Function safety system of battery management system of vehicle and vehicle

Abstract

The invention provides a function safety system of a battery management system of a vehicle and the vehicle. The functional safety system includes: an input module configured to provide a control signal of a battery relay; the control module comprises a relay control unit which is configured to generate a relay control instruction based on the control signal; and the execution module is configured to control closing and opening of the relay in response to the relay control instruction. The input module includes a first input unit and a second input unit configured to provide a first control signal and a second control signal, respectively, and the control module is configured to generate a relay control instruction based on at least one of the first control signal and the second control signal. According to the functional safety system of the battery management system, the two input units are configured, when the battery management system is reset abnormally and one input unit cannot provide a control signal, the other input unit can provide the control signal, the relay is kept in a controllable state, and the safety of a vehicle is improved.

Description

Technical Field

[0001] The present invention relates to the field of vehicles, and particularly to the field of battery management systems for vehicles. More specifically, the present invention relates to a functional safety system for a battery management system of a vehicle and a vehicle applying the functional safety system. Background Art

[0002] Currently, new energy vehicles are increasingly appearing in life, and the related technologies are also developing rapidly. New energy vehicles use batteries as the power source, and a battery management system (BMS for short) is usually used to manage various operations of the battery. For example, the closing or opening of battery relays. However, the software of the BMS may experience abnormal reset due to software program errors, hardware failures, system interruptions, etc. When the software of the BMS undergoes abnormal reset, the BMS will be unable to manage the battery, and the battery relay may lose control and open, which will cause the vehicle to lose power and be unable to drive normally. If this occurs during the driving process of the vehicle, it will increase the risk of traffic accidents.

[0003] Therefore, it is necessary to improve the safety performance of the battery management system of the vehicle. Summary of the Invention

[0004] The object of the present invention is to solve the problems existing in the above-mentioned prior art, and to provide a functional safety system for a battery management system of a vehicle, which can improve the safety performance of the battery management system of the vehicle in a cost-effective and reliable manner.

[0005] To this end, according to one aspect of the present invention, there is provided a functional safety system for a battery management system of a vehicle. The functional safety system includes: an input module configured to provide a control signal for a battery relay of the vehicle, the control signal including a closing signal and an opening signal; a control module including a relay control unit configured to generate a relay control instruction based on the control signal; an execution module configured to control the closing and opening of the battery relay in response to the relay control instruction, wherein the input module includes a first input unit and a second input unit configured to provide a first control signal and a second control signal respectively, and the control module is configured to generate the relay control instruction based on at least one of the first control signal and the second control signal.

[0006] According to the above technical concept, the present invention may further include any one or more of the following optional forms.

[0007] In some alternative forms, the first input unit is provided with a monitoring unit configured to receive monitoring signals from the second input unit at a preset frequency to monitor the operating state of the second input unit.

[0008] In some alternative forms, the first input unit is configured such that when the monitoring unit receives the monitoring signal from the second input unit at the preset frequency, the first input unit sends a first closing signal.

[0009] In some alternative forms, the first input unit is further configured such that when the monitoring unit does not receive the monitoring signal from the second input unit within a preset time, the first input unit sends a first opening signal.

[0010] In some alternative forms, the monitoring signal from the second input unit is a second closing signal.

[0011] In some alternative forms, the monitoring unit is a timer.

[0012] In some alternative forms, the second input unit includes a storage unit configured to store operating parameters required by the battery management system.

[0013] In some alternative forms, the operating parameters at least include at least one of relay status information, vehicle status information, and battery pack status information.

[0014] In some alternative forms, the storage unit is a random access memory provided with an initial area where the operating parameters are stored, and the initial area is configured to retain the operating parameters stored therein when the battery management system is reset.

[0015] In some alternative forms, the first input unit is configured to supply power to the second input unit and the control module.

[0016] In some alternative forms, the first input unit is a system basis chip and the second input unit is a microcontroller unit.

[0017] In some alternative forms, the execution module includes a high-side driver and a low-side driver configured to control the closing and opening of the battery relay based on the relay control instruction.

[0018] According to another aspect of the present invention, there is provided a vehicle including a functional safety system of the battery management system of the vehicle as described above.

[0019] The functional safety system of the battery management system of the present invention configures two input units. When the battery management system is abnormally reset and one of the input units cannot provide a control signal, the other input unit can provide a control signal to keep the battery relay in a controllable state, improving the safety of the vehicle. Brief Description of the Drawings

[0020] Other features and advantages of the present invention will be better understood through the following alternative embodiments described in detail in conjunction with the drawings, where:

[0021] Figure 1 A schematic diagram of a functional safety system according to an embodiment of the present invention is shown. Detailed Embodiments

[0022] The implementation and use of the embodiments will be discussed in detail below. However, it should be understood that the specific embodiments discussed are merely illustrative of specific ways of implementing and using the present invention, and do not limit the scope of the present invention.

[0023] Generally, in the electrical design of the BMS, the component for driving the closing or opening of the battery relay receives a control signal from a microcontroller unit (MCU). The inventor found that when a software fault, abnormality, or system restart is required in the BMS software, the MCU in the BMS will perform a software reset, which will cause the MCU to restart and reload the program. The MCU will lose its original function. At this time, the MCU may not be able to provide the control signal for the battery relay, and the battery relay will open.

[0024] Referring to Figure 1 , Figure 1 is a schematic diagram of a functional safety system according to an embodiment of the present invention.

[0025] A functional safety system 100 according to an embodiment of the present invention generally includes an input module 110, a control module 120, and an execution module 130. The input module 110 is configured to provide control signals for a battery relay of a vehicle, and the control signals may include a closing signal and an opening signal respectively for controlling the closing and opening of the battery relay. The control module 120 includes a relay control unit 121, and the relay control unit 121 receives the control signals from the input module 110 and generates corresponding relay control instructions based on the control signals. The execution module 130 is configured to receive the relay control instructions from the control module 120 and control the closing and opening of the battery relay in response to the relay control instructions. Additionally, the input module 110 includes a first input unit 111 and a second input unit 112. The first input unit 111 is configured to provide a first control signal for the battery, and the first control signal includes a first closing signal and a first opening signal. The second input unit 112 is configured to provide a second control signal for the battery, and the second control signal includes a second closing signal and a second opening signal. The control module 120 generates relay control instructions based on at least one of the first control signal from the first input unit 111 and the second control signal from the second input unit 112 to control the state of the battery relay.

[0026] In this way, the first input unit 111 and the second input unit 112 can be redundant to each other, and the control module 120 can generate relay control instructions based on the first control signal or the second control signal or both the first control signal and the second control signal, so that when one input unit fails, the other input unit can normally provide control signals, maintaining the battery relay closed during system abnormal reset. Thus, the vehicle will always have power support and can be driven normally, improving the safety and reliability of the vehicle.

[0027] In some embodiments, the first input unit 111 may be a System Basis Chip (SBC), and the second input unit 112 may be an MCU. As one of the core components of the BMS, the SBC may include special functions and interfaces related to the BMS. Using the SBC as a redundant component of the MCU can more easily achieve an integrated design and reduce the complexity of the hardware and software integration of the BMS. During operation, the SBC may send a first closing signal (Contactor Command_SBC = 1) or a first opening signal (Contactor Command_SBC = 0), and the MCU may send a second closing signal (Contactor Command_MCU = 1) or a second opening signal (Contactor Command_MCU = 0). The relay control unit 121 analyzes the control signals from the SBC and the MCU and generates a relay closing instruction (ContactorCommand = 1) or a relay opening instruction (Contactor Command = 0). The specific relationships among the first control signal, the second control signal, and the relay control instruction are shown in Table 1.

[0028] Table 1 Relationships among the first control signal, the second control signal, and the relay control instruction

[0029]

[0030]

[0031] It can be understood that the first input unit 111 is not limited thereto, and other components can also be selected as needed. For example, two independent MCUs, namely a main MCU and a standby MCU, can be configured in the BMS. When the main MCU is reset, the standby MCU can operate to maintain the functions of the BMS.

[0032] Generally, the SBC is provided with multiple interfaces, including a power interface. Therefore, the user can connect the SBC to an external power supply, and the external power supply provides the power required for the operation of the SBC. The SBC can also supply the power from the external power supply to other components of the system through its power interface. In some embodiments, the SBC can supply power to the MCU and the control module 120, that is, the first input unit 111 can supply power to the second input unit 112 and the relay control unit 121. In this way, the power management of the BMS system can be simplified, the complexity of wiring can be reduced, and the maintenance of the system can be made more convenient.

[0033] As Figure 1As shown, in this embodiment, the first input unit 111 may be configured with a monitoring unit 113. During operation, the second input unit 112 may send a monitoring signal to the monitoring unit 113 of the first input unit 111 at a preset frequency. The monitoring unit 113 monitors the operating state of the second input unit 112 based on this monitoring signal. Herein, the preset frequency may be, for example, 10 ms. Specifically, when the monitoring unit 113 receives the monitoring signal sent by the second input unit 112 at the preset frequency, it indicates that the second input unit 112 is in a normal operating state. At this time, the first input unit 111 operates normally and sends a first closing signal.

[0034] In addition, when the monitoring unit 113 does not receive the monitoring signal sent by the second input unit 112 within a preset time, it indicates that the second input unit 112 is in an abnormal state. Herein, the preset time may be, for example, 1000 ms. At this time, the first input unit 111 will detect this abnormality and send a first disconnection signal to disconnect the battery relay, preventing the BMS from operating in an abnormal state. In some embodiments, the monitoring signal sent by the second input unit 112 may be a second closing signal for controlling the closing of the battery relay. During the operation of the vehicle, the BMS usually needs to control the battery relay to close to provide power for the vehicle. At this time, the second input unit 112 may send the second closing signal to both the relay control unit 121 and the monitoring unit 113. The relay control unit 121 outputs a relay closing instruction based on this second closing signal, and the monitoring unit 113 detects that the second input unit 112 is in a normal operating state based on this second closing signal. In this way, the reliability and safety of the system are improved.

[0035] In some embodiments, the monitoring unit 113 may be a timer. In this case, the second input unit 112 will regularly refresh the timer at a preset frequency. When the timer is not refreshed within a preset time, the data of the timer will gradually increase. When the data of the timer increases to a preset threshold, the first input unit 111 will detect the abnormality of the timer. At this time, the first input unit 111 will send a control signal to disconnect the battery relay, powering off the system with abnormal operation to ensure the safety of the system.

[0036] Continue to refer to Figure 1, a storage unit 114 may also be configured in the second input unit 112, and the storage unit 114 is used to store some important operating parameters required by the BMS. The operating parameters may include: relay status information (e.g., pre-charging of the relay, fast charging information, etc.), BMS and / or vehicle status information (e.g., charging gun mode, parking mode, driving mode, etc.), fault status, battery pack status information (e.g., voltage value, current value, temperature value, etc.), vehicle speed, wake-up request from the vehicle (the request is transmitted via the CAN bus), wake-up line status (the status is transmitted via a wire), etc.

[0037] In some embodiments, the storage unit 114 may be a Random Access Memory (RAM). An initial area may be configured in the RAM, and the operating parameters required by the BMS are stored in the initial area. The RAM may be configured to retain the operating parameters stored in the initial area when the BMS is reset. Specifically, a specific initial area may be allocated in the address space of the RAM, and this area is used to store key parameters. When the BMS is reset, the key parameters of the system may change. At this time, the RAM writes these key parameters into the above-mentioned initial area to ensure that the key parameters are not cleared when the BMS is reset. After the BMS reset is completed, the data in the initial area is checked. If it is found that the data in the initial area is not the default value, the system may load this data into the corresponding parameters to restore the previous state. In this way, the BMS can return to the previous state after the reset is completed, so as to reduce the impact of the BMS reset on the vehicle and the user.

[0038] In Figure 1 , the execution module 130 may include a High Side Driver (HSD) 131 and a Low Side Driver (LSD) 132, and the closing and opening of the battery relay are jointly controlled by the HSD 131 and the LSD 132. Using this hybrid drive method, if one of the drivers fails, the system can still use the other driver to work normally, improving the flexibility of the system.

[0039] The functional safety system of the battery management system of the present invention is provided with two input units, namely SBC and MCU. When the MCU performs a software reset of the battery management system, the SBC can normally provide the control signal for the battery relay, keeping the battery relay in a controllable state during vehicle driving. In addition, the MCU of the battery management system of the present invention needs to complete the reset within a certain time (for example, 300 ms) to prevent other controllers in the vehicle (such as the steering controller, seat controller, door handle controller, etc.) from reporting errors due to not receiving signals sent by the MCU of the battery management system for a long time, further ensuring the safety performance of the vehicle.

[0040] It should be understood that the embodiments shown in the figures only show the optional configuration modes of the functional safety system of the battery management system of the vehicle according to the present invention. However, they are only illustrative and not restrictive. Other configuration modes can also be adopted without departing from the idea and scope of the present invention.

[0041] The technical content and features of the present invention have been disclosed above. However, it can be understood that under the creative concept of the present invention, those skilled in the art can make various changes and improvements to the above-disclosed concept, but they all fall within the protection scope of the present invention. The description of the above embodiments is illustrative rather than restrictive, and the protection scope of the present invention is determined by the claims.

Claims

1. A functional safety system for a battery management system of a vehicle, Characterized in that, The functional safety system (100) includes: An input module (110), the input module (110) is configured to provide a control signal for a battery relay of the vehicle, and the control signal includes a closing signal and an opening signal; A control module (120), the control module (120) includes a relay control unit (121), and the relay control unit (121) is configured to generate a relay control instruction based on the control signal; An execution module (130), the execution module (130) is configured to control the closing and opening of the battery relay in response to the relay control instruction, Wherein, the input module (110) includes a first input unit (111) and a second input unit (112), the first input unit (111) and the second input unit (112) are configured to provide a first control signal and a second control signal respectively, and the control module (120) is configured to generate the relay control instruction based on at least one of the first control signal and the second control signal.

2. The functional safety system according to claim 1, Characterized in that, The first input unit (111) is provided with a monitoring unit (113), and the monitoring unit (113) is configured to: receive a monitoring signal from the second input unit (112) at a preset frequency to monitor the working state of the second input unit (112).

3. The functional safety system according to claim 2, Characterized in that, The first input unit (111) is configured to: when the monitoring unit (113) receives the monitoring signal from the second input unit (112) at the preset frequency, the first input unit (111) sends a first closing signal.

4. The functional safety system according to claim 2, Characterized in that, The first input unit (111) is further configured to: when the monitoring unit (113) does not receive the monitoring signal from the second input unit (112) within a preset time, the first input unit (111) sends a first opening signal.

5. The functional safety system according to claim 2, Characterized in that, The monitoring signal from the second input unit (112) is a second closing signal.

6. The functional safety system according to claim 2, Characterized in that, The monitoring unit (113) is a timer.

7. The functional safety system according to claim 1, Characterized in that, The second input unit (112) includes a storage unit (114), and the storage unit (114) is configured to store working parameters required by the battery management system.

8. The functional safety system according to claim 7, Characterized in that, The working parameters at least include: at least one of relay status information, vehicle status information, and battery pack status information.

9. The functional safety system according to claim 7, Characterized in that, The storage unit (114) is a random access memory, the random access memory is provided with an initial area, the operating parameters are stored in the initial area, and the random access memory is configured to maintain the storage of the operating parameters in the initial area when the battery management system is reset.

10. The functional safety system according to claim 1, wherein, the first input unit (111) is configured to supply power to the second input unit (112) and the control module (120).

11. The functional safety system according to any one of claims 1 to 10, wherein, the first input unit (111) is a system basis chip, and the second input unit (112) is a micro control unit.

12. The functional safety system according to any one of claims 1 to 10, wherein, the execution module (130) includes a high-side driver (131) and a low-side driver (132), and the high-side driver (131) and the low-side driver (132) are configured to control the closing and opening of the battery relay based on the relay control instruction.

13. A vehicle, wherein, the vehicle includes a battery management system, and the battery management system is configured with the functional safety system of the battery management system of the vehicle according to any one of claims 1 to 12.

Images