Safety design method for monorail auxiliary battery

Abstract

The application discloses a safety design method of a monorail auxiliary storage battery, and belongs to the field of safety management of a monorail train auxiliary storage battery. The method collects cell voltage and temperature through double-slave control module redundancy, and combines an analog front-end collection chip and a single-chip microcomputer temperature channel to perform parallel collection of typical temperature points; after consistency verification, residual error analysis, channel confidence and data health state evaluation, safety judgment data is generated; and then based on main and auxiliary single-chip microcomputer double-path driving, independent power supply, contactor open-loop and closed-loop confirmation and manual bipolar isolation, safety disposal of single-point faults in collection, control, power supply and maintenance isolation is realized.

Description

Technical Field

[0001] This invention relates to the field of safety management of auxiliary batteries for monorail trains, and more particularly to a safety design method for auxiliary batteries for monorail trains. Background Technology

[0002] The auxiliary battery system of a monorail train is used to provide power to the vehicle's auxiliary loads and control equipment. Its operating status directly affects the continuity of low-voltage power supply to the vehicle and the safety of maintenance operations. Existing auxiliary battery systems typically use a battery management system to collect individual cell voltage and temperature and control the closing or opening of contactors to achieve charge / discharge management and fault protection.

[0003] In existing solutions, the acquisition of individual cell voltage and temperature often relies on a single slave control module or a single acquisition chip, and the main control contactor control and controller power supply also often use a single path. When a slave control acquisition failure, a main control failure, or a power supply failure occurs, the battery management system may not be able to identify individual cell overvoltage, individual cell undervoltage, or temperature over-limit conditions in a timely manner, causing the battery to enter an overcharged, over-discharged, or overheated state.

[0004] Meanwhile, in maintenance scenarios, if only a single-pole disconnection is performed on the battery output side or there is a lack of bipolar isolation confirmation in conjunction with the door lock fixing structure, maintenance personnel may still come into contact with the live circuit, posing a risk of electric shock.

[0005] Therefore, a safety design method for monorail auxiliary batteries is needed to address the shortcomings of the existing technologies. Summary of the Invention

[0006] One objective of this invention is to propose a safety design method for monorail auxiliary batteries. Addressing the single-point failure risk in the existing monorail train auxiliary battery system's data acquisition, control, power supply, and maintenance isolation links, this invention proposes a technical solution combining dual-slave redundant data acquisition, channel health assessment, dynamic data degradation, asymmetric control by master and slave microcontrollers, closed-loop disconnection confirmation, and manual bipolar isolation. This invention improves the reliability of hazardous condition identification, enhances the safe disconnection capability in case of contactor failure, and reduces the risk of electric shock during maintenance.

[0007] This invention provides a safety design method for a single-rail auxiliary storage battery, comprising: S1, acquiring individual cell voltage data and individual cell temperature data of the battery pack through a first slave control module and a second slave control module, and having at least one slave control module acquire preset typical temperature points in parallel through an analog front-end acquisition chip and a microcontroller temperature acquisition channel to form a redundant acquisition dataset; S2, performing consistency verification and residual analysis on the redundant acquisition dataset to generate channel confidence and data health status for each acquisition channel; S3, performing weighted acceptance, anomaly removal, or downgraded acceptance based on the channel confidence and data health status to obtain safety judgment data; S4, identifying individual cell overvoltage, individual cell undervoltage, and temperature over-limit conditions based on the safety judgment data, and generating contact... The system executes a contactor closing permission command or a contactor disconnection protection command. Contactor closing employs a closing strategy confirmed by both the main and auxiliary microcontrollers, while contactor disconnection uses a disconnection strategy triggered by valid confirmation from either the main or auxiliary microcontroller. S5. Based on the contactor closing permission command or disconnection protection command, the main microcontroller controls the positive drive circuit of the contactor coil, and the auxiliary microcontroller controls the negative drive circuit of the contactor coil. Both the main and auxiliary microcontrollers are powered by independent power supply circuits. S6. After executing the disconnection protection command, the disconnection result is confirmed using the contactor auxiliary contact status, changes in battery output current, and changes in voltage. A severe fault state is generated if disconnection fails or if adhesion is suspected, and the manual double-pole switch is used as the object for maintenance isolation.

[0008] Optionally, S1 includes:

[0009] The first slave module and the second slave module are respectively connected to the single cell voltage sampling harness and the single cell temperature sampling harness of the same battery pack;

[0010] The first slave control module and the second slave control module respectively generate data frames containing individual cell number, sampling time, individual cell voltage value, individual cell temperature value and acquisition channel identifier;

[0011] When the analog front-end acquisition chip and the microcontroller temperature acquisition channel acquire the same preset typical temperature point, the temperature values ​​of the two are written into the parallel temperature data item corresponding to the same temperature point number.

[0012] Optionally, S2 includes:

[0013] A preset sampling synchronization window is determined based on the sampling time in the data frame, and the difference between the data of the first slave control module and the data of the second slave control module with the same unit number and within the preset sampling synchronization window is calculated.

[0014] Residual calculations are performed on the temperature values ​​of the analog front-end acquisition chip and the temperature acquisition channel of the microcontroller for the same temperature point number.

[0015] The difference and the residual are compared with a preset voltage consistency threshold and a preset temperature consistency threshold, respectively, to generate a consistency flag;

[0016] The consistency flag, the number of consecutive anomalies, the communication verification result, and the sampling timing deviation are mapped to normal state, degraded state, or fault state, which are used as the data health status.

[0017] The channel confidence level is generated based on the data health status and consistency markers.

[0018] Optionally, S3 includes:

[0019] Set the preset downgrade threshold to be lower than the preset acceptance threshold;

[0020] When the number of consecutive abnormal events reaches the preset rejection limit, the data of the corresponding acquisition channel will be rejected first and a corresponding channel fault mark will be generated.

[0021] When the number of consecutive anomalies does not reach the preset rejection count, the channel confidence of the acquisition channel is greater than or equal to the preset acceptance threshold, and the consistency is marked as passed, the data of that acquisition channel will be included in the weighted acceptance.

[0022] When the number of consecutive anomalies does not reach the preset rejection count, and the channel confidence of the acquisition channel is greater than or equal to the preset downgrade threshold and less than the preset acceptance threshold, or the channel confidence is greater than or equal to the preset acceptance threshold but the consistency is marked as failing, the data of the acquisition channel is marked as downgraded acceptance data and its triggering of contactor closing permission command is restricted.

[0023] When the confidence level of a data acquisition channel is less than the preset degradation threshold, the data of that acquisition channel is removed and a corresponding channel fault flag is generated.

[0024] Furthermore, the security determination data is generated as follows: normalized weights are determined for the acquisition channels that have not been eliminated based on the channel confidence level;

[0025] The normalized weights are used to perform a weighted calculation on the voltage values ​​of cells with the same cell number and the temperature values ​​of cells with the same temperature point number.

[0026] When the number of acquisition channels participating in the weighted calculation is below the preset redundancy threshold, a downgrade status flag will be added to the security judgment data.

[0027] When a degraded status flag or a channel fault flag exists, a contactor closing permission command is allowed to be generated only if the channel confidence of at least one non-degraded acquisition channel is greater than or equal to the preset acceptance threshold, the consistency flag is passed, and no corresponding channel fault flag is generated.

[0028] Optionally, S4 includes:

[0029] The individual cell voltage values ​​in the safety assessment data are compared with preset overvoltage thresholds and preset undervoltage thresholds, respectively; the individual cell temperature values ​​in the safety assessment data are compared with preset temperature over-limit thresholds.

[0030] A protection disconnection command is generated when any comparison result meets the protection triggering condition.

[0031] When all individual unit voltage and temperature values ​​do not meet the protection triggering conditions and both the main microcontroller and the auxiliary microcontroller output closing confirmation signals, a contactor closing permission command is generated.

[0032] Furthermore, the disconnection strategy includes: when the main microcontroller confirms that the protection trigger condition is met based on the safety judgment data, the main microcontroller cancels the positive terminal drive of the contactor coil;

[0033] When the secondary microcontroller confirms that the protection trigger condition is met based on the safety judgment data, the secondary microcontroller cancels the negative terminal drive of the contactor coil.

[0034] When either the main microcontroller or the auxiliary microcontroller detects a communication timeout, power supply abnormality, or control output abnormality in the other microcontroller, the microcontroller that detected the abnormality cancels the corresponding contactor coil drive.

[0035] Optionally, S5 includes:

[0036] The control circuits of the main microcontroller and the sub-microcontroller are respectively connected to independent power conversion circuits.

[0037] The main microcontroller outputs a high-side drive control signal to the positive terminal switching device of the contactor coil, and the auxiliary microcontroller outputs a low-side drive control signal to the negative terminal switching device of the contactor coil.

[0038] Upon receiving a disconnect protection command, at least one of the high-side drive control signal and the low-side drive control signal is set to the disconnect state.

[0039] Optionally, S6 includes:

[0040] Within a preset confirmation time window after the disconnection protection command is issued, the status of the contactor auxiliary contacts is read, and the current and voltage values ​​before the disconnection protection command are issued are compared with the reference to collect the decrease in battery output current and the change in output voltage.

[0041] If the auxiliary contact of the contactor is not switched to the open state, or the decrease in the current on the battery output side does not reach the preset current disconnection confirmation threshold, or the change in the voltage on the output side does not reach the preset voltage disconnection confirmation threshold, it is determined as a disconnection failure or suspected adhesion.

[0042] After determining that the disconnection has failed or is suspected of sticking, the locking contactor closes the permission command, records the serious fault status, and outputs the fault reporting information to the train control system or maintenance terminal.

[0043] Furthermore, the manual double-pole switch is located at the positive and negative terminals of the battery output, and the manual double-pole switch is a molded case circuit breaker;

[0044] Before entering the maintenance state, the manual double-pole switch is first operated to the off position, and then the opening state of the battery box door or maintenance door is restricted to correspond to the off position by the door lock fixing structure.

[0045] When a severe fault condition exists, the disconnection position is confirmed as the output condition for the maintenance-allowed flag;

[0046] When the disconnection position is not confirmed, the maintenance permission flag should not be output.

[0047] The beneficial effects of this invention are:

[0048] 1. By redundantly acquiring the individual unit voltage and temperature through the first and second slave control modules, and by combining the parallel acquisition of typical temperature points of the analog front-end acquisition chip and the microcontroller temperature acquisition channel, the risk of missing dangerous operating conditions due to the failure of a single acquisition link or a single temperature acquisition chip can be reduced.

[0049] 2. By generating security judgment data through consistency verification, residual analysis, channel confidence and data health status, and performing weighted acceptance, downgraded acceptance or anomaly removal on the acquisition channels, it can maintain a judgmentable security protection logic when some acquisition channels are abnormal, and restrict abnormal data from triggering contactor closure permission.

[0050] 3. By controlling the positive drive of the contactor coil with the main microcontroller and the negative drive with the auxiliary microcontroller, and by adopting a strategy of double confirmation for closure and triggering by any valid confirmation for opening, combined with closed-loop confirmation of opening result, upgraded handling of adhesion and manual double-pole switch isolation, the reliability of contactor opening can be enhanced and the safety of maintenance isolation can be improved. Attached Figure Description

[0051] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0052] Figure 1 This is a flowchart of a safety design method for a single-rail auxiliary battery.

[0053] Figure 2 This is a flowchart of step S4 of the present invention. Detailed Implementation

[0054] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0055] refer to Figures 1-2 A safety design method for a single-rail auxiliary storage battery includes: S1, acquiring individual cell voltage and temperature data of the battery pack through a first slave control module and a second slave control module, and having at least one slave control module acquire preset typical temperature points in parallel through an analog front-end acquisition chip and a microcontroller temperature acquisition channel to form a redundant acquisition dataset; S2, performing consistency verification and residual analysis on the redundant acquisition dataset to generate channel confidence and data health status for each acquisition channel; S3, performing weighted acceptance, anomaly rejection, or downgraded acceptance based on the channel confidence and data health status to obtain safety judgment data; S4, identifying individual cell overvoltage, individual cell undervoltage, and temperature over-limit conditions based on the safety judgment data, and generating contactor closure... The system executes either a permission command or a disconnection protection command. For example, contactor closure employs a closure strategy where both the main and auxiliary microcontrollers confirm the connection, while contactor disconnection is triggered by valid confirmation from either the main or auxiliary microcontroller. S5. Based on the contactor closure permission command or disconnection protection command, the main microcontroller controls the positive drive circuit of the contactor coil, and the auxiliary microcontroller controls the negative drive circuit of the contactor coil. Both the main and auxiliary microcontrollers are powered by independent power supply circuits. S6. After executing the disconnection protection command, the disconnection result is confirmed using the contactor auxiliary contact status, changes in battery output current, and changes in voltage. A severe fault state is generated if disconnection fails or if adhesion is suspected, and the manual double-pole switch is used as the object for maintenance isolation.

[0056] In this specific embodiment, S1 includes:

[0057] The first and second slave control modules are installed in the same battery box and are respectively connected to the single cell voltage sampling harness and single cell temperature sampling harness of the same battery pack through independent connectors. The single cell voltage sampling harness includes sampling wires led out in the order of cells and enters the respective input protection and filtering circuits on the two slave control modules to ensure that the two acquisitions are electrically independent. The single cell temperature sampling harness includes signal pairs corresponding to each temperature sensor and enters the respective temperature measurement interface circuits on the two slave control modules to ensure that the two temperature acquisitions are redundant.

[0058] The battery management master controller periodically sends synchronous sampling trigger signals to the two slave control modules, and the sampling period is fixed. Each time a trigger is triggered, the two slave control modules complete the sampling of the voltage and temperature of all individual cells within the same sampling period and write the sampling time into the data frame, so that the two data channels can be aligned according to the sampling time in subsequent steps;

[0059] The first slave module and the second slave module encapsulate the sampling results into data frames and report them to the battery management master controller. The data frame is defined by the following formula:

[0060] ;

[0061] in Indicates slave control module For individual unit number The generated data frame, and Indicates the first slave control module, This indicates the second slave control module. This indicates the cell number and corresponds one-to-one with the physical serial number of the cells within the battery pack. Indicates slave control module For monomers The sampling time at which the sampling is completed and the result is latched is determined by the local timer count corresponding to the synchronous sampling trigger signal. Indicates slave control module Collected monomers The unit voltage value is expressed in volts. Indicates slave control module Collected monomers The monomer temperature value is expressed in degrees Celsius. This represents the data acquisition channel identifier and is used to distinguish the data source between the first slave control module and the second slave control module; it is a fixed value assigned during system configuration.

[0062] The preset typical temperature point is determined during system configuration. Each temperature point is numbered and associated with the battery compartment. Each fixed temperature measurement position corresponds to a specific location, and two temperature sensors are installed at each position. The first slave control module assigns a number to each temperature point and simultaneously acquires the temperature value of the temperature sensor at the same location in parallel through the temperature acquisition channel of the analog front-end chip and the temperature acquisition channel of the microcontroller, and completes latching within the same sampling period. The temperature value output by the temperature acquisition channel of the analog front-end chip is written into the analog front-end temperature field of the parallel temperature data item, and the temperature value output by the microcontroller temperature acquisition channel is written into the microcontroller temperature field of the parallel temperature data item corresponding to the same temperature point number and bound to the temperature point number for storage. This allows the same temperature point number to simultaneously contain two temperature data sources in the redundant acquisition dataset: one from the analog front-end chip and one from the microcontroller temperature acquisition channel.

[0063] The battery management master controller collects all data frames reported by the two slave control modules and the parallel temperature data items generated by the first slave control module into a redundant acquisition dataset according to the sampling period, and then enters the subsequent consistency verification and residual analysis processing flow.

[0064] In this specific embodiment, S2 includes:

[0065] Based on two data frames And perform consistency verification and residual analysis on parallel temperature data items at typical temperature points, and generate data health status and channel confidence;

[0066] The battery management controller establishes a preset sampling synchronization window at the beginning of each sampling period. The window width of the preset sampling synchronization window is fixed. And the sampling times reported by the two slave control modules within the same sampling period For alignment purposes, each individual unit is numbered. Select the data frames from the first slave control module and the second slave control module that satisfy the following conditions: A pair of data is used as synchronization alignment data, and when multiple pairs meet the conditions, one is selected. The smallest pair is used as the individual unit number. The alignment result is for those that cannot be aligned. Data frames that have completed alignment within the specified time frame are recorded as sampling timing deviation anomalies and the anomalies are attributed to the corresponding acquisition channels.

[0067] Number each completed unit. Calculate the voltage difference between individual cells and simultaneously calculate the sampling timing deviation, numbering each typical temperature point. The temperature values ​​from the analog front-end acquisition chip and the microcontroller temperature acquisition channel in the same parallel temperature data item are read, and the temperature residual is calculated. The difference, timing deviation, and residual are obtained as follows:

[0068] ;

[0069] in Indicates the individual unit number The voltage difference between the two slave-controlled cells, This indicates the unit number assigned by the first slave control module. The individual unit voltage values ​​were acquired and are derived from the data frame. This indicates the second slave control module's unit number. The individual unit voltage values ​​were acquired and are derived from the data frame. Indicates the individual unit number The sampling timing deviation between the two slave controls This indicates the unit number assigned by the first slave control module. The sampling time and from the data frame This indicates the second slave control module's unit number. The sampling time and from the data frame Indicates the typical temperature point number Parallel temperature residuals, Indicates the number of the same typical temperature point. The temperature value is acquired and latched by the temperature acquisition channel of the analog front-end chip. Indicates the number of the same typical temperature point. Temperature values ​​acquired and latched by the microcontroller's temperature acquisition channel;

[0070] Battery management controller settings preset voltage consistency threshold Consistency threshold with preset temperature and number each individual unit. Generate voltage conformance markers And when and season Otherwise Number each typical temperature point Generate temperature uniformity markers And when season Otherwise ;

[0071] The battery management master controller maintains a counter for the number of consecutive anomalies for each acquisition channel, updating the counter with the sampling period as the step size. The first slave control module's acquisition channel... The consecutive number of anomalies occurs when the reported communication verification fails, or when any of the unit numbers involved in the alignment has a sampling timing deviation, or when any unit number meets the requirements. Alternatively, if any temperature sensor meets the condition of abnormal temperature consistency, the value is incremented by one and reset to zero when all checks pass during the sampling cycle. This is the second slave control module's data acquisition channel. The number of consecutive anomalies is updated according to the same rules, simulating the temperature acquisition channel of the front-end acquisition chip. Temperature acquisition channel with microcontroller The number of consecutive anomalies at any typical temperature point satisfies the following condition. Add one at time and number all typical temperature points to satisfy Reset to zero;

[0072] The battery management controller constructs a data health status based on consistency flags, the number of consecutive anomalies, communication verification results, and sampling timing deviations. This health status is limited to three mutually exclusive values: normal, degraded, or fault. Communication verification failure or abnormal sampling timing deviations are directly classified as fault states and remain so until the number of consecutive anomalies for that acquisition channel is reset to zero in subsequent sampling cycles. The number of consecutive anomalies must meet certain conditions. The condition is determined to be faulty and the fault threshold in this embodiment is met. The number of consecutive anomalies satisfies The status is determined to be downgraded, and the number of consecutive anomalies meets the following criteria. The system is considered to be in a normal state when all corresponding consistency flags are passed.

[0073] After receiving the data health status, the battery management controller generates channel confidence and limits the channel confidence to a certain range. Within the interval, the confidence level of the acquisition channel in normal state is assigned to 1.0, the confidence level of the acquisition channel in degraded state is assigned to 0.7, and the confidence level of the acquisition channel in fault state is assigned to 0.0. The confidence level of any acquisition channel that fails the consistency flag is kept at no higher than 0.7 to ensure that the consistency verification result can directly affect the subsequent weighted acceptance and degrade removal decisions.

[0074] In this specific embodiment, S3 includes:

[0075] The battery management master controller makes rule-based decisions on channel confidence and data health status and generates safety judgment data. The battery management master controller defines the collection channel set as follows:

[0076] ;

[0077] in This indicates the first slave control module's acquisition channel, and its data source is the step. data frames This indicates that the second slave control module acquires data through a data acquisition channel, and its data source is the data frame from step S1. This indicates the analog front-end acquisition chip temperature acquisition channel, and its data source is the analog front-end temperature field in the parallel temperature data item of step S1. This indicates the microcontroller temperature acquisition channel, and its data source is the microcontroller temperature field in the parallel temperature data item of step S1. ;

[0078] The battery management master controller manages each acquisition channel. Reading steps The generated channel confidence Number of consecutive anomalies And set the preset acceptance threshold to Set the preset downgrade threshold to And satisfy Set the preset number of rejections to Based on this, anomaly removal and downgrade acceptance determination are performed;

[0079] when The battery management main controller will collect data from the channel. Mark as rejected and generate corresponding channel fault flags. Furthermore, this acquisition channel will not be included in the safety assessment data calculation during this sampling period. and The battery management main controller will also collect the channel. Mark as rejected and generate corresponding channel fault flags. ,when and Furthermore, when the consistency flag associated with this acquisition channel passes, the battery management controller marks the acquisition channel as a non-degraded acquisition channel and allows it to participate in weighted acquisition. And satisfy Or satisfy However, if the consistency flag is marked as failing, the battery management controller will mark the acquisition channel as a degraded acceptance channel and generate a degrade flag. Furthermore, this downgraded acceptance channel will be limited to participating only in the calculation of safety judgment data and will not be used as the triggering basis for contactor closure permission;

[0080] The consistency tag uses the output of step S2 and is bound according to the measurement object; a voltage consistency tag is used for the individual voltage. And when a certain single-unit number corresponding The individual unit will be numbered at that time. Both individual unit voltage data are processed using downgraded data acquisition, and temperature consistency marking is applied for typical temperature points. And when a typical temperature point is numbered corresponding The typical temperature point will be numbered at that time. Both parallel temperature data streams were processed using downgraded data acceptance.

[0081] After completing channel-level elimination and downgrade marking, the battery management controller constructs a set of acquisition channels for weighted calculation based on the measurement object and fixes a preset redundancy threshold. Each individual is numbered Construct a set of acquisition channels for individual cell voltages It only includes the acquisition channels that were not rejected, and each typical temperature point is numbered. Construct a set of acquisition channels for typical temperatures It only includes the acquisition channels that were not excluded, and for each measurement object participating in the weighted calculation... Generate security judgment data values The weighted calculation uses weights normalized to channel confidence levels and is given by the following formula:

[0082] ;

[0083] in Indicates the object of measurement The security assessment data value, Indicates the object of measurement and when Time indicates individual unit number The object of single-unit voltage measurement, when The time indicates the typical temperature point number. Typical temperature measurement objects, Indicates the object of measurement The corresponding set of acquisition channels participating in the weighted calculation and when Time to take ,when Time to take , Indicates the acquisition channel The channel confidence score is output by step S2. Denotes the acquisition channel count variable used for normalized summation and satisfies Indicates the acquisition channel For the measurement object The original measurement value is when hour Indicates the individual unit number The individual unit voltage value is taken from the corresponding data frame. ,when hour Indicates the typical temperature point number The temperature value and take it as or ;

[0084] After completing the above weighted calculation, the battery management controller calculates the number of channels participating in the weighted calculation for each measurement object. ,when At that time, a downgrade status flag will be added to the safety assessment data of the corresponding measurement object. And when season and will or any This closing constraint is written into the security determination data header of this sampling period;

[0085] When any degradation status flag or any channel fault flag exists in the safety judgment data header, the battery management master controller will only meet the following conditions if at least one non-degraded accepted channel exists. And the corresponding consistency flag is passed and When the output closing enable flag is set to the allowed state, and when the closing enable flag is set to the prohibited state, the condition input of the contactor closing permission command generated by step S4 within the current sampling period is locked, thereby limiting the contactor closing permission triggered by the degraded data.

[0086] In this specific embodiment, S4 includes:

[0087] The main microcontroller and the auxiliary microcontroller independently complete the protection determination based on the safety determination data and generate the contactor closing permission command or the protection opening command. The safety determination data includes the individual unit number. Safety assessment of individual cell voltage value and the numbering of each typical temperature point Safety judgment temperature value And includes the closed enable flag output in step S3. ,in For individual item numbering The weighted acceptance result is in V. Numbering of typical temperature points The weighted acceptance result and the unit is , To close the enable flag and set its value to either "allow" or "disable";

[0088] Both the main microcontroller and the slave microcontroller store the same protection threshold parameters and apply the same set of thresholds to all microcontrollers at the end of each sampling period. and The comparison is performed, and the threshold parameter is fixedly set to a preset overvoltage threshold. Preset undervoltage threshold With respect to the preset temperature over-limit threshold The protection trigger condition is defined as follows:

[0089] ;

[0090] in This indicates that the protection trigger condition is met and its value is either true or false. This indicates the number of individual battery cells in the pack and is fixed by the system configuration. This indicates the number of typical temperature points, which is fixed by the system configuration. This indicates the operation of finding the maximum value. This indicates the minimum value operation. Represents a logical OR operation. Indicates the individual unit number The safety assessment unit voltage value. This indicates the preset overvoltage threshold. This indicates the preset undervoltage threshold. Indicates the typical temperature point number The safe temperature value. This indicates a preset temperature exceeding the threshold.

[0091] The main microcontroller calculates and obtains the local protection trigger confirmation signal. And when True season If the condition is true, a disconnect protection command is generated, and the sub-microcontroller calculates the local protection trigger confirmation signal. And when True season If true, a disconnect protection command is generated, where This indicates a protection trigger confirmation signal on the main microcontroller side. This indicates a protection trigger confirmation signal on the secondary microcontroller side;

[0092] The main microcontroller and the slave microcontroller exchange confirmation signals through a bidirectional communication link and perform online monitoring using heartbeat frames, with the heartbeat frame period fixed at [time missing]. And the communication timeout threshold is fixed at Any microcontroller can detect when the other party's heartbeat frames are consecutively missing for a certain period of time. The system will determine if a communication timeout has occurred and force the local protection trigger confirmation signal to be true in order to trigger a disconnect protection command.

[0093] The main microcontroller and the auxiliary microcontroller each perform power supply anomaly detection on the local power supply circuit. When the local control power supply voltage exceeds the allowable window, they forcibly set the local protection trigger confirmation signal to true to trigger the disconnect protection command. The local control power supply voltage is sampled by their respective analog-to-digital conversion channels, and the allowable window is fixed. And a power supply abnormality is determined when two consecutive sampling cycles exceed the allowable window;

[0094] The main microcontroller and the auxiliary microcontroller detect abnormalities in the local control output. When the inconsistency between the drive control signal and the drive feedback signal is detected for 200ms, the local protection trigger confirmation signal is forcibly set to true to trigger the disconnect protection command. The drive feedback signal is output from the hardware feedback terminal of the contactor coil drive circuit and connected to the digital input terminal of the corresponding microcontroller to reflect the actual conduction state of the high-side or low-side switching device.

[0095] When the protection trigger confirmation signal of either the main microcontroller or the slave microcontroller is true, the system will confirm the disconnect protection command as valid and enter the disconnect strategy execution process. The disconnect strategy can be triggered as long as either valid confirmation is met.

[0096] If and only if This is allowed, provided that both the protection trigger confirmation signals from the main microcontroller and the slave microcontroller are false, and the main microcontroller outputs a closing confirmation signal. The signal is true and the microcontroller outputs a closed confirmation signal. When true, the system generates a contactor closure permission command, in which This indicates a closing confirmation signal from the main microcontroller, and is set by the main microcontroller after completing threshold comparison and anomaly detection and confirming that there is no disconnection condition. This indicates that the secondary microcontroller has closed the signal and is set by the secondary microcontroller after completing the threshold comparison and anomaly detection and confirming that there is no disconnection condition.

[0097] In this specific embodiment, S5 includes:

[0098] The main microcontroller and the auxiliary microcontroller form independent control loops in hardware and implement series drive of the high side and low side of the same contactor coil to realize the double confirmation of closure and the effective execution basis of opening.

[0099] The control circuit containing the main microcontroller is powered by an independent first power conversion circuit, while the control circuit containing the secondary microcontroller is powered by an independent second power conversion circuit. The input terminals of both the first and second power conversion circuits are taken from the battery management system control power input bus and are connected in series with independent fuses and reverse connection protection devices. Input filter networks are also configured to prevent fault coupling between the two power supplies. The first power conversion circuit outputs the operating power for the main microcontroller. and It is used to power the main microcontroller logic and high-side driver, and the second power conversion circuit outputs the operating power for the secondary microcontroller. and It is also used for powering the sub-microcontroller logic and low-side driver, where This indicates the operating power supply voltage of the main microcontroller. Indicates the operating power supply voltage of the sub-microcontroller;

[0100] The contactor coil circuit is constructed by connecting a high-side switching device and a low-side switching device in series. The high-side switching device is denoted as... Furthermore, when it is turned on, the positive terminal of the contactor coil is connected to the coil power supply bus. The low-side switching device is denoted as... And when it is turned on, the negative terminal of the contactor coil is connected to the return bus, where This represents the high-side switching device on the positive side of the contactor coil, implemented using a power MOSFET. This indicates the low-side switching device on the negative side of the contactor coil, implemented using a power MOSFET;

[0101] The main microcontroller outputs the high-side drive control signal. Up to the high-side driver and driven by the high-side driver The gate of the microcontroller outputs a low-side drive control signal. To the low-side driver and driven by the low-side driver The gate, in which This indicates the high-side drive control signal of the main microcontroller, and its value is either an on or off command. This indicates the low-side drive control signal of the sub-microcontroller, and its value is either an on command or an off command;

[0102] The energizing condition of the contactor coil is determined by the two series drives and is defined as follows: ,in Indicates that the contactor coil is energized and enabled when When true, a complete current path is formed across the two ends of the contactor coil; when When the error is false, the contactor coil current path is cut off. This represents a logical AND operation; upon receiving the contactor closure permission command generated in step S4, the main microcontroller will... Set to conduction command and the sub-microcontroller will Set to conduction command to enable and Simultaneously, the circuit is turned on and the contactor coil is energized. Upon receiving the disconnect protection command generated in step S4, the main microcontroller will... Set to disconnect command and sub-microcontroller will At least one of the disconnect commands is executed, thereby causing and At least one of them shall be turned off and the current path of the contactor coil shall be cut off;

[0103] To ensure failover safety, the high-side drive control signal output of the main microcontroller is configured with a power-on default disconnect logic and is connected via a hardware pull-down resistor. When the main microcontroller is reset or powered off, the command is locked to disconnect. The low-side drive control signal output of the slave microcontroller is set to power-on default disconnect logic and is controlled by a hardware pull-down resistor. When the sub-microcontroller is reset or powered off, it is locked to a disconnect command, so that in the event of an abnormal power supply or microcontroller malfunction in any control circuit, the contactor coil can be de-energized and enter the disconnect protection state through the series drive structure.

[0104] In this specific embodiment, S6 includes:

[0105] The battery management controller executes the command immediately after the disconnection protection command takes effect and S5 has de-energized the contactor coil. At the same time as issuing the disconnection protection command, the preset confirmation time window is activated. And fixed selection And latch the battery output current reference value in the most recent sampling result before the disconnect protection command is issued. Compared with the output voltage reference value The battery output current is acquired by a Hall current sensor installed in the battery output main circuit and obtained through analog-to-digital conversion, while the output voltage is acquired by a voltage divider sampling circuit at the battery output terminal and obtained through analog-to-digital conversion. and All adopt continuous The arithmetic mean of the samples is used to suppress transient noise;

[0106] In the preset confirmation time window When the battery expires, the main controller reads the status of the contactor auxiliary contacts. Simultaneously, the battery output current confirmation value is collected. Confirmed value of output side voltage ,in The data is obtained by connecting the auxiliary contacts of the contactor to the main digital input terminal of the battery management controller after optocoupler isolation. This indicates that the auxiliary contact is in the open state. This indicates that the auxiliary contact is in the closed state. and Sampling and filtering methods and and same;

[0107] The battery management controller calculates the decrease in battery output current. With output voltage change And compared with a threshold, the calculation relationship is as follows: in This indicates the decrease in battery output current, expressed in amperes (A). This represents the reference value of the battery output current before the disconnection protection command is issued, and the unit is 1. This represents the battery output current confirmation value at the end of the preset confirmation time window, and the unit is 1. Represents the change in output voltage, with units of 1. This represents the output voltage reference value before the disconnection protection command is issued, and the unit is 1. This represents the output voltage confirmation value at the end of the preset confirmation time window, and the unit is 1. This represents the absolute value operation;

[0108] The preset current disconnection confirmation threshold is fixed. The preset voltage disconnection confirmation threshold is fixed at [value]. And define the successful disconnection condition as and and When the auxiliary contact state of the contactor has not switched to the open state or Not achieved or Not achieved The system is then judged as failing to disconnect or suspected adhesion, and a serious fault status is generated. ;

[0109] In a critical fault condition The battery management master controller executes a closing lockout and continuously prohibits the output of contactor closing permission commands, while simultaneously displaying the severe fault status and contactor auxiliary contact status. and The judgment result and the time of the fault occurrence are written into the fault record area and the fault reporting information is output to the train control system and maintenance terminal through the vehicle communication interface.

[0110] The manual double-pole switch is located at the positive and negative terminals of the battery output and is implemented using a molded case circuit breaker. The manual double-pole switch is equipped with a mechanical position indicator and auxiliary contacts, and the confirmation signal of the disconnected position is connected to the maintenance permission judgment input. Before entering the maintenance state, the battery management master controller requires the manual double-pole switch to be operated to the disconnected position and interlocks the openable state of the battery box door or maintenance door with the disconnected position through the door lock fixing structure, so that the door lock fixing structure releases the door opening mechanism only when the manual double-pole switch is in the disconnected position.

[0111] When a severe fault condition When present, the battery management controller will set the manual bipolar switch to the OFF position as an output maintenance enable flag. The necessary condition is that the maintenance permission mark is prohibited from being output without confirming the disconnection position. This upgrades maintenance isolation from the contactor control link to manual bipolar isolation closed-loop confirmation in scenarios where disconnection fails or adhesion is suspected.

[0112] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

[0113] In this invention, redundant acquisition datasets, channel confidence, data health status, and security judgment data form a continuous processing chain from acquisition input to protection judgment, enabling slave acquisition failures or acquisition chip anomalies to be incorporated into security decisions through consistency verification, residual analysis, and degradation elimination mechanisms.

[0114] This invention combines the safety judgment result with the dual-path drive of the main and auxiliary single-chip microcomputers, the independent power supply circuit, the contactor auxiliary contacts, and the confirmation of current and voltage changes on the output side, so that the closing permission and opening protection no longer depend on a single control path, and forms a maintenance-side isolation closed loop through the manual double-pole switch and the door lock fixing structure.

Claims

1. A safety design method for a single-rail auxiliary storage battery, characterized in that, include: S1. Collect battery pack cell voltage data and cell temperature data through the first slave control module and the second slave control module, and have at least one slave control module collect preset typical temperature points in parallel through the analog front-end acquisition chip and the microcontroller temperature acquisition channel to form a redundant acquisition dataset. S2. Perform consistency verification and residual analysis on redundant acquisition datasets to generate channel confidence and data health status for each acquisition channel; S3. Perform weighted acceptance, anomaly removal, or downgraded acceptance based on channel confidence and data health status to obtain security judgment data; S4. Based on safety judgment data, identify single-cell overvoltage, single-cell undervoltage, and temperature over-limit conditions, and generate contactor closing permission command or disconnection protection command. The contactor closing adopts a closing strategy that is confirmed by both the main microcontroller and the auxiliary microcontroller, and the contactor disconnection adopts a disconnection strategy that can be triggered by either the main microcontroller or the auxiliary microcontroller with valid confirmation. S5. According to the contactor closing permission command or disconnection protection command, the main microcontroller controls the positive drive circuit of the contactor coil, and the auxiliary microcontroller controls the negative drive circuit of the contactor coil. The main microcontroller and the auxiliary microcontroller are powered by independent power supply circuits. S6. After executing the disconnection protection command, the disconnection result is confirmed by the status of the contactor auxiliary contacts, the change in current and voltage on the battery output side, and a serious fault state is generated when disconnection fails or suspected adhesion is detected, and the manual double-pole switch is used as the object of maintenance isolation execution.

2. The safety design method for a single-rail auxiliary battery according to claim 1, characterized in that, S1 includes: The first slave module and the second slave module are respectively connected to the single cell voltage sampling harness and the single cell temperature sampling harness of the same battery pack; The first slave control module and the second slave control module respectively generate data frames containing individual cell number, sampling time, individual cell voltage value, individual cell temperature value and acquisition channel identifier; When the analog front-end acquisition chip and the microcontroller temperature acquisition channel acquire the same preset typical temperature point, the temperature values ​​of the two are written into the parallel temperature data item corresponding to the same temperature point number.

3. The safety design method for a single-rail auxiliary battery according to claim 2, characterized in that, S2 include: A preset sampling synchronization window is determined based on the sampling time in the data frame, and the difference between the data of the first slave control module and the data of the second slave control module with the same unit number and within the preset sampling synchronization window is calculated. Residual calculations are performed on the temperature values ​​of the analog front-end acquisition chip and the temperature acquisition channel of the microcontroller for the same temperature point number. The difference and the residual are compared with a preset voltage consistency threshold and a preset temperature consistency threshold, respectively, to generate a consistency flag; The consistency flag, the number of consecutive anomalies, the communication verification result, and the sampling timing deviation are mapped to normal state, degraded state, or fault state, which are used as the data health status. The channel confidence level is generated based on the data health status and consistency markers.

4. The safety design method for a single-rail auxiliary battery according to claim 3, characterized in that, S3 includes: Set the preset downgrade threshold to be lower than the preset acceptance threshold; When the number of consecutive abnormal events reaches the preset rejection limit, the data of the corresponding acquisition channel will be rejected first and a corresponding channel fault mark will be generated. When the number of consecutive anomalies does not reach the preset rejection count, the channel confidence of the acquisition channel is greater than or equal to the preset acceptance threshold, and the consistency is marked as passed, the data of that acquisition channel will be included in the weighted acceptance. When the number of consecutive anomalies does not reach the preset rejection count, and the channel confidence of the acquisition channel is greater than or equal to the preset downgrade threshold and less than the preset acceptance threshold, or the channel confidence is greater than or equal to the preset acceptance threshold but the consistency is marked as failing, the data of the acquisition channel is marked as downgraded acceptance data and its triggering of contactor closing permission command is restricted. When the confidence level of a data acquisition channel is less than the preset degradation threshold, the data of that acquisition channel is removed and a corresponding channel fault flag is generated.

5. The safety design method for a single-rail auxiliary battery according to claim 4, characterized in that, The security determination data in step S3 is generated as follows: the normalized weights of the acquisition channels that have not been eliminated are determined according to the channel confidence level; The normalized weights are used to perform a weighted calculation on the voltage values ​​of cells with the same cell number and the temperature values ​​of cells with the same temperature point number. When the number of acquisition channels participating in the weighted calculation is below the preset redundancy threshold, a downgrade status flag will be added to the security judgment data. When a degraded status flag or a channel fault flag exists, a contactor closing permission command is allowed to be generated only if the channel confidence of at least one non-degraded acquisition channel is greater than or equal to the preset acceptance threshold, the consistency flag is passed, and no corresponding channel fault flag is generated.

6. The safety design method for a single-rail auxiliary battery according to claim 5, characterized in that, S4 includes: The individual cell voltage values ​​in the safety assessment data are compared with preset overvoltage thresholds and preset undervoltage thresholds, respectively; the individual cell temperature values ​​in the safety assessment data are compared with preset temperature over-limit thresholds. A protection disconnection command is generated when any comparison result meets the protection triggering condition. When all individual unit voltage and temperature values ​​fail to meet the protection triggering conditions and both the main and auxiliary microcontrollers output closure confirmation signals, a contactor closure permission command is generated.

7. The safety design method for a single-rail auxiliary battery according to claim 6, characterized in that, The disconnection strategy described in step S4 includes: When the main microcontroller confirms that the protection trigger condition is met based on the safety judgment data, the main microcontroller cancels the positive drive of the contactor coil. When the secondary microcontroller confirms that the protection trigger condition is met based on the safety judgment data, the secondary microcontroller cancels the negative terminal drive of the contactor coil. When either the main microcontroller or the auxiliary microcontroller detects a communication timeout, power supply abnormality, or control output abnormality in the other microcontroller, the microcontroller that detected the abnormality cancels the corresponding contactor coil drive.

8. A safety design method for a single-rail auxiliary battery according to claim 7, characterized in that, S5 include: The control circuits of the main microcontroller and the sub-microcontroller are respectively connected to independent power conversion circuits. The main microcontroller outputs a high-side drive control signal to the positive terminal switching device of the contactor coil, and the auxiliary microcontroller outputs a low-side drive control signal to the negative terminal switching device of the contactor coil. Upon receiving a disconnect protection command, at least one of the high-side drive control signal and the low-side drive control signal is set to the disconnect state.

9. A safety design method for a single-rail auxiliary battery according to claim 8, characterized in that, S6 include: Within a preset confirmation time window after the disconnection protection command is issued, the status of the contactor auxiliary contacts is read, and the current and voltage values ​​before the disconnection protection command are issued are compared with the reference to collect the decrease in battery output current and the change in output voltage. If the auxiliary contact of the contactor is not switched to the open state, or the decrease in the current on the battery output side does not reach the preset current disconnection confirmation threshold, or the change in the voltage on the output side does not reach the preset voltage disconnection confirmation threshold, it is determined as a disconnection failure or suspected adhesion. After determining that the disconnection has failed or is suspected of being stuck, the lock contactor closes the permission command, records the serious fault status, and outputs fault reporting information to the train control system or maintenance terminal.

10. A safety design method for a single-rail auxiliary storage battery according to claim 9, characterized in that, The manual double-pole switch mentioned in step S6 is set at the positive and negative terminals of the battery output, and the manual double-pole switch is a molded case circuit breaker; Before entering the maintenance state, the manual double-pole switch is first operated to the off position, and then the opening state of the battery box door or maintenance door is restricted to correspond to the off position by the door lock fixing structure. When a severe fault condition exists, the disconnection position is confirmed as the output condition for the maintenance-allowed flag; When the disconnection position is not confirmed, the maintenance permission flag should not be output.

Images