Safety control system and method for contactor in energy storage battery management system

Abstract

According to the safety control system and method for the contactor in the energy storage battery management system, the contactor can still be controlled under the condition that the I / O port of the control module is damaged, the safety and reliability of the energy storage battery management system are remarkably improved, the contactor is connected between the battery module and the load module, and the safety of the energy storage battery management system is improved. A coil of the contactor can control closing and opening of the contactor, the coil is respectively connected with a power supply, the driving circuit and the control module, a watchdog chip is arranged between the control module and the driving circuit, and the watchdog chip is configured to receive a heartbeat signal sent by the control module and output a control signal to control the driving circuit to connect the coil and the power supply from the coil side; and when the watchdog chip does not receive the heartbeat signal sent by the control module, the watchdog chip outputs a control signal to control the driving circuit, and the coil is disconnected from the power supply from the coil side.

Description

Technical Field

[0001] The present invention relates to the technical field of battery management systems, and in particular to a safety control system and method for a contactor in an energy storage battery management system. Technical Background

[0002] In the design process of BMS for new energy storage system, MCU with I / O port and peripheral circuit is needed to control the closing and opening of contactor in power circuit. Especially after the contactor is controlled to be turned on, during the normal operation of battery system, if BMS detects abnormal operation of battery cell voltage, battery cell temperature, or other abnormalities such as ambient temperature, charge and discharge current, and other components of the system, the contactor needs to be disconnected.

[0003] Most of the current solutions directly use the high or low level output of the MCU's I / O port to control the closing and opening of the contactor. This control method may have the following problems:

[0004] 1. If the drive circuit module that controls the closing or disconnection of the contactor or the drive circuit module is damaged and fails, the DC contactor may not be controlled to close for operation, or cannot be controlled to disconnect for safety protection.

[0005] 2. If the I / O port of the MCU fails and can only continuously output a certain level, or the MCU is directly damaged, causing the input signal of the drive circuit to continue to be a certain level, it may cause the DC contactor to be unable to be controlled to close for operation, or unable to be controlled to open for safety protection. Summary of the invention

[0006] In view of the above problems, the present invention provides a safety control system and method for contactors in an energy storage battery management system, which can control the contactors even when the I / O port of the control module is damaged, thereby significantly improving the safety and reliability of the energy storage battery management system.

[0007] The technical solution is as follows: a safety control system for contactors in an energy storage battery management system, comprising a battery module and a load module connected to each other, a contactor is connected between the positive electrode of the battery module and the positive electrode of the load module, and between the negative electrode of the battery module and the negative electrode of the load module, respectively, the contactor comprises a coil and a contact, the coil can control the closing and opening of the contact, the coil is respectively connected to a power supply, a drive circuit and a control module, and the control module controls the drive circuit to connect the loop between the coil and the power supply;

[0008] It is characterized in that: a watchdog chip is arranged between the control module and the drive circuit, and the watchdog chip is configured to receive a heartbeat signal sent by the control module, and output a control signal to control the drive circuit to connect the coil and the power supply from the coil side; when the watchdog chip does not receive the heartbeat signal sent by the control module, the watchdog chip outputs a control signal to control the drive circuit to disconnect the coil from the power supply from the coil side.

[0009] Furthermore, the watchdog chip includes a first watchdog chip and a second watchdog chip, the first watchdog chip is used to control a first drive circuit between the positive pole of the battery module and the positive pole of the load module, and the second watchdog chip is used to control a second drive circuit between the negative pole of the battery module and the negative pole of the load module.

[0010] Furthermore, it also includes a third watchdog chip, which is connected to a third drive circuit, and the third drive circuit is connected to a power supply. The third watchdog chip is configured to receive a heartbeat signal issued by the control module, and output a control signal to control the third drive circuit to connect the coil and the power supply. When the third watchdog chip does not receive the heartbeat signal issued by the control module, the third watchdog chip outputs a control signal to control the third drive circuit from the power supply end to disconnect the power supply from the coil.

[0011] Furthermore, the control module is an MCU of the BMS, and the first watchdog chip, the second watchdog chip and the third watchdog chip are respectively connected to different I / O ports of the MCU of the BMS.

[0012] Furthermore, it also includes a redundant control module, which communicates with the control module via CAN, a third watchdog chip is connected to a third drive circuit, and the third drive circuit is connected to a power supply. The third watchdog chip is configured to receive a heartbeat signal emitted by the redundant control module, and output a control signal to control the third drive circuit to connect the coil to the power supply. When the third watchdog chip does not receive the heartbeat signal emitted by the redundant control module, the third watchdog chip outputs a control signal to control the third drive circuit from the power supply end to disconnect the power supply from the coil.

[0013] Furthermore, the driving circuit includes a first driving MOS tube and a second driving MOS tube, the drain of the first driving MOS tube is connected to a 12V power supply, the source of the first driving MOS tube is connected to the drain of the second driving MOS tube, the source of the second driving MOS tube is grounded, the gate of the first driving MOS tube is connected to the control end, and the gate of the second driving MOS tube is connected to the output end of the watchdog chip.

[0014] Furthermore, the driving circuit also includes a hardware protection MOS tube, the drain of the hardware protection MOS tube is connected to the gate of the second driving MOS tube, the source of the hardware protection MOS tube is grounded, the gate of the hardware protection MOS tube is connected to a control module, the control module is connected to an overcurrent protection circuit and an overvoltage protection circuit, and the control module outputs a hardware protection signal according to feedback from the overcurrent protection circuit and the overvoltage protection circuit.

[0015] Furthermore, the heartbeat signal is a PWM signal.

[0016] A safety control method for a contactor in an energy storage battery management system, the method is implemented based on the above-mentioned safety control system for the contactor in the energy storage battery management system, and the method comprises the steps of:

[0017] Power on and start;

[0018] The control module outputs the default level to disconnect the contactor and power supply;

[0019] Perform initialization and self-test;

[0020] If the initialization and self-test are normal, the heartbeat signal is output to close the contactor and connect the power supply, and the battery management system works normally. If no fault is detected, the heartbeat signal is continuously output to close the contactor and connect the power supply;

[0021] If a fault is detected, the output will disconnect the contactor and power supply at the default level to eliminate the fault;

[0022] If the fault is eliminated, the output heartbeat signal is restored to close the contactor and connect the power supply; if the fault is not eliminated, the default level is output to disconnect the contactor and power supply to eliminate the fault. If the fault cannot be eliminated continuously, the machine will shut down automatically.

[0023] If the initialization and / or self-test is abnormal, wait for manual shutdown and maintenance and restart, and make an abnormal timeout judgment;

[0024] If it has not timed out, the machine will be powered on again after manual shutdown for maintenance and restart; if it has timed out, it will shut down automatically.

[0025] The safety control system of the contactor in the energy storage battery management system of the present invention increases the hardware watchdog and sets the hardware watchdog between the driving circuit and the control module. The control module no longer outputs a high / low level to drive the driving circuit. The input signal of the hardware watchdog comes from the heartbeat signal of the control module. After the hardware watchdog receives the input heartbeat signal, the output signal controls the driving circuit to connect the coil and the power supply. The control module must output a periodic heartbeat signal to allow the hardware watchdog to output a closed control level. Once the hardware watchdog cannot receive the input heartbeat signal, the hardware watchdog will output a level signal to control the disconnection of the coil and the power supply. Even if the I / O port of the MCU fails and can only continuously output a certain level, or the MCU is directly damaged, resulting in the input signal of the driving circuit being continuously at a certain level, it does not affect the control of the contactor, thereby improving safety.

[0026] The present invention also considers enhancing safety from the perspective of redundant control, and adds a third drive circuit for the power supply of the contactor control coil. When the contactor needs to be closed, the power supply of the coil is turned on through the third drive circuit at the same time; when the contactor needs to be disconnected for protection, the power supply of the coil is also controlled to be disconnected from the power supply end at the same time, thereby further enhancing the safety of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is a schematic diagram of the system composition of a safety control system for a contactor in an energy storage battery management system in Example 1;

[0028] Figure 2 This is a schematic diagram of the system composition of a safety control system for a contactor in an energy storage battery management system in Example 2;

[0029] Figure 3 This is a schematic diagram of the system composition of a safety control system for a contactor in an energy storage battery management system in Example 3;

[0030] Figure 4 is a schematic diagram of a driving circuit diagram in an embodiment;

[0031] Figure 5 Schematic diagram of the steps of a method for safely controlling a contactor in an energy storage battery management system in an embodiment. DETAILED DESCRIPTION Specific embodiment 1:

[0033] See Figure 1, a safety control system for contactors in an energy storage battery management system, comprising a battery module 1 and a load module 2 connected to each other, a contactor 3 connected between the positive electrode of the battery module 1 and the positive electrode of the load module 2, and a contactor 3 connected between the negative electrode of the battery module 1 and the negative electrode of the load module 2, respectively, the contactor 3 comprising a coil 301 and a contact 302, the coil 301 being capable of controlling the closing and opening of the contact 302, the coil 301 being respectively connected to a power supply 4, a drive circuit 5 and a control module 6, and the control module 6 connecting the loop between the coil 301 and the power supply 4 by controlling the drive circuit 5;

[0034] A watchdog chip 7 is arranged between the control module 6 and the drive circuit 5. The watchdog chip 7 is configured to receive a heartbeat signal sent by the control module 6, and output a control signal to control the drive circuit 5 to connect the coil 301 with the power supply 4 from the coil side; when the watchdog chip 7 does not receive the heartbeat signal sent by the control module 6, the watchdog chip 7 outputs a control signal to control the drive circuit 5 to disconnect the coil 301 from the power supply 4 from the coil side.

[0035] In the embodiment, the watchdog chip includes a first watchdog chip 7A and a second watchdog chip 7B, the first watchdog chip is used to control the first drive circuit 5A between the positive pole of the battery module 1 and the positive pole of the load module 2, and the second watchdog chip 7B is used to control the second drive circuit 5B between the negative pole of the battery module and the negative pole of the load module.

[0036] In the embodiment, a hardware watchdog chip is arranged between the control module and the drive circuit to replace the traditional method of directly controlling the closing and disconnecting of the contactor by outputting a high / low level from the I / O port of the MCU. The hardware watchdog chip determines whether to output a control signal by receiving a heartbeat signal sent by the control module, thereby controlling the drive circuit to connect or disconnect the connection between the coil and the power supply. Through the introduction of the hardware watchdog chip, even if the I / O port of the MCU fails or the MCU itself is damaged, the system can still normally control the closing and disconnection of the contactor, thereby avoiding the potential safety hazard caused by the control signal being continuously at a certain level. The hardware watchdog chip will output a closing control level only when receiving a periodic heartbeat signal, thereby improving the stability of the system, significantly improving the safety and reliability of the energy storage battery management system, and reducing the safety risks caused by control module failure or drive circuit failure. The watchdog chip can monitor the heartbeat signal of the MCU in real time. Once an abnormality is detected, measures are immediately taken to disconnect the contactor to ensure that the contactor can be disconnected in time to prevent the occurrence of dangerous situations such as overheating, overcharging, and over-discharging of the battery system. The response speed of the hardware watchdog is faster than that of software monitoring, and abnormal situations can be handled in a shorter time, thereby improving the response speed of the system.

[0037] Specific embodiment 2: Figure 2On the basis of the specific embodiment 1, it further includes a third watchdog chip 7C, the third watchdog chip 7C is connected to the third drive circuit 5C, the third drive circuit 5C is connected to the power supply 4, the third watchdog chip 7C is configured to receive the heartbeat signal sent by the control module 6, and output a control signal to control the third drive circuit 5C to connect the coil 301 and the power supply 4. When the third watchdog chip 7C does not receive the heartbeat signal sent by the control module 6, the third watchdog chip 7C outputs a control signal to control the third drive circuit 5C to disconnect the power supply 4 from the coil 301 from the power supply end. When the contactor needs to be closed, the power supply of the coil is connected through the third drive circuit at the same time; when the contactor needs to be disconnected for protection, the power supply of the coil is also controlled to be disconnected from the power supply end at the same time, thereby further enhancing the safety of the system.

[0038] In one embodiment, the control module 6 is the MCU of the BMS, and the first watchdog chip, the second watchdog chip and the third watchdog chip are respectively connected to different I / O ports of the MCU of the BMS, so as to increase the independence of the control signal and avoid the complete failure of the system caused by the failure of a single port.

[0039] Specific embodiment 3: Figure 3 On the basis of the specific embodiment 2, it further includes a redundant control module 8, the redundant control module 8 communicates with the control module 6 through CAN, the third watchdog chip 7C is connected to the third drive circuit 5C, the third drive circuit 5C is connected to the power supply 4, the third watchdog chip 7C is configured to receive the heartbeat signal sent by the redundant control module 8, and output a control signal to control the third drive circuit 5C to connect the coil 301 and the power supply 4. When the third watchdog chip 7C does not receive the heartbeat signal sent by the redundant control module 8, the third watchdog chip 7C outputs a control signal to control the third drive circuit 7C to disconnect the power supply 4 from the coil 301 from the power supply end. In the embodiment, by adding a redundant control module, the safety of the system is further enhanced to ensure that the system can still work normally when the main control module fails. Through the design of the control module and the third drive circuit, the embodiment reduces the impact of single point failures on the system and improves the reliability of the entire energy storage battery management system.

[0040] See Figure 4 , Figure 4 An actual circuit diagram of a driving circuit is given, the driving circuit includes a first driving MOS tube QP11 and a second driving MOS tube QP16, the drain of the first driving MOS tube QP11 is connected to a 12V power supply, the source of the first driving MOS tube QP11 is connected to the drain of the second driving MOS tube QP16, the source of the second driving MOS tube QP16 is grounded, the gate of the first driving MOS tube QP11 is connected to the control end, and the gate of the second driving MOS tube QP16 is connected to the output end of the watchdog chip;

[0041] In one embodiment, the driving circuit further includes a hardware protection MOS transistor QP29, the drain of the hardware protection MOS transistor QP29 is connected to the gate of the second driving MOS transistor QP16, the source of the hardware protection MOS transistor QP29 is grounded, and the gate of the hardware protection MOS transistor QP29 is connected to the control module. The control module 6 is connected to an overcurrent protection circuit and an overvoltage protection circuit. The control module 6 will output a hardware protection signal according to feedback from the overcurrent protection circuit and the overvoltage protection circuit.

[0042] Figure 4 In the figure, the bottom UIProtect is the signal from the overvoltage and overcurrent hardware protection circuit. When there is no hardware protection, the corresponding hardware protection MOS tube QP29 is disconnected from the ground. The watchdog output control signal Relays_con at the top of the figure will be meaningful and can be pulled high or low. When there is a signal from the overvoltage and overcurrent hardware protection circuit, the hardware protection MOS tube QP29 is shorted to the ground. The watchdog control signal at the top of the figure is continuously pulled low and cannot control the corresponding second drive MOS tube QP16, which plays a role in hardware protection.

[0043] Figure 4 Relays_con in the control module is the control signal output by the watchdog chip when it outputs PWM wave, so that the second driver MOS tube QP16 is connected to the ground. Otherwise, the failure to feed the watchdog due to hardware protection or MCU failure will cause the second driver MOS tube QP16 to be disconnected, and the relay will have no ground loop and cannot work normally.

[0044] Figure 4 Rcon_1 in the figure is the relay coil control signal of conventional application. It requires that the hardware protection MOS tube QP29 below and the second driving MOS tube corresponding to the watchdog are normal, and the relay is provided with ground. This signal can control the coil control of the relay by controlling the conduction and disconnection of the first driving MOS tube QP11 to the ground. In the embodiment, the driving circuit is provided with multiple driving MOS tubes and hardware protection circuits. The present invention realizes multiple protections for contactor control, which can significantly improve the safety and reliability of the safety control system of the contactor in the energy storage battery management system.

[0045] See Figure 5 In an embodiment of the present invention, a safety control method for a contactor in an energy storage battery management system is also provided. The method is implemented based on the safety control system of the contactor in the energy storage battery management system described above. The method comprises the steps of:

[0046] Power on and start;

[0047] The output default level disconnects the contactor and power supply;

[0048] Perform initialization and self-test;

[0049] If the initialization and self-test are normal, the heartbeat signal is output to close the contactor and connect the power supply, and the battery management system works normally. If no fault is detected, the heartbeat signal is continuously output to close the contactor and connect the power supply;

[0050] If a fault is detected, the output will disconnect the contactor and power supply at the default level to eliminate the fault;

[0051] If the fault is eliminated, the output heartbeat signal is restored to close the contactor and connect the power supply; if the fault is not eliminated, the default level is output to disconnect the contactor and power supply to eliminate the fault. If the fault cannot be eliminated continuously, the machine will shut down automatically.

[0052] If the initialization and / or self-test is abnormal, wait for manual shutdown and maintenance and restart, and make an abnormal timeout judgment;

[0053] If it has not timed out, the machine will be powered on again after manual shutdown for maintenance and restart; if it has timed out, it will shut down automatically.

[0054] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the present invention can be implemented in other specific forms without departing from the spirit or essential features of the present invention. Therefore, the embodiments should be considered exemplary and non-restrictive in all respects, and the scope of the present invention is defined by the appended claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims be included in the present invention.

[0055] In addition, it should be understood that although the present specification is described according to implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment may also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.

Claims

1. A safety control system for contactors in an energy storage battery management system, comprising a battery module and a load module connected to each other, wherein a contactor is connected between the positive electrode of the battery module and the positive electrode of the load module, and between the negative electrode of the battery module and the negative electrode of the load module, respectively, and wherein the contactor comprises a coil and a contact point, wherein the coil can control the closing and opening of the contact point, wherein the coil is respectively connected to a power supply, a drive circuit and a control module, wherein the control module controls the drive circuit so that the loop between the coil and the power supply is connected Features: A watchdog chip is arranged between the control module and the drive circuit, and the watchdog chip is configured to receive a heartbeat signal sent by the control module, and output a control signal to control the drive circuit to connect the coil and the power supply from the coil side; when the watchdog chip does not receive the heartbeat signal sent by the control module, the watchdog chip outputs a control signal to control the drive circuit to disconnect the coil from the power supply from the coil side.

2. The safety control system of a contactor in an energy storage battery management system according to claim 1, characterized in that: The watchdog chip includes a first watchdog chip and a second watchdog chip, wherein the first watchdog chip is used to control a first drive circuit between the positive electrode of the battery module and the positive electrode of the load module, and the second watchdog chip is used to control a second drive circuit between the negative electrode of the battery module and the negative electrode of the load module.

3. The safety control system of a contactor in an energy storage battery management system according to claim 2, characterized in that: It also includes a third watchdog chip, which is connected to a third drive circuit, which is connected to a power supply, and is configured to receive a heartbeat signal sent by the control module, and output a control signal to control the third drive circuit to connect the coil to the power supply. When the third watchdog chip does not receive the heartbeat signal sent by the control module, the third watchdog chip outputs a control signal to control the third drive circuit to disconnect the power supply from the coil from the power supply end.

4. The safety control system of a contactor in an energy storage battery management system according to claim 3, characterized in that: The control module is an MCU of the BMS, and the first watchdog chip, the second watchdog chip and the third watchdog chip are respectively connected to different I / O ports of the MCU of the BMS.

5. The safety control system of a contactor in an energy storage battery management system according to claim 4, characterized in that: It also includes a redundant control module, which communicates with the control module via CAN, a third watchdog chip is connected to a third drive circuit, and the third drive circuit is connected to a power supply. The third watchdog chip is configured to receive a heartbeat signal sent by the redundant control module and output a control signal to control the third drive circuit to connect the coil to the power supply. When the third watchdog chip does not receive the heartbeat signal sent by the redundant control module, the third watchdog chip outputs a control signal to control the third drive circuit to disconnect the power supply from the coil from the power supply end.

6. The safety control system of a contactor in an energy storage battery management system according to claim 1, characterized in that: The driving circuit includes a first driving MOS tube and a second driving MOS tube, the drain of the first driving MOS tube is connected to a 12V power supply, the source of the first driving MOS tube is connected to the drain of the second driving MOS tube, the source of the second driving MOS tube is grounded, the gate of the first driving MOS tube is connected to the control end, and the gate of the second driving MOS tube is connected to the output end of the watchdog chip.

7. The safety control system of a contactor in an energy storage battery management system according to claim 6, characterized in that: The driving circuit also includes a hardware protection MOS tube, the drain of the hardware protection MOS tube is connected to the gate of the second driving MOS tube, the source of the hardware protection MOS tube is grounded, the gate of the hardware protection MOS tube is connected to a control module, the control module is connected to an overcurrent protection circuit and an overvoltage protection circuit, and the control module outputs a hardware protection signal according to feedback from the overcurrent protection circuit and the overvoltage protection circuit.

8. The safety control system of a contactor in an energy storage battery management system according to claim 1, characterized in that: The heartbeat signal is a PWM signal.

9. A safety control method for a contactor in an energy storage battery management system, characterized in that: The method is implemented based on the safety control system of the contactor in the energy storage battery management system according to any one of claims 1 to 8, and the method comprises the steps of: powering on and starting; The control module outputs the default level to disconnect the contactor and power supply; Perform initialization and self-test; If the initialization and self-test are normal, the heartbeat signal is output to close the contactor and connect the power supply, and the battery management system works normally. If no fault is detected, the heartbeat signal is continuously output to close the contactor and connect the power supply; If a fault is detected, the output will disconnect the contactor and power supply at the default level to eliminate the fault; If the fault is eliminated, the output heartbeat signal is restored and the contactor is closed to connect the power supply; If the fault is not eliminated, the output default level disconnects the contactor and power supply to eliminate the fault. If the fault cannot be eliminated continuously, the machine will shut down automatically. If the initialization and / or self-test is abnormal, wait for manual shutdown and maintenance and restart, and make an abnormal timeout judgment; If it has not timed out, the machine will be powered on again after manual shutdown for maintenance and restart; if it has timed out, it will shut down automatically.

Images