A method, system, device and medium for detecting a safety state loop in a functional safety architecture of a vehicle-mounted BMS

Abstract

The present application belongs to the technical field of vehicle-mounted battery pack state monitoring, and particularly relates to a detection method, system, device and medium for a safety state loop in a vehicle-mounted BMS functional safety architecture, which is applied to the condition that the functional monitoring layer in the BMS functional safety architecture detects that the vehicle violates a safety target before high-voltage power-on of the battery pack; the functional monitoring layer triggers the MCU_HS_PWR interface to be at a high level through an analog signal, and performs self-checking on the safety state loop of the high-voltage relay module; the first detection instruction is sent to the high-voltage relay module, and after receiving the first detection for safety detection, the safety state loop information of the high-voltage relay module is determined according to the high and low side driving state readback. In the present application, the detection method can verify that the high-voltage relay state can be normally disconnected under the condition that the relay is not attracted and the battery pack has no high voltage, thereby ensuring the safety and reliability of the BMS system test.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of vehicle-mounted battery pack state monitoring, and particularly relates to a detection method, system and device for a safety state loop in a vehicle-mounted BMS functional safety architecture and a medium. BACKGROUND

[0002] In the functional safety project of the vehicle-mounted battery pack BMS, according to the ISO 26262-2018 standard and GB / T 39086-2020 "Functional Safety Requirements and Test Methods for Battery Management Systems for Electric Vehicles", for the functional safety project, for example, the safety target is to prevent battery monomer over-temperature from leading to thermal runaway, and it is necessary to enter a safety state within the FTTI time (fault tolerance interval time), and the safety state is to disconnect the high-voltage relay.

[0003] The functional safety architecture in the BMS mainly refers to the E-GAS three-layer architecture, which includes a functional layer, a functional monitoring layer and a controller monitoring layer. On the basis of the E-GAS three-layer architecture, the Level-1 layer is the functional layer, the Level-2 layer is the functional monitoring layer, and the Level-3 layer is the controller monitoring layer. The functional layer of the Level-1 layer is mainly the combination of software and related hardware resources capable of realizing the design function, the functional monitoring layer of the Level-2 layer is mainly responsible for monitoring the output results of the functional layer, which is equivalent to the redundancy check of the software, and the controller monitoring layer of the Level-3 layer is mainly to ensure that the hardware environment of the running of the LV1 layer and the LV2 layer is normal, that is, it is mainly to monitor the controller. The above safety target is implemented in the functional monitoring layer of the Level-2 layer, that is, after a functional safety violation of the safety target occurs, how to ensure that the functional monitoring layer in the BMS system has the ability to enter the safety state within the current driving cycle and disconnect the high-voltage relay, which has become the research focus of the technical personnel in the field.

[0004] The functional safety requirement of the functional safety software is based on the above functional safety target, in order to ensure that the BMS software has the ability to enter the safety state before starting, that is, has the ability to disconnect the high-voltage relay. The existing technical solutions mostly detect the sticking fault of the relay before power-on, the open-circuit fault of the high-voltage attracted relay and the three-state diagnosis of the relay driving circuit (including the short circuit to the power supply, the short circuit to the ground and the open circuit of the driving circuit), which detects the available state of the relay after power-on. The above fault detection method cannot solve the problem of detecting the disconnection ability of the relay before high-voltage power-on required by the functional safety software. SUMMARY

[0005] The application aims to provide a detection method, system, device and medium for a safety state loop in a vehicle-mounted BMS functional safety architecture, to solve the problem that when it is required to enter a safety state after triggering a violation of a safety target in functional safety software, the ability to detect that a high-voltage relay is disconnected before power-on is required, and under the condition that the high-voltage relay is not attracted and the battery pack has no high voltage, the safety and reliability of the BMS system during testing are ensured.

[0006] The application achieves the above-mentioned purpose by the following technical solutions:

[0007] In a first aspect, the application provides a detection method for a safety state loop in a vehicle-mounted BMS functional safety architecture, which is applied to the situation that before the high-voltage power-on of a battery pack, the functional monitoring layer in the BMS functional safety architecture detects that the vehicle violates a safety target, and the functional monitoring layer triggers the MCU_HS_PWR interface to be at a high level through an analog signal, and the safety state loop of a high-voltage relay module is self-detected, and the detection method comprises the following steps:

[0008] sending a first detection instruction to the high-voltage relay module, wherein the first detection instruction comprises the following operations in sequence: disconnecting high-side and low-side driving, disconnecting high-side and attracting low-side, disconnecting high-side and low-side, attracting high-side and disconnecting low-side, and returning to disconnecting high-side and low-side;

[0009] receiving the first detection instruction, calling an operation control strategy corresponding to the first detection instruction prepared in advance in the functional monitoring layer, and returning the high-side and low-side driving states of the high-voltage relay module after detection in response to the detection control strategy;

[0010] reading back the high-side and low-side driving states of the high-voltage relay module, and determining safety state loop information of the high-voltage relay module according to the high-side and low-side driving state read back.

[0011] Further, when the functional monitoring layer self-checks the safety state loop of the high-voltage relay module, the safety state loop comprises the following configurations:

[0012] (1) the physical contact of the high-voltage relay module is in a disconnected state;

[0013] (2) the high-side and low-side driving of the high-voltage relay module adopts 12v low-voltage power supply.

[0014] Further, the operation control strategy corresponding to the first detection instruction prepared in advance comprises:

[0015] receiving the high-side and low-side driving state read back of the high-voltage relay module, matching the subsequent corresponding operation in the first detection instruction after reading out the state, and outputting the instruction;

[0016] receive the output instruction and process it into a control instruction;

[0017] receive the control instruction, and perform data output after the high-voltage relay module performs a driving operation;

[0018] receive the data output and process it into a high / low edge driving state status readback.

[0019] Further, before the functional monitoring layer performs self-checking on the high-voltage relay module safety state loop, the method comprises the following steps of:

[0020] The functional monitoring layer monitors the battery pack single cell temperature, and when the real-time monitored single cell temperature is higher than the set software temperature threshold, the BMS enters the safety state loop self-checking within the FTTI time.

[0021] Further, the safety state loop information of the high-voltage relay module is determined according to the high / low edge driving state readback, comprising: determining whether the BMS enters a safety state or a fault state according to the high / low edge driving state readback of the high-voltage relay and whether the state is changed within the set time; wherein,

[0022] If the driving state readback of all operations in the first detection instruction passes, the BMS enters a safety state.

[0023] If the driving state readback of any one of all operations in the first detection instruction triggers timeout detection, the current safety state readback detection is ended, the BMS enters a fault state, and the fault is reported through CAN protection output.

[0024] In a second aspect, the application provides a safety state loop detection system in a vehicle-mounted BMS functional safety architecture, which is used for, when the functional monitoring layer in the BMS functional safety architecture detects that a vehicle violates a safety target before a battery pack high voltage is powered on, the functional monitoring layer triggers the MCU_HS_PWR interface to be at a high level through an analog signal, and performs self-checking on the safety state loop of the high-voltage relay module. The detection system comprises a logic operation module that performs real-time information interaction with the high-voltage relay module;

[0025] The logic operation module is configured to send a first detection instruction to the high-voltage relay module, wherein the first detection instruction comprises the following operations in sequence: disconnecting high edge and low edge driving, disconnecting high edge and attracting low edge, disconnecting high edge and low edge, attracting high edge and disconnecting low edge, and returning to disconnecting high edge and low edge.

[0026] The high-voltage relay module is configured to receive the first detection instruction, call the operation control strategy corresponding to the first detection instruction in the functional monitoring layer, and return the high / low edge driving state after safety detection in response to the detection control strategy.

[0027] The logic operation module is also used for reading back the high and low side driving states of the high voltage relay module, and determining the safety state loop information of the high voltage relay module according to the high and low side driving state read back.

[0028] Further, the logic operation module comprises a logic unit, a control unit, a high and low side driving unit and a state read back unit.

[0029] The logic unit is used for receiving the high and low side driving state read back of the high voltage relay module, matching the subsequent corresponding operation in the first detection instruction after the state read back, and outputting the instruction to the control unit.

[0030] The control unit is used for receiving the output instruction and processing it into a control instruction, and outputting it to the high and low side driving unit.

[0031] The high and low side driving unit is used for receiving the control instruction, and outputting data to the state read back unit after the high voltage relay module performs the driving operation.

[0032] The state read back unit is used for receiving the data output and processing it into the high and low side driving state read back to the logic unit.

[0033] In a third aspect, the present application provides an electronic device, comprising:

[0034] a processor; and a memory for storing instructions executable by the processor.

[0035] The processor is configured to execute the instructions to implement the detection method as described above.

[0036] In a fourth aspect, the present application provides a computer readable storage medium, when the instructions in the computer readable storage medium are executed by the processor of an electronic device, the electronic device can execute the detection method as described above.

[0037] The present application has the following beneficial effects:

[0038] 1. The detection method in the present application can solve the problem of detecting whether the relay is disconnected before power-on as required by the functional safety software, and under the condition that the relay is not attracted and the battery pack has no high voltage, the functional monitoring layer judges to trigger the safety loop detection, verifies that the high voltage relay state can normally be disconnected, and ensures the safety and reliability of the BMS system during testing.

[0039] 2. The self-test of the safety status circuit of the high-voltage relay module in this invention specifically involves detecting the pin angle of the MCU_HS_PWR interface triggering the safety status of the high-voltage relay module in the functional monitoring layer, so that the status of the relay in the circuit can achieve the effect of disconnection, including operations such as reading back the relay status. Furthermore, compared to high-voltage detection in existing technologies, this invention uses 12V low voltage for high-low side drive detection and reading back, resulting in better test safety. Attached Figure Description

[0040] Figure 1 This is a flowchart of a method for detecting a safety state loop in the functional safety architecture of an on-board BMS provided in Embodiment 1 of this application.

[0041] Figure 2 This is a schematic diagram of a method for detecting the safety state loop in the functional safety architecture of an on-board BMS provided in Embodiment 1 of this application.

[0042] Figure 3 This is a structural block diagram of the detection control strategy in the detection method of the safety state loop in the vehicle-mounted BMS functional safety architecture provided in Embodiment 1 of this application.

[0043] Figure 4 This is a flowchart illustrating the specific implementation of the detection method for the safety state loop in the functional safety architecture of the vehicle-mounted BMS provided in Embodiment 1 of this application. Detailed Implementation

[0044] The present application will now be described in further detail with reference to the accompanying drawings. It should be noted that the following specific embodiments are only used to further illustrate the present application and should not be construed as limiting the scope of protection of the present application. Those skilled in the art can make some non-essential improvements and adjustments to the present application based on the above application content.

[0045] Example 1

[0046] like Figures 1-3 As shown, this embodiment proposes a detection method for the safety state loop in the functional safety architecture of an on-board BMS. It is applied to the battery pack before high voltage power-on and when the functional monitoring layer in the BMS functional safety architecture detects that the vehicle violates the safety target, the functional monitoring layer triggers the MCU_HS_PWR interface to be at a high level through an analog signal to perform a self-test on the safety state loop of the high voltage relay module.

[0047] It should be noted that the safety state loop in the embodiment mainly refers to: the control instruction of the function monitoring layer of the Level-2 layer, the action execution of the actuator (specifically a high-voltage relay module in the embodiment) receiving the control instruction of the function monitoring layer, and the state reading for the action execution of the actuator, and the controller monitoring layer of the Level-3 layer ensures that the hardware environment of the operation of the LV2 layer is normal. The path formed by all actions on this link is collectively referred to as a safety state loop.

[0048] In the embodiment, the detection method includes the following steps:

[0049] S1, a first detection instruction is sent to the high-voltage relay module, wherein the first detection instruction includes the following operations in sequence: disconnecting the high-side and low-side driving, disconnecting the high-side and attracting the low-side, disconnecting the high-side and the low-side, attracting the high-side and disconnecting the low-side, and returning to disconnecting the high-side and the low-side;

[0050] S2, receiving the first detection instruction, calling the operation control strategy corresponding to the first detection instruction prepared in the function monitoring layer, and after responding to the detection control strategy, the high-voltage relay module returns the high-side and low-side driving states;

[0051] S3, reading the high-side and low-side driving states of the high-voltage relay module, and determining the safety state loop information of the high-voltage relay module according to the high-side and low-side driving state reading.

[0052] It can be understood that the safety state detection method in the vehicle-mounted BMS functional safety architecture proposed in the embodiment is that the research subject of the method is to detect the ability of the BMS system to disconnect the high-voltage relay before the safety state triggers the high-voltage relay to be disconnected, that is, under the premise that the relay cannot be closed before the high-voltage is powered on, it is verified that the BMS system has the ability to disconnect the high-voltage relay in this driving cycle. The safety state mainly requires entering the safety state after triggering the violation of the safety target in the functional safety software.

[0053] In the embodiment, when the functional safety software is specifically implemented, it is required that when the vehicle violates the safety target, such as the vehicle BMS detecting that the battery temperature is too high and requiring the BMS to disconnect the relay within a certain time, a safety state signal needs to be simulated when the vehicle is powered on for the first time. In the embodiment, the interface for simulating the entry into the safety state is MCU_HS_PWR; when the LV2 function monitoring layer is powered on for the first time, the self-check of the safety state loop is triggered, the LV2 function monitoring layer simulates the triggering of the safety state, the pin angle triggering the safety state is named MCU_HS_PWR; when the MCU_HS_PWR angle triggers a high level, the safety path is detected, and the detection path is as shown in Figure 2 .

[0054] Further preferably, when the function monitoring layer self-checks the safety state loop of the high-voltage relay module, the safety state loop comprises the following configurations:

[0055] (1) the physical contact of the high-voltage relay is in an open state;

[0056] (2) the high-voltage relay uses 12V low-voltage power supply for high-side and low-side driving.

[0057] In the embodiment, the self-checking of the safety state loop of the high-voltage relay module is different from the detection of the on-off capability of the relay in the prior art, but is to detect the pin angle of the safety state MCU_HS_PWR interface triggered by the high-voltage relay module in the function monitoring layer, so that the state of the relay in the loop can achieve the effect of being opened, including the read-back operation of the state of the relay. In addition, compared with the high-voltage detection in the prior art, the application uses 12V low-voltage for high-side and low-side driving detection read-back (non-high-voltage detection), and the safety of the test is better.

[0058] Further preferably, the pre-prepared operation control strategy corresponding to the first detection instruction comprises: receiving the high-side and low-side driving state read-back of the high-voltage relay module, matching the subsequent corresponding operation in the first detection instruction after reading out the state, and outputting the instruction; receiving the output instruction and processing it into a control instruction; receiving the control instruction, and after the high-voltage relay module executes the driving operation, performing data output; receiving the data output and processing it into a high-side and low-side driving state read-back.

[0059] In combination with Figure 4 , the first detection instruction in the above step S1 comprises the following steps:

[0060] Step 1: open the high-side driving of the relay and open the low-side driving of the relay;

[0061] Step 2: open the high-side driving of the relay and attract the low-side driving of the relay;

[0062] Step 3: open the high-side driving of the relay and open the low-side driving of the relay;

[0063] Step 4: attract the high-side driving of the relay and open the low-side driving of the relay;

[0064] Step 5: open the high-side driving of the relay and open the low-side driving of the relay;

[0065] Step 6: Success enters the safety state success flag;

[0066] ERR: fault state; the steps are connected with the ERR state by arrows, including:

[0067] Relay high-low side drive state read back Condition-11;

[0068] Timeout detection Condition-12;

[0069] Relay high-low side drive state read back Condition-21;

[0070] Timeout detection Condition-22;

[0071] Relay high-low side drive state read back Condition-31;

[0072] Timeout detection Condition-32;

[0073] Relay high-low side drive state read back Condition-41;

[0074] Timeout detection Condition-42;

[0075] Relay high-low side drive state read back Condition-51;

[0076] Timeout detection Condition-52;

[0077] The prerequisite for entering the safe state is that the BMS software unit detects before the initial self-check and high-voltage power-on, wherein the detected high-voltage relay module includes the main positive relay, the main negative relay, and the like, which are collectively referred to as relays.

[0078] Further preferably, before the functional monitoring layer performs self-checking on the high-voltage relay module safety state loop, the functional monitoring layer includes: the functional monitoring layer monitors the battery pack cell temperature, and when the real-time monitored cell temperature is higher than the set software temperature threshold, the BMS enters the safety state loop self-checking within the FTTI time. That is, the functional monitoring layer in this embodiment detects that the vehicle violates the safety target.

[0079] Further preferably, according to the high-low side drive state read back, the safety state loop information of the high-voltage relay module is determined, including: according to the high-low side drive state read back of the high-voltage relay and the confirmation of whether the state changes within the set time, the BMS enters the safety state or the fault state; wherein, if the drive state read back of all operations in the first detection instruction passes, the BMS enters the safety state; if the drive state read back of any one of all operations in the first detection instruction triggers the timeout detection, the current safety state back detection is ended, the BMS enters the fault state, and the fault is reported through the CAN protection output.

[0080] In combination with Figure 3 and Figure 4, in order to more clearly express the technical solutions of the present application, the content of the present application is described in detail, the safety state loop detection specifically includes the following steps:

[0081] Enter Step1 state, issue command: open relay high side drive, open relay low side drive; the command passes through the controller module (in this embodiment, specifically a logic operation module) to the actuator module (high voltage relay module), and the functional safety software logic module (M0) reads back the state, i.e. relay high-low side drive state reading Condition-11, and it is indeed read back that the relay high side drive is open, and the relay low side drive is open. If the detection time between the detection of the relay high-low side drive state and the actual read state is too large, the timeout detection Condition-12 is triggered, i.e. the detection time is too long, the system enters the ERR fault state, and the detection of the current safety state is ended.

[0082] In Step1 state, the relay high-low side drive state reading Condition-11 indeed reads back that the relay high side drive is open, and the relay low side drive is open, which meets the condition to enter the next stage. Enter Step2 state, issue command: open relay high side drive, attract relay low side drive; the functional safety software logic module reads back the state, i.e. relay high-low side drive state reading Condition-21, and it is indeed read back that the relay high side drive is open, and the relay low side drive is attracted. If the detection time between the detection of the relay high-low side drive state and the actual read state is too large, the timeout detection Condition-22 is triggered, i.e. the detection time is too long, the system enters the ERR fault state, and the detection of the current safety state is ended.

[0083] In Step2 state, the relay high-low side drive state reading Condition-21 indeed reads back that the relay high side drive is open, and the relay low side drive is attracted, which meets the condition to enter the next stage. Enter Step3 state, issue command: open relay high side drive, open relay low side drive; the functional safety software logic module reads back the state, i.e. relay high-low side drive state reading Condition-31, and it is indeed read back that the relay high side drive is open, and the relay low side drive is open. If the detection time between the detection of the relay high-low side drive state and the actual read state is too large, the timeout detection Condition-32 is triggered, i.e. the detection time is too long, the system enters the ERR fault state, and the detection of the current safety state is ended.

[0084] In Step3 state, the relay high-low side driving state back reading Condition-31 indeed reads that the relay high side driving is open, and the relay low side driving is open, which meets the condition to enter the next stage. Step4 state is entered, and the command is issued: attract the relay high side driving, and open the relay low side driving; the functional safety software logic module reads the state, i.e., the relay high-low side driving state back reading Condition-41, and indeed reads that the relay high side driving is attracted, and the relay low side driving is open. If the detection time between the detected relay high-low side driving state and the actually read state is too large, the timeout detection Condition-42 is triggered, i.e., the detection time is too long, the system enters the ERR fault state, and the detection of the current safety state is ended.

[0085] In Step4 state, the relay high-low side driving state back reading Condition-41 indeed reads that the relay high side driving is attracted, and the relay low side driving is open, which meets the condition to enter the next stage. Step5 state is entered, and the command is issued: open the relay high side driving, and open the relay low side driving; the functional safety software logic module reads the state, i.e., the relay high-low side driving state back reading Condition-51, and indeed reads that the relay high side driving is open, and the relay low side driving is open. If the detection time between the detected relay high-low side driving state and the actually read state is too large, the timeout detection Condition-52 is triggered, i.e., the detection time is too long, the system enters the ERR fault state, and the detection of the current safety state is ended.

[0086] In Step5 state, the relay high-low side driving state back reading Condition-51 indeed reads that the relay high side driving is open, and the relay low side driving is open, which meets the condition to enter the next stage. Step6 state is entered, which is Success entering the safety state flag, and entering this state represents that the detection of entering the safety state is successful, the detection success flag of the safety state is sent, the detection of this safety state is successful, and the test is ended.

[0087] The frequency of the detection method of the safety state loop is only detected once before power-on.

[0088] Example 2

[0089] Based on the same inventive concept, the embodiment provides a detection system of a safety state loop in a vehicle-mounted BMS functional safety architecture, which is used to perform self-checking on the safety state loop of a high-voltage relay module when the functional monitoring layer in the BMS functional safety architecture detects that the vehicle violates a safety target before the battery pack is powered on, and the functional monitoring layer triggers the MCU_HS_PWR interface to be at a high level through an analog signal, wherein the detection system comprises a logic operation module that performs real-time information interaction with the high-voltage relay module.

[0090] The logic operation module is configured to send a first detection instruction to the high-voltage relay module, wherein the first detection instruction comprises the following operations in sequence: disconnecting high-side and low-side driving, disconnecting high-side and attracting low-side, disconnecting high-side and low-side, attracting high-side and disconnecting low-side, and returning to disconnecting high-side and low-side.

[0091] The high-voltage relay module is configured to receive the first detection instruction, call an operation control strategy corresponding to the first detection instruction prepared in advance in the functional monitoring layer, and return the high-side and low-side driving states after responding to the detection control strategy.

[0092] The logic operation module is further configured to read back the high-side and low-side driving states of the high-voltage relay module, and determine safety state loop information of the high-voltage relay module according to the read-back high-side and low-side driving states.

[0093] Further preferably, the logic operation module comprises a logic unit, a control unit, a high-low side driving unit, and a state read-back unit; the logic unit is configured to receive the read-back high-side and low-side driving states of the high-voltage relay module, match the subsequent corresponding operations in the first detection instruction after reading out the states, output the instruction, and output the instruction to the control unit; the control unit is configured to receive the output instruction and process the output instruction into a control instruction, and output the control instruction to the high-low side driving unit; the high-low side driving unit is configured to receive the control instruction, perform driving operations on the high-voltage relay module, and output data to the state read-back unit; and the state read-back unit is configured to receive the data output and process the data output into the read-back high-side and low-side driving states to the logic unit.

[0094] The above units are all present in the functional safety software, and refer to Figure 3 M0 is the logic unit; M1 is the control unit; M2 is the relay high-low side driving unit; M3 is the state read-back unit; C0 is the output instruction processed by the logic unit; C1 is the control instruction of the control unit; C2 is the data output of the relay high-low side driving unit; C3 is the state read-back of the state read-back unit; and M0 is the logic unit, which mainly receives the state read-back C3 of the state read-back unit M3, processes the control logic of the high-voltage relay high-low side driving after reading out the states, and outputs the result to the control unit M1 through the output instruction C0 according to the control logic of the high-voltage relay high-low side driving.

[0095] The control unit M1 receives the output instruction C0 of the logic unit M0, processes the output instruction C0 into a control instruction C1, and outputs the control instruction C1 to the relay high-low edge driving unit M2.

[0096] The relay high-low edge driving unit M2 receives the control instruction C1 of the control unit M1, and outputs the data output C2 to the state reading unit M3 after performing processing on the control instruction.

[0097] The state reading unit M3 mainly receives the data output C2 after the relay high-low edge driving unit M2 processes the execution state of the relay high-low edge driving, processes the data output C2, and outputs the state readback C3 to the logic unit M0; the entire fault processing logic is as described above.

[0098] It should be noted that the above-mentioned logic operation module and high-voltage relay module correspond to steps S1 to S3 in the implementation of the above-mentioned detection method, and the instances and application scenarios realized by the corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1.

[0099] According to the above-mentioned embodiments of the present application, in the functional safety software, the detection system is for the electric vehicle before power-on (non-high-voltage detection), and in the functional safety software, it is required to trigger a safety target violation to enter a safety state, for example, the vehicle BMS detects that the battery temperature is too high, and requires the BMS to disconnect the relay within a certain time. Therefore, when the vehicle is powered on for the first time, a safety state signal needs to be simulated, and the interface for simulating the entry into the safety state is MCU_HS_PWR. When the LV2 function monitoring layer is powered on, the self-check of the safety state loop is triggered, the LV2 function monitoring layer simulates the trigger of the safety state, the pin angle of the trigger of the safety state is named as MCU_HS_PWR, and when the MCU_HS_PWR angle triggers a high level, the safety path detection is performed. Under the premise that the high-voltage relay is not closed, it is determined to trigger the safety loop detection, and it is verified that the high-voltage relay state can be normally disconnected.

[0100] Embodiment 3

[0101] The embodiment provides an electronic device, which comprises:

[0102] a processor; a memory for storing processor-executable instructions;

[0103] The processor is configured to execute the instructions to implement the detection method provided in the above-mentioned embodiments.

[0104] Embodiment 4

[0105] The embodiment provides a computer readable storage medium, when instructions in the computer readable storage medium are executed by a processor of the electronic device in the above embodiment, the electronic device can execute the detection method as described above.

[0106] Those skilled in the art can understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0107] In addition, each functional module in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0108] When the functions are realized in the form of software function modules and sold or used as independent products, the software function modules can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art or the parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program codes that can be stored in the medium.

[0109] The above embodiments are only used to illustrate the technical solutions of the present application, but not limit the present application; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalent replacements; and these modifications or replacements do not drive the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting a safety state loop in a functional safety architecture of an in-vehicle BMS, characterized in that, When the function monitoring layer in the BMS function safety architecture detects that the vehicle violates the safety target before the battery pack high voltage is powered on, the function monitoring layer triggers the MCU_HS_PWR interface to be at a high level by an analog signal, and performs self-checking on the safety state loop of the high voltage relay module. The detection method comprises: sending a first detection instruction to the high voltage relay module, wherein the first detection instruction comprises the following operations in sequence: disconnecting the high side and low side driving, disconnecting the high side and attracting the low side, disconnecting the high side and the low side, attracting the high side and disconnecting the low side, and returning to disconnecting the high side and the low side; receiving the first detection instruction, calling the operation control strategy corresponding to the first detection instruction prepared in the function monitoring layer, and returning the high side and low side driving states of the high voltage relay module after detecting in response to the operation control strategy; reading back the high side and low side driving states of the high voltage relay module, and determining the safety state loop information of the high voltage relay module according to the high side and low side driving state read back; When the function monitoring layer in the BMS function safety architecture detects that the vehicle violates the safety target, the MCU_HS_PWR interface is triggered to be at a high level, the high voltage relay module receives the control instruction of the function monitoring layer, and the state read back for the action execution of the high voltage relay module, and all actions on this link form a path of the safety state loop. 2.The method for detecting the safety state loop in the functional safety architecture of the vehicle-mounted BMS according to claim 1, characterized in that: When the function monitoring layer performs self-checking on the safety state loop of the high voltage relay module, the safety state loop comprises the following configurations: (1) the physical contact of the high voltage relay module is in a disconnected state; (2) the high side and low side driving of the high voltage relay module adopts 12v low voltage power supply. 3.The method of claim 1, wherein the method further comprises: determining the safety state of the BMS function safety architecture based on the safety state loop. The pre-prepared operation control strategy corresponding to the first detection instruction comprises: receiving the high side and low side driving state read back of the high voltage relay module, matching the subsequent corresponding operation in the first detection instruction after reading out the state, and outputting the instruction; receiving the output instruction and processing it into a control instruction; receiving the control instruction, performing the driving operation of the high voltage relay module, and then outputting data; receiving the data output and processing it into a high side and low side driving state read back.

4. The method of claim 1, wherein the method further comprises: determining the safety state of the BMS functional safety architecture based on the safety state of the safety state loop. Before the function monitoring layer performs self-checking on the safety state loop of the high voltage relay module, it comprises: The function monitoring layer monitors the battery pack single temperature, and when the real-time monitored single temperature is higher than the set software temperature threshold, the BMS enters the safety state loop self-checking within the FTTI time.

5. The method of claim 1, wherein the method further comprises: determining the safety state of the BMS functional safety architecture based on the detected safety state of the safety state loop. The safety state loop information of the high voltage relay module is determined according to the high side and low side driving state read back, and whether the state changes is confirmed within the set time; wherein, if the driving state read back of all operations in the first detection instruction passes, the BMS enters the safety state; if any one of the driving state read back of all operations in the first detection instruction triggers the timeout detection, the current safety state read back detection is ended, the BMS enters the fault state, and the fault is reported through the CAN protection output.

6. A detection system of a safety state loop in a functional safety architecture of an on-board BMS, characterized in that, The detection system is used for when the function monitoring layer in the BMS function safety architecture detects that the vehicle violates the safety target before the battery pack high voltage is powered on, the function monitoring layer triggers the MCU_HS_PWR interface to be at a high level through an analog signal, the safety state loop of the high voltage relay module is self-checked, and the detection system comprises a logic operation module which performs real-time information interaction with the high voltage relay module; The logic operation module is used for sending a first detection instruction to the high voltage relay module, wherein the first detection instruction comprises the following operations in sequence: disconnecting high side and low side driving, disconnecting high side and attracting low side, disconnecting high side and low side, attracting high side and disconnecting low side, and returning to disconnecting high side and low side. The high voltage relay module is used for receiving the first detection instruction, calling the operation control strategy corresponding to the first detection instruction prepared in the function monitoring layer, and returning the high side and low side driving states after safety detection in response to the operation control strategy. The logic operation module is also used for reading back the high side and low side driving states of the high voltage relay module, and determining the safety state loop information of the high voltage relay module according to the high side and low side driving state read back. When the function monitoring layer in the BMS function safety architecture detects that the vehicle violates the safety target, the MCU_HS_PWR interface is triggered to be at a high level, the high voltage relay module receives the control instruction of the function monitoring layer, and the state read back for the action execution of the high voltage relay module, and all actions on this link form the path of the safety state loop.

7. The detection system of a safety state loop in a functional safety architecture of a vehicle BMS according to claim 6, characterized in that: The logic operation module comprises a logic unit, a control unit, a high-low side driving unit and a state read back unit. The logic unit is used for receiving the high side and low side driving state read back of the high voltage relay module, matching the subsequent corresponding operation in the first detection instruction after the state read out, outputting the instruction, and outputting the instruction to the control unit. The control unit is used for receiving the output instruction and processing it into a control instruction, and outputting it to the high-low side driving unit. The high-low side driving unit is used for receiving the control instruction, performing the driving operation, and outputting data to the state read back unit. The state read back unit is used for receiving the data output and processing it into the high side and low side driving state read back to the logic unit.

8. An electronic device, comprising: It comprises: a processor; a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the detection method of any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, When the instructions in the computer readable storage medium are executed by the processor of the electronic device, the electronic device can execute the detection method of any one of claims 1 to 5.

Images