Battery system

Abstract

The invention provides a battery system capable of efficiently executing safe startup. A storage unit (51) of a battery system (1) stores a startup program (PG1) relating to startup of a measurement unit (30), a measurement program (PG2) relating to measurement, and a state calculation program (PG3) relating to calculation of the battery state of a battery cell (12) in a divided manner. The control device (50) executes a first secure boot for a first program including a boot program (PG1), and then executes a process included in the first program. During the execution of the processing of the first program, a second secure boot is executed for a second program including the measurement program (PG2) or the state calculation program (PG3). After the processing of the first program is executed and the second secure boot is executed, the processing included in the second program is executed.

Description

Technical Field

[0001] This invention relates to battery systems. Background Technology

[0002] For example, Japanese Patent Application Publication No. 2023-87987 discloses an electronic control device for performing secure startup. In this electronic control device, the target area for secure startup is divided into at least a first segmented region and a second segmented region. A portion of the verification process for the first segmented region is performed by a hardware security module, and the entire verification process for the second segmented region is performed by an arithmetic unit capable of performing computational processing. At this time, a portion of the verification process for the first segmented region and the entire verification process for the second segmented region are performed in parallel.

[0003] For example, Japanese Patent Application Publication No. 2023-117789 discloses a safety start device that performs a safety start. This safety start device includes a determination unit and a control unit. The determination unit performs a safety start relative to a verification target program and determines the matching of the verification target program. The control unit causes the verification target program determined by the determination unit to be matched to be executed. The determination unit and the execution of the verification target program by the control unit simultaneously determine the matching of verification target programs among multiple verification target programs whose matching has not been determined.

[0004] Patent Document 1: Japanese Patent Application Publication No. 2023-87987

[0005] Patent Document 2: Japanese Patent Application Publication No. 2023-117789

[0006] However, the inventors of this application considered performing a safe start relative to the battery program required for calculating the state of the battery cells, such as the SOC, connected to the load. When performing a safe start relative to this battery program using the electronic control device disclosed in Japanese Patent Application Publication No. 2023-87987 or the safe start device disclosed in Japanese Patent Application Publication No. 2023-117789, there is a situation where the execution time of the safe start becomes longer. Summary of the Invention

[0007] The battery system disclosed herein includes a battery cell, a measurement unit, and a control device. The measurement unit includes a voltage measurement unit for measuring the voltage of the battery cell, a current measurement unit for measuring the current of the battery cell, and a temperature measurement unit for measuring the temperature of the battery cell. The control device includes a storage unit, a first safety start execution unit, a first processing execution unit, a second safety start execution unit, and a second processing execution unit. The storage unit stores a start-up program, a measurement program, and a state calculation program. The start-up program is related to the process of starting the measurement unit. The measurement program is related to the measurement processing of measuring the voltage, current, and temperature of the battery cell using the measurement unit. The state calculation program is related to the calculation processing of calculating the battery state of the battery cell based on at least one of the battery voltage, current, and temperature measured by the measurement processing. The first safety start execution unit performs a safety start for a first program that includes at least the start-up program. After the security startup based on the first security startup execution unit is executed, the first processing execution unit executes the processing included in the first program. During the execution of the processing based on the first processing execution unit, the second security startup execution unit executes a security startup for a second program including at least one of the measurement program and the state calculation program. After the processing based on the first processing execution unit is executed and the security startup based on the second security startup execution unit is executed, the second processing execution unit executes the processing included in the second program.

[0008] According to the battery system disclosed herein, the battery state of a single cell is calculated by sequentially executing a startup process, a measurement process, and a calculation process during startup. Therefore, a safe startup is performed for a first program that includes at least a startup procedure related to the initially executed startup process, and the processes contained in the first program are executed. At this time, a safe startup is performed in parallel with the execution of the processes contained in the first program for a second program that includes at least one of a measurement procedure and a state calculation procedure. Therefore, considering the processing order required for calculating the battery state, the program is divided into a first program and a second program, and the processes contained in the first program and the safe startup for the second program are executed in parallel, thus shortening the execution time required for a safe startup. Attached Figure Description

[0009] Figure 1 This is a schematic diagram illustrating the battery system according to the first embodiment.

[0010] Figure 2 This is a diagram showing the processing involved in calculating the state of a single battery cell.

[0011] Figure 3 This is a diagram showing the first and second procedures of the first embodiment.

[0012] Figure 4 This is a timing diagram showing the control sequence during startup of the battery system in the first embodiment.

[0013] Figure 5 The diagram shows the first and second procedures of a modified example of the first embodiment.

[0014] Figure 6 This is a diagram illustrating the first and second procedures of the second embodiment.

[0015] Figure 7 This is a block diagram showing the control device of the battery system according to the second embodiment.

[0016] Figure 8 This is a timing diagram showing the control sequence during startup of the battery system in the second embodiment.

[0017] Explanation of reference numerals in the attached figures

[0018] 1, 1A...Battery system; 12...Battery cell; 30...Measurement unit; 31...Voltage measurement unit; 32...Current measurement unit; 33...Temperature measurement unit; 50, 50A...Control device; 51...Storage unit; 61, 61A...First safety start execution unit; 62, 62A...Second safety start execution unit; 63, 63A...First processing execution unit; 64, 64A...Second processing execution unit; 71...First front safety start execution unit; 72...First rear safety start execution unit; 81...First pre-processing execution unit; 82...First post-processing execution unit; PG1. ...Startup program; PG11...Voltage startup program; PG12...Current startup program; PG13...Temperature startup program; PG2...Measurement program; PG3...State calculation program; PG4...Communication program; PG5...Fault diagnosis program; PG51, PG51A...Program 1; PG52, PG52A...Program 2; PG61...First pre-program; PG62...First post-program; S1...Startup processing; S11...Voltage startup processing; S12...Current startup processing; S13...Temperature startup processing; S2...Measurement processing; S3...Calculation processing. Detailed Implementation

[0019] Hereinafter, an embodiment of the technology disclosed herein will be described with reference to the accompanying drawings. Furthermore, the embodiments described herein are not intended to specifically limit the invention. The figures are schematic diagrams and do not necessarily faithfully represent actual embodiments. In addition, components and parts that perform the same function are appropriately labeled with the same reference numerals, and repeated descriptions are appropriately omitted.

[0020] <First Embodiment>

[0021] Figure 1 This is a conceptual diagram illustrating the battery system 1 according to the first embodiment. (Example) Figure 1 As shown, the battery system 1 includes battery cells 12. Battery cells 12 are capable of charging and discharging. For example, a secondary battery can be used as the battery cell 12. A secondary battery, for example, can be repeatedly charged and discharged by the movement of a charge carrier between a pair of electrodes (e.g., positive and negative electrodes) via an electrolyte. For example, a lithium-ion secondary battery or a nickel-metal hydride battery can be used as the battery cell 12. In this embodiment, the battery cell 12 is a lithium-ion secondary battery. Furthermore, the number of battery cells 12 constituting the battery system 1 is not particularly limited and is a predetermined number. In this embodiment, the battery system 1 includes multiple battery cells 12. Here, the multiple battery cells 12 constitute a battery pack 10. In the battery pack 10, the multiple battery cells 12 are connected in series. Here, the multiple battery cells 12 are connected in series via a busbar (not shown). However, the multiple battery cells 12 can also be connected in parallel.

[0022] In battery system 1, multiple battery cells 12 (in other words, battery pack 10) are connected to a load 5. Power is supplied to the load 5 from the multiple battery cells 12. The load 5 is not particularly limited. The load 5 may be, for example, a drive device such as an electric motor of a vehicle or an inverter. A smoothing capacitor for reducing abrupt changes in current may also be connected to the load 5. Here, battery system 1 is, for example, a system for use in vehicles such as hybrid electric vehicles, plug-in hybrid electric vehicles, or electric vehicles. In this case, the battery pack 10 of battery system 1 is used as a power source to supply power to the electric motor that drives the vehicle. However, battery system 1 is not limited to vehicle use. In addition, in this embodiment, the number of battery cells 12 constituting battery system 1 can be appropriately set according to the amount of power supplied to the load 5.

[0023] In this embodiment, such as Figure 1 As shown, the battery system 1 includes a measurement unit 30 and a control device 50. The measurement unit 30 measures parameters related to the battery cell 12. Here, the measurement unit 30 measures the parameters used to calculate the battery state of the battery cell 12. The types of specific parameters measured by the measurement unit 30 are not particularly limited.

[0024] In this embodiment, the measuring unit 30 includes a voltage measuring unit 31, a current measuring unit 32, and a temperature measuring unit 33. The voltage measuring unit 31 measures the voltage value (hereinafter also referred to as the single-cell battery voltage value) of the battery cell 12. The specific type of the voltage measuring unit 31 is not particularly limited as long as it can measure the single-cell battery voltage value. In this embodiment, the voltage measuring unit 31 is, for example, a voltage measuring IC (Integrated Circuit). The current measuring unit 32 measures the current value (hereinafter also referred to as the single-cell battery current value) of the battery cell 12. The specific type of the current measuring unit 32 is not particularly limited as long as it can measure the single-cell battery current value. In this embodiment, the current measuring unit 32 is, for example, a current measuring element (in other words, a current sensor). The temperature measuring unit 33 measures the temperature (hereinafter also referred to as the single-cell battery temperature) of the battery cell 12. The specific type of the temperature measuring unit 33 is not particularly limited as long as it can measure the single-cell battery temperature. In this embodiment, the temperature measuring unit 33 is, for example, a temperature measuring element (in other words, a temperature sensor).

[0025] In this embodiment, the individual cell voltage values ​​of the multiple battery cells 12 may sometimes differ. Therefore, voltage measuring units 31 are provided for each battery cell 12. That is, the number of voltage measuring units 31 is the same as the number of battery cells 12. Similarly, the individual cell temperatures of the multiple battery cells 12 may sometimes differ. Therefore, temperature measuring units 33 are provided for each battery cell 12. Here, the number of temperature measuring units 33 is the same as the number of battery cells 12. In this embodiment, the multiple battery cells 12 are connected in series, therefore, the individual cell current values ​​of the multiple battery cells 12 are the same. Therefore, only one current measuring unit 32 is needed for each of the multiple battery cells 12 (in other words, the battery pack 10). The current measuring unit 32 measures the current value at any point, making that current value the individual cell current value of the multiple battery cells 12.

[0026] The control device 50 performs control, for example, for calculating the battery state of multiple battery cells 12. Furthermore, the control device 50 performs control related to the energization of the battery cells 12 and the load 5, as well as control of the power supply from the battery cells 12 to the load 5. The structure of the control device 50 is not particularly limited. The control device 50 may be, for example, a microcomputer. The control device 50 may include, for example, I / F, CPU, ROM, RAM, etc. The control device 50 may be composed of a single computer or multiple computers.

[0027] In this embodiment, such as Figure 1As shown, the control device 50 includes a storage unit 51, a CPU 52, and an HSM 53. The storage unit 51 stores, for example, a battery program for performing processes such as calculating the battery state of the individual battery cells 12. The CPU 52 is a Central Processing Unit. The CPU 52 provides instructions to the measurement unit 30, the HSM 53, etc. The HSM 53 is a Hardware Security Module, which is dedicated hardware for securely managing information. In this embodiment, the HSM 53 performs a secure boot, described later.

[0028] However, in this embodiment, the control device 50 calculates the state of the batteries of the plurality of battery cells 12 constituting the battery pack 10 and determines the degree of degradation of the battery cells 12 based on the battery state. Here, the state of the battery cells 12 is not particularly limited. Examples of the state of the battery cells 12 include SOC, SOH, and SOF. SOC is short for State of Charge, an indicator of the charging state of the battery cell 12. For example, SOC shows the battery capacity when the battery is fully charged (100%) and fully discharged (0%). SOH is short for State of Health, an indicator of the capacity degradation state of the battery cell 12 as a percentage. SOH can be, for example, the health or integrity of the battery cell 12. SOH is the ratio of the capacity of the battery cell 12 before and after degradation. For example, the percentage of the capacity at degradation when the initial battery cell 12's capacity is taken as 100% is SOH. SOF is short for State of Function, which is an indicator of the input and output characteristics of a single battery cell, such as the maximum charge and discharge current or electrical power.

[0029] In this embodiment, the battery states such as SOC, SOH, and SOF can be calculated using at least one of the individual cell voltage, individual cell current, and individual cell temperature of the battery cell 12. Here, the battery states such as SOC, SOH, and SOF are calculated using all of the individual cell voltage, individual cell current, and individual cell temperature of the battery cell 12. SOC, SOH, and SOF can also be calculated using existing known methods.

[0030] Figure 2 This diagram illustrates the process for calculating the state of battery cell 12. In this embodiment, the control device 50 can calculate the state of battery cell 12 by sequentially executing multiple processes. Here, when calculating the state of battery cell 12, when the battery system 1 is started, the control device 50 performs the following steps: Figure 2As shown, the startup process S1, measurement process S2, and calculation process S3 are executed sequentially. Startup process S1 is the process of starting the measurement unit 30. Here, startup process S1 is the process of starting the measurement unit 30, which measures parameters required for calculating the battery state. In startup process S1, the voltage measurement unit 31, current measurement unit 32, and temperature measurement unit 33 are started as the measurement unit 30. In this embodiment, startup process S1 includes: voltage startup process S11 that starts the voltage measurement unit 31, current startup process S12 that starts the current measurement unit 32, and temperature startup process S13 that starts the temperature measurement unit 33. Furthermore, the specific processing content of startup process S1 is not particularly limited. In this embodiment, startup process S1 executes a process that enables the measurement unit 30 to measure parameters. For example, in startup process S1, initialization processing is performed on the voltage measurement unit 31, current measurement unit 32, and temperature measurement unit 33, enabling them to measure the individual cell voltage value, individual cell current value, and individual cell temperature, respectively.

[0031] Measurement process S2 is the process of measuring parameters through measurement unit 30. In this embodiment, in measurement process S2, voltage measurement unit 31 measures the voltage value of a single battery cell, current measurement unit 32 measures the current value of a single battery cell, and temperature measurement unit 33 measures the temperature of a single battery cell. Here, receiving instructions from CPU 52, the single battery cell voltage value, single battery cell current value, and single battery cell temperature of each battery cell 12 are measured. For example, CPU 52 sends measurement signals to voltage measurement unit 31, current measurement unit 32, and temperature measurement unit 33. Voltage measurement unit 31, receiving the measurement signal, measures the single battery cell voltage value of battery cell 12. Current measurement unit 32, receiving the measurement signal, measures the single battery cell current value of battery cell 12. Temperature measurement unit 33, receiving the measurement signal, measures the single battery cell temperature of battery cell 12. In measurement process S2, CPU 52 acquires the single battery cell voltage value, single battery cell current value, and single battery cell temperature of each battery cell 12.

[0032] Calculation process S3 is the process of calculating the state of battery cell 12. In calculation process S3, the state of battery cell 12 is calculated based on at least one of the cell voltage value, cell current value, and cell temperature measured in measurement process S2. For example, in calculation process S3, at least one of SOC, SOH, and SOF is calculated as the state of battery cell 12 using all values ​​of cell voltage, cell current, and cell temperature. Here, the SOC, SOH, and SOF of each cell 12 are all calculated at the same time point. In calculation process S3, at least one of SOC, SOH, and SOF can be calculated by substituting at least one of the cell voltage value, cell current value, and cell temperature into, for example, a predetermined calculation formula.

[0033] In this embodiment, such as Figure 1 As shown, the storage unit 51 pre-stores a startup program PG1, a measurement program PG2, and a state calculation program PG3 as the battery program. The startup program PG1 is... Figure 2 The startup process S1 is related to the startup procedure. The startup procedure PG1 is executed by the CPU 52 of the control device 50 to perform the startup procedure S1. By executing the startup procedure S1, the detection unit 30 is started. In this embodiment, as... Figure 1 As shown, the startup program PG1 includes a voltage startup program PG11, a current startup program PG12, and a temperature startup program PG13. The voltage startup program PG11 is related to... Figure 2 The voltage start-up process S11 is related to the procedure. By executing the voltage start-up procedure PG11, the voltage measurement unit 31 set for each battery cell 12 is activated. The current start-up procedure PG12 is related to... Figure 2 The current start-up process S12 is related to the current start-up procedure. The current measuring unit 32 starts by executing the current start-up procedure PG12. The temperature start-up procedure PG13 is related to... Figure 2 The temperature start-up process S13 is related to the procedure. By executing the temperature start-up procedure PG13, the temperature measurement unit 33 set for each battery cell 12 is started.

[0034] The PG2 measurement procedure is with Figure 2 The measurement process S2 is related to the measurement procedure. Measurement procedure S2 is executed by CPU52 through measurement procedure PG2. By executing measurement procedure S2, the voltage, current, and temperature of each individual battery cell 12 are measured. The state calculation procedure PG3 is related to... Figure 2The calculation process S3 is related to the program. Here, the CPU52 executes the state calculation program PG3 to perform the calculation process S3. By executing the calculation process S3, the state of the battery (e.g., SOC, SOH, SOF) of each battery cell 12 is calculated.

[0035] However, in this embodiment, a safety start is performed on the program before execution. Safety start is a safety function for the battery system 1. Safety start is a function that detects tampering with each program stored in the storage unit 51 of the control device 50, and ensures the security (or compatibility) of the execution of each program. In this embodiment, safety start is performed on the programs stored in the storage unit 51. Furthermore, safety start is performed using a method known in the art. Here, by performing safety start, programs that have not been detected as tampered with and whose security is ensured can be executed. Here, safety start is performed by the HSM53 of the control device 50. Safety start is performed on the startup program PG1 (specifically, voltage startup program PG11, current startup program PG12, and temperature startup program PG13), measurement program PG2, and state calculation program PG3 stored in the storage unit 51. The execution time required to perform this safety start is preferably short. Therefore, in this embodiment, the execution time required for performing the safety start when the battery system 1 is started is shortened.

[0036] In this embodiment, such as Figure 1 As shown, the startup program PG1, measurement program PG2, and status calculation program PG3 are stored in the storage unit 51 in a segmented manner. Here, "stored in a segmented manner" means that the programs are in a continuous state. This means that the startup program PG1, measurement program PG2, and status calculation program PG3 are each recorded together without any other program being inserted in the middle of a single program. For example, the startup program PG1, measurement program PG2, and status calculation program PG3 are independently recorded in one or more files. Here, the measurement program PG2 or status calculation program PG3 is not inserted into the middle of the startup program PG1. The startup program PG1 or status calculation program PG3 is not inserted into the middle of the measurement program PG2. Furthermore, the startup program PG1 or measurement program PG2 is not inserted into the middle of the status calculation program PG3. For example, when the startup program PG1, measurement program PG2, and status calculation program PG3 are recorded in one file, they are recorded in the order of startup program PG1, measurement program PG2, and status calculation program PG3.

[0037] Figure 3This diagram illustrates the first program PG51 and the second program PG52. In this embodiment, the battery program stored in the storage unit 51 is divided into the first program PG51 and the second program PG52. The first program PG51 includes a startup program PG1 (specifically, a voltage startup program PG11, a current startup program PG12, and a temperature startup program PG13) and a measurement program PG2. The second program PG52 includes a state calculation program PG3. The first program PG51 and the second program PG52 are stored separately in the storage unit 51.

[0038] In this embodiment, such as Figure 1 As shown, the control device 50 includes a first secure boot execution unit 61, a second secure boot execution unit 62, a first processing execution unit 63, and a second processing execution unit 64. Each of the units 61 to 64 of the control device 50 can be implemented in software or hardware. Each of the units 61 to 64 of the control device 50 can also be implemented using one or more processors or by circuitry. Here, the first secure boot execution unit 61 and the second secure boot execution unit 62 are included in the HSM 53 and are a function of the HSM 53. The first processing execution unit 63 and the second processing execution unit 64 are included in the CPU 52 and are a function of the CPU 52.

[0039] Next, according to Figure 4 The control sequence during the startup of battery system 1 will be explained. In this embodiment, when battery system 1 is started, a safe startup is executed sequentially in the order of the first program PG51 (more specifically, startup program PG1 and measurement program PG2) and the second program PG52 (more specifically, state calculation program PG3).

[0040] First of all, Figure 4 In step S101, Figure 1 The first safety start execution unit 61 of the HSM53 performs a safety start for the first program PG51 (hereinafter also referred to as the first safety start). Here, the first safety start execution unit 61, as the first program PG51, performs a safety start for the start program PG1 (specifically, the voltage start program PG11, the current start program PG12, and the temperature start program PG13) and the measurement program PG2. In this embodiment, as Figure 4As shown, CPU 52 sends a first secure boot start signal SG11 to HSM 53. Upon receiving the first secure boot start signal SG11, HSM 53 executes a first secure boot for the first program PG 51. Furthermore, if no tampering is detected with the first program PG 51 during the first secure boot, HSM 53 sends a first secure boot end signal SG12 to CPU 52. By receiving the first secure boot end signal SG12, CPU 52 can determine that the first secure boot has ended normally. Here, a normal secure boot end means that the program on which the secure boot was performed has not been tampered with and security has been ensured.

[0041] After performing the first secure boot as shown, execute the following steps sequentially. Figure 4 Steps S102 and S103. In steps S102 and S103, Figure 1 After performing the first safety start, the first processing execution unit 63 executes the processes included in the first program PG51. Here, the processes included in the first program PG51 include a start-up process S1 and a measurement process S2. In this embodiment, in step S102, the first processing execution unit 63 executes the start-up process S1. Here, the first processing execution unit 63 executes the start-up process S1 for the measurement unit 30 by executing the start-up program PG1. The first processing execution unit 63 starts the voltage measurement unit 31, the current measurement unit 32, and the temperature measurement unit 33 by executing the voltage start-up program PG11, the current start-up program PG12, and the temperature start-up program PG13 of the start-up program PG1. Here, the first processing execution unit 63 executes the voltage start-up process S11, the current start-up process S12, and the temperature start-up process S13 as the start-up process S1. In this embodiment, as... Figure 4 As shown, after the CPU 52 receives the first safe start-up end signal SG12, the first processing execution unit 63 of the CPU 52 sends a start signal SG21 to the voltage measuring unit 31, current measuring unit 32, and temperature measuring unit 33 of the measuring unit 30. The measuring unit 30 (voltage measuring unit 31, current measuring unit 32, and temperature measuring unit 33) receives the start signal SG21 and executes the start-up process S1. For example, as the start-up of the measuring unit 30, a predetermined initialization process is executed. In addition, when the start-up process S1 is executed for the measuring unit 30, a start-up end signal SG22 is sent from the measuring unit 30 to the CPU 52. The CPU 52 determines that the start-up process S1 has been executed for the measuring unit 30 by receiving the start-up end signal SG22.

[0042] Next, in Figure 4In step S103, the first processing execution unit 63 executes the measurement process S2. Here, the first processing execution unit 63 executes the measurement process S2 for the measurement unit 30 by executing the measurement program PG2 after the CPU 52 receives the start-end signal SG22. In this embodiment, when executing the measurement process S2, the first processing execution unit 63 of the CPU 52 performs the measurement process S2 as follows: Figure 4 As shown, the voltage measuring unit 31, current measuring unit 32, and temperature measuring unit 33 of the measuring unit 30 send a measuring signal SG31. Upon receiving the measuring signal SG31, the voltage measuring unit 31 measures the single-cell voltage value V1 of the battery cell 12. Then, it sends the single-cell voltage value V1 to the CPU 52. Upon receiving the measuring signal SG31, the current measuring unit 32 measures the single-cell current value A1 of the battery cell 12. Then, it sends the single-cell current value A1 to the CPU 52. Upon receiving the measuring signal SG31, the temperature measuring unit 33 measures the single-cell temperature T1 of the battery cell 12. It then sends the single-cell temperature T1 to the CPU 52. The first processing execution unit 63 terminates the execution of the measuring process S2 by receiving the single-cell voltage value V1, the single-cell current value A1, and the single-cell temperature T1.

[0043] In this embodiment, Figure 4 In step S104, during the execution of the processing based on the first processing execution unit 63 (here, the start processing S1 and the measurement processing S2), Figure 1 The second secure boot execution unit 62 performs a secure boot for the second program PG52 (hereinafter also referred to as the second secure boot). Here, the second secure boot execution unit 62 performs a secure boot for the state calculation program PG3 as the second program PG52. In this embodiment, as Figure 4 As shown, CPU 52 sends a second secure boot start signal SG41 to HSM 53. Upon receiving the second secure boot start signal SG41, HSM 53 executes a second secure boot for the second program PG 52. Furthermore, if no tampering is detected with the second program PG 52 during the second secure boot, HSM 53 sends a second secure boot end signal SG42 to CPU 52. By receiving the second secure boot end signal SG42, CPU 52 can determine that the second secure boot has completed normally.

[0044] In this embodiment, in step S104, the second safety start execution unit 62 is configured to terminate the execution of the second safety start for the second program PG52 before the execution of the processing contained in the first program PG51 based on the first processing execution unit 63 is completed. Here, the second safety start execution unit 62 terminates the execution of the second safety start before the execution of the measurement processing S2 based on the first processing execution unit 63 is completed. Specifically, the second safety start termination signal SG42 is sent from the HSM53 to the CPU52 until the individual cell voltage value V1, individual cell current value A1, and individual cell temperature T1 measured in the measurement processing S2 are sent to the CPU52. In addition, in this embodiment, the approximate execution times for the first execution time of the first safety start for the first program PG51 and the second execution time of the second safety start for the second program PG52 can be calculated in advance based on the processing capacity of the control device 50 and the program capacity. Therefore, based on the pre-calculated second execution time, the second secure start execution unit 62 begins the execution of the second secure start in such a way that the execution of the second secure start ends before the execution of the processing contained in the first program PG51 based on the first processing execution unit 63 ends.

[0045] exist Figure 4 In step S105, Figure 1 The second processing execution unit 64 executes the processing included in the second program PG52. Here, the second processing execution unit 64 executes the calculation processing S3 executed by the state calculation program PG3. In this embodiment, the calculation processing S3 is executed after the measurement processing S2 and the second safe start for the state calculation program PG3. Therefore, the second processing execution unit 64 executes the calculation processing S3 after executing the start-up processing S1 based on the first processing execution unit 63 and the measurement processing S2, and after executing the second safe start based on the second safe start execution unit 62. As the calculation processing S3, the second processing execution unit 64 uses all the values ​​of the single cell voltage value V1, the single cell current value A1, and the single cell temperature T1 measured by the measurement processing S2 to calculate at least one of the state of the battery cell 12, namely SOC, SOH, and SOF. Here, the SOC, SOH, and SOF of the battery cell 12 are all calculated at the same time point.

[0046] Furthermore, in this embodiment, after performing the calculation process S3, the battery system 1 switches to a normal start-up mode. A normal start-up mode is a mode in which power is prepared to be supplied from the battery pack 10 of the battery system 1 to the load 5. Although not illustrated, the battery system 1 can supply power to or deprive the load 5 based on instructions from the ECU of the vehicle equipped with the battery system 1 during the normal start-up mode. In the absence of a normal start-up mode, power cannot be supplied from the battery pack 10 to the load 5. In this case, the vehicle cannot be driven using the motor, which is an example of the load 5.

[0047] In this embodiment, as described above... Figure 1 As shown, the battery system 1 includes a battery cell 12, a measuring unit 30, and a control device 50. The measuring unit 30 includes: a voltage measuring unit 31 for measuring the single-cell voltage V1 of the battery cell 12; a current measuring unit 32 for measuring the single-cell current A1 of the battery cell 12; and a temperature measuring unit 33 for measuring the single-cell temperature of the battery cell 12. Figure 1 As shown, the control device 50 includes a storage unit 51, a first safety start execution unit 61, a first processing execution unit 63, a second safety start execution unit 62, and a second processing execution unit 64. The storage unit 51 stores, in a segmented manner, a start program PG1 related to the start process S1 of the start measurement unit 30, a measurement program PG2 related to the measurement process S2 that measures the individual cell voltage value V1, the individual cell current value A1, and the individual cell temperature T1 by the measurement unit 30, and a state calculation program PG3 related to the calculation process S3 that calculates the battery state of the individual cell 12 based on at least one of the individual cell voltage value V1, the individual cell current value A1, and the individual cell temperature T1 measured by the measurement process S2. The first safety start execution unit 61 is as follows... Figure 4 Step S101 is for the first program PG51, which contains at least the startup program PG1 (see reference). Figure 3 The first secure boot is executed. After executing the first secure boot based on the first secure boot execution unit 61, the first processing execution unit 63 then... Figure 4 In steps S102 and S103, the processes contained in the first program PG51 are executed (here, the startup process S1 and the measurement process S2). During the execution of the processes based on the first processing execution unit 63, the second safety startup execution unit 62 performs a second safety startup on the second program PG52, which includes at least one of the measurement program PG2 and the state calculation program PG3 (here, the state calculation program PG3). After executing the processes based on the first processing execution unit 63 and performing the second safety startup based on the second safety startup execution unit 62, the second processing execution unit 64, in Figure 4 In step S105, the processing contained in the second program PG52 is executed (here, the calculation process S3 is performed).

[0048] In this embodiment, when the battery system 1 is started, such as Figure 2 As shown, the battery state of each battery cell 12 is calculated by sequentially executing the startup process S1, the measurement process S2, and the calculation process S3. Therefore, a first safe start is performed for a first program PG51, which includes at least a startup procedure PG1 related to the initially executed startup process S1, and the processes contained in the first program PG51 are executed. At this time, a second safe start is performed in parallel with the execution of the processes contained in the first program PG51 for a second program PG52, which includes a state calculation procedure PG3. Therefore, considering the processing order required to calculate the battery state, the battery program is divided into a first program PG51 and a second program PG52, and the processes contained in the first program PG51 and the second safe start for the second program PG52 are executed in parallel, thus shortening the execution time required for safe start.

[0049] In this embodiment, such as Figure 3 As shown, program PG51 includes startup program PG1 and measurement program PG2. Program PG52 includes state calculation program PG3. For example, the state calculation program PG3 may have a larger capacity and a longer processing time compared to a program that combines startup program PG1 and measurement program PG2. Therefore, by changing the timing of secure startup execution in startup program PG1, measurement program PG2, and state calculation program PG3, secure startup can be performed more efficiently.

[0050] Alternatively, in this embodiment, the measurement procedure PG2 may also be included in the second procedure PG52. That is, the first procedure PG51 may include the startup procedure PG1, and the second procedure PG52 may include the measurement procedure PG2 and the state calculation procedure PG3. In this case, the first safe startup execution unit 61 performs a first safe startup for the startup procedure PG1. The first processing execution unit 63 performs startup processing S1. The second safe startup execution unit 62 performs a second safe startup for the measurement procedure PG2 and the state calculation procedure PG3. The second processing execution unit 64 sequentially performs measurement processing S2 and calculation processing S3.

[0051] In this embodiment, the second safety start execution unit 62 is configured to finish executing the second safety start for the second program PG52 before the execution of the processing included in the first program PG51 based on the first processing execution unit 63 finishes. Therefore, at the end of the start process S1 and the measurement process S2 included in the first program PG51, the execution of the second safety start for the second program PG52 is completed. Thus, the calculation process S3 can be executed at the point when the measurement process S2 ends. Therefore, the process of calculating the battery state of the battery cell 12 can be executed efficiently.

[0052] Figure 5 This diagram illustrates a modified example of the first embodiment, showing the first program PG51 and the second program PG52. In this embodiment, as... Figure 5 As shown, the first program PG51 may also include programs other than the startup program PG1 and the measurement program PG2. The storage unit 51 may also store the communication program PG4 and the fault diagnosis program PG5. The communication program PG4 is a program related to communication processing that enables the control device 50 to communicate with an external component of the battery system 1. The external component of the battery system 1 is, for example, the ECU of a vehicle equipped with the battery system 1. For example, the control device 50 of the battery system 1 and the ECU are connected in a communicable manner via a CAN communication controller (not shown). The communication processing based on the communication program PG4 is the process of initializing the aforementioned CAN communication controller. The communication processing is, for example, the process executed after the startup process S1. The communication program PG4 is executed by the CPU 52, thereby performing the communication processing. As a result, the CAN communication controller is initialized, and CAN communication between the control device 50 and the ECU is established.

[0053] The fault diagnosis program PG5 is a fault diagnosis processing program related to diagnosing faults in the measurement units 30 (specifically, the voltage measurement unit 31, the current measurement unit 32, and the temperature measurement unit 33). The fault diagnosis program PG5 is executed by the CPU 52 to perform fault diagnosis processing for the measurement units 30. Furthermore, the specific processing content is not particularly limited as long as it is capable of diagnosing (in other words, detecting) faults in the measurement units 30; existing known processing methods can be used.

[0054] In this embodiment, such as Figure 5 As shown, it is also possible that, in addition to the startup program PG1 and the measurement program PG2, the first program PG51 also includes a communication program PG4 and a fault diagnosis program PG5. In this case, Figure 1In addition to executing the startup procedure PG1 and the measurement procedure PG2, the first safety startup execution unit 61 also executes the first safety startup procedure PG4 and the fault diagnosis procedure PG5. The first processing execution unit 63 performs communication processing by executing the communication procedure PG4 and performs fault diagnosis processing for the measurement unit 30 by executing the fault diagnosis procedure PG5.

[0055] Communication processing and fault diagnosis processing are performed, for example, along with startup processing S1 when battery system 1 is started. Therefore, by performing the first safe startup for communication program PG4 and fault diagnosis program PG5 at the same time as startup program PG1, safe startup and communication processing and fault diagnosis processing can be performed efficiently.

[0056] <Second Implementation>

[0057] Next, the battery system 1A according to the second embodiment will be described. In this embodiment, the first procedure is further subdivided to perform a safe start.

[0058] Figure 6 This diagram illustrates the first program PG51A and the second program PG52A of the second embodiment. (See diagram) Figure 6 As shown, the first program PG51A has a first pre-program PG61 and a first post-program PG62. The first pre-program PG61 includes a voltage start-up program PG11 related to the voltage start-up process S11 for starting multiple voltage measurement units 31, and a temperature start-up program PG13 related to the temperature start-up process S13 for starting multiple temperature measurement units 33. The first post-program PG62 includes a current start-up program PG12 related to the current start-up process S12 for starting one current measurement unit 32. The second program PG52A includes a measurement program PG2 related to the measurement process S2, and a state calculation program PG3 related to the calculation process S3.

[0059] Figure 7 This is a block diagram illustrating the control device 50A according to the second embodiment. For example... Figure 7 As shown, the battery system 1A includes a control device 50A. The control device 50A includes a first safety start execution unit 61A, a second safety start execution unit 62A, a first processing execution unit 63A, and a second processing execution unit 64A.

[0060] The first safety start actuator 61A includes a first pre-safety start actuator 71 and a first post-safety start actuator 72. The first pre-safety start actuator 71 performs a safety start (hereinafter also referred to as the first pre-safety start) for the first pre-program PG61 (here, the voltage start program PG11 and the temperature start program PG13). The first post-safety start actuator 72 performs a safety start (hereinafter also referred to as the first post-safety start) for the first post-program PG62 (here, the current start program PG12). The second safety start actuator 62A performs a second safety start for the second program PG52A (here, the measurement program PG2 and the state calculation program PG3).

[0061] like Figure 7 As shown, the first processing execution unit 63A includes a first pre-processing execution unit 81 and a first post-processing execution unit 82. After performing a safety start based on the first pre-safe start execution unit 71, the first pre-processing execution unit 81 performs the processes included in the first pre-program PG61 (here, voltage start process S11 and temperature start process S13). After performing a safety start based on the first post-safe start execution unit 72, the first post-processing execution unit 82 performs the processes included in the first post-program PG62 (here, current start process S12). After performing a safety start based on the second safety start execution unit 62A, the second processing execution unit 64A performs the processes included in the second program PG52A (here, measurement process S2 and calculation process S3).

[0062] In this embodiment, the first post-safety start execution unit 72 performs the first post-safety start during the execution of the processing based on the first pre-processing execution unit 81 (here, voltage start processing S11 and temperature start processing S13). The second safety start execution unit 62A performs the second safety start for the second program PG52A during the execution of the processing based on the first post-processing execution unit 82 (here, current start processing S12) or after the execution of current start processing S12.

[0063] Next, according to Figure 8 The control sequence during startup of the battery system 1A according to this embodiment will be described. In this embodiment, when the battery system 1A is started, a safe startup is performed in the order of the first pre-program PG61, the first post-program PG62, and the second program PG52A.

[0064] First of all, Figure 8 In step S201, Figure 7The first secure boot execution unit 71 of the HSM53 performs a first secure boot for the first pre-program PG61. Here, for example, the CPU52 sends a first secure boot start signal SG11a to the HSM53. If the HSM53 receives the first secure boot start signal SG11a, the first secure boot execution unit 71 performs the first secure boot. When the execution of the first secure boot ends and no tampering with the first pre-program PG61 is detected, the HSM53 sends a first secure boot end signal SG12a to the CPU52.

[0065] Next, in Figure 8 In step S202, Figure 7 The first preprocessing execution unit 81 executes the first preprocessing procedure PG61, which contains the processing (here, voltage start-up processing S11 and temperature start-up processing S13). Here, the CPU 52 sends a first start signal SG21a to the voltage measuring unit 31 and the temperature measuring unit 33. The voltage measuring unit 31 receives the first start signal SG21a and executes the voltage start-up processing S11. The temperature measuring unit 33 receives the first start signal SG21a and executes the temperature start-up processing S13. After startup, the voltage measuring unit 31 and the temperature measuring unit 33 send a first start-up end signal SG22a to the CPU 52.

[0066] exist Figure 8 In step S203, during the execution of the processing based on the first preprocessing execution unit 81 (here, voltage start processing S11 and temperature start processing S13), Figure 7 The first secure boot execution unit 72 performs a first secure boot for the first post-program PG62. For example, the CPU 52 sends a first secure boot start signal SG11b to the HSM 53. If the HSM 53 receives the first secure boot start signal SG11b, the first secure boot execution unit 72 performs the first secure boot. When the execution of the first secure boot ends and no tampering with the first post-program PG62 is detected, the HSM 53 sends a first secure boot end signal SG12b to the CPU 52.

[0067] Next, in Figure 8 In step S204, Figure 7 The first post-processing execution unit 82 executes the processing contained in the first post-program PG62 (here, the current start process S12) by executing the first post-program PG62. Here, the CPU 52 sends a second start signal SG21b to the current measuring unit 32. The current measuring unit 32 receives the second start signal SG21b and executes the current start process S12. After starting, the current measuring unit 32 sends a second start end signal SG22b to the CPU 52.

[0068] In this embodiment, Figure 8 In step S205, during the execution of the processing based on the first post-processing execution unit 82 (here, the current-starting processing S12), Figure 7 The second secure boot execution unit 62A performs a second secure boot for the second program PG52A. For example, the CPU 52 sends a second secure boot start signal SG41a to the HSM 53. If the HSM 53 receives the second secure boot start signal SG41a, the second secure boot execution unit 62A performs the second secure boot. When the execution of the second secure boot ends and no tampering with the second program PG52A is detected, the HSM 53 sends a second secure boot end signal SG42a to the CPU 52.

[0069] After performing the second secure boot as shown, execute Figure 8 Steps S206 and S207. Here, Figure 7 After performing the second safety start, the second processing execution unit 64A executes the processing contained in the second program PG52A. Here, in step S206, the second processing execution unit 64A executes the measurement process S2. The second processing execution unit 64A executes the measurement process S2 for the measurement unit 30 by executing the measurement program PG2 after the CPU 52 receives the second safety start end signal SG42a. Here, the second processing execution unit 64A sends the measurement signal SG31a to the voltage measurement unit 31, the current measurement unit 32, and the temperature measurement unit 33 of the measurement unit 30. When the voltage measurement unit 31 receives the measurement signal SG31a, it measures the single cell voltage value V1 of the battery cell 12. Then, it sends the single cell voltage value V1 from the voltage measurement unit 31 to the CPU 52. When the current measurement unit 32 receives the measurement signal SG31a, it measures the single cell current value A1 of the battery cell 12. Then, it sends the single cell current value A1 from the current measurement unit 32 to the CPU 52. Upon receiving the measurement signal SG31a, the temperature measurement unit 33 measures the individual cell temperature T1 of the battery cell 12. Subsequently, the temperature measurement unit 33 sends the individual cell temperature T1 to the CPU 52. The second processing execution unit 64A terminates the measurement process S2 by receiving the individual cell voltage value V1, the individual cell current value A1, and the individual cell temperature T1.

[0070] exist Figure 8 In step S207, Figure 7The second processing execution unit 64A executes the calculation process S3 by executing the state calculation program PG3. In this embodiment, the second processing execution unit 64A executes the calculation process S3 after executing the measurement process S2 and the second safety start based on the second safety start execution unit 62A. As the calculation process S3, the second processing execution unit 64A uses all the values ​​of the single cell voltage value V1, the single cell current value A1, and the single cell temperature T1 measured by the measurement process S2 to calculate at least one of the state of the battery cell 12, namely SOC, SOH, and SOF. Here, the SOC, SOH, and SOF of the battery cell 12 are all calculated at the same time point.

[0071] In this embodiment, the voltage measuring unit 31 and the temperature measuring unit 33 are provided for each battery cell 12. The current measuring unit 32 is provided for each of the multiple battery cells 12. Therefore, compared to the voltage starting program PG11 and the temperature starting program PG13, the current-start procedure PG12 has a smaller capacity and a shorter execution time required for safe startup. In this embodiment, safe startup is performed first for the voltage starting program PG11 and the temperature starting program PG13, and then for the current-start procedure PG12. Therefore, the timing of starting the voltage startup process S11 and the temperature startup process S13 can be advanced by an amount corresponding to the subsequent execution of the safe startup for the current-start procedure PG12. Therefore, the time required to start the battery system 1A can be shortened.

[0072] Furthermore, in this embodiment, the safe startup of the voltage startup procedure PG11 and the safe startup of the temperature startup procedure PG13 can be performed separately. For example, the voltage startup process S11 can be performed after the safe startup of the voltage startup procedure PG11 is executed. Alternatively, the safe startup of the temperature startup procedure PG13 can be performed during the execution of the voltage startup process S11. Or, the temperature startup process S13 can be performed after the safe startup of the temperature startup procedure PG13 is executed. In this case, the safe startup of the current startup procedure PG12 can be performed during the execution of the temperature startup process S13.

[0073] As stated above, this specification includes the disclosures described below.

[0074] Item 1: A battery system comprising: a battery cell; a measuring unit having a voltage measuring unit for measuring the battery cell's voltage, a current measuring unit for measuring the battery cell's current, and a temperature measuring unit for measuring the battery cell's temperature; and a control device comprising: a storage unit storing, in a divided manner, a startup program, a measuring program, and a state calculation program, wherein the startup program is related to a startup process for starting the measuring unit, the measuring program is related to a measuring process for measuring the battery cell's voltage, current, and temperature using the measuring unit, and the state calculation program is based on the battery cell voltage measured by the measuring process. The calculation process is related to calculating the battery state of the battery cell based on at least one of the aforementioned single-cell current value and the aforementioned single-cell temperature; a first safety start execution unit performs a safety start for a first program that includes at least the aforementioned start procedure; a first processing execution unit performs the processing included in the first program after the safety start based on the first safety start execution unit is executed; a second safety start execution unit performs a safety start for a second program that includes at least one of the aforementioned measurement procedure and the aforementioned state calculation procedure during the execution of the processing based on the first processing execution unit; and a second processing execution unit performs the processing included in the second program after the processing based on the first processing execution unit is executed and after the safety start based on the second safety start execution unit is executed.

[0075] Item 2: In the battery system described in Item 1, the first program includes the measurement program and the second program includes the state calculation program.

[0076] Item 3: In the battery system described in Item 1 or 2, the second safety start execution unit is configured to terminate the execution of the safety start for the second program before the processing included in the first program executed by the first processing execution unit is terminated.

[0077] Item 4: In the battery system described in Item 1, the startup procedure includes: a voltage startup procedure related to the voltage startup process of starting the voltage measuring unit; a current startup procedure related to the current startup process of starting the current measuring unit; and a temperature startup procedure related to the temperature startup process of starting the temperature measuring unit. The first procedure includes: a first pre-procedure including the voltage startup procedure and the temperature startup procedure; and a first post-procedure including the current startup procedure. The second procedure includes the measuring procedure and the state calculation procedure. The first safety startup execution unit includes: a first pre-procedure safety startup execution unit performing a safety startup for the first pre-procedure; and a first post-procedure safety startup execution unit performing a safety startup for the first post-procedure. The first processing execution unit includes: The first pre-processing execution unit executes the processing contained in the first pre-processing procedure after the security start based on the first pre-security start execution unit is executed; and the first post-processing execution unit executes the processing contained in the first post-processing procedure after the security start based on the first post-security start execution unit is executed. The first post-security start execution unit executes the security start during the execution of the processing based on the first pre-processing execution unit, and the second security start execution unit executes the security start for the second procedure during the execution of the processing based on the first post-processing execution unit.

[0078] Item 5: In any of the above-mentioned battery systems in items 1 to 4, a plurality of the above-mentioned battery cells are connected in series, the voltage measuring unit is set for each of the above-mentioned battery cells, the temperature measuring unit is set for each of the above-mentioned battery cells, and one of the above-mentioned current measuring units is set for the plurality of the above-mentioned battery cells.

[0079] Item 6: In any of the battery systems described in items 1 to 5, the storage unit stores a communication program related to communication processing for communicating with the outside after the startup process, and the first program includes the communication program.

[0080] Item 7: In any of the battery systems described in items 1 to 6, the storage unit stores a fault diagnosis program, which is related to fault diagnosis processing for diagnosing faults in the measurement unit, and the first program includes the fault diagnosis program.

Claims

1. A battery system, characterized in that, have: Battery cell; The measuring unit includes a voltage measuring unit for measuring the voltage value of a single battery cell, a current measuring unit for measuring the current value of a single battery cell, and a temperature measuring unit for measuring the temperature of a single battery cell. as well as Control device, The control device includes: The storage unit stores, in a segmented manner, a startup program, a measurement program, and a state calculation program. The startup program is related to the startup process of starting the measurement unit. The measurement program is related to the measurement process of measuring the voltage value, current value, and temperature of the individual battery cell through the measurement unit. The state calculation program is related to the calculation process of calculating the battery state of the individual battery cell based on at least one of the voltage value, current value, and temperature of the individual battery cell measured by the measurement process. The first secure boot execution unit performs secure boot on a first program that includes at least the boot program; The first processing execution unit executes the processing contained in the first program after the secure startup based on the first secure startup execution unit is executed; A second secure startup execution unit performs a secure startup on a second program comprising at least one of the measurement program and the state calculation program during the execution of processing based on the first processing execution unit; and The second processing execution unit executes the processing contained in the second program after the processing based on the first processing execution unit is executed and the secure startup based on the second secure startup execution unit is executed.

2. The battery system according to claim 1, characterized in that, The first procedure includes the measurement procedure. The second program includes the state calculation program.

3. The battery system according to claim 1 or 2, characterized in that, The second secure startup execution unit is configured to terminate the execution of secure startup for the second program before the processing contained in the first program executed by the first processing execution unit is terminated.

4. The battery system according to claim 1, characterized in that, The startup program has the following features: A voltage start-up procedure, which is related to the voltage start-up process that initiates the voltage measuring unit; A current-start procedure, which is related to the current-start process for starting the current measuring unit; as well as The temperature startup procedure is related to the temperature startup process that initiates the temperature measuring unit. The first procedure has: The first pre-procedure includes the voltage start-up procedure and the temperature start-up procedure; and The first subsequent procedure includes the current-initiating procedure. The second procedure includes the measurement procedure and the state calculation procedure. The first safe start execution unit has: The first pre-start secure boot execution unit performs secure boot on the first pre-procedure; and The first post-safe boot execution unit performs a safe boot for the first post-program. The first processing execution unit has: The first pre-processing execution unit, after the secure startup based on the first pre-secure startup execution unit is executed, performs the processing contained in the first pre-process; and The first post-processing execution unit executes the processing contained in the first post-program after the secure startup based on the first post-secure startup execution unit is executed. The first post-safe start execution unit performs safe start during the period when the processing based on the first pre-processing execution unit is executed. The second secure boot execution unit performs secure boot on the second program during the period when the processing based on the first post-processing execution unit is executed.

5. The battery system according to any one of claims 1 to 4, characterized in that, Multiple battery cells are connected in series. The voltage measuring unit is configured for each of the battery cells. The temperature measuring unit is set up for each of the battery cells. The current measuring unit is provided for each of the multiple battery cells.

6. The battery system according to any one of claims 1 to 5, characterized in that, The storage unit stores a communication program related to communication processing for communication with the outside world after the startup process. The first program includes the communication program.

7. The battery system according to any one of claims 1 to 6, characterized in that, The storage unit stores a fault diagnosis program, which is related to fault diagnosis processing for diagnosing faults in the measurement unit. The first program includes the fault diagnosis program.

Images