A control method and system for abnormal reset of a battery management system, and a vehicle

Abstract

The application discloses a kind of battery management system abnormal reset control method, system and vehicle, including battery management system and redundancy controller, battery management system carries out CAN communication with high voltage relay module, stores vehicle high voltage power-on related signal, calculates and stores battery SOC, SOP, issues maintenance high voltage related control instruction;Redundancy controller carries out CAN communication with battery management system, obtains and stores vehicle high voltage power-on related signal from battery management system, battery SOC and battery SOP;Redundancy controller carries out CAN communication with high voltage relay module, in the case where battery management system long time CAN frame is lost, and before abnormal reset, vehicle is in high voltage power-on state, set up takeover flag bit, execute abnormal reset redundancy control strategy, maintain vehicle high voltage power-on state, and the stored battery SOC, SOP are used as initial value for real-time calculation calculation.The safety risk caused by power interruption can be avoided after the abnormal reset of the battery management system by using the application.

Description

Technical Field

[0001] This invention belongs to the field of vehicle battery management, specifically relating to a control method, system, and vehicle for abnormal reset of a battery management system. Background Technology

[0002] With the rapid development of the new energy vehicle market and the continuous improvement of technological capabilities, the number of components that the battery management system needs to control is increasing, and the control algorithms are becoming more and more complex, resulting in a continuous increase in the complexity of product hardware design and software load.

[0003] The battery management system (BMS), as the management component of the power battery, is responsible for the output of high voltage, including the control of the high-voltage relay, the calculation of the battery's remaining charge (SOC), and the calculation of the battery's charge / discharge power (SOP). If the BMS experiences an abnormality such as a reset, the high-voltage relay will unexpectedly disconnect, causing the vehicle to suddenly lose power. The remaining charge and charge / discharge power of the power battery will also be inaccurately calculated, making it impossible to assess the battery's condition. Especially during vehicle operation or when the vehicle's assisted driving system is engaged, if the BMS suddenly resets, causing the high-voltage relay to unexpectedly disconnect, a power interruption will inevitably occur, potentially leading to a collision in severe cases. The specific analysis is as follows:

[0004] 1. After the battery management system is reset and restored, hardware initialization will be performed. If the high-voltage relay is not specially controlled or processed during hardware initialization, the high-voltage relay will inevitably return to its initial state (i.e., the open state), which will lead to power loss, power interruption, and safety risks.

[0005] 2. During the abnormal reset of the battery management system, relevant CAN messages will not be sent. However, after the abnormal reset is restored, if the calculation module has not completed the calculation of the battery SOC (State of Charge, remaining power) and battery SOP (Charge and Discharge Power), it will send out SOC=0 and SOP=0 as CAN messages for vehicle application control, which may cause the vehicle to lurch forward or jerk, posing a safety risk.

[0006] 3. If the battery management system fails to recover on its own after a certain period of time following an abnormal reset, there is also a risk of power interruption.

[0007] Therefore, how to maintain the high-voltage power supply of the entire vehicle after an abnormal reset of the battery management system is an urgent problem to be solved. Summary of the Invention

[0008] In view of the shortcomings of the prior art, the purpose of this application is to provide a control method, system and vehicle for abnormal reset of the battery management system, so as to avoid safety risks caused by power interruption after abnormal reset of the battery management system.

[0009] Firstly, this application provides a control system for abnormal reset of a battery management system, including a battery management system. The battery management system communicates with a high-voltage relay module via CAN, stores the high-voltage relay status, the battery management system operating mode, and the voltage signal behind the high-voltage relay, calculates and stores the battery SOC and battery SOP, and issues high-voltage relay control commands and battery management system operating mode control commands. The control system also includes a redundant controller, which communicates with the battery management system via CAN, obtains and stores the high-voltage relay status, battery management system operating mode, high-voltage relay voltage signal, battery SOC, and battery SOP from the battery management system. The redundant controller communicates with the high-voltage relay module via CAN. If the battery management system experiences prolonged CAN frame loss and the vehicle was in a high-voltage powered-on state before the abnormal reset, the redundant controller sets a takeover flag, executes an abnormal reset redundant control strategy, maintains the vehicle in a high-voltage powered-on state, and uses the stored battery SOC and battery SOP as initial values ​​for real-time calculation of battery SOC and battery SOP. The calculated values ​​are then used for vehicle control.

[0010] By setting a takeover flag and executing an abnormal reset redundancy control strategy when the battery management system (BMS) undergoes an abnormal reset and the vehicle is in a high-voltage powered-on state before the reset, the redundant controller effectively avoids unexpected disconnection of the high-voltage relay caused by the abnormal BMS reset, ensuring the continuous connectivity of the high-voltage circuit and significantly improving the safety and operational stability of the vehicle's high-voltage system. By using the battery SOC and SOP stored before the abnormal reset as the initial values ​​for real-time calculation by the redundant controller, data clearing or initialization jumps caused by the BMS reset are avoided, effectively ensuring the continuity and accuracy of battery state of charge and power state calculations during fault switching, and preventing vehicle power anomalies or power limitations caused by sudden data changes. By setting dual logical judgment conditions of long-term CAN frame loss and the high-voltage state before the reset, extreme fault scenarios requiring takeover can be accurately identified, effectively preventing policy mis-triggering and improving the anti-interference capability and logical reliability of the control system in complex electromagnetic interference and communication anomaly environments.

[0011] Optionally, the redundant controller is a vehicle controller. By reusing the vehicle controller as a redundant control carrier, there is no need to add a separate dedicated redundant control module, which can significantly reduce the number of additional electronic control unit hardware and wiring harness connections.

[0012] Secondly, this application provides a control method for abnormal reset of a battery management system, employing the aforementioned control system for abnormal reset of a battery management system. The steps performed by the redundant controller in the control method include:

[0013] The system determines whether the battery management system (BMS) has experienced prolonged CAN frame loss. If so, it sets the takeover flag. Next, it checks if the vehicle was in a high-voltage powered-on state before the BMS abnormal reset. If so, it executes the abnormal reset redundancy control strategy to maintain the vehicle's high-voltage powered-on state. The stored battery SOC and SOP are used as initial values ​​for real-time calculation, and are stored upon power-off, along with the takeover flag. The calculated battery SOC and SOP are then used for vehicle control.

[0014] Prolonged CAN frame loss in the battery management system (BMS) can lead to abnormal BMS resets that fail to recover for extended periods. The redundancy strategy is triggered only when BMS communication is abnormal and the system requires high voltage, effectively preventing malfunctions due to single-condition misjudgments and significantly improving the accuracy of abnormal scenario identification and the robustness of the control logic. Upon meeting the judgment conditions, the abnormal reset redundancy control strategy is executed immediately, maintaining the vehicle's high-voltage power supply. This effectively eliminates the risk of high-voltage relays being de-energized due to communication interruptions during BMS abnormal resets, ensuring uninterrupted transition of the high-voltage circuit during fault transients. This guarantees continuous power supply to the vehicle's high-voltage accessories and uninterrupted drive system power. By using the battery SOC and SOP stored before the BMS abnormal reset as the initial values ​​for real-time calculation by the redundancy controller, the abrupt calculation problems caused by data loss or starting from default values ​​after traditional resets are effectively overcome. This allows the battery state calculation results during the redundancy control phase to smoothly continue from the actual values ​​before the reset, preventing vehicle power limitations or power interruptions caused by data jumps. By updating the calculated battery SOC and SOP values ​​in real time during the redundancy control process and storing them when the system is powered off, and simultaneously storing the takeover flag, the system ensures the preservation of critical status data after the system is completely powered off.

[0015] Optionally, if both condition 1a and condition 1b are met, then the battery management system is determined to have experienced prolonged CAN frame loss; wherein,

[0016] Condition 1a: The first controller that communicates with the battery management system via CAN determines that the battery management system is experiencing CAN frame loss and the duration is greater than a first preset time.

[0017] Condition 1b: The second controller that communicates with the battery management system via CAN determines that the battery management system is experiencing CAN frame loss and the duration is greater than the first preset time.

[0018] By using two independent nodes, the first and second controllers, to perform heterogeneous cross-verification of the BMS communication status, misjudgments of frame loss caused by transient electromagnetic interference or occasional transceiver failures in a single controller can be effectively avoided, thus significantly reducing the probability of false triggering of the redundancy takeover strategy. When both independent controllers continuously detect BMS frame loss on their respective communication links, it can be confirmed that the communication is abnormal on the BMS side, rather than a sampling deviation of a single controller. This dual confirmation mechanism significantly improves the reliability and robustness of the system in identifying communication faults in harsh vehicle environments such as strong vibration and high and low temperatures. By introducing a duration threshold condition that exceeds a first preset time, combined with synchronous timing verification by the two controllers, it is possible to accurately distinguish between occasional CAN bus transient disturbances and continuous communication interruptions, preventing frequent triggering of redundant state switching due to brief frame loss pulses, and ensuring the stability of the original control logic during normal communication fluctuations.

[0019] Optionally, the first controller is a vehicle controller, and the second controller is a motor controller. The vehicle controller and the motor controller are functionally independent and are located at the vehicle energy management level and drive execution level, respectively. Both have their own physical receiving channels and data processing logic for the BMS CAN messages. By using two functionally independent controllers to synchronously perform frame loss timing verification, true heterogeneous redundancy detection can be achieved, effectively preventing single misjudgments caused by local software abnormalities or port failures of a certain controller, and significantly improving the objectivity and reliability of conclusions on long-term CAN frame loss.

[0020] Optionally, the abnormal reset redundancy control strategy is as follows: the redundant controller does not perform hardware initialization on the high-voltage relay, issues a control command for the battery management system to operate in high-voltage activation mode, and issues a control command for the high-voltage relay to close.

[0021] By bypassing hardware initialization of the high-voltage relays through the redundant controller, and directly issuing control commands for the battery management system (BMS) to activate high voltage and close the high-voltage relays, the relay state reset or disconnection caused by hardware initialization in traditional reset procedures can be effectively avoided. This ensures continuous conduction of the high-voltage circuit during BMS abnormal resets, preventing power loss to high-voltage accessories and interruption of drive power, thus guaranteeing the continuity of driving safety and ride experience. Simultaneously issuing commands for activating the high-voltage operating mode and closing the high-voltage relays ensures logical consistency between the high-voltage relay state and the BMS operating mode, avoiding actuator conflicts or protection malfunctions caused by mode-state mismatches. This ensures the integrity and self-consistency of the vehicle's high-voltage management logic during redundant control.

[0022] Optionally, the steps performed by the battery management system include:

[0023] The abnormal reset flag and the takeover flag are checked:

[0024] If both the abnormal reset flag and the takeover flag are present simultaneously, the CAN communication module within the battery management system will not be activated (i.e., CAN communication will not be performed), high-voltage relay control commands will be stopped, and the calculation and storage of battery SOC and battery SOP will cease. When the BMS detects an abnormal reset and the redundant controller has the takeover flag set, it will proactively prevent the CAN communication module from activating, stop issuing high-voltage relay control commands, and stop the calculation and storage of battery SOC and battery SOP. This effectively prevents the BMS from sending erroneous control messages and preempting the bus in an unknown initial state, thereby providing the redundant controller with an interference-free exclusive control environment. This ensures that the execution of the high-voltage maintenance strategy is not disrupted by any conflicting commands, significantly improving the system's safety level.

[0025] If a takeover flag is present but an abnormal reset flag is absent, the battery SOC and SOP are obtained from the redundant controller, and these values ​​are used as initial values ​​for real-time calculation of the battery SOC and SOP. When the BMS detects only the presence of the takeover flag and no abnormal reset, it obtains the calculated and stored battery SOC and SOP from the redundant controller as its initial values. This allows the BMS to quickly obtain accurate initial battery state values, ensuring that the calculation results after BMS recovery remain consistent with those during the redundant control phase.

[0026] If an abnormal reset flag exists but a takeover flag does not, and the vehicle is in a high-voltage powered-on state before the battery management system (BMS) experiences an abnormal reset, the abnormal reset control strategy is executed to maintain the high-voltage powered-on state. The stored battery SOC and SOP are used as initial values ​​for real-time calculation. When the BMS detects that only its own abnormal reset flag exists and it has not been redundantly taken over, it actively determines whether it was in a high-voltage state before the abnormal reset. If so, it autonomously executes the abnormal reset control strategy to maintain high voltage and performs calculations based on its stored battery SOC and SOP as initial values. This ensures that even in a mild abnormal reset scenario where the redundant controller does not trigger takeover, the BMS can still autonomously maintain a high-voltage state and quickly restore its calculation function, improving the system's ability to handle different levels of fault severity.

[0027] Optionally, the abnormal reset control strategy is as follows: the bottom-level unit of the battery management system does not perform hardware initialization on the high-voltage relay; the application-level unit of the battery management system issues a control command to activate the battery management system's operating mode and a control command to close the high-voltage relay. By not performing hardware initialization on the high-voltage relay and directly issuing control commands to activate the battery management system's operating mode and close the high-voltage relay, the relay state reset or disconnection caused by hardware initialization in the traditional reset process can be effectively avoided. This ensures that the high-voltage circuit remains continuously conductive during BMS abnormal reset, thereby preventing power failure of high-voltage accessories and interruption of drive power, and ensuring the continuity of driving safety and driving experience. By simultaneously issuing the high-voltage activation operating mode command and the high-voltage relay closing command, the state of the high-voltage relay is kept logically consistent with the operating mode of the battery management system, avoiding actuator conflicts or protection malfunctions caused by mode and state mismatch. By dividing the tasks into layers—the low-level constraints that do not initialize the hardware and the application-level actions that issue high-voltage activation commands—the low-level hardware remains silent and does not interfere with the state of the high-voltage relay ports, while the application layer actively outputs control commands. The two work together to avoid execution conflicts caused by inconsistent goals between the low-level and application layers, and fully utilize the application layer's logical decision-making ability regarding the system's operating mode, thereby improving the collaborative efficiency of control response after abnormal reset.

[0028] Optionally, to prevent the application layer unit from defaulting to disconnecting the high-voltage relay control command after an abnormal reset and from sending CAN messages with a value of 0 for the battery SOC and battery SOP to the vehicle controller before the battery SOC and battery SOP calculations are completed, thus causing the vehicle controller to use the high-voltage relay for control and resulting in vehicle jerking or forward lurching, the lower-level unit, after not performing hardware initialization on the high-voltage relay, will not respond to the high-voltage relay control command or send CAN messages about the battery SOC and battery SOP if it does not receive the abnormal reset recovery control flag. By setting the lower-level unit to only respond to the high-voltage relay control command and send CAN messages about the battery SOC and battery SOP after receiving the abnormal reset recovery control flag, the system effectively avoids the lower-level unit rashly performing high-voltage relay switching operations or broadcasting potentially erroneous calculation parameters before the application layer unit has completed self-testing, status confirmation, or data reconstruction, significantly improving the operational safety during the system reset process. During the period when the underlying unit does not receive the abnormal reset recovery control flag, actively prohibiting the transmission of CAN messages for battery SOC and battery SOP can avoid broadcasting invalid values ​​that have not been calibrated by the application layer to the vehicle network. This prevents the downstream vehicle controller from receiving incorrect state estimates and making unreasonable power limits or torque commands, thereby ensuring the validity and reliability of CAN bus data during the fault transition period.

[0029] Optionally, the bottom-layer unit sets the abnormal reset flag after determining that the battery management system has recovered from an abnormal reset. The application-layer unit uses the stored battery SOC and battery SOP as initial values ​​to perform real-time calculations of the battery SOC and battery SOP. After completing one calculation, it sets the abnormal reset recovery control flag. The bottom-layer unit sets the abnormal reset flag first to clearly inform the system that the BMS hardware reset has ended; the application-layer unit sets the abnormal reset recovery control flag after completing one battery SOC and battery SOP calculation to notify the bottom-layer unit that the calculation has been effectively completed. This hierarchical and time-phased flag setting sequence allows the application layer, the bottom layer, and external controllers (such as the vehicle controller) to clearly understand the current recovery stage of the BMS, which is beneficial for each node in the system to make reasonable control decisions based on the accurate recovery status. By requiring the application-layer unit to complete at least one complete calculation based on the stored battery SOC and battery SOP before setting the abnormal reset recovery control flag, it is ensured that the bottom-layer unit will not respond to high-voltage relay control commands or send CAN messages before receiving the flag.

[0030] Optionally, if the stored high-voltage relay status is closed, the battery management system's operating mode is high-voltage activation, and the voltage signal behind the high-voltage relay is high-voltage, then the vehicle is determined to be in a high-voltage power-on state before the battery management system's abnormal reset. By performing a logical AND operation on three independent conditions—the high-voltage relay status being closed, the battery management system's operating mode being high-voltage activation, and the voltage signal behind the high-voltage relay being high-voltage—and using the triple information of control command status, operating mode status, and physical voltage feedback signal to mutually verify each other, the system effectively avoids misjudgments that may occur due to sensor drift, communication delays, or logical conflicts when relying on a single judgment condition (such as only detecting the voltage signal). This significantly improves the system's accuracy in identifying the true high-voltage state before reset.

[0031] Thirdly, this application provides a vehicle that includes a control system for abnormal reset of the aforementioned battery management system. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the embodiments of this application will be described below.

[0033] Figure 1 This is a schematic diagram of the vehicle in an embodiment of this application.

[0034] Figure 2 This is a control system architecture diagram for abnormal reset of the battery management system in this application embodiment.

[0035] Figure 3 This is a flowchart illustrating the execution of the redundant controller in the control method for abnormal reset of the battery management system according to an embodiment of this application.

[0036] Figure 4 This is a flowchart illustrating the execution of the battery management system in the control method for abnormal reset of the battery management system according to an embodiment of this application.

[0037] Figure 5 This is a flowchart illustrating the execution of the underlying unit in the control method for abnormal reset of the battery management system according to an embodiment of the application.

[0038] Figure 6 This is an execution flowchart of the application layer unit in the control method for abnormal reset of the battery management system according to the application embodiment. Detailed Implementation

[0039] The embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The detailed description of the following embodiments and the accompanying drawings are used to illustrate the principles of this application by way of example, but should not be used to limit the scope of this application, that is, this application is not limited to the described embodiments.

[0040] like Figure 1 As shown, Figure 1 This is a schematic diagram of a vehicle in an embodiment of this application. The vehicle may be, but is not limited to, a pure electric vehicle (PEV / BEV), a hybrid electric vehicle (HEV), a range-extended electric vehicle (REEV), a plug-in hybrid electric vehicle (PHEV), or a new energy vehicle.

[0041] like Figure 1 As shown in the embodiments of this application, the vehicle includes a control system for abnormal reset of the battery management system.

[0042] like Figure 2As shown, the battery management system abnormal reset control system in this embodiment includes a battery management system 1 and a redundant controller 3. The high-voltage relay module 2 in this embodiment includes a high-voltage relay, a high-voltage relay controller, and a CAN communication module, enabling CAN communication, which is prior art. The battery management system 1 communicates with the high-voltage relay module 2 via CAN, storing the high-voltage relay status, the battery management system operating mode, and the voltage signal behind the high-voltage relay. It calculates and stores the battery SOC and battery SOP, and issues high-voltage relay control commands and battery management system operating mode control commands. The redundant controller 3 communicates with the battery management system 1 via CAN, acquiring and storing the high-voltage relay status, battery management system operating mode, voltage signal behind the high-voltage relay, battery SOC, and battery SOP from the battery management system 1. The redundant controller 3 communicates with the high-voltage relay module 2 via CAN. In the event of prolonged CAN frame loss in the battery management system 1, and the vehicle being in a high-voltage powered-on state before the abnormal reset, the redundant controller 3 sets the takeover flag, executes the abnormal reset redundant control strategy, maintains the vehicle in a high-voltage powered-on state, and uses the stored battery SOC and battery SOP as initial values ​​for real-time calculation of battery SOC and battery SOP. After calculation, the results are used for vehicle control.

[0043] By setting the takeover flag and executing the abnormal reset redundancy control strategy when the Battery Management System 1 (BMS) undergoes an abnormal reset and the vehicle is in a high-voltage power-on state before the reset, the redundant controller 3 effectively avoids the unexpected disconnection of the high-voltage relay caused by the abnormal BMS reset, ensuring the continuous connectivity of the high-voltage circuit and significantly improving the safety and operational stability of the vehicle's high-voltage system. By using the battery SOC and battery SOP stored before the abnormal reset as the initial values ​​for real-time calculation by the redundant controller 3, data clearing or initialization jumps caused by the BMS reset are avoided, effectively ensuring the continuity and accuracy of the calculation of battery state of charge and power state during fault switching, and preventing vehicle power abnormalities or power limitations caused by data mutations. By setting dual logical judgment conditions of long-term CAN frame loss and high-voltage state before reset, extreme fault scenarios that require takeover can be accurately identified, effectively preventing policy mis-triggering and improving the anti-interference capability and logic reliability of the control system in complex electromagnetic interference and communication abnormal environments.

[0044] In one possible embodiment, the redundant controller 3 is a vehicle controller.

[0045] As an example, the bottom-level unit of the battery management system 1 is responsible for determining whether an abnormal reset has occurred and for responding to high-voltage relay control commands and sending and receiving CAN messages. The application-level unit of the battery management system 1 is responsible for issuing high-voltage relay control commands and battery management system operating mode control commands according to user needs. After the battery management system starts working, it begins to store high-voltage relay status, battery management controller operating mode, calculate battery SOC, calculate battery SOP, and other high-voltage status-related signals in real time, and reads the stored values ​​and transmits them to its application-level unit after the abnormal reset is recovered.

[0046] like Figure 3 As shown, the control method for abnormal reset of the battery management system in this embodiment of the application adopts the above-mentioned control system for abnormal reset of the battery management system. The steps performed by the redundant controller 3 in this control method include:

[0047] S11. Determine if the battery management system has experienced prolonged CAN frame loss. If yes, proceed to S12; otherwise, end the process.

[0048] As an example, prolonged CAN frame loss in the battery management system can cause the battery management system to reset abnormally and fail to recover for an extended period.

[0049] In one possible embodiment, if both conditions 1a and 1b are met simultaneously, it is determined that the battery management system has experienced prolonged CAN frame loss. Condition 1a: The first controller communicating with the battery management system 1 via CAN determines that the battery management system is experiencing CAN frame loss for a duration exceeding a first preset time. Condition 1b: The second controller communicating with the battery management system 1 via CAN determines that the battery management system is experiencing CAN frame loss for a duration exceeding the first preset time. By utilizing dual controllers for mutual backup and verification, the abnormality detected by either controller alone is insufficient to trigger the high-voltage maintenance of the subsequent redundant control strategy, effectively eliminating the single-point failure risk in the fault detection stage and further improving the overall safety level of the battery management system's abnormal reset control strategy.

[0050] In one possible embodiment, the first controller is a vehicle controller and the second controller is a motor controller 4.

[0051] S12, set the takeover flag, and then execute S13.

[0052] S13. Determine whether the vehicle was in a high-voltage power-on state before the battery management system was abnormally reset. If so, execute S14; otherwise, execute S15.

[0053] In one possible embodiment, if the stored high-voltage relay is closed, the battery management system is in high-voltage activation mode, and the voltage signal behind the high-voltage relay is high voltage, then it is determined that the vehicle is in a high-voltage power-on state before the battery management system is abnormally reset.

[0054] S14. Execute the abnormal reset redundancy control strategy to maintain the vehicle's high-voltage power-on state. Use the stored battery SOC and battery SOP as initial values ​​for real-time calculation of battery SOC and battery SOP, and store them upon power-off. Simultaneously, store the takeover flag bit, and then terminate. The calculated battery SOC and battery SOP are used for vehicle control.

[0055] In one possible embodiment, the abnormal reset redundancy control strategy is as follows: the redundant controller 3 does not perform hardware initialization on the high-voltage relay, the redundant controller 3 issues a control command for the battery management system to operate in high-voltage activated mode, and the redundant controller 3 issues a control command for the high-voltage relay to close. By simultaneously issuing the high-voltage activated operating mode command and the high-voltage relay closing command, the state of the high-voltage relay is kept logically consistent with the operating mode of the battery management system, avoiding actuator conflicts or protection malfunctions caused by mode and state mismatch, and ensuring the integrity and self-consistency of the vehicle's high-voltage management logic during redundancy control.

[0056] S15. Maintain the vehicle's low-voltage power supply, then end.

[0057] This mechanism not only provides complete data traceability during the fault period for maintenance diagnosis, but also facilitates the rapid identification of historical states based on the takeover flag bit when the system is powered on again, providing reliable data support for the decision-making of system self-recovery or safe power-down strategies.

[0058] like Figure 4 As shown, in one possible embodiment, the steps performed by the battery management system 1 in the control method for abnormal reset of the battery management system include:

[0059] S21. Determine whether both the abnormal reset flag and the takeover flag exist simultaneously. If yes, execute S22; otherwise, execute S23.

[0060] S22. Do not start the CAN communication module (i.e., do not perform CAN communication), stop issuing high-voltage relay control commands, stop calculating and storing battery SOC and battery SOP, and then execute S23.

[0061] The Battery Management System 1 (BMS1) does not activate its internal CAN communication module to avoid conflicts with the CAN signals sent by the Redundant Controller 3. BMS1 does not control the high-voltage relays to avoid power loss due to simultaneous operation with the Redundant Controller 3. Furthermore, BMS1 does not perform data calculations or storage to prevent the battery SOC and SOP information being tampered with by the Redundant Controller 3. In other words, once the Redundant Controller 3 takes over during the current power-on cycle, it remains in control, even if BMS1 recovers. The next time the vehicle is powered on, the Redundant Controller 3 sends the stored battery SOC, SOP, and takeover flag to BMS1.

[0062] When the BMS detects an abnormal reset and the redundant controller has set the takeover flag, it actively does not start the CAN communication module, stops issuing high-voltage relay control commands, and stops calculating and storing battery SOC and battery SOP. This effectively prevents the BMS from sending erroneous control messages to preempt the bus in an unknown initial state, thereby providing the redundant controller with an interference-free exclusive control environment. This ensures that the execution of the high-voltage maintenance strategy is not disrupted by any conflicting commands, significantly improving the system safety level.

[0063] S23. Determine if there is a takeover flag and if there is no abnormal reset flag. If yes, execute S24; otherwise, execute S25.

[0064] S24. Obtain the battery SOC and battery SOP from the redundant controller 3, and use the obtained battery SOC and battery SOP as the initial values ​​for real-time calculation of battery SOC and battery SOP, and then end.

[0065] When the BMS detects that only the takeover flag exists and there is no abnormal reset, it obtains the battery SOC and battery SOP calculated and stored by the redundant controller as its initial calculation values. This enables the BMS to quickly obtain accurate initial battery state values, effectively shortens the start-up delay of the BMS to restore normal control functions, and ensures that the calculation results after the BMS restores are consistent with the calculation results during the redundant control phase.

[0066] S25. Determine if there is an abnormal reset flag and if there is no takeover flag. If yes, proceed to S26; otherwise, end.

[0067] S26. Determine whether the vehicle was in a high-voltage power-on state before the battery management system was abnormally reset. If so, execute S27; otherwise, execute S28.

[0068] S27. Execute the abnormal reset control strategy to maintain the high voltage power-on state of the vehicle, and use the stored battery SOC and battery SOP as the initial values ​​for real-time calculation of battery SOC and battery SOP, and then end.

[0069] In one possible embodiment, the abnormal reset control strategy is as follows: the bottom-level unit of the battery management system 1 does not perform hardware initialization on the high-voltage relay, and the application-level unit of the battery management system 1 issues a control command to activate the high-voltage relay and a control command to close the high-voltage relay. By dividing the bottom-level constraint of not initializing hardware and the application-level action of issuing the high-voltage activation command into layers, the bottom-level hardware remains silent and does not interfere with the state of the high-voltage relay port, while the application layer actively outputs control commands. The two work together to avoid execution conflicts caused by inconsistent goals between the bottom-level and application layers, and fully utilize the application layer's logical decision-making ability regarding the system's operating mode, thereby improving the coordination efficiency of the control response after an abnormal reset.

[0070] S28. Maintain the vehicle's low-voltage power supply, then end.

[0071] By configuring the BMS to simultaneously check the abnormal reset flag and the takeover flag upon power-on, and executing branch processing logic for three different flag combinations, the BMS can accurately identify whether the current reset originates from its own abnormality or from the activation of the redundant controller, thus making an orderly decision on whether to restore CAN communication and control. This mechanism effectively avoids conflicting commands issued by the BMS and the redundant controller after a reset, ensuring the orderly control logic of the system during fault transitions.

[0072] In one possible embodiment, if the bottom-level unit of the battery management system 1 does not perform hardware initialization on the high-voltage relay and does not receive the abnormal reset recovery control flag, it will not respond to the high-voltage relay control command or send CAN messages regarding battery SOC and battery SOP. By setting the bottom-level unit to respond to the high-voltage relay control command and send battery SOC and battery SOP messages only after receiving the abnormal reset recovery control flag, the system effectively avoids the bottom-level unit rashly performing high-voltage relay switching operations or broadcasting potentially erroneous calculation parameters before the application layer unit has completed self-testing, status confirmation, or data reconstruction, thus significantly improving the operational safety during the system reset process.

[0073] In one possible embodiment, after determining that the battery management system has recovered from an abnormal reset, the underlying unit of the battery management system sets the abnormal reset flag. The application layer unit uses the stored battery SOC and battery SOP as initial values ​​to perform real-time calculations of the battery SOC and battery SOP. After completing one calculation, the abnormal reset recovery control flag is set.

[0074] Setting the abnormal reset flag at the bottom layer unit indicates that the hardware layer is ready. After the application layer unit completes the calculation, setting the abnormal reset recovery control flag indicates that the data layer is ready. The two flags together ensure that the system executes the final high-voltage relay control command only after double confirmation, which significantly improves the safety and integrity level of the recovery process after the BMS abnormal reset.

[0075] like Figure 5 As shown, the steps performed by the underlying unit of the battery management system 1 include:

[0076] S31. Determine if an abnormal reset and restart (recovery) of the battery management system has occurred. If yes, proceed to S32; otherwise, end the process.

[0077] S32, Set the exception reset flag, and then execute S33.

[0078] S33. Do not perform hardware initialization on the high-voltage relay, and then execute S34.

[0079] Since the high-voltage relay is not hardware initialized, the high-voltage relay closing command issued by the application layer unit before the abnormal reset has already been executed if the power supply to the high-voltage relay is not interrupted. After the abnormal reset is restored, the high-voltage relay is not hardware initialized, so the closing command sent before the reset remains unchanged, the high-voltage relay is still in the closed state, and the high-voltage power-on state of the whole vehicle can be maintained.

[0080] S34. Determine whether the abnormal reset recovery control flag has been received. If yes, execute S36; otherwise, execute S35.

[0081] S35: Do not respond to high-voltage relay control commands, do not send CAN messages about battery SOC and battery SOP, and then return to execute S34.

[0082] S36. Respond to the high-voltage relay control command, send CAN messages about battery SOC and battery SOP, and then end.

[0083] like Figure 6 As shown, the steps performed by the application layer unit of the battery management system 1 include:

[0084] S41. Determine if an abnormal reset flag has been received. If yes, proceed to S42; otherwise, end.

[0085] S42. Determine whether the vehicle was in a high-voltage power-on state before the battery management system was abnormally reset. If so, execute S43; otherwise, execute S46.

[0086] S43. Issue a control command to activate the battery management system to high voltage, issue a control command to close the high voltage relay, and then execute S44.

[0087] S44. Use the stored battery SOC and battery SOP as the initial values ​​for calculation to perform real-time calculation of battery SOC and battery SOP, and then execute S45.

[0088] S45. After completing one calculation, set the abnormal reset recovery control flag, and then end.

[0089] S46. Maintain the vehicle's low-voltage power supply, then end.

[0090] Finally, it should be noted that the application of this application is not limited to the examples above. Those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims. Those skilled in the art can understand and implement all or part of the processes of the above embodiments, and equivalent changes made according to the claims of this application still fall within the scope of this application.

Claims

1. A control system for abnormal reset of a battery management system, comprising a battery management system (1), wherein the battery management system (1) communicates with a high-voltage relay module (2) via CAN, stores the high-voltage relay status, the battery management system operating mode, and the voltage signal behind the high-voltage relay, calculates and stores the battery SOC and battery SOP, and issues high-voltage relay control commands and battery management system operating mode control commands; characterized in that: It also includes a redundant controller (3), which communicates with the battery management system (1) via CAN, and obtains and stores the high-voltage relay status, battery management system working mode, high-voltage relay back voltage signal, battery SOC and battery SOP from the battery management system (1); the redundant controller (3) communicates with the high-voltage relay module (2) via CAN, and when the battery management system loses CAN frames for a long time and the vehicle is in a high-voltage power-on state before the abnormal reset, it sets the takeover flag, executes the abnormal reset redundant control strategy, maintains the high-voltage power-on state of the vehicle, and uses the stored battery SOC and battery SOP as the initial values ​​for real-time calculation of battery SOC and battery SOP.

2. The control system for abnormal reset of the battery management system according to claim 1, characterized in that: The redundant controller (3) is a vehicle controller.

3. A control method for abnormal reset of a battery management system, characterized in that: The control system described in claim 1 or 2, wherein the steps performed by the redundant controller (3) in the control method include: Determine if the battery management system has experienced prolonged CAN frame loss; if so, set the takeover flag. Then determine if the vehicle was in a high-voltage power-on state before the battery management system's abnormal reset; if so, execute the abnormal reset redundancy control strategy to maintain the vehicle's high-voltage power-on state. Use the stored battery SOC and battery SOP as initial values ​​for real-time calculation of battery SOC and battery SOP, and store them when power is off, while also storing the takeover flag.

4. The control method for abnormal reset of the battery management system according to claim 3, characterized in that: If both conditions 1a and 1b are met, then the battery management system is determined to have experienced prolonged CAN frame loss; where, Condition 1a: The first controller that communicates with the battery management system (1) via CAN determines that the battery management system has CAN frame loss and the duration is greater than the first preset time; Condition 1b: The second controller that communicates with the battery management system (1) via CAN determines that the battery management system has CAN frame loss and the duration is greater than the first preset time.

5. The control method for abnormal reset of the battery management system according to claim 4, characterized in that: The first controller is a vehicle controller, and the second controller is a motor controller (4).

6. The control method for abnormal reset of the battery management system according to claim 3, characterized in that, The abnormal reset redundancy control strategy is as follows: the redundant controller (3) does not perform hardware initialization on the high voltage relay, issues a control command for the battery management system to be activated by high voltage, and issues a control command for the high voltage relay to be closed.

7. The control method for abnormal reset of the battery management system according to claim 3, characterized in that, The steps performed by the battery management system (1) include: The abnormal reset flag and the takeover flag are checked: If both the abnormal reset flag and the takeover flag are present, the CAN communication module inside will not be started, the high-voltage relay control commands will be stopped, and the calculation and storage of battery SOC and battery SOP will be stopped. If there is a takeover flag but no abnormal reset flag, the battery SOC and battery SOP are obtained from the redundant controller (3), and the obtained battery SOC and battery SOP are used as the initial values ​​for real-time calculation of battery SOC and battery SOP. If an abnormal reset flag exists but a takeover flag does not exist, then if the vehicle is in a high-voltage power-on state before the battery management system abnormally resets, the abnormal reset control strategy will be executed to maintain the high-voltage power-on state of the vehicle, and the stored battery SOC and battery SOP will be used as the initial values ​​for real-time calculation of battery SOC and battery SOP.

8. The control method for abnormal reset of the battery management system according to claim 7, characterized in that, The abnormal reset control strategy is as follows: the bottom unit of the battery management system (1) does not perform hardware initialization of the high voltage relay, and the application layer unit of the battery management system (1) issues a control command for the battery management system to be activated by high voltage and issues a control command for the high voltage relay to be closed.

9. The control method for abnormal reset of the battery management system according to claim 8, characterized in that: If the underlying unit does not perform hardware initialization on the high-voltage relay and does not receive the abnormal reset recovery control flag, it will not respond to the high-voltage relay control command and will not send CAN messages about the battery SOC and battery SOP.

10. The control method for abnormal reset of the battery management system according to claim 9, characterized in that: After determining that the battery management system has recovered from an abnormal reset, the underlying unit sets the abnormal reset flag bit. The application layer unit uses the stored battery SOC and battery SOP as initial values ​​to perform real-time calculations of battery SOC and battery SOP. After completing one calculation, it sets the abnormal reset recovery control flag.

11. The control method for abnormal reset of the battery management system according to any one of claims 3 to 10, characterized in that: If the stored high-voltage relay is closed, the battery management system is in high-voltage activation mode, and the voltage signal behind the high-voltage relay is high voltage, then the vehicle is in a high-voltage power-on state before the battery management system is abnormally reset.

12. A vehicle, characterized in that: The control system includes the abnormal reset of the battery management system as described in claim 1 or 2.

Images