Management device, power storage device, system, and communication method

Abstract

A BMU (31) that manages a power storage cell (30A) is provided with: a current sensor (33) that measures the charge / discharge current of the power storage cell (30A); a first communication unit (36) that communicates with the vehicle (3); and a management unit (37) that executes: a determination process (S105) that detects, by means of the current sensor (33), a pulse pattern (25) generated in the charge / discharge current of the power storage cell (30A), and determines whether or not the detected pulse pattern (25) coincides with a predetermined pattern; and a communication process (S106) for communicating with the vehicle (3) via the first communication unit (36) when it is determined that the first communication unit (36) matches the second communication unit (36) in the determination process.

Description

Technical Field

[0001] The technology disclosed in this specification relates to a management device for managing power storage cells, a power storage device, a system, and a communication method. Background Art

[0002] In the past, there is known a power storage device having a communication unit for communicating with a device (for example, refer to Patent Document 1). Specifically, the power storage device described in Patent Document 1 is mounted on a vehicle (equivalent to the device), and has a battery cell that supplies power to an electric load mounted on the vehicle and a management device that manages the battery cell. The management device has a communication unit, and communicates with a vehicle ECU (electronic control unit: electronic control unit) via the communication unit.

[0003] However, in recent years, vehicles have begun to be equipped with functions for connecting to electrical communication lines such as the Internet and mobile phone networks. Vehicles equipped with such functions are called "connected cars" and the like. In such vehicles, the control program (so-called firmware) of the vehicle ECU can also be updated remotely via the electrical communication line.

[0004] Prior art literature

[0005] Patent Literature

[0006] Patent Document 1: (Japanese) Patent Publication No. 2022-18218 Summary of the invention

[0007] Problems to be solved by the invention

[0008] When a power storage device is mounted in a vehicle equipped with a connection function to an electric communication line, a management device provided in the power storage device is also connected to the outside of the vehicle via the vehicle, so there is a concern of a cyber attack on the management device.

[0009] An object of one aspect of the present invention is to improve the robustness against a cyber attack on a management device that manages power storage cells.

[0010] Means for solving problems

[0011] A management device is a management device for managing a battery cell, the management device comprising: a current sensor for measuring the charge and discharge current of the battery cell; a first communication unit for communicating with at least any one of a device to which power is supplied from the battery cell, a device for charging the battery cell, and a device for exchanging signals with the management device; and a management unit for performing: a determination process for detecting a pulse pattern generated in the charge and discharge current of the battery cell by the current sensor, and determining whether the detected pulse pattern is consistent with a prescribed pattern; and a communication process for communicating with the device via the first communication unit when the determination process determines that the pulse pattern is consistent.

[0012] Effects of the Invention

[0013] According to the above configuration, the robustness against a cyber attack on the management device that manages the power storage cells is improved. That is, by generating and utilizing a predetermined pattern that cannot be easily reproduced or generated, a more robust system can be constructed. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a schematic diagram showing the appearance of the system according to the first embodiment.

[0015] Figure 2 is a schematic diagram of the system.

[0016] Figure 3 It is a block diagram showing the structure of an in-vehicle ECU.

[0017] Figure 4 It is an exploded perspective view of the power storage device.

[0018] Figure 5A It is a top view of a power storage cell.

[0019] Figure 5B yes Figure 5A The cross-section view along line AA is shown.

[0020] Figure 6 It is a block diagram showing the electrical structure of the power storage device.

[0021] Figure 7 This is a flow chart of the communication process with the vehicle-mounted ECU.

[0022] Figure 8 This is a flowchart of the second and subsequent communication processes with the in-vehicle ECU according to the third embodiment. DETAILED DESCRIPTION

[0023] [Overview of Embodiments]

[0024] (1) The management device involved in the implementation mode is a management device for managing a battery cell, and the management device includes: a current sensor for measuring the charge and discharge current of the battery cell; a first communication unit for communicating with at least any one of a device to which power is supplied from the battery cell, a device for charging the battery cell, and a device for exchanging signals with the management device; and a management unit for performing: a determination process for detecting a pulse pattern generated in the charge and discharge current of the battery cell by the current sensor, and determining whether the detected pulse pattern is consistent with a prescribed pattern; and a communication process for communicating with the device via the first communication unit when the determination process determines that the pulse pattern is consistent.

[0025] In the communication between the management device and the device described in (1) above, a prescribed pattern is pre-specified between the device and the management device. When the device communicates with the management device, the discharge current supplied from the power storage cell to the device or the charging current used by the device to charge the power storage cell generates a pulse pattern corresponding to the prescribed pattern. The management device determines whether the pulse pattern generated in the charging current or the discharging current (hereinafter referred to as the charging and discharging current) is consistent with the prescribed pattern. In this way, the management device can determine whether the communication partner is a regular communication partner for which a prescribed pattern has been pre-specified between the management device and the communication partner.

[0026] Since the network attack on the management device mainly invades from the first communication unit, by judging whether the communication object is a legitimate communication object based on the pulse pattern, if it is not a legitimate communication object, the communication via the first communication unit is rejected, thereby improving the robustness against the network attack on the management device. That is, by generating / using a predetermined pattern that cannot be easily reproduced or generated, a more secure system can be built.

[0027] (2) In the management device described in (1) above, the management unit may perform encrypted communication with the device via the first communication unit.

[0028] According to the management device described in (2) above, by combining the pulse pattern for generating the charge and discharge current with the encryption of the communication, the robustness of the security is further improved.

[0029] (3) A management device as described in (1) or (2) above, wherein the management unit may perform the determination process before receiving the updated firmware when the management unit receives the updated firmware from the device via the first communication unit, and when the determination process finds the updated firmware to be consistent, the management unit receives the updated firmware from the device via the first communication unit during the communication process.

[0030] For example, if a device that receives power from a power storage cell or a device that charges a power storage cell has a function of connecting to an electric communication line, the firmware of a management unit of the management device can be updated remotely via the electric communication line. In this case, if the firmware is tampered with, there is a concern that the management device may fall into an undesirable state.

[0031] According to the management device described in (3) above, the determination process is performed before receiving the updated firmware, and the updated firmware is received when it is determined to be consistent in the determination process. In other words, the management device receives the updated firmware after confirming that the device that sent the updated firmware is a regular communication partner that has a predetermined pattern with the management device in advance. In this way, the possibility of the firmware of the management unit of the management device being tampered with and updated by the firmware can be reduced.

[0032] (4) A management device as described in any one of (1) to (3) above, wherein the management unit may perform the determination process before accepting the diagnosis based on the external diagnostic device when accepting the diagnosis based on the external diagnostic device via the first communication unit, and when the determination process finds the diagnosis to be consistent, the management unit accepts the diagnosis based on the external diagnostic device via the first communication unit during the communication process, wherein the external diagnostic device diagnoses whether the management unit has any abnormality.

[0033] Conventionally, an external diagnostic device diagnoses whether the management device has abnormality via a device supplied with power from a power storage cell or a device charging the power storage cell. In this case, a malicious third party may illegally obtain information from the management device using a device pretending to be an external diagnostic device.

[0034] According to the management device described in (4) above, the determination process is performed before accepting the diagnosis by the external diagnostic device via the first communication unit, and the diagnosis by the external diagnostic device is accepted when the determination process determines that the diagnosis is consistent. In this way, the possibility of the information of the management unit of the management device being illegally obtained can be reduced.

[0035] (5) A management device as described in any one of (1) to (4) above, wherein the management unit may perform the determination process when communicating with the device for the first time, and if a consistency is determined in the determination process, the management unit does not perform the determination process in the second and subsequent communications and communicates with the device via the first communication unit.

[0036] If it is possible to confirm at once that the device of the communication partner is a legitimate communication partner, it may not be necessary to detect the pulse pattern every time communication is performed.

[0037] According to the management device described in (5) above, the determination process is executed when communicating with the device for the first time. If a match is found in the determination process, the determination process is not executed in the second and subsequent communications, thereby shortening the time required for the second and subsequent communications.

[0038] (6) A power storage device according to an embodiment includes power storage cells and a management device according to any one of (1) to (5) above that manages the power storage cells.

[0039] According to the power storage device described in (6) above, whether or not a communication partner is a legitimate communication partner is determined based on a pulse pattern generated in the charge and discharge current of the power storage cell, thereby improving the robustness against a network attack on a management device that manages the power storage cell.

[0040] (7) The system involved in the implementation mode comprises: the power storage device described in (6) above; and a device, which is at least any one of a device that is supplied with electric power from the power storage device, a device that charges the power storage device, and a device that exchanges signals with the management device, and has a second communication unit that communicates with the management device, and the device has a pulse generating unit that causes the charging and discharging current of the power storage device to generate a pulse pattern corresponding to the prescribed pattern.

[0041] According to the system described in (7) above, whether or not the communication partner is a legitimate communication partner is determined based on the pulse pattern generated in the charge and discharge current of the power storage cell, thereby improving the robustness against a network attack on the management device that manages the power storage cell.

[0042] (8) The communication method involved in the implementation mode is a communication method of a management device for managing a single battery cell, comprising the following steps: a determination step, detecting a pulse pattern generated in a charge and discharge current of the single battery cell by a current sensor, and determining whether the detected pulse pattern is consistent with a prescribed pattern; and a communication step, communicating with the device via a first communication unit when it is determined in the determination step that the pulse pattern is consistent.

[0043] According to the communication method described in (8) above, whether or not a communication partner is a legitimate communication partner is determined based on a pulse pattern generated in the charge and discharge current of the power storage cell, thereby improving the robustness against a network attack on a management device that manages the power storage cells.

[0044] (9) The communication method involved in the implementation mode is a communication method between a management device for managing a battery cell and a device, comprising the following steps: a generation step, wherein the device causes the charge and discharge current of the battery cell to generate a pulse pattern corresponding to a prescribed pattern; a determination step, wherein the management device detects the pulse pattern generated in the charge and discharge current of the battery cell by a current sensor, and determines whether the detected pulse pattern is consistent with the prescribed pattern; and a communication step, wherein when it is determined in the determination step that they are consistent, the device communicates with the management device.

[0045] According to the communication method described in (9) above, whether or not the communication partner is a legitimate communication partner is determined based on the pulse pattern generated in the charge and discharge current of the power storage cell, thereby improving the robustness against a network attack on the management device that manages the power storage cells.

[0046] (10) The communication method involved in the implementation mode is a communication method of a management device for managing a single battery cell, comprising the following steps: a determination step, detecting a pulse pattern generated in a charge and discharge current of the single battery cell by a current sensor, and determining whether the detected pulse pattern is consistent with a prescribed pattern; a communication step, communicating with the device via a first communication unit when it is determined in the determination step that the pulse pattern is consistent; and a generation step, generating the prescribed pattern.

[0047] If the prescribed pattern is fixed to one, there is a concern that the prescribed pattern may be estimated. According to the communication method described in (10), by generating a prescribed pattern, the prescribed pattern can be changed. Thus, compared with the case where the prescribed pattern is fixed to one, the robustness against a network attack on the management device that manages the power storage cells is further improved.

[0048] [Details of implementation method]

[0049] Hereinafter, embodiments of the present disclosure will be described. The present disclosure is not limited to these examples but is shown by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0050] The embodiments of the present disclosure can be implemented in various forms such as a device, a method, a computer program for realizing the functions of these devices or methods, and a recording medium recording the computer program.

[0051] <Implementation Method 1>

[0052] based on Figures 1 to 7 Embodiment 1 will be described. In the following description, reference numerals in the drawings may be omitted except for a part of the same components.

[0053] (1) System structure

[0054] Reference Figure 1 , a system 1 according to Embodiment 1 is described. The system 1 includes a vehicle 3 and a power storage device 2 mounted on the vehicle 3. The vehicle 3 is an engine vehicle using an engine as a driving source. The vehicle 3 is an example of a device to which power is supplied from the power storage device 2 and a device to charge the power storage device 2. The vehicle 3 may also be an electric vehicle (EV), a hybrid vehicle (HV), a plug-in hybrid vehicle (PHV), or the like.

[0055] like Figure 2 As shown, the vehicle 3 includes an onboard ECU 10 (Electronic Control Unit), auxiliary equipment 11 , a high voltage system 12 , a DC / DC converter 13 , a first FET 14 (Field Effect Transistor), and a second FET 15 .

[0056] The vehicle-mounted ECU 10 is a device that controls various parts of the vehicle 3. The configuration of the vehicle-mounted ECU 10 will be described later.

[0057] The auxiliary machines 11 are devices that are operated by electric power supplied from the power storage device 2 , and specifically include headlights, a power steering device, an electric brake system, an air conditioner, and the like.

[0058] The high voltage system 12 is an engine starting device (so-called starter motor) for starting the engine of the vehicle 3, a vehicle generator (so-called alternator) for generating electricity using the engine of the vehicle 3 as a power source, etc. The high voltage system 12 is connected to the DC / DC converter 13 via a power line 16.

[0059] The DC / DC converter 13 is a bidirectional converter. The DC / DC converter 13 is connected to the power storage device 2 via the power line 17. The DC / DC converter 13 converts the voltage supplied from the power storage device 2 into a predetermined voltage and supplies it to the engine starting device. The DC / DC converter 13 converts the power generated by the vehicle generator into a predetermined voltage and charges the power storage device 2.

[0060] The first FET 14 is provided on a power line 19 described later. The second FET 15 is provided on a power line 16. The first FET 14 and the second FET 15 are used to generate a pulse pattern 25 for the charge and discharge current of the power storage device 2, and are turned on and off by the vehicle-mounted ECU 10. The vehicle-mounted ECU 10, the first FET 14, and the second FET 15 are an example of a pulse generating unit.

[0061] The power storage device 2 is connected to the vehicle-mounted ECU 10 via a signal line 18 so as to be communicable. The power storage device 2 is connected to the DC / DC converter 13 via a power line 17 and is connected to the auxiliary devices 11 via a power line 19 branching from the power line 17.

[0062] (2) Electrical structure of vehicle ECU

[0063] Reference Figure 3 , the electrical structure of the vehicle-mounted ECU 10 will be described. The vehicle-mounted ECU 10 includes a control unit 20 , a second communication unit 21 , a third communication unit 22 , and a storage unit 23 .

[0064] The control unit 20 includes a CPU, a RAM, and the like. The second communication unit 21 is a communication circuit used by the control unit 20 to communicate with various devices (including the power storage device 2) mounted on the vehicle 3. The third communication unit 22 is a communication circuit used by the control unit 20 to communicate with devices outside the vehicle 3 via an electrical communication line such as the Internet or a portable mobile phone network. The storage unit 23 stores various control programs executed by the control unit 20, predetermined patterns predetermined in advance with the power storage device 2, and the like.

[0065] (3) Structure of power storage device

[0066] like Figure 4 As shown, the power storage device 2 includes a housing 71. The housing 71 includes a main body 73 made of a synthetic resin material and a cover 74. The main body 73 is a bottomed cylindrical shape. The main body 73 includes a bottom surface 75 and four side surfaces 76. The four side surfaces 76 form an upper opening 77 at the upper end portion.

[0067] The housing 71 houses the battery pack 30 including a plurality of power storage cells 30A and a circuit board unit 72 . The power storage cells 30A are secondary batteries that can be repeatedly charged and discharged, and are specifically, for example, lithium ion secondary batteries. The circuit board unit 72 is disposed on the upper portion of the battery pack 30 .

[0068] The cover 74 closes the upper opening 77 of the main body 73. An outer peripheral wall 78 is provided around the cover 74. The cover 74 has a protrusion 79 that is substantially T-shaped in a plan view. A positive external terminal 80P is fixed to one corner of the front portion of the cover 74, and a negative external terminal 80N is fixed to the other corner.

[0069] like Figure 5A as well as Figure 5B As shown, the power storage cell 30A houses an electrode body 83 together with a non-aqueous electrolyte in a rectangular parallelepiped case 82. The case 82 includes a case body 84 and a lid 85 that closes an opening at the top thereof.

[0070] Although the details of the electrode body 83 are not shown in the figure, a separator made of a porous resin film is arranged between a negative electrode element (Japanese: element) formed by coating a negative electrode active material on a substrate formed of copper foil and a positive electrode element formed by coating a positive electrode active material on a substrate formed of aluminum foil. They are both in a strip shape, and the negative electrode element and the positive electrode element are respectively offset to opposite sides in the width direction relative to the separator, and are wound into a flat shape in a manner that can be accommodated in the case body 84.

[0071] The positive terminal 87 is connected to the positive electrode element via the positive electrode collector 86, and the negative terminal 89 is connected to the negative electrode element via the negative electrode collector 88. The positive electrode collector 86 and the negative electrode collector 88 are composed of a flat base portion 90 and a leg portion 91 extending from the base portion 90. A through hole is formed in the base portion 90. The leg portion 91 is connected to the positive electrode element or the negative electrode element. The positive terminal 87 and the negative terminal 89 are composed of a terminal body portion 92 and a shaft portion 93 protruding downward from the center portion of the lower surface thereof. Among them, the terminal body portion 92 and the shaft portion 93 of the positive terminal 87 are integrally formed of aluminum (single material). In the negative terminal 89, the terminal body portion 92 is made of aluminum and the shaft portion 93 is made of copper, and they are assembled. The terminal main bodies 92 of the positive electrode terminal 87 and the negative electrode terminal 89 are disposed at both ends of the cover 85 via gaskets 94 made of an insulating material, and are exposed to the outside from the gaskets 94 .

[0072] like Figure 5A As shown, the cover 85 has a pressure release valve 95. The pressure release valve 95 is located between the positive electrode terminal 87 and the negative electrode terminal 89. The pressure release valve 95 is released to reduce the internal pressure of the case 82 when the internal pressure of the case 82 exceeds a limit value.

[0073] (3) Electrical structure of power storage device

[0074] like Figure 6 As shown, the power storage device 2 includes a battery pack 30, a BMU 31 (Battery Management Unit), and a communication connector 32. The BMU 31 is an example of a management device.

[0075] The battery pack 30 is connected to the positive external terminal 80P via the power line 34P and to the negative external terminal 80N via the power line 34N. The battery pack 30 is composed of 12 power storage cells 30A connected in a manner of 3 in parallel and 4 in series. Figure 4 In FIG. 1 , three power storage cells 30A connected in parallel are represented by one battery symbol.

[0076] The BMU 31 is a device that manages the power storage device 2. The BMU 31 includes a current sensor 33, a voltage sensor 35, a first communication unit 36, and a management unit 37. The BMU 31 operates with the power supplied from the battery pack 30.

[0077] The current sensor 33 is provided on the power line 34N. The current sensor 33 measures the charge and discharge current [I] of the power storage cell 30A and outputs the measured current to the management unit 37 .

[0078] The voltage sensor 35 is connected to both ends of each power storage cell 30A. The voltage sensor 35 measures the voltage [V] of each power storage cell 30A and outputs the voltage to the management unit 37 .

[0079] The first communication unit 36 ​​is a circuit used by the management unit 37 to communicate with the in-vehicle ECU 10 .

[0080] The management unit 37 includes a microcomputer 37A and a storage unit 37B that are integrated with a CPU, a RAM, etc. The microcomputer 37A manages each part of the power storage device 2 by executing a control program (so-called firmware) stored in the storage unit 37B. The storage unit 37B has a non-volatile storage medium that can be repeatedly rewritten. The control program executed by the management unit 37 and various data are stored in the storage unit 37B. The various data include a predetermined pattern.

[0081] The communication connector 32 is a connector for the signal line 18 used by the connection management unit 37 to communicate with the in-vehicle ECU 10 .

[0082] (4) Communication between the vehicle ECU and the power storage device

[0083] The management unit 37 of the power storage device 2 communicates with the onboard ECU 10 via the first communication unit 36. Here, as an example of the communication between the management unit 37 and the onboard ECU 10, the onboard ECU 10 sends update firmware to the management unit 37 of the power storage device 2. The communication between the management unit 37 and the onboard ECU 10 is not limited to this, and is performed for an appropriate purpose.

[0084] The onboard ECU 10 receives the update firmware of the management unit 37 from the manufacturer of the power storage device 2 or the like via the third communication unit 22. The onboard ECU 10 transmits the received update firmware to the management unit 37 via the second communication unit 21. When the management unit 37 receives the update firmware, it updates the firmware stored in the storage unit 37B with the received update firmware.

[0085] Here, when receiving the update firmware from the vehicle-mounted ECU 10, the management unit 37 detects the pulse pattern generated in the charge and discharge current of the power storage cell 30A before receiving the update firmware, and determines whether the communication partner is a regular communication partner (i.e., the vehicle 3) for which a predetermined pattern is previously specified between the management unit 37 and the management unit 37, based on the detected pulse pattern. When the management unit 37 determines that the communication partner is the vehicle 3, the update firmware is received.

[0086] Reference Figure 2 Before sending the update firmware, the vehicle-mounted ECU 10 turns on / off the first FET 14 or the second FET 15 according to a predetermined pattern, thereby causing the charge and discharge current of the power storage cell 30A to generate the pulse pattern 25 .

[0087] The prescribed pattern is information indicating the pulse pattern 25, specifically, information indicating the number of pulses, pulse width, pulse interval, etc. The prescribed pattern can also be referred to as a password pattern. The pulse widths and pulse intervals of the plurality of pulses constituting the pulse pattern 25 may not be fixed. For example, a plurality of pulse widths may be mixed, and a plurality of pulse intervals may be mixed.

[0088] The predetermined pattern is preferably a pattern that cannot be easily produced (or imitated). For example, if a pulse pattern 25 is generated that is a complex combination of various pulse widths and various pulse intervals, it becomes difficult for a third party to estimate the pulse pattern 25, thereby further improving the robustness against network attacks.

[0089] The operation of the on-board ECU 10 to generate the pulse pattern 25 will be described in more detail. When the discharge current flows from the power storage cell 30A to the auxiliary machinery 11, the on-board ECU 10 turns on / off the first FET 14 to generate the pulse pattern 25 in the discharge current. Similarly, when the discharge current flows from the power storage cell 30A to the engine starter of the high voltage system 12, the on-board ECU 10 turns on / off the second FET 15 to generate the pulse pattern 25 in the discharge current. When the charging current flows from the vehicle generator of the high voltage system 12 to the power storage cell 30A, the on-board ECU 10 turns on / off the second FET 15 to generate the pulse pattern 25 in the charging current.

[0090] (5) Communication processing with the vehicle ECU

[0091] Reference Figure 7 The flow of the communication process with the vehicle-mounted ECU 10 executed by the management unit 37 will be described. Here, the communication for the vehicle-mounted ECU 10 to send the update firmware to the management unit 37 of the power storage device 2 will be described as an example. When the vehicle-mounted ECU 10 requests the management unit 37 to start communication, this process starts.

[0092] In step S101, the management unit 37 determines whether the requested communication is for sending updated firmware. If it is for sending updated firmware, the management unit 37 proceeds to S102, and if it is not for sending updated firmware, the management unit 37 ends the process. Figure 7 Although omitted in the description, if the communication is not for sending the updated firmware, the requested communication is performed separately after the present processing is completed.

[0093] In S102 , the management unit 37 shifts to a detection mode for detecting the pulse pattern 25 generated in the charge and discharge current of the power storage cell 30A.

[0094] In S103 , the management unit 37 notifies the in-vehicle ECU 10 via the first communication unit 36 ​​that the mode has shifted to the detection mode.

[0095] When the vehicle-mounted ECU 10 is notified of the transition to the detection mode, it turns on / off the first FET 14 or the second FET 15 according to a predetermined pattern, thereby causing the charge and discharge current of the power storage cell 30A to generate a pulse pattern 25 according to the predetermined pattern.

[0096] In S104, the management unit 37 repeatedly measures the current value through the current sensor 33 during a predetermined time (a time longer than the time required to generate the pulse pattern 25 of the charge and discharge current), and stores the measured current value in the RAM. The current value stored in the RAM may be only the current value of the most recent predetermined time. That is, the current value measured before the most recent predetermined time may also be deleted from the RAM.

[0097] In S105, the management unit 37 detects the pulse pattern generated in the charge and discharge current based on the multiple current values ​​stored in the RAM, and determines whether the detected pulse pattern is consistent with the specified pattern (an example of determination processing). If they are consistent, the management unit 37 determines that the communication object is a regular communication object and enters S106. If they are inconsistent, the management unit 37 determines that the communication object is not a regular communication object and ends the processing. In other words, the management unit 37 refuses to receive the firmware update.

[0098] In S106, the management unit 37 receives the update firmware from the vehicle-mounted ECU 10 via the first communication unit 36 ​​(an example of communication processing). This communication is performed in an encrypted manner.

[0099] (6) Effects of Implementation

[0100] According to the BMU 31 involved in the first embodiment, it is determined whether the pulse pattern 25 generated in the charge and discharge current of the power storage cell 30A is consistent with the prescribed pattern. In this way, the BMU 31 can determine whether the communication object is a regular communication object that has a prescribed pattern previously prescribed between the BMU 31. The network attack mainly invades from the first communication unit 36, so it is determined whether the communication object is a regular communication object based on the pulse pattern 25, and if it is not a regular communication object, the communication via the first communication unit 36 ​​is rejected, thereby improving the robustness against the network attack on the BMU 31. That is, by generating / using a prescribed pattern that cannot be easily reproduced and generated, a more secure system can be built.

[0101] According to the BMU 31 , by using both the pulse pattern 25 for generating the charge and discharge current of the power storage cell 30A and encryption of communication, the robustness of security is further improved.

[0102] According to the BMU 31, the determination process is performed before receiving the updated firmware (S105), and the updated firmware is received when it is determined to be consistent in the determination process. In other words, the BMU 31 receives the updated firmware after confirming that the transmission source of the updated firmware is a legitimate communication partner. In this way, the possibility of the firmware of the management unit 37 of the BMU 31 being tampered with can be reduced.

[0103] According to the power storage device 2 according to the first embodiment, whether or not the communication partner is a legitimate communication partner is determined based on the pulse pattern 25 generated in the charge and discharge current of the power storage cell 30A, thereby improving the robustness against the cyber attack on the BMU 31 .

[0104] According to the system 1 according to the first embodiment, whether or not the communication partner is a legitimate communication partner is determined based on the pulse pattern 25 generated in the charge and discharge current of the power storage cell 30A, thereby improving the robustness against the cyber attack on the BMU 31 .

[0105] <Implementation Method 2>

[0106] In the first embodiment described above, as an example of a case where the on-board ECU 10 requests communication from the management unit 37 of the power storage device 2, communication for the on-board ECU 10 to send updated firmware to the management unit 37 of the power storage device 2 is illustrated. In contrast, in the second embodiment, as an example of a case where the on-board ECU 10 requests communication from the management unit 37 of the power storage device 2, communication for an external diagnostic device (hereinafter referred to as an external diagnostic device) connected to the vehicle 3 to diagnose whether the BMU 31 has a fault via the on-board ECU 10 is illustrated. The external diagnostic device is an example of a device that exchanges signals with the management device.

[0107] The vehicle 3 is provided with a connector for connecting an external diagnostic device. When the external diagnostic device diagnoses whether the BMU 31 has a fault, it is connected to the connector via a communication cable. The connector is connected to the vehicle-mounted ECU 10. The external diagnostic device communicates with the management unit 37 via the vehicle-mounted ECU 10. That is, the vehicle-mounted ECU 10 relays the communication between the external diagnostic device and the management unit 37.

[0108] The communication flow between the vehicle-mounted ECU 10 and the management unit 37 according to the second embodiment is substantially the same as that of the first embodiment except that the external diagnostic device is used to diagnose whether the BMU 31 has a fault, so the description thereof is omitted.

[0109] According to the BMU 31 of the second embodiment, the determination process (S105) is performed before the diagnosis by the external diagnostic device is accepted via the first communication unit 36, and the diagnosis by the external diagnostic device is accepted when the determination process determines that the information is consistent (S106). In this way, the possibility of the information of the management unit 37 of the BMU 31 being illegally acquired can be reduced.

[0110] <Implementation Method 3>

[0111] pass Figure 8 Implementation method 3 is described.

[0112] In the above-mentioned first and second embodiments, the management unit 37 detects the pulse pattern 25 each time when performing communication (communication for sending firmware update by the vehicle-mounted ECU 10 or communication for diagnosing whether the BMU 31 has a fault) to determine whether the communication partner is a regular communication partner. In contrast, the management unit 37 involved in the third embodiment determines whether the pulse pattern 25 is consistent with the prescribed pattern only when the communication is performed for the first time after the power storage device 2 is mounted on the vehicle 3. If it is consistent, the management unit 37 communicates with the vehicle-mounted ECU 10 without determining whether the pulse pattern 25 is consistent with the prescribed pattern in the second and subsequent communications.

[0113] The flow when communicating with the vehicle-mounted ECU 10 for the first time is substantially the same as the flow in the first embodiment or the second embodiment, and therefore the description thereof will be omitted.

[0114] Reference Figure 8 Here, the communication flow after the second communication is described. Here, the communication of the vehicle-mounted ECU 10 to send the update firmware to the management unit 37 of the power storage device 2 is illustrated. Figure 8 As shown, S102 to S105 are not executed in the second and subsequent communications. Therefore, the BMU 31 receives the update firmware from the vehicle-mounted ECU 10 without detecting the pulse pattern 25 ( S106 ).

[0115] According to the BMU 31 according to the third embodiment, the determination process is executed when communicating with the vehicle 3 for the first time (S105), and if it is determined to be consistent in the determination process, the determination process is not executed in the second and subsequent communications, thereby shortening the time required for the second and subsequent communications.

[0116] <Implementation Method 4>

[0117] In the fourth embodiment, the BMU 31 generates a predetermined pattern at a certain timing. The certain timing may be, for example, a regular timing, or when a predetermined pattern generation signal is received from the vehicle-mounted ECU 10, or when a user has a request to generate a predetermined pattern, or when a certain threat (data interference, intrusion, data rewriting, etc.) is detected. Here, the case where a predetermined pattern generation signal is received from the vehicle-mounted ECU 10 is used as an example for explanation.

[0118] When the in-vehicle ECU 10 communicates with the BMU 31 (for example, when updating firmware is sent to the BMU 31 ), the in-vehicle ECU 10 sends a predetermined pattern generation signal to the BMU 31 .

[0119] Upon receiving the predetermined pattern generation signal, the BMU 31 generates a predetermined pattern, replaces the existing predetermined pattern with the generated predetermined pattern (ie, changes the predetermined pattern), and then transmits the replaced predetermined pattern to the in-vehicle ECU 10 .

[0120] When the vehicle-mounted ECU 10 receives the predetermined pattern from the BMU 31 , it generates a pulse pattern in the charge and discharge current based on the received predetermined pattern.

[0121] According to the BMU 31 according to the fourth embodiment, by generating a predetermined pattern, the predetermined pattern can be replaced (that is, the predetermined pattern can be changed). This further improves the robustness against a network attack on the BMU 31 compared to a case where the predetermined pattern is fixed to one.

[0122] <Other Implementation Methods>

[0123] The present invention is not limited to the embodiments described in the above description and drawings, and for example, the following embodiments are also included in the technical scope of the present invention.

[0124] (1) In the above embodiment, the pulse pattern 25 (ie, the predetermined pattern) for generating the charge and discharge current is used together with encryption of the communication. However, the communication may not be encrypted.

[0125] (2) In the above embodiment, the vehicle 3 is exemplified as a device to which electric power is supplied from the power storage cell 30A or a device to charge the power storage cell 30A. However, the device is not limited to the vehicle 3 and may be another device.

[0126] (3) In the above embodiment, the prescribed pattern is only one pattern, but the prescribed pattern may be multiple. The multiple prescribed patterns may be used in sequence, may be used separately according to the communication content, or may be selected according to a certain rule. The prescribed pattern generated by a rolling code (an electronic code composed of multiple elements whose combination changes irregularly every time the transmission unit is operated) may be further changed.

[0127] (4) In the above embodiment, the vehicle 3 includes the first FET 14 and the second FET 15 , but the vehicle 3 may include a relay instead of the FET.

[0128] (5) In the above embodiment, the vehicle 3 is exemplified as the device. The vehicle 3 is a device that is supplied with power from the power storage cell 30A and is a device that charges the power storage cell 30A. In contrast, the device may be a device that is supplied with power from the power storage cell 30A but does not charge the power storage device 2, or a device that charges the power storage cell 30A but does not supply power from the power storage device 2.

[0129] In the above embodiment, the case where the vehicle-mounted ECU 10 requests communication from the management unit 37 is illustrated, but the management unit 37 may also request communication from the vehicle-mounted ECU 10. For example, the management unit 37 may also request communication from the vehicle-mounted ECU 10 for notifying the vehicle-mounted ECU 10 of the state of the power storage device 2. In this case, after requesting communication from the vehicle-mounted ECU 10, the management unit 37 shifts to the detection mode. The vehicle-mounted ECU 10 to which communication is requested generates a pulse pattern in the charge and discharge current of the power storage unit 30A. The management unit 37 detects the pulse pattern, and when the detected pulse pattern is consistent with the prescribed pattern, the state of the power storage device 2 is notified to the vehicle-mounted ECU 10.

[0130] (7) In the above embodiment, the lithium ion secondary battery is used as an example of the power storage cell 30A. However, the power storage cell 30A may be a capacitor accompanied by an electrochemical reaction.

[0131] (8) In the above embodiment, the case where the determination of whether the communication partner is a legitimate party is described based on the pulse pattern generated in the charge and discharge current of the power storage cell 30A. However, the method of determining whether the communication partner is a legitimate party is not limited to this.

[0132] For example, the BMU 31 may include a temperature sensor for measuring the temperature of the power storage cell 30A, and the vehicle-mounted ECU 10 may generate a signal pattern (a 0 / 1 signal or a certain duty ratio (duty) signal) corresponding to a predetermined pattern in the output signal of the temperature sensor. The temperature sensor is not limited to a sensor for measuring the temperature of the power storage cell 30A, and may be a sensor for detecting the temperature of the housing 71 of the power storage device 2. The temperature sensor may be arranged inside or outside the housing 71.

[0133] The in-vehicle ECU 10 may generate a signal pattern in the output signal of the voltage sensor 35 of the power storage cell 30A.

[0134] All or part of the communication signal (request signal or response signal) between the vehicle-mounted ECU 10 and the BMU 31, a mirror value, a checksum value, or other judgment values ​​may be used as a prescribed pattern (used as a prescribed pattern itself or added to an existing prescribed pattern).

[0135] (9) In the fourth embodiment, the BMU 31 replaces the existing prescribed pattern with the generated prescribed pattern. However, all or part of the generated prescribed pattern may be added to the existing prescribed pattern.

[0136] The generated predetermined pattern may be an analog signal instead of a digital signal. Furthermore, the BMU 31 may convert the analog signal into a digital signal and set it as the predetermined pattern. Alternatively, a signal accidentally superimposed with noise may be generated as the predetermined pattern regardless of whether it is a digital signal or an analog signal.

[0137] (10) In the above embodiment, the case where the BMU 31 detects both the pulse pattern generated in the charging current and the pulse pattern generated in the discharging current is exemplified. In contrast, the BMU 31 may detect only the pulse pattern generated in the charging current or only the pulse pattern generated in the discharging current. That is, the so-called detection of the pulse pattern generated in the charging and discharging current of the power storage cell 30A includes not only the case of detecting both the pulse pattern generated in the charging current and the pulse pattern generated in the discharging current, but also the case of detecting only the pulse pattern generated in the charging current and the case of detecting only the pulse pattern generated in the discharging current.

[0138] Description of Reference Numerals

[0139] 1: system; 2: power storage device; 3: vehicle (an example of a device); 10: vehicle-mounted ECU (an example of a pulse generating unit); 14: first FET (an example of a pulse generating unit); 15: second FET (an example of a pulse generating unit); 21: second communication unit; 25: pulse pattern; 30A: power storage cell; 31: BMU (an example of a management device); 33: current sensor; 36: first communication unit; 37: management unit.

Claims

1. A management device for managing a power storage cell, the management device comprising: A current sensor for measuring the charge and discharge current of the power storage monomer; a first communication unit that communicates with at least one of a device to which power is supplied from the power storage cell, a device that charges the power storage cell, and a device that exchanges signals with the management device; as well as Management Department, The management department performs: a determination process of detecting a pulse pattern generated in the charge and discharge current of the power storage cell by the current sensor and determining whether the detected pulse pattern is consistent with a predetermined pattern; as well as The communication process is to communicate with the device via the first communication unit when it is determined in the determination process that the two devices are consistent.

2. The management device according to claim 1, wherein: The management unit performs encrypted communication with the device via the first communication unit.

3. The management device according to claim 1 or claim 2, wherein: When the management unit receives updated firmware of the management unit from the device via the first communication unit, the management unit performs the determination process before receiving the updated firmware, and when a consistency is determined in the determination process, the management unit receives the updated firmware from the device via the first communication unit during the communication process.

4. The management device according to claim 1 or claim 2, wherein: When the management unit accepts a diagnosis based on an external diagnostic device via the first communication unit, the management unit performs the determination process before accepting the diagnosis based on the external diagnostic device, and when a consistency is determined in the determination process, the management unit accepts the diagnosis based on the external diagnostic device via the first communication unit during the communication process, wherein the external diagnostic device diagnoses whether the management unit has any abnormality.

5. The management device according to claim 1 or claim 2, wherein: The management unit executes the determination process when communicating with the device for the first time, and if a match is determined in the determination process, communicates with the device via the first communication unit without executing the determination process in second and subsequent communications.

6. An electric storage device comprising: power storage monomer; and The management device according to claim 1 or claim 2 manages the power storage cells.

7. A system comprising: The power storage device according to claim 6; and a device, which is at least one of a device to which power is supplied from the power storage device, a device to charge the power storage device, and a device to exchange signals with the management device, and has a second communication unit for communicating with the management device, The device includes a pulse generating unit that generates a pulse pattern corresponding to the predetermined pattern in the charge and discharge current of the power storage device.

8. A communication method, which is a communication method of a management device for managing a power storage cell, the communication method comprising: a determination step of detecting a pulse pattern generated in the charge and discharge current of the power storage unit by a current sensor, and determining whether the detected pulse pattern is consistent with a prescribed pattern; and A communication step of communicating with the device via the first communication unit when it is determined in the determination step that the two devices are consistent.

9. A communication method, which is a communication method between a management device for managing a power storage cell and another device, the method comprising: a generating step, wherein the device causes the charge and discharge current of the power storage monomer to generate a pulse pattern corresponding to a prescribed pattern; a determination step, wherein the management device detects a pulse pattern generated in the charge and discharge current of the power storage unit by a current sensor, and determines whether the detected pulse pattern is consistent with the specified pattern; as well as A communication step, when it is determined in the determination step that they are consistent, the device communicates with the management device.

10. A communication method, which is a communication method of a management device for managing a power storage cell, the communication method comprising: a determination step of detecting a pulse pattern generated in the charge and discharge current of the power storage unit by a current sensor, and determining whether the detected pulse pattern is consistent with a prescribed pattern; a communication step of communicating with the device via a first communication unit when the determination step determines that the device is consistent with the first communication unit; as well as The generating step generates the prescribed pattern.

Images