integrity data to a wireless network controller (300) of the battery management system via a wireless black communication channel; the WNC (300) verifying (502) the battery sensing data based on the integrity data; and sending (408) the battery sensing data by the WNC (300) to a vehicle control system (VCS).

[0040] Figure 6 The method of Figure 5The difference is that generating (404) integrity data by the MMS (200) based on battery sensing data includes generating (602) one or more of an error detection code or a message authentication code (MAC) based on the battery sensing data. The error detection code may include, for example, a cyclic redundancy check (CRC), a checksum, a parity bit, a hash code, or other error detection codes. The WNC (300) may verify (502) the received battery sensing data by generating an error detection code and comparing the generated value with the error detection code included in the battery sensing data. The message authentication code may include a message authentication code generated by a key. For example, each MMS (200) may share the same key, or each may have a different key for generating the message authentication code. The WNC (300) may then generate a message authentication code based on the battery sensing data using the appropriate key and compare the generated message authentication code with the received message authentication code.

[0041] For further explanation, Figure 7 FIG. 5 illustrates a flowchart of an exemplary method of functional safety in a battery monitoring system according to an embodiment of the present disclosure, including generating (402) battery sensing data by a module monitoring system (200) of a battery management system; generating (404) integrity data by the MMS (200) based on the battery sensing data; the MMS (200) sending (406) the battery sensing data and the integrity data to a wireless network controller (300) of the battery management system via a wireless black communication channel; the WNC (300) verifying (502) the battery sensing data based on the integrity data; and the WNC (300) sending (408) the battery sensing data to a vehicle control system (VCS).

[0042] Figure 7 The method of Figure 5 is different from

[0043] For further illustration, Figure 8A flowchart illustrating an exemplary method of functional safety in a battery monitoring system according to an embodiment of the present disclosure, the method including generating (402) battery sensing data by a module monitoring system (200) of a battery management system; generating (404) integrity data by the MMS (200) based on the battery sensing data by generating (702) an identifier associated with the MMS (200); the MMS (200) sending (406) the battery sensing data and the integrity data to a wireless network controller (300) of the battery management system via a wireless black communication channel; the WNC (300) verifying (502) the battery sensing data based on the integrity data; and the WNC (300) sending (408) the battery sensing data to a vehicle control system (VCS).

[0044] Figure 8 The method of Figure 7 differs in that verifying (502) the battery sensing data by the WNC (300) based on the integrity data includes verifying (802) the battery sensing data based on the memory address and data type of the battery sensing data. It is assumed that the identifier includes the memory address of the MMS (200) that stores (e.g., in the memory (203)) the battery sensing data before being sent to the WNC (300). For example, it is assumed that for a given MMS (200), voltage data (207) is stored in one region of the memory (203), temperature data (209) is stored in another region of the memory (203), and current data (211) is in a third region of the memory (203). Each region of the memory can be defined by a specific address or range of addresses. In other words, each type of battery sensing data is configured to be stored in a predefined region of the memory. Thus, the identifier in the integrity data indicates which specific region of the memory (203) the battery sensing data is stored in. Therefore, verifying (802) the battery sensing data based on the memory address and data type of the battery sensing data can include comparing the memory address of the identifier and the data type of the battery sensing data (e.g., current data, voltage data, temperature data) to determine whether the indicated memory address corresponds to the correct memory region (203) for that data type.

[0045] For further illustration, Figure 9A flowchart illustrating an exemplary method of functional safety in a battery monitoring system according to an embodiment of the present disclosure, including generating (402) battery sensing data by a module monitoring system (200) of a battery management system; generating (404) integrity data by the MMS (200) based on the battery sensing data; the MMS (200) sending (406) the battery sensing data and the integrity data to a wireless network controller (300) of the battery management system via a wireless black communication channel; the WNC (300) verifying (502) the battery sensing data based on the integrity data; and the WNC (300) sending (408) the battery sensing data to a vehicle control system (VCS).

[0046] Figure 9 The method of Figure 5 differs from

[0047] Figure 9 The method of Figure 5 in that sending (406) the battery data and the integrity data by the MMS (200) to the WNC (300) of the battery management system via a wireless black communication channel includes sending (902) the battery sensing data and the integrity data based on the data type of the battery sensing data and the sorting of the data type transmission. For example, the MMS (200) may be configured to send the battery sensing data in a repeating order of current data, voltage data, and temperature data. Thus, the portion of the battery sensing data sent (902) depends on the next data type in the sorting.

[0048] For further illustration, Figure 10 A flowchart illustrating an exemplary method of functional safety in a battery monitoring system according to an embodiment of the present disclosure, including generating (402) battery sensing data by a module monitoring system (200) of a battery management system; generating (404) integrity data by the MMS (200) based on the battery sensing data; the MMS (200) sending (406) the battery sensing data and the integrity data to a wireless network controller (300) of the battery management system via a wireless black communication channel; the WNC (300) verifying (502) the battery sensing data based on the integrity data; and the WNC (300) sending (408) the battery sensing data to a vehicle control system (VCS).

[0049] Figure 10 The method of Figure 5 differs in that the integrity data generated (404) by the MMS (200) based on the battery sensing data includes generating (1002) one or more of a sequence identifier or a timestamp of the battery sensing data. For example, the timestamp may indicate when the battery sensing data was generated or sent to the WNC (300). The timestamp can be verified (502) according to one or more rules (e.g., after the timestamp of previously received battery sensing data, before the current time, etc.). The integrity data may also include a sequence identifier of the battery sensing data. For example, each MMS (200) may maintain a counter that increments for each portion of the battery sensing data sent to the WNC (300). The counter can be configured to roll over when reaching a specific value or threshold.

[0050] For further illustration, Figure 11 FIG. 10 illustrates a flowchart of an exemplary method showing functional safety in a battery monitoring system according to an embodiment of the present disclosure. The method includes generating (402) battery sensing data by a module monitoring system (200) of a battery management system; generating (404) integrity data by the MMS (200) based on the battery sensing data; the MMS (200) sending (406) the battery sensing data and the integrity data to a wireless network controller (300) of the battery management system via a wireless black communication channel; and the WNC (300) sending (408) the battery sensing data to a vehicle control system (VCS).

[0051] Figure 11 The method of Figure 4 differs in that Figure 11 the method further includes determining (1102) that the battery sensing data is invalid based on the integrity data. For example, an error detection code or MAC generated by the WNC (300) may be different from the error detection code included in the integrity data. As another example, the integrity data may include an identifier that does not correspond to a valid MMS (200). As a further example, the timestamp of the integrity data may indicate that the battery sensing data was sent in the future or before a time threshold.

[0052] Figure 11 the method further includes the WNC (300) requesting (1104) the MMS (200) to re - send the battery sensing data. In other words, the WNC (300) requests the MMS (200) to provide a replacement for the invalid battery sensing data. Figure 11The method further includes sending (1106), by the MMS (200), battery sensing data and integrity data to the WNC (300) via another communication channel. For example, the battery sensing data can be sent using an optical transmission channel, a power line transmission channel, or another wireless black communication channel operating at a different frequency.

[0053] In view of the foregoing explanation, the reader will recognize that the benefits of functional safety in a battery monitoring system according to embodiments of the present disclosure include, but are not limited to:

[0054] Improved battery space utilization and configuration compared to a wired battery management system, while maintaining compliance with ASIL-D.

[0055] Improved protection against data corruption, interference, and attacks compared to other wireless battery management systems, while maintaining compliance with ASIL-D.

[0056] Exemplary embodiments of the present invention are mainly described in the context of a full-featured computer system for functional safety in a battery monitoring system. However, those skilled in the art will recognize that the present invention can also be embodied in a computer program product disposed on a computer-readable storage medium for use with any suitable data processing system. Such a computer-readable storage medium can be any storage medium for machine-readable information, including magnetic media, optical media, or other suitable media. Examples of such media include magnetic disks in a hard disk drive or a floppy disk, compact discs for an optical drive, magnetic tapes, and other media that will occur to those skilled in the art. Those skilled in the art will immediately recognize that any computer system with a suitable programming device will be capable of executing the steps of the method of the present invention embodied in the computer program product. Those skilled in the art will also recognize that although some exemplary embodiments described in this specification are directed to software installed and executed on computer hardware, alternative embodiments implemented as firmware or hardware are fully within the scope of the present invention.

[0057] The present invention can be a system, apparatus, method, and / or computer program product. The computer program product can include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to execute aspects of the present invention.

[0058] A computer-readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. A computer-readable storage medium can be, by way of example and not limitation, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer floppy disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device (such as a punched card or raised structures in a groove having instructions recorded thereon), and any appropriate combination of the foregoing. As used herein, a computer-readable storage medium should not be construed as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., light pulses passing through an optical fiber cable), or an electrical signal transmitted through a wire.

[0059] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the corresponding computing / processing device.

[0060] The computer-readable program instructions for carrying out operations of the present invention may be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state-setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages (such as Smalltalk, C++ etc.), and conventional procedural programming languages (such as the "C" programming language or similar programming languages). The computer-readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the latter case, the remote computer may be connected to the user's computer through any type of network connection, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider). In some embodiments, an electronic circuit, including, for example, a programmable logic circuit, a field-programmable gate array (FPGA), or a programmable logic array (PLA), may be personalized by utilizing the state information of the computer-readable program instructions to execute the computer-readable program instructions to perform various aspects of the present invention.

[0061] Aspects of the present invention are described herein with reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0062] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer-readable program instructions may also be stored in a computer-readable storage medium that can direct a computer, a programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer-readable storage medium storing the instructions comprises an article of manufacture including instructions for implementing aspects of the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0063] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable device, or other device to produce a computer-implemented process, such that the instructions executed on the computer, other programmable device, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0064] The flowcharts and block diagrams in the figures illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, a segment, or a portion of an instruction, which includes one or more executable instructions for implementing a specified logical function. In some alternative embodiments, the functions labeled in the blocks may not occur in the order labeled in the figures. For example, two consecutive blocks shown may actually be executed substantially simultaneously, or these blocks may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block shown in the block diagram and / or flowchart, and combinations of blocks shown in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system that performs the specified functions or actions, or by a combination of dedicated hardware and computer instructions.

[0065] The advantages and features of the present disclosure can be further described by the following statements:

[0066] 1. A method, apparatus, system, and computer program product for functional safety in a battery management system, including generating battery sensing data by a module monitoring system of the battery management system; the module monitoring system generating integrity data based on the battery sensing data; the module monitoring system sending the battery sensing data and the integrity data to a wireless network controller of the battery management system via a wireless black communication channel; and sending the battery sensing data to a vehicle control system via the wireless network controller.

[0067] 2. The method, apparatus, system, and computer program product according to claim 1, wherein the module monitoring system is one of a plurality of module monitoring systems, each of the plurality of module monitoring systems being configured to monitor a corresponding battery module among a plurality of battery modules; and wherein the wireless network controller is configured to receive corresponding battery sensing data from each of the plurality of battery modules.

[0068] 3. The method, apparatus, system, and computer program product according to claim 1 or 2, further including: the wireless network controller verifying the battery sensing data based on the integrity data; and wherein sending the battery sensing data to the vehicle control system is performed in response to verifying the battery sensing data.

[0069] 4. The method, apparatus, system, and computer program product according to any one of claims 1-3, wherein generating the integrity data includes generating one or more of an error detection code or a message authentication code based on the battery sensing data.

[0070] 5. The method, apparatus, system, computer program product according to any one of claims 1-4, wherein generating the integrity data includes generating an identifier associated with the module monitoring system.

[0071] 6. The method, apparatus, system, computer program product according to any one of claims 1-5, wherein the identifier includes a memory address of the module monitoring system associated with the sensing data; and wherein verifying the battery sensing data includes verifying the battery sensing data based on the memory address and the data type of the battery sensing data.

[0072] 7. The method, apparatus, system, computer program product according to any one of claims 1-6, wherein the module monitoring system sending the battery sensing data and the integrity data to the wireless network controller via the wireless black communication channel includes: sending the battery sensing data and the integrity data based on the data type of the battery sensing data and the sorting of data type transmission; and wherein verifying the battery sensing data includes: verifying the battery sensing data based on the data type of the battery sensing data conforming to the sorting of data type transmission.

[0073] 8. The method, apparatus, system, computer program product according to any one of claims 1-7, wherein generating the integrity data includes generating one or more of a sequence identifier or a timestamp of the battery sensing data.

[0074] 9. The method, apparatus, system, computer program product according to any one of claims 1-8, further comprising: determining that the battery sensing data is invalid based on the integrity data; and the wireless network controller requesting the module monitoring system to re-send the battery sensing data.

[0075] 10. The method, apparatus, system, computer program product according to any one of claims 1-9, further comprising: the module monitoring system sending the battery sensing data and the integrity data to the wireless network controller via another communication channel.

[0076] 11. The method, apparatus, system, computer program product according to any one of claims 1-10, wherein the another communication channel includes another wireless black communication channel associated with a frequency different from that of the wireless black communication channel.

[0077] 12. The method, apparatus, system, computer program product according to any one of claims 1-11, comprising: a plurality of module management systems, each module management system being configured to monitor a corresponding battery module among a plurality of battery modules; a wireless network controller; and wherein the battery management system is configured to perform the following steps, including: generating battery sensing data by the module monitoring system among the plurality of battery management systems; generating integrity data by the module monitoring system based on the battery sensing data; sending, by the module monitoring system, the battery sensing data and the integrity data to the wireless network controller of the battery management system via a wireless black communication channel; and sending the battery sensing data to a vehicle control system by the wireless network controller.

[0078] 13. The method, apparatus, system, computer program product according to any one of claims 1-12, wherein the steps further include: verifying the battery sensing data by the wireless network controller based on the integrity data; and wherein sending the battery sensing data to the vehicle control system is performed in response to verifying the battery sensing data.

[0079] 14. The method, apparatus, system, computer program product according to any one of claims 1-13, wherein generating the integrity data includes generating one or more of an error detection code or a message authentication code based on the battery sensing data.

[0080] 15. The method, apparatus, system, computer program product according to any one of claims 1-14, wherein generating the integrity data includes generating an identifier associated with the module monitoring system.

[0081] 16. The method, apparatus, system, computer program product according to any one of claims 1-15, wherein the identifier includes a memory address of the module monitoring system associated with the sensing data; and wherein verifying the battery sensing data includes verifying the battery sensing data based on the memory address and the data type of the battery sensing data.

[0082] 17. The method, apparatus, system, computer program product according to any one of claims 1-16, wherein the module monitoring system sending the battery sensing data and the integrity data to the wireless network controller via the wireless black communication channel includes: sending the battery sensing data and the integrity data based on the data type of the battery sensing data and a data type transmission order; and wherein verifying the battery sensing data includes: verifying the battery sensing data based on the data type of the battery sensing data conforming to the data type transmission order.

[0083] 18. The method, apparatus, system, computer program product according to any one of claims 1-17, wherein generating the integrity data includes generating one or more of a sequence identifier or a timestamp of the battery sensing data.

[0084] 19. The method, apparatus, system, computer program product according to any one of claims 1-18, wherein the step further includes: determining that the battery sensing data is invalid based on the integrity data; and the radio network controller requesting the module monitoring system to retransmit the battery sensing data.

[0085] 20. The method, apparatus, system, computer program product according to any one of claims 1-19, wherein the step further includes: the module monitoring system sending the battery sensing data and the integrity data to the radio network controller via another communication channel.

Claims

1. A functional safety method in a battery management system, the method comprises: generating battery sensing data by a module monitoring system of the battery management system; the module monitoring system generating integrity data based on the battery sensing data; the module monitoring system sending the battery sensing data and the integrity data to a wireless network controller of the battery management system via a wireless communication channel; the wireless network controller determining that the battery sensing data is invalid based on the integrity data; after determining that the battery sensing data is invalid, the wireless network controller requesting the module monitoring system to re - send the battery sensing data; and sending the battery sensing data to a vehicle control system by the wireless network controller.

2. The method according to claim 1: wherein, the module monitoring system is one of a plurality of module monitoring systems, and each of the plurality of module monitoring systems is configured to monitor a corresponding battery module among a plurality of battery modules; and wherein, the wireless network controller is configured to receive corresponding battery sensing data from each battery module among the plurality of battery modules.

3. The method according to claim 1, further comprises: the wireless network controller verifying the battery sensing data based on the integrity data; and wherein, sending the battery sensing data to the vehicle control system is performed in response to verifying the battery sensing data.

4. The method according to claim 3, wherein, generating the integrity data includes generating one or more of an error detection code or a message authentication code based on the battery sensing data.

5. The method according to claim 3, wherein, generating the integrity data includes generating an identifier associated with the module monitoring system.

6. The method according to claim 5: wherein, the identifier includes a memory address of the module monitoring system associated with the sensing data; and wherein, verifying the battery sensing data includes verifying the battery sensing data based on the memory address and the data type of the battery sensing data.

7. The method according to claim 3: wherein, the module monitoring system sending the battery sensing data and the integrity data to the wireless network controller via the wireless communication channel includes: sending the battery sensing data and the integrity data based on the data type of the battery sensing data and the sorting of data type transmission; and wherein, verifying the battery sensing data includes: verifying the battery sensing data based on the data type of the battery sensing data conforming to the sorting of data type transmission.

8. The method according to claim 3, wherein, generating the integrity data includes generating one or more of a sequence identifier or a timestamp of the battery sensing data.

9. The method according to claim 1, further comprises: the module monitoring system sending the battery sensing data and the integrity data to the wireless network controller via another communication channel.

10. The method according to claim 9, wherein, The other communication channel includes another wireless communication channel associated with a frequency different from that of the wireless communication channel.

11. A battery management system, comprising: A plurality of module management systems, each module management system being configured to monitor a corresponding battery module among a plurality of battery modules; A wireless network controller; and wherein the battery management system is configured to perform the following steps, including: Generating battery sensing data by a module monitoring system among the plurality of battery management systems; Generating integrity data by the module monitoring system based on the battery sensing data, the generating of the integrity data including generating an identifier, the identifier including a memory address of the module monitoring system associated with the sensing data; Sending the battery sensing data and the integrity data from the module monitoring system to the wireless network controller of the battery management system via a wireless communication channel; Verifying the battery sensing data by the wireless network controller based on the memory address and the data type of the battery sensing data; and After verifying the battery sensing data, sending the battery sensing data to a vehicle control system by the wireless network controller.

12. The battery management system according to claim 11, wherein Generating the integrity data includes generating one or more of an error detection code or a message authentication code based on the battery sensing data.

13. The battery management system according to claim 11: wherein The module monitoring system sending the battery sensing data and the integrity data to the wireless network controller via the wireless communication channel includes: sending the battery sensing data and the integrity data based on the data type of the battery sensing data and the data type transmission order; and wherein verifying the battery sensing data includes verifying the battery sensing data based on the data type of the battery sensing data conforming to the data type transmission order.

14. The battery management system according to claim 11, wherein Generating the integrity data includes generating one or more of a sequence identifier or a timestamp of the battery sensing data.

15. The battery management system according to claim 11, wherein The steps further include: Determining that the battery sensing data is invalid based on the integrity data; and The wireless network controller requesting the module monitoring system to re-send the battery sensing data.

16. The battery management system according to claim 15, wherein The steps further include: Sending the battery sensing data and the integrity data from the module monitoring system to the wireless network controller via another communication channel.

Images