Functional safety in battery management systems

Abstract

In a particular embodiment, functional safety in a battery management system includes a network controller of a battery management system (BMS) that receives a message including a first set of data type blocks from a module monitoring system (MMS) of the BMS. In this embodiment, the network controller determines a block sequence order for the first set of data type blocks, the block sequence order indicating a position of each data type block within the message. The network controller determines whether the message complies with a predetermined block sequence protocol. In response to determining that the message does not comply with the predetermined block sequence protocol, the network controller determines that data within the message is outdated.

Description

Technical Field Background Technology

[0001] Electric vehicles are powered by high-voltage battery systems comprising multiple battery cells. A battery management system (BMS) monitors various properties of the battery cells, including voltage, temperature, and current, to ensure proper and safe battery operation. In conventional wired BMS systems, the battery cells are grouped into modules, each with components for monitoring these properties. Each of these components is wired to a central controller. Problems arising from this solution include: a lack of flexibility in packaging design, wasted space due to connectors and wiring within the battery pack, and challenges in extending the battery's secondary lifespan. While wireless technologies can be used to connect battery monitoring components to the central controller, these technologies are vulnerable to interference from other systems or malicious parties and are also susceptible to cyberattacks. Summary of the Invention

[0002] Methods, systems, apparatus, and computer program products for functional safety in battery management systems are disclosed. In a particular embodiment, functional safety in a battery management system includes a module monitoring system (MMS) for the battery management system (BMS) that generates battery sensor data and uses a block sequence protocol to generate messages that encode the battery sensor data. The block sequence protocol is a data structure that defines a pattern, order, or otherwise arranges a sequence of data type blocks within a message. A message may include multiple different types of data (e.g., slow data, fast data, diagnostic data, fault data, status data, etc.). Each of these different types of data may be encoded as a data type block of a specific type within the message. In this embodiment, the MMS also generates the message by determining a first set of data type blocks to be included in the message and determining a block sequence order for the first set of data type blocks for the message. The block sequence order for a specific message is the order in which each data type block is located within the specific message. For each data type block in the first set of data type blocks, the MMS selects a position within the block sequence order that differs from a previous position of that data type block in a previous block sequence order of consecutive previous messages. In this embodiment, the MMS generates a message using each data type block in a first set of data type blocks located according to a position selected within a determined block sequence order. After locating the data type blocks according to the block sequence order determined according to the block sequence protocol, the MMS sends the message to the network controller of the BMS.

[0003] In a particular embodiment, functional safety in the battery management system includes a network controller of the battery management system (BMS) that receives a message comprising a first set of data type blocks from the BMS's module monitoring system (MMS). In this embodiment, the network controller determines a block sequence order for the first set of data type blocks, the block sequence order indicating the position of each data type block within the message. The network controller determines whether the message conforms to a predetermined block sequence protocol. In response to determining that the message does not conform to the predetermined block sequence protocol, the network controller determines that the data within the message is outdated.

[0004] In a particular embodiment, functional safety in the battery management system includes a module monitoring system that generates battery sensor data and generates a message encoding that battery sensor data. In this example, the order of the data types in the message differs from that of consecutive previous messages. Continuing with this example, the module monitoring system sends the message to the wireless network controller of the battery management system via a wireless black communication channel.

[0005] The above and other objects, features and advantages of the invention will become apparent from the following more detailed description of exemplary embodiments of the invention as illustrated in the accompanying drawings, wherein like reference numerals generally denote like parts of exemplary embodiments of the invention. Attached Figure Description

[0006] Figure 1A A block diagram of a system for functional safety in a battery management system according to at least one embodiment of the present invention is illustrated.

[0007] Figure 1B A block diagram of a system for communication between a network controller and a module monitoring system according to at least one embodiment of the present invention is illustrated.

[0008] Figure 2 A block diagram of a module monitoring system for functional safety in a battery management system according to at least one embodiment of the present invention is shown;

[0009] Figure 3 A block diagram of a functionally safe wireless network controller for a battery management system according to at least one embodiment of the present invention is shown;

[0010] Figure 4 A block diagram of a system for functional safety in a battery management system according to at least one embodiment of the present invention is illustrated.

[0011] Figure 5 An example of data transmitted using a battery management system according to at least one embodiment of the present invention is shown;

[0012] Figure 6Another example of data transmitted using a battery management system according to at least one embodiment of the present invention is shown;

[0013] Figure 7 Another example of data transmitted using a battery management system according to at least one embodiment of the present invention is shown;

[0014] Figure 8 Another example of data transmitted using a battery management system according to at least one embodiment of the present invention is shown;

[0015] Figure 9 This is a flowchart illustrating an implementation of a method for functional safety in a battery management system according to the present disclosure;

[0016] Figure 10 This is a flowchart illustrating an implementation of a method for functional safety in a battery management system according to the present disclosure;

[0017] Figure 11 This is a flowchart illustrating an implementation of a method for functional safety in a battery management system according to the present disclosure;

[0018] Figure 12 This is a flowchart illustrating an implementation of a method for functional safety in a battery management system according to the present disclosure;

[0019] Figure 13 This is a flowchart illustrating an implementation of a method for functional safety in a battery management system according to the present disclosure; and

[0020] Figure 14 This is a flowchart illustrating an implementation of a method for functional safety in a battery management system according to the present disclosure. Detailed Implementation

[0021] For the purpose of describing specific examples, the terminology used herein is not intended to limit further examples. Whenever the singular forms such as “a,” “an,” and “the” are used and the use of only a single element is neither express nor implicitly mandatory, further examples may also use multiple elements to achieve the same functionality. Similarly, when a function is subsequently described as being implemented using multiple elements, further examples may use a single element or a processing entity to achieve the same functionality. It will be further understood that when the terms “comprises,” “comprising,” “includes,” and / or “including” are used, they specify the presence of the stated feature, integral, step, operation, process, action, element, and / or component, but do not preclude the presence or addition of one or more other features, integrals, steps, operations, processes, actions, elements, components, and / or any group thereof.

[0022] It should be understood that when one element is referred to as "connected" or "coupled" to another element, these elements can be directly connected or coupled, or connected or coupled via one or more intermediate elements. If two elements A and B are combined using "or," it should be understood that all possible combinations are disclosed, i.e., only A, only B, and A and B. An alternative wording for the same combination is "at least one of A and B." This also applies to combinations of more than two elements.

[0023] Therefore, while further examples are capable of various modifications and alternative forms, some specific examples are shown in the accompanying drawings and will be described in detail thereafter. However, this detailed description does not limit the further examples to the specific forms described. Further examples may cover all modifications, equivalents, and alternatives falling within the scope of this disclosure. The same reference numerals refer to the same or similar elements throughout the description of the drawings, which, when compared with each other, can be implemented equivalently or in modified form while providing the same or similar function.

[0024] from Figure 1A The present disclosure begins with an illustration of an exemplary method, system, apparatus, and computer program product for functional safety in a battery monitoring system, with reference to the accompanying drawings. Figure 1AA diagram illustrating a system for functional safety in a battery management system according to at least one embodiment of the present invention is provided. The system includes a battery pack (102), such as a high-voltage battery for an electric vehicle. The battery pack (102) includes a plurality of battery cells (104a-n), such as lithium-ion (Li-ion) battery cells. The battery cells (104a-n) are grouped into modules (106a-n) such that each module (106a-n) includes a corresponding subset of the battery cells (104a-n). The battery cells (104a-n) can be physically grouped into modules (106a-n) using a box, chassis, or other housing. As will be described below, the battery cells (104a-n) can also be logically grouped into modules (106a-n) by means of different groups of battery cells (104a-n) monitored by different module monitoring systems (108a-n).

[0025] The system also includes a battery management system (110). The battery management system (110) monitors various attributes of the battery cells (104a-n) and provides battery sensor data indicating these attributes to the vehicle control system (112). The battery management system (110) includes multiple module monitoring systems (MMS) (108a-n). Each MMS (108a-n) is configured to monitor a corresponding module (106a-n) of the battery cells (104a-n). For example, each module (106a-n) may have an MMS (108a-n) attached to a chassis, base, tray, or other mechanism that holds the battery cells (104a-n) of the module (106a-n). Each MMS (108a-n) includes an Analog Front End (AFE) (109a-n) to measure various attributes of the battery cells (104a-n) of its corresponding module (106a-n). Such attributes can include voltage, current, temperature, and potentially other attributes. These attributes are indicated in the battery sensor data generated by the MMS (108a-n).

[0026] Each MMS (108a-n) encodes its battery sensor data for transmission as a wireless signal and transmits the battery sensor data via a wireless transceiver (RF transceiver) (111a-n) to a wireless network controller (WNC) (114) (e.g., a 2.4 GHz wireless channel). The WNC (114) includes a controller (116) and an RF transceiver (115) for receiving battery sensor data from the MMS (108a-n). The WNC (114) then transmits the battery sensor data received from the MMS (108a-n) to a vehicle control system (VCS) (112) using a wired or wireless communication channel. The VCS (112) may include the vehicle's central "computer". The VCS (112) may be a central control unit or may be collectively referred to as one or more vehicle subsystems. Figure 1B A simplified example of communication between WNC(114) and MMS(108a-n) is shown.

[0027] The data used in the BMS (110) needs to have a high level of safety integrity as defined by various functional safety standards (e.g., IEC 61508, ISO 26262, ISO 25119, etc.), therefore the entire signal chain from the AFE to the μC needs to ensure this level of integrity. To meet this requirement, the AFE (109a-n) and controller (116) are required to meet a high level of integrity, while the RF transceivers (111a-n, 115) can have a lower level of integrity to reduce design cost and complexity. Due to this lower integrity at the RF transceivers (111a-n, 115), an end-to-end “black channel” is implemented between high-integrity components. A wireless black communication channel is considered a “black channel” because no other device or channel is used as an intermediary between the RF transceivers (111a-n, 115). Figure 4 An alternative view of the structure is shown in the image. To ensure that the security integrity within the RF transceivers (111a-n, 115) is not compromised, additional mechanisms (i.e., device identification, data identification, data integrity, and data freshness) are required to implement a "black channel".

[0028] The AFE (109a-n) provides device and data identification, data cyclic redundancy check (CRC) integrity, and data freshness by performing periodic internal diagnostics. However, due to low integrity on the RF transceivers (111a-n, 115), the freshness of AFE (109a-n) data can be compromised within the RF transceivers (111a-n, 115), especially when transmitting the same data type (e.g., voltage, status, fault) over multiple messages.

[0029] To ensure data identification, integrity, and freshness, message ordering ensures that all necessary data (measurements, information, diagnostics, etc.) are transmitted within the required timeframe, and different data types within a message are "mixed up" to prevent any two consecutive messages from having the same data type in the same location. Figure 5 The message sequence shown provides an example of the data to be transmitted (some at frequencies higher than others). Since each data packet contains an ID and a CRC, both identification and integrity can be ensured by performing a check / compare within the controller (116) of the WNC (114). However, if a given data block becomes outdated / stuck within the RF transceiver (111a-n) of the MMS (108a-n), the ID will still be acceptable, the CRC will still be correct, but the data will no longer be fresh.

[0030] The message sequence can be modified by shifting the data type around each message so that similar data types do not fall into the same position consecutively. Figure 6 A possible modification to the sequence is shown, wherein each message is unique, distinct from previous messages, and the data type does not fall in the same position between any two consecutive messages. Thus, if a given data block becomes obsolete within the RF transceivers (111a-n) of the MMS (108a-n), the data order of the new messages will cause the CRC of the data to be corrupted once the CRC of the data is checked at the controller (116) of the WNC (114). The size of the data packets, the length of the message period, and the additional data provided in the sequence will depend on the specific design requirements.

[0031] For illustrative purposes, the example sequence is developed for the TI BQ796xx AFE series. These AFEs provide a device address, register address, and data CRC for each frame, which can be used by the controller (116) of the WNC (114) to ensure device identification, data identification, and data integrity, respectively. Furthermore, internal diagnostics within the AFE provide overlays for the freshness of its output registers, thereby ensuring sufficient security integrity for data freshness. However, the same risks remain when all the different data types are appended within a low-integrity RF transceiver. Figure 7 The initial sequence that can be applied to this AFE is shown in the figure.

[0032] After shifting the data groups around the message, Figure 6 As can be seen, each message within a period is unique, and no two consecutive messages have the same data type at the same location. This means that the controller (116) of the WNC (114) will be able to detect outdated data from the RF transceivers (111a-n) of the MMS (108a-n).

[0033] To assist the controller (116) in detecting outdated data, the MMS (108a-n) can be configured to generate battery sensor data and use a block sequence protocol to generate a message that encodes the battery sensor data. A block sequence protocol is a data structure that defines a pattern, order, or otherwise arranges a sequence of data type blocks within a message. A message may include multiple different types of data (e.g., slow data, fast data, diagnostic data, fault data, status data, etc.). Each of these different data types can be encoded within the message as a data type block of a specific type.

[0034] The MMS (108a-n) further generates the message by determining a first set of data type blocks to be included in the message, and determines the block sequence order of the first set of data type blocks for the message. The block sequence order of a specific message is the order in which each data type block is located within the specific message. For each data type block in the first set of data type blocks, the MMS selects a position within the block sequence order that is different from the previous position of that data type block in the previous block sequence order of consecutive previous messages. In this embodiment, the MMS (108a-n) generates the message using each data type block in the first set of data type blocks located according to the position selected within the determined block sequence order. The MMS (108a-n) sends the message to the network controller (116) of the BMS.

[0035] The network controller (116) can be configured to determine the freshness of data received by the MMS (108a-n). In a particular embodiment, the network controller (116) receives a message from the MMS (108a-n) comprising a first set of data type blocks. In this embodiment, the network controller (116) determines a block sequence order for the first set of data type blocks, indicating the position of each data type block within the message. The network controller (116) determines whether the message conforms to a predetermined block sequence protocol. In response to determining that the message does not conform to the predetermined block sequence protocol, the network controller (116) determines that the data within the message is outdated.

[0036] To further explain, Figure 2A block diagram of a module monitoring system (MMS) (200) (e.g., the module monitoring system (108a-n) of FIG. 1) for use in a wireless sensor network with a secure wireless protocol, according to at least one embodiment of the present invention, is illustrated. The MMS (200) includes a controller (201) coupled to a memory (203). The controller (201) is configured to obtain sensor readings from sensors (205) (e.g., voltage sensors, temperature sensors, current sensors) to generate battery sensor data (e.g., voltage data (207), temperature data (209), current data (211)). According to this disclosure, the controller (201) may include or implement a microcontroller, an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a programmable logic array (PLA) such as a field-programmable gate array (FPGA), or other data computing units. The battery sensor data (e.g., voltage data (207), temperature data (209), current data (211)) may be stored in the memory (203). The memory (203) may be a non-volatile memory, such as flash memory.

[0037] The sensor (205) is configured to measure properties (e.g., voltage, temperature, current) of the battery cells (e.g., battery cells (104a-n) of the module (106a-n), on which the MMS (200) is mounted. For bidirectional wireless communication with a wireless network controller (e.g., the WNC (114) of Figure 1), the MMS (200) includes a transceiver (213) coupled to the controller (201).

[0038] exist Figure 2 In the example, the memory (203) includes a freshness controller (212) that includes computer program instructions that, when executed by the controller (201), cause the controller (201) to perform the following operations: generate battery sensor data; generate a message encoding the battery sensor data based on a block sequence protocol (including: determining a first set of data type blocks to be included in the message; determining a block sequence order for the first set of data type blocks for the message (including, for each data type block in the first set of data type blocks, selecting a position within the block sequence order that differs from a previous position of the data type block in a previous block sequence order of consecutive previous messages); and generating the message using each data type block in the first set of data type blocks positioned according to the selected position within the determined block sequence order); and sending the message to the network controller of the BMS.

[0039] To further explain, Figure 3A block diagram of a wireless network controller (WNC) (300) (e.g., the wireless network controller (114) of FIG. 1) for use in a wireless sensor network with a secure wireless protocol, according to at least one embodiment of the present invention, is illustrated. The WNC (300) includes a controller (301) coupled to a memory (303). The controller (301) is configured to request and receive sensor data (e.g., voltage data (307), temperature data (309), current data (311)) from a plurality of MMS (200) via a transceiver (305). According to this disclosure, the controller (301) may include or implement a microcontroller, an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a programmable logic array (PLA) such as a field-programmable gate array (FPGA), or other data computing unit. Battery sensor data (e.g., voltage data (307), temperature data (309), current data (311)) may be stored in the memory (303). The memory (303) may be a non-volatile memory such as flash memory. The controller (301) is further configured to provide formatted battery sensor data to the BMS controller (e.g., via interface (313)). Figure 6 The interface may include a BMS controller (412) or a vehicle control system (e.g., the VCS (112) of Figure 1). The interface may include a bus or other wired connection to the BMS controller or VCS.

[0040] exist Figure 3 In the example, the memory (303) includes a freshness controller (312) that includes computer program instructions that, when executed by the controller (301), cause the controller (301) to perform the following operations: receive a message including a first set of data type blocks from a module monitoring system (MMS) of the battery management system; determine a block sequence order for the first set of data type blocks, the block sequence order indicating the position of each data type block within the message; determine whether the message conforms to a predetermined block sequence protocol; and, in response to determining that the message does not conform to the predetermined block sequence protocol, determine that the data within the message is outdated.

[0041] To further explain, Figure 9 A flowchart illustrating an implementation of a method for functional safety in a battery management system according to the present disclosure is provided. Figure 9The method includes generating (902) battery sensor data by a module monitoring system (MMS) (901) of a battery management system (BMS). According to embodiments of the invention, the battery management system can be wireless or wired. As described above, the MMS can be configured to monitor corresponding modules of battery cells. For example, each module may have an MMS attached to a chassis, base, tray, or other mechanism that holds the battery cells of the module. In a particular embodiment, each MMS includes an analog front end (AFE) to measure various properties of the battery cells of its corresponding module. Such properties may include voltage, current, temperature, and potentially other properties. These properties can be indicated in the battery sensor data generated by the MMS. The generation (902) of battery sensor data by the module monitoring system (MMS) (901) of the battery management system (BMS) can be performed by monitoring and measuring the properties of the battery cells and using the measured properties to generate the battery sensor data.

[0042] Figure 9 The method also includes generating (904) a message encoding battery sensor data by MMS (901) based on a block sequence protocol. A block sequence protocol is a data structure that defines a pattern, order, or otherwise arranges a sequence of data type blocks within a message. A message may include multiple different types of data (e.g., slow data, fast data, diagnostic data, fault data, status data, etc.). Each of these different data types can be encoded within the message as a data type block of a specific type.

[0043] In a particular embodiment, the block sequence protocol may indicate a specific repetition interval for including a particular type of data block within any message. For example, the block sequence protocol may indicate that a fast data type of data block should be included in every message, and a slow data type of data block should be included in every four messages. In another particular embodiment, the block sequence protocol may indicate a specific positional order of data type blocks for a message. For example, the block sequence protocol may indicate a specific order as: fast data in a first position of a first message, status data in a second position, slow data in a third position, slow diagnostic data in a fourth position, and fault data in a fifth position. Continuing this example, this order continues for a second message having fault data in a first position, fast data in a second position, fast diagnostic data in a third position, other data in a fourth position, and status data in a fifth position. In a particular embodiment, the “position” of data within the order may be more specific and defines the start and stop position addresses, offsets, and other things that a person skilled in the art would think of within the message. Messages encoded with battery sensor data by the MMS (901) based on the block sequence protocol (904) can be performed by checking the block sequence protocol to determine the block sequence order of a particular message. The block sequence order of a specific message is the order in which each data type block is located within that specific message. For example, the block sequence order might indicate that a data type block of type 1 is in the first position within the message, a data type block of type 2 is in the second position, and a data type block of type 3 is in the third position.

[0044] exist Figure 9 In the method, the message encoding battery sensor data generated (904) by the MMS (901) based on a block sequence protocol includes: determining (906) a first set of data type blocks to be included in the message. A data type block is a data block of a specific data type. The type of data block included in the message sent from the MMS to the network controller can depend on the type of hardware and software used by the components of the battery management system and the communication protocol used by those components. For example, in a particular protocol, the message from the MMS to the network controller may include types of data type blocks, such as status data, fast data, slow data, fault data, fast diagnostic data, slow diagnostic data, other data, and other data 2. Determining (906) the first set of data type blocks to be included in the message can be performed by: determining which types of data blocks should be included in the message.

[0045] exist Figure 9In the method, the message encoding battery sensor data generated (904) by the MMS (901) based on the block sequence protocol includes: determining (908) the block sequence order of a first set of data type blocks for the message (including, for each data type block in the first set of data type blocks, selecting within the block sequence order a position of the data type block that is different from its previous position in the previous block sequence order of consecutive previous messages). Determining (908) the block sequence order of the first set of data type blocks for the message (including, for each data type block in the first set of data type blocks, selecting within the block sequence order a position of the data type block that is different from its previous position in the previous block sequence order of consecutive previous messages) can be performed by checking the block sequence protocol to determine where a particular data type block should be placed within the message. Furthermore, a series of counters and registers can be used to track, store, and record which types of data type blocks will be included in the message, the previous position of the data type block type, the message sent because the type of the data type block is included in the message, and other things that those skilled in the art would consider.

[0046] Furthermore, the message encoding the battery sensor data generated by MMS (901) based on the block sequence protocol (904) includes: generating (910) a message using each data type block in a first set of data type blocks positioned according to a selected position within the determined block sequence order. Generating (910) a message using each data type block in the first set of data type blocks positioned according to a selected position within the determined block sequence order can be performed by placing the data type blocks in a queue to be sent according to the determined block sequence order.

[0047] Furthermore, the message encoded by the battery sensor data generated (904) by the MMS (901) based on the block sequence protocol includes: the MMS (901) sending (912) the message to the network controller of the BMS. The MMS (901) sending the message to the network controller of the BMS can be performed by transmitting a signal including the message via a wired or wireless interface.

[0048] To further explain, Figure 10 A flowchart illustrating an implementation of a method for functional safety in a battery management system according to the present disclosure is provided. Figure 10 Methods and Figure 9 The similarities in their methods are Figure 10The method also includes: generating (902) battery sensor data by the MMS (901) of the battery management system (BMS); generating (904) a message encoding the battery sensor data by the MMS (901) based on a block sequence protocol (including: determining (906) a first set of data type blocks to be included in the message; determining (908) a block sequence order of the first set of data type blocks for the message (including, for each data type block in the first set of data type blocks, selecting a position of a data type block within the block sequence order that is different from a previous position of that data type block in a previous block sequence order of consecutive previous messages); and generating (910) a message using each data type block in the first set of data type blocks located according to the position selected within the determined block sequence order); and sending (912) the message by the MMS (901) to the network controller of the BMS.

[0049] exist Figure 10 In the method, determining (906) the first set of data type blocks to be included in the message includes: determining (1002) which types of data type blocks should be included in the first set of data type blocks. Determining (1002) which types of data type blocks should be included in the first set of data type blocks can be performed by checking a block sequence protocol to determine the specific repetition interval for including a specific type of data block within any message, and determining the specific positional order of the data type blocks for that message. In a particular embodiment, a series of registers and counters may be used to track, store, and record which types of data type blocks will be included in the message; the previous position of the data type block type; the message sent because the type of data type block is included in the message; and other things that those skilled in the art will consider.

[0050] To further explain, Figure 11 A flowchart illustrating the implementation of the method for functional safety in a battery management system according to this disclosure is provided. Figure 11 The method includes the network controller (1101) of the BMS receiving (1102) a message comprising a first set of data type blocks from the module monitoring system (MMS) of the battery management system. The receipt (1102) of the message comprising the first set of data type blocks by the network controller (1101) of the BMS from the module monitoring system (MMS) of the battery management system can be performed by receiving a signal encoding the message containing the first set of data type blocks via a wired or wireless interface.

[0051] Figure 11The method also includes the network controller (1101) determining (1104) a block sequence order indicating the position of each data type block within the message for a first set of data type blocks. As described above, the block sequence order of a particular message is the order in which each data type block is located within the particular message. For example, the block sequence order may indicate that a first type of data type block is in a first position within the message, a second type of data type block is in a second position, and a third type of data type block is in a third position. The network controller (1101) determines (1104) the block sequence order indicating the position of each data type block within the message by: determining an identifier for each data type block; and determining location information (e.g., address, offset, byte count, etc.) indicating the position of each data type block.

[0052] also, Figure 11 The method also includes determining, by the network controller (1101), whether (1106) a message conforms to a predetermined block sequence protocol. A block sequence protocol is a data structure that defines a pattern, order, or otherwise arranges a sequence of data type blocks within a message. The determination by the network controller (1101) whether (1106) a message conforms to the predetermined block sequence protocol can be performed by: determining the expected block sequence order of the message based on the block sequence protocol, and determining whether the message's block sequence order matches the expected block sequence order. For example, the expected block sequence order may indicate an expected fast data block at a first position. In this example, if the message's block sequence order indicates a slow data block at the first position, the network controller can determine that the message does not conform to the predetermined block sequence protocol.

[0053] Furthermore, in response to determining that the message does not conform to the predetermined block sequence protocol, the network controller (1101) determines (1108) that the data within the message is outdated. This determination by the network controller (1101) in response to determining that the message does not conform to the predetermined block sequence protocol can be performed by storing an indication that one or more data blocks in the message are outdated within the network controller. In a particular embodiment, the network controller may ignore the outdated message and request updated information from the MMS. In other embodiments, the network controller may utilize the data even if it is outdated.

[0054] To further explain, Figure 12 A flowchart illustrating the implementation of the method for functional safety in a battery management system according to this disclosure is provided. Figure 12 Methods and Figure 11 The similarities in their methods are Figure 12The method also includes: receiving (1102) a message comprising a first data type block set from the module monitoring system (MMS) of the battery management system by the network controller (1101) of the BMS; determining (1104) a block sequence order indicating the position of each data type block within the message for the first data type block set by the network controller (1101); determining (1106) whether the message conforms to a predetermined block sequence protocol by the network controller (1101); and in response to determining that the message does not conform to the predetermined block sequence protocol, determining (1108) that the data within the message is outdated by the network controller (1101).

[0055] However, Figure 12 The method further includes: in response to determining that the message conforms to a predetermined block sequence protocol, the network controller (1101) determines (1202) that the data within the message is fresh. The determination by the network controller (1101) that the data within the message is fresh in response to determining that the message conforms to the predetermined block sequence protocol can be performed by storing an indication that the message is fresh. As described above, in addition to confirming data freshness, the network controller can also use CRC to confirm the device identifier, data identifier, and message integrity.

[0056] To further explain, Figure 13 A flowchart illustrating an implementation of a method for functional safety in a battery management system according to the present disclosure is provided. Figure 13 Methods and Figure 11 The similarities in their methods are Figure 13 The method also includes: receiving (1102) a message comprising a first data type block set from the module monitoring system (MMS) of the battery management system by the network controller (1101) of the BMS; determining (1104) a block sequence order indicating the position of each data type block within the message for the first data type block set by the network controller (1101); determining (1106) whether the message conforms to a predetermined block sequence protocol by the network controller (1101); and in response to determining that the message does not conform to the predetermined block sequence protocol, determining (1108) that the data within the message is outdated by the network controller (1101).

[0057] exist Figure 13 In the method, determining whether a message conforms to a predetermined block sequence protocol by the network controller (1101) (1106) includes: determining (1302) the set of expected data type blocks to be included in the message according to the predetermined block sequence protocol. Determining the set of expected data type blocks to be included in the message according to the predetermined block sequence protocol (1302) can be performed by: checking the predetermined block sequence protocol; reading the major and minor order of data type blocks in the predetermined block sequence protocol; and using registers and counters to determine the pattern used to include specific data type blocks in the message.

[0058] In addition, Figure 13 In the method, determining (1106) whether a message conforms to a predetermined block sequence protocol by the network controller (1101) includes: determining (1304) whether a first data type block set matches an expected data type block set. Determining whether (1304) the first data type block set matches the expected data type block set can be performed by: determining the expected data type block set of the message; and comparing the expected data type block set of the message with the first data type block set received in the message. For example, the expected block sequence order may indicate that a fast data block is expected at a first position. In this example, if the block sequence order of the message indicates that a slow data block is in the first position, the network controller can determine that the message does not conform to the predetermined block sequence protocol.

[0059] To further explain, Figure 14 A flowchart illustrating an implementation of a method for functional safety in a battery management system according to the present disclosure is provided. Figure 14 Methods and Figure 11 The similarities in their methods are Figure 14 The method also includes: receiving (1102) a message comprising a first data type block set from the module monitoring system (MMS) of the battery management system by the network controller (1101) of the BMS; determining (1104) a block sequence order indicating the position of each data type block within the message for the first data type block set by the network controller (1101); determining (1106) whether the message conforms to a predetermined block sequence protocol by the network controller (1101); and in response to determining that the message does not conform to the predetermined block sequence protocol, determining (1108) that the data within the message is outdated by the network controller (1101).

[0060] exist Figure 14 In the method, determining by the network controller (1101) whether a message conforms to a predetermined block sequence protocol (1106) includes: determining (1402) whether the position of each data type block in the first data type block set is different from the previous position of the data type block within the previous block sequence order of consecutive previous messages received by the MMS. In a particular embodiment, the “position” of data within the sequence can be more specific and defines the start and stop address, offset, and other things that a person skilled in the art would think of within the message. Determining whether the position of each data type block in the first data type block set (1402) is different from the previous position of the data type block within the previous block sequence order of consecutive previous messages received by the MMS can be performed by: storing and tracking the previous position; and comparing the previous position with the current position.

[0061] exist Figure 14In the method, in response to determining that the message does not conform to a predetermined block sequence protocol, the network controller (1101) determines (1108) that the data within the message is outdated, including: in response to determining that the position of each data type block in the first data type block set is different from the previous position of the data type block in the previous block sequence order of consecutive previous messages received by the MMS, determining (1404) that the data within the message is outdated. Determining that the data within the message is outdated in response to determining that the position of each data type block in the first data type block set is different from the previous position of the data type block in the previous block sequence order of consecutive previous messages received by the MMS can be performed by storing an indication that the data within the message is outdated. In a particular embodiment, the network controller may ignore the outdated message and request updated information from the MMS. In other embodiments, the network controller may utilize the data even if the data is outdated.

[0062] Those skilled in the art will understand that the method described herein for detecting data freshness by shifting the order of data included in a message can be applied to both wired and wireless systems to improve black channel communication.

[0063] Based on the above explanation, the reader will recognize that the functional safety benefits of the battery management system according to at least one embodiment of the present invention include, but are not limited to:

[0064] • Improve the performance of the module monitoring system by ensuring that the WNC can identify each MMS in the network by providing a device ID for each data frame.

[0065] • Improve the performance of the module monitoring system by ensuring that the WNC can recognize each data type (e.g., voltage, temperature, etc.) from the identified MMS.

[0066] • Improve the performance of the module monitoring system by ensuring that the WNC can detect data corruption on each message by calculating and comparing redundancy codes (CRC).

[0067] • Improve the performance of the module monitoring system by performing diagnostics within the AFE and reporting the status to the WNC.

[0068] • Improve the performance of the module monitoring system by requesting AFE data in a specific order and at repetition intervals that can be verified by the WNC, thereby ensuring that the AFE data remains fresh as it passes through the wireless transceiver.

[0069] • Improve the performance of the module monitoring system by ensuring proper end-to-end protection of security data between high security integrity components (data generated by AFE is transmitted to the controller at WNC without losing its security integrity).

[0070] • Improve the performance of the module monitoring system by ensuring a more robust freshness mechanism in both wireless and wired systems.

[0071] Exemplary embodiments of the present invention are described largely within the context of a full-functioning computer system for functional safety. However, those skilled in the art will recognize that the invention can also be embodied in a computer program product disposed on a computer-readable storage medium for use with any suitable data processing system. Such a computer-readable storage medium can be any storage medium for machine-readable information, including magnetic media, optical media, or other suitable media. Examples of such media include disks in hard disk drives or floppy disks, compressed disks for optical drives, magnetic tape, and other media that will be apparent to those skilled in the art. Those skilled in the art will readily recognize that any computer system with suitable programming means will be able to perform the steps of the methods of the invention embodied in the computer program product. Those skilled in the art will also recognize that while some exemplary embodiments described in this specification are geared towards software installed on and executed on computer hardware, alternative embodiments as firmware or hardware implementations are fully within the scope of the invention.

[0072] This invention can be a system, apparatus, method, and / or computer program product. A computer program product may include a computer-readable storage medium (or medium) having computer-readable program instructions thereon for causing a processor to perform aspects of the invention.

[0073] A computer-readable storage medium can be a tangible device capable of retaining and storing instructions for use by an instruction execution device. A computer-readable storage medium can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer floppy disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable optical disc read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanical encoding devices (e.g., punch cards or raised structures in slots on which instructions are recorded), and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be construed as being itself a transient signal, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0074] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a suitable computing / processing device, or downloaded via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network) to an external computer or external storage device. This network may include copper cables, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the respective computing / processing device.

[0075] Computer-readable program instructions used to perform the operations of this invention may be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(e.g., Smalltalk, C++, etc.) and traditional procedural programming languages ​​(e.g., "C" programming language or similar programming languages)). The computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as a standalone software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)) or may be connected to an external computer (e.g., via the Internet provided by an Internet service provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs) may execute computer-readable program instructions by utilizing state information from the computer-readable program instructions to personalize the electronic circuitry and perform aspects of the invention.

[0076] This document describes aspects of the invention with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0077] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that can instruct a computer, programmable data processing apparatus, and / or other device to operate in a particular manner, such that the computer-readable storage medium storing the instructions includes an article of writing comprising instructions that implement aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0078] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer-implemented process, such that the instructions, which are executed on the computer, other programmable apparatus or other device, implement the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0079] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this respect, each block in a flowchart or block diagram may represent a module, segment, or part of an instruction, comprising one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may not occur in the order indicated in the figures. For example, depending on the functions involved, two blocks shown consecutively may actually be executed substantially simultaneously, or these blocks may sometimes be executed in reverse order. It should also be noted that each block shown in the block diagrams and / or flowcharts, and combinations of blocks shown in the block diagrams and / or flowcharts, may be implemented by a hardware-based dedicated system that performs the specified function or action or executes a combination of dedicated hardware and computer instructions.

[0080] The advantages and features of this disclosure can be further described by the following statements:

[0081] 1. A method for functional safety in a battery management system, the method comprising: generating battery sensor data by a module monitoring system (MMS) of a battery management system (BMS); generating a message encoding the battery sensor data by the MMS based on a block sequence protocol, including: determining a first set of data type blocks to be included in the message; determining a block sequence order of the first set of data type blocks for the message, including, for each data type block in the first set of data type blocks, selecting a position within the block sequence order that differs from a previous position of the data type block in a previous block sequence order of consecutive previous messages; generating the message using each data type block in the first set of data type blocks positioned according to the selected position within the determined block sequence order; and sending the message by the MMS to a network controller of the BMS.

[0082] 2. According to the method of Declaration 1, determining the first set of data type blocks to be included in the message includes: determining which types of data type blocks should be included in the first set of data type blocks.

[0083] 3. According to the method of statement 1 or 2, wherein the block sequence protocol indicates the specific repetition interval for including a specific type of data block within any message.

[0084] 4. According to any one of the statements 1-3, wherein the block sequence protocol indicates the specific positional order of data type blocks used for the message.

[0085] 5. According to any one of the statements 1-4, wherein the first data type block set includes: data integrity data.

[0086] 6. The method according to any one of statements 1-5, wherein the first data type block set includes: the identifier of the MMS and the identifiers of one or more data type blocks of the first data type block set.

[0087] 7. A method for functional safety in a battery management system, the method comprising: receiving a message including a first set of data type blocks from a module monitoring system (MMS) of the battery management system by a network controller of the BMS; determining, for the first set of data type blocks, a block sequence order indicating the position of each data type block in the message by the network controller; determining, by the network controller, whether the message conforms to a predetermined block sequence protocol; and, in response to determining that the message does not conform to the predetermined block sequence protocol, determining, by the network controller, that data within the message is outdated.

[0088] 8. The method according to any one of statements 1-7.

[0089] 9. The method according to any one of claims 1-8 further includes: in response to determining that a message conforms to a predetermined block sequence protocol, the network controller determines that the data within the message is fresh.

[0090] 10. The method according to any one of claims 1-9, wherein determining whether a message conforms to a predetermined block sequence protocol by the network controller includes: determining a set of expected data type blocks to be included in the message according to the predetermined block sequence protocol; and determining whether a first set of data type blocks matches the set of expected data type blocks.

[0091] 11. The method according to any one of claims 1-10, wherein determining whether the message conforms to a predetermined block sequence protocol by the network controller includes: determining whether the position of each data type block in the first data type block set is different from the previous position of the data type block in the previous block sequence order of consecutive previous messages received by the MMS; wherein determining that the data in the message is outdated in response to determining that the message does not conform to the predetermined block sequence protocol includes: determining that the data in the message is outdated in response to determining that the position of each data type block in the first data type block set is different from the previous position of the data type block in the previous block sequence order of consecutive previous messages received by the MMS.

[0092] 12. The method according to any one of statements 1-11, wherein the block sequence protocol indicates a specific repetition interval for including a particular type of data block within any message.

[0093] 13. The method according to any one of statements 1-12, wherein the block sequence protocol indicates the specific positional order of data type blocks used for the message.

[0094] 14. According to any one of the statements 1-13, wherein the first data type block set includes: data integrity data.

[0095] 15. The method according to any one of claims 1-14, wherein the first data type block set includes: the identifier of the MMS and the identifiers of one or more data type blocks of the first data type block set.

[0096] 16. A functional safety apparatus for a battery management system, the apparatus comprising a module monitoring system (MMS) of the battery management system (BMS), the MMS comprising: a processor; a memory coupled to the processor, the memory including computer program instructions, which, when executed by the processor, cause the MMS to perform the following operations: generating battery sensor data; generating a message encoding the battery sensor data based on a block sequence protocol, including: determining a first set of data type blocks to be included in the message; determining a block sequence order of the first set of data type blocks for the message, including: for each data type block in the first set of data type blocks, selecting, within the block sequence order, a position of a data type block that differs from a previous position of the data type block in a previous block sequence order of consecutive previous messages; generating the message using each data type block in the first set of data type blocks positioned according to the selected position within the determined block sequence order; and sending the message to a network controller of the BMS.

[0097] 17. The apparatus according to statement 16, wherein determining the first set of data type blocks to be included in the message comprises: determining which types of data type blocks should be included in the first set of data type blocks.

[0098] 18. The apparatus according to statement 16 or 17, wherein the block sequence protocol indicates a specific repetition interval for including a particular type of data block within any message.

[0099] 19. An apparatus according to any one of statements 16-18, wherein the block sequence protocol indicates the specific positional order of data type blocks used for a message.

[0100] 20. An apparatus according to any one of claims 16-19, wherein the first data type block set includes: data integrity data.

[0101] 21. An apparatus according to any one of claims 16-20, wherein the first data type block set comprises: an identifier of the MMS and identifiers of one or more data type blocks of the first data type block set.

[0102] 22. A functional safety apparatus for a battery management system, the apparatus comprising a network controller of a battery management system (BMS), the network controller comprising: a processor; and a memory coupled to the processor, the memory including computer program instructions that, when executed by the processor, cause the network controller to perform the following operations: receiving a message comprising a first set of data type blocks from a module monitoring system (MMS) of the battery management system by the network controller of the BMS; determining, for the first set of data type blocks, a block sequence order indicating the position of each data type block in the message by the network controller; determining, by the network controller, whether the message conforms to a predetermined block sequence protocol; and, in response to determining that the message does not conform to the predetermined block sequence protocol, determining, by the network controller, that data within the message is outdated.

[0103] 23. An apparatus according to any one of statements 16-22.

[0104] 24. The apparatus according to any one of claims 16-23, further comprising: in response to determining that the message conforms to a predetermined block sequence protocol, the network controller determines that the data within the message is fresh.

[0105] 25. An apparatus according to any one of claims 16-24, wherein determining whether the message conforms to a predetermined block sequence protocol by the network controller comprises: determining, according to the predetermined block sequence protocol, a set of expected data type blocks to be included in the message; and determining whether a first set of data type blocks matches the set of expected data type blocks.

[0106] 26. An apparatus according to any one of claims 16-25, wherein determining whether a message conforms to a predetermined block sequence protocol by the network controller includes: determining whether the position of each data type block in a first set of data type blocks is different from the previous position of the data type block in the previous block sequence order of consecutive previous messages received by the MMS; wherein determining that data within the message is outdated in response to determining that the message does not conform to the predetermined block sequence protocol includes: determining that data within the message is outdated in response to determining that the position of each data type block in the first set of data type blocks is different from the previous position of the data type block in the previous block sequence order of consecutive previous messages received by the MMS.

[0107] 27. An apparatus according to any one of statements 16-26, wherein the block sequence protocol indicates a specific repetition interval for including a particular type of data block within any message.

[0108] 28. An apparatus according to any one of statements 16-27, wherein the block sequence protocol indicates the specific positional order of data type blocks used for a message.

[0109] 29. An apparatus according to any one of claims 16-28, wherein the first data type block set includes: data integrity data.

[0110] 30. An apparatus according to any one of claims 16-29, wherein the first data type block set comprises: an identifier of the MMS and identifiers of one or more data type blocks of the first data type block set.

[0111] One or more embodiments may be described herein by way of method steps illustrating the performance of specific functions and their relationships. For ease of description, the boundaries and order of these functional building blocks and method steps have been arbitrarily defined herein. Alternative boundaries and orders may be defined as long as the specified functions and relationships are properly performed. Therefore, any such alternative boundaries or orders are within the scope and spirit of the claims. Furthermore, for ease of description, the boundaries of these functional building blocks have been arbitrarily defined herein. Alternative boundaries may be defined as long as certain important functions are properly performed. Similarly, flowchart blocks may also be arbitrarily defined herein to illustrate certain important functions.

[0112] Within the scope of use, flowchart block boundaries and sequences may be defined in other ways and still perform certain important functions. Therefore, this alternativeity of functional building blocks and flowchart blocks and sequences is limited within the scope and spirit of the claims. Those skilled in the art will also recognize that the functional building blocks and other illustrative blocks, modules, and components described herein may be implemented as described or by discrete components, application-specific integrated circuits, processors executing appropriate software, or any combination thereof.

[0113] While specific combinations of various functions and features of one or more embodiments are explicitly described herein, other combinations of these features and functions are equally possible. This disclosure is not limited to the specific examples disclosed herein and explicitly incorporates these other combinations.

Claims

1. A method, the method comprising: Battery sensor data is generated by the Module Monitoring System (MMS) of the Battery Management System (BMS); The message generated by MMS based on the block sequence protocol encodes the battery sensor data, including: Determine the first set of data type blocks to be included in the message; For the message, determining the block sequence order of the first data type block set includes: for each data type block in the first data type block set, selecting a position within the block sequence order that differs from the previous position of the data type block in the previous block sequence order of consecutive previous messages, such that the position of the data type block is different within the block sequence order of consecutive messages; and The message is generated using each data type block in the first set of data type blocks, which is positioned according to a selected location within the determined block sequence order; and the message is sent by the MMS to the network controller of the BMS.

2. The method according to claim 1, wherein, Determining the first set of data type blocks to be included in the message includes: determining which types of data type blocks should be included in the first set of data type blocks.

3. The method according to claim 1, wherein, The block sequence protocol indicates the specific repetition interval for including a particular type of data block within any message.

4. The method according to claim 1, wherein, The block sequence protocol indicates the specific positional order of data type blocks used for messages.

5. The method according to claim 1, wherein, The first data type block set includes: data integrity data.

6. The method according to claim 1, wherein, The first data type block set includes: the identifier of the MMS and the identifiers of one or more of the data type blocks in the first data type block set.

7. A method, the method comprising: The network controller of the battery management system (BMS) receives a message including a first data type block set from the module monitoring system (MMS) of the battery management system; The network controller determines the block sequence order for the first set of data type blocks, and the block sequence order indicates the position of each data type block within the message; The network controller determines whether the position of each data type block within the message conforms to the position indicated in the predetermined block sequence protocol; as well as In response to determining that the position of each data type block within the message does not conform to the position indicated in the predetermined block sequence protocol, the network controller determines that the data within the message is outdated.

8. The method according to claim 7, further comprising: In response to determining that the message conforms to a predetermined block sequence protocol, the network controller determines that the data within the message is fresh.

9. The method according to claim 7, wherein, The network controller determines whether the message conforms to the predetermined block sequence protocol by including: According to the predetermined block sequence protocol, determine the set of expected data type blocks to be included in the message; and Determine whether the first set of data type blocks matches the expected set of data type blocks.

10. The method according to claim 7, wherein, The network controller determines whether the message conforms to the predetermined block sequence protocol by including: Determine whether the position of each data type block in the first set of data type blocks differs from its previous position within the previous block sequence order of consecutive previous messages received by the MMS; and Specifically, determining that the data within the message is outdated in response to determining that the message does not conform to a predetermined block sequence protocol includes: determining that the data within the message is outdated in response to determining that the position of each data type block in the first data type block set is different from the previous position of the data type block in the previous block sequence order of consecutive previous messages received by the MMS.

11. The method according to claim 7, wherein, The block sequence protocol indicates the specific repetition interval for including a particular type of data block within any message.

12. The method according to claim 7, wherein, The block sequence protocol indicates the specific positional order of data type blocks used for messages.

13. The method according to claim 7, wherein, The first data type block set includes: data integrity data.

14. The method according to claim 7, wherein, The first data type block set includes: the identifier of the MMS and the identifiers of one or more data type blocks in the first data type block set.

15. An apparatus comprising a module monitoring system (MMS) of a battery management system (BMS), the MMS comprising: processor; A memory coupled to the processor, the memory including: computer program instructions, which, when executed by the processor, cause the MMS to perform the following operations: Generate battery sensor data; The message encoding the battery sensor data is generated based on the block sequence protocol, including: Determine the first set of data type blocks to be included in the message; For the message, determining the block sequence order of the first data type block set includes: for each data type block in the first data type block set, selecting a position within the block sequence order that differs from the previous position of the data type block in the previous block sequence order of consecutive previous messages, such that the position of the data type block is different within the block sequence order of consecutive messages; and The message is generated using each data type block in the first set of data type blocks, which is positioned according to a selected location within the determined block sequence order; and the message is sent to the network controller of the BMS.

Images