Method for functional safety risk assessment for ground support vehicle battery reserve systems

Abstract

The application discloses a functional safety risk assessment method for a ground vehicle battery storage system and relates to the technical field of battery management systems. The method comprises the following steps: triggering event analysis is performed on the functional performance limitations of the charge estimation error, thermal management response abnormalities and charge and discharge control deviations and the like, and potential dangerous scenarios are identified; a battery system simulation test environment containing an electrochemical model, a thermal model and load working conditions is constructed in simulation software, and functional limitation scenario testing and verification are performed; system state data triggered by functional limitations in testing or actual operation are uploaded to a cloud management system for recording and analysis; risk levels are divided based on the severity, potential occurrence frequency and system detectability of the functional limitations, and graded coping strategies are matched. The application realizes systematic evaluation and risk mitigation of the functional safety of the ground vehicle battery storage system, and effectively improves the operation safety and management reliability.

Description

Technical Field

[0001] This invention relates to the field of battery management system technology, and more specifically to a method for functional safety risk assessment of battery storage systems for temporary vehicles. Background Technology

[0002] Low-altitude aircraft, near-ground operation robots, and other ground-based vehicles serve as crucial transport tools for urban air traffic and special operations. The safety and reliability of their power systems are core elements ensuring operational safety. Battery storage systems, as the primary energy unit of these vehicles, are responsible for energy storage, status monitoring, thermal management, and charge / discharge control. In actual operation, even without hardware failures, battery systems may still experience safety risks such as power interruption and performance degradation due to functional limitations—e.g., errors in state of charge (SOC) estimation, thermal runaway risks caused by inconsistencies in individual battery cells, reduced charge / discharge capacity at low temperatures, and delayed thermal management response. These issues fall under the category of functional safety (SOTIF, Safety of the Intended Functionality), which refers to risks arising from insufficient functional performance or reasonably foreseeable usage scenarios in the absence of hardware failure.

[0003] In existing technologies, the functional safety risk assessment of battery storage systems for ground-based vehicles has the following main shortcomings: the design of battery management systems (BMS) focuses mainly on the diagnosis and protection of hardware faults, lacking a systematic identification and evaluation mechanism for scenarios with limited functional performance; there is a lack of simulation testing methods and evaluation systems for the functional safety of battery systems, making it difficult to fully identify potential risks caused by algorithm deviations, environmental coupling, or the complexity of operating conditions during the R&D stage; and there is a lack of risk classification methods and differentiated response strategies for the functional limitations of battery storage systems.

[0004] Therefore, proposing a functional safety risk assessment method for battery storage systems of temporary vehicles, and how to systematically identify, assess and mitigate the safety risks caused by functional deficiencies in battery storage systems of temporary vehicles, thereby improving the operational safety and management reliability of temporary vehicles, are problems that urgently need to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the present invention provides a functional safety risk assessment method for a battery storage system for temporary vehicles, which is used to solve the problem of how to systematically identify, assess and mitigate the safety risks caused by functional limitations of the battery storage system for temporary vehicles in the absence of hardware failure, so as to improve the operational safety and management reliability of temporary vehicles.

[0006] To achieve the above objectives, the present invention provides the following technical solution: The functional safety risk assessment method for battery storage systems in temporary vehicles includes the following steps: S1. Identify potential hazardous scenarios caused by functional limitations of the battery storage system in the absence of hardware failure. S2. Construct a simulation environment that includes the battery's electrochemical and thermal characteristics, and run the battery management control logic in the simulation environment to test potential hazardous scenarios; determine improvement strategies to mitigate the impact of functional performance limitations on functional safety based on the test results. S3. Upload the system status data and corresponding scenario parameters triggered by functional limitations during the testing process or actual operation to the cloud management system. S4. Based on the severity of functional limitations, potential frequency of occurrence, and system detectability, risk levels are classified, and graded response strategies are matched according to the classification results.

[0007] Optionally, limitations in the functionality of S1 include state of charge estimation error, abnormal thermal management response, and charge / discharge control deviation.

[0008] Optionally, the simulation environment in S2 includes: a battery simulation model, which includes: a single cell model, a battery pack thermal model, and an electrical load model.

[0009] Optionally, the test scenarios in S2 include: charge and discharge load scenario, ambient temperature scenario, heat dissipation condition scenario, and functional limitation trigger event; The charging and discharging load scenario is used to simulate the power demand changes and operating cycle characteristics of vehicles operating on the ground in real-world conditions. The ambient temperature scenario is used to simulate temperature changes and extreme high and low temperature conditions in real environments. The heat dissipation scenario is used to simulate the cooling environment of the battery pack; Functional limitation triggering events are used to inject or simulate specific conditions in the simulation that lead to errors in power estimation, abnormal thermal management response, or deviations in charge and discharge control.

[0010] Optionally, the battery management control logic in S2 interacts with external hardware through a data acquisition and control interface. The external hardware includes a battery management main control unit, a voltage / temperature sampling unit, a current sensor, a relay drive unit, and a thermal management execution unit.

[0011] Optionally, S2 also includes: extracting key parameters corresponding to the potential hazardous scenarios identified in S1, and determining the target test scenario by combining external environmental conditions and system operating status; and constructing corresponding simulation test cases in the simulation environment based on the target test scenario.

[0012] Optionally, the severity level in S4 is divided into high, relatively high, moderate, relatively low, and low. The potential occurrence frequency and system detectability are both classified as high, medium, and low; The tiered response strategy includes early warning alerts, power limiting, enhanced thermal management, and emergency protection measures.

[0013] Optional, the matching rules for the tiered response strategy include: When the severity is high, and the potential frequency of occurrence and the system detectability are both high or medium, emergency protection measures shall be implemented. When the severity is high or moderate and the potential frequency of occurrence is medium or low, a forced cooling strategy is activated and safety derating measures are implemented. When the severity is moderate or low and the system detectability is moderate or low, power limiting measures are activated. When the severity is low, the potential frequency of occurrence is medium or low, and the system detectability is medium or low, early warning measures will be implemented.

[0014] Optionally, when emergency protection measures are implemented or forced cooling strategies are activated, a vehicle-level alarm signal is output simultaneously.

[0015] Optionally, the rules for risk level classification in S4 include: When the severity is high, and the potential frequency of occurrence and the system detectability are both high or medium, the risk level is determined to be high. When the severity is high or moderate and the potential frequency of occurrence is medium or low, the risk level is determined to be high. When the severity is moderate or low, and the system detectability is moderate or low, the risk level is determined to be moderate or low. When the severity is low, the potential frequency of occurrence is medium or low, and the system detectability is medium or low, the risk level is determined to be low.

[0016] As can be seen from the above technical solution, compared with the prior art, the present invention discloses a functional safety risk assessment method for battery storage systems of temporary vehicles, the beneficial effects of which are: 1) This invention systematically applies the functional safety methodology to the field of battery storage systems for temporary vehicles, and establishes a complete evaluation closed loop covering functional limitation identification, simulation verification, data recording and graded response, filling the technical gap in SOTIF evaluation of existing battery management systems; 2) By constructing a simulation environment that includes electrochemical and thermal characteristics and connecting it to actual control logic, the limitations of functional performance caused by algorithm deviation, parameter mismatch or environmental coupling can be effectively exposed during the research and development stage, providing a reliable verification platform for algorithm optimization and strategy improvement. 3) By classifying risk levels based on the severity, frequency of occurrence, and detectability, and matching them with differentiated tiered response strategies, refined and dynamic management of the functional safety of the battery storage system is achieved, ensuring both safety and system availability. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0018] Figure 1 A flowchart of a functional safety risk assessment method for a battery storage system for temporary ground vehicles provided by the present invention; Figure 2 A flowchart of the sub-steps of S2 provided by the present invention; Figure 3 This is a schematic diagram illustrating the framework for severity level classification, matching of graded response measures, and risk assessment provided by the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] See Figure 1 As shown, this invention discloses a functional safety risk assessment method for a battery storage system for temporary vehicles, comprising the following steps: S1. Identify potential hazardous scenarios caused by functional limitations of the battery storage system in the absence of hardware failure. S2. Construct a simulation environment that includes the battery's electrochemical and thermal characteristics, and run the battery management control logic in the simulation environment to test potential hazardous scenarios; determine improvement strategies to mitigate the impact of functional performance limitations on functional safety based on the test results. S3. Upload the system status data and corresponding scenario parameters triggered by functional limitations during the testing process or actual operation to the cloud management system. S4. Based on the severity of functional limitations, potential frequency of occurrence, and system detectability, risk levels are classified, and graded response strategies are matched according to the classification results.

[0021] Furthermore, the functional limitations of S1 include errors in state of charge estimation, abnormal thermal management response, and deviations in charge and discharge control.

[0022] Specifically, in S1, it is first necessary to identify potential dangerous behaviors caused by functional limitations, and then conduct a specific analysis of the triggering events in combination with battery status, external environment and operating conditions.

[0023] As shown in Table 1, the event analysis reveals the following issues: The battery management system's estimation of available capacity deviates in low-temperature environments, potentially leading to inaccurate range predictions; differences in individual battery cell consistency cause localized overheating during fast charging, which the thermal management algorithm fails to respond to in a timely manner; sampling errors of the current sensor under dynamic conditions increase the cumulative deviation of SOC; misjudgment of battery polarization effects during charging leads to premature termination of charging or overcharging risks; and insufficient instantaneous power output of the battery under sudden load changes, coupled with the system's failure to limit power in time, can cause voltage drops or system power outages.

[0024] Table 1 Common functional limitations and risk events of battery storage systems and their corresponding triggering events

[0025] Furthermore, the simulation environment in S2 includes: a battery simulation model, which includes: a single cell model, a battery pack thermal model, and an electrical load model.

[0026] Furthermore, the test scenarios in S2 include: charge and discharge load scenarios, ambient temperature scenarios, heat dissipation condition scenarios, and functional limitation triggering events; The charging and discharging load scenario is used to simulate the power demand changes and operating cycle characteristics of vehicles operating on the ground in real-world conditions. The ambient temperature scenario is used to simulate temperature changes and extreme high and low temperature conditions in real environments. The heat dissipation scenario is used to simulate the cooling environment of the battery pack; Functional limitation triggering events are used to inject or simulate specific conditions in the simulation that lead to errors in power estimation, abnormal thermal management response, or deviations in charge and discharge control.

[0027] Furthermore, the battery management control logic in S2 interacts with external hardware through a data acquisition and control interface. The external hardware includes a battery management main control unit, a voltage / temperature sampling unit, a current sensor, a relay drive unit, and a thermal management execution unit.

[0028] Furthermore, S2 also includes: extracting key parameters corresponding to potential hazardous scenarios identified in S1, and determining the target test scenario by combining external environmental conditions and system operating status; and constructing corresponding simulation test cases in the simulation environment based on the target test scenario.

[0029] like Figure 2 As shown, S2 further includes the following sub-steps: (a) Determine the target test scenario Based on the different potential hazardous scenarios identified by S1, key parameters (such as ambient temperature, state of charge range, charge / discharge rate, battery aging level, etc.) are extracted for each scenario. These parameters are then combined with external environmental conditions and system operating status to determine the final target test scenario. The value range of the key parameters can be determined based on historical operating data, theoretical analysis, or empirical values.

[0030] (II) Constructing a simulation environment

[0031] The simulation environment can be built based on commercial simulation software, such as MATLAB / Simulink, GT-Suite, Amesim, COMSOL, etc., with the MATLAB / Simulink and Amesim co-simulation platform being preferred.

[0032] In this simulation environment, a battery simulation model needs to be built that includes the following components: Cell-level model: Used to simulate the dynamic response characteristics of a battery cell as its state parameters, such as voltage, current, state of charge, and temperature, change with operating conditions. Equivalent circuit models (such as second-order RC models), electrochemical models, or electrochemical-thermal coupling models can be used.

[0033] Battery pack thermal model: Used to simulate the influence of temperature field distribution, heat conduction path, and heat dissipation conditions inside the battery pack on battery temperature. Lumped parameter thermal models, finite element thermal models, or a combination of both can be used.

[0034] Electrical load model: used to simulate the power demand characteristics of vehicles during actual operation, including load curves for typical operating conditions such as takeoff, cruise, hovering, and landing.

[0035] Furthermore, based on the actual battery management system (BMS) hardware and software configuration, corresponding data acquisition and control interfaces are configured in the simulation environment. These interfaces can connect to or simulate one or more of the following hardware: battery management main control unit, voltage and / or temperature sampling unit, current sensor, relay drive unit, and thermal management execution unit. Through hardware-in-the-loop (HIL) or software-in-the-loop (SIL) methods, the actual BMS controller or control algorithm is connected to the simulation environment to achieve closed-loop interaction between the control logic and the virtual battery model. Simultaneously, non-ideal characteristics such as noise, drift, and failure of sensor signals can be simulated in the simulation environment to examine the functional performance of the BMS under complex signal conditions.

[0036] Battery management algorithms consistent with those of the actual control system are loaded into the simulation environment, including SOC / SOH / SOP estimation algorithms, equalization control algorithms, thermal management control algorithms, charge and discharge management algorithms, and fault diagnosis algorithms.

[0037] (iii) Set up the test scenario and execute the simulation

[0038] Setting up target test scenarios in a simulation environment mainly includes the following four categories: Charge and discharge load scenarios: used to simulate power demand changes and operating cycle characteristics in real operation, including constant current charging, constant voltage charging, pulse charging, dynamic discharging, regenerative braking, and typical flight operating cycle.

[0039] Ambient temperature scenario: Used to simulate temperature changes and extreme high and low temperature conditions in real environments, including high temperature hot immersion, low temperature cold start, temperature gradual change, temperature shock, etc.

[0040] Heat dissipation scenario: Used to simulate the cooling environment of the battery pack, such as air cooling, liquid cooling, natural convection cooling, phase change material cooling, or immersion cooling.

[0041] Functional limitation triggering events: These are used to actively inject or simulate specific conditions in simulation that lead to errors in power estimation, abnormal thermal management response, or deviations in charge and discharge control. Examples include sensor deviation injection, parameter disturbance injection, algorithm logic abnormality triggering, and communication failure injection.

[0042] Based on the identified target test scenario, construct corresponding simulation test cases in the simulation environment and run them in batches. Record battery status responses, BMS control command outputs, and system behavior.

[0043] (iv) Test Result Analysis and Improvement

[0044] Analyze the test results to identify the root causes of functional limitations and propose targeted improvement measures. These improvement measures include: Optimize the estimation algorithm (e.g., use multi-model fusion estimation, adaptive Kalman filtering combined with neural network correction, etc.); Enhanced thermal management strategies (e.g., using model predictive control to actively adjust cooling power); Adjust the charging and discharging logic (e.g., add a state handshake mechanism and dynamic polarization voltage compensation). Add redundant monitoring (e.g., dual-frequency injection insulation testing, redundant communication bus design, etc.).

[0045] The improved strategy can be reloaded into the simulation environment for regression testing to verify the effectiveness of the improvement.

[0046] Furthermore, the severity level in S4 is divided into high, relatively high, moderate, relatively low, and low. The potential occurrence frequency and system detectability are both classified as high, medium, and low; The tiered response strategy includes early warning alerts, power limiting, enhanced thermal management, and emergency protection measures.

[0047] Furthermore, the matching rules for the tiered response strategy include: When the severity is high, and the potential frequency of occurrence and the system detectability are both high or medium, emergency protection measures shall be implemented. When the severity is high or moderate and the potential frequency of occurrence is medium or low, a forced cooling strategy is activated and safety derating measures are implemented. When the severity is moderate or low and the system detectability is moderate or low, power limiting measures are activated. When the severity is low, the potential frequency of occurrence is medium or low, and the system detectability is medium or low, early warning measures will be implemented.

[0048] Furthermore, when emergency protection measures are implemented or forced cooling strategies are activated, a vehicle-level alarm signal is output simultaneously.

[0049] Furthermore, the rules for risk level classification in S4 include: When the severity is high, and the potential frequency of occurrence and the system detectability are both high or medium, the risk level is determined to be high. When the severity is high or moderate and the potential frequency of occurrence is medium or low, the risk level is determined to be high. When the severity is moderate or low, and the system detectability is moderate or low, the risk level is determined to be moderate or low. When the severity is low, the potential frequency of occurrence is medium or low, and the system detectability is medium or low, the risk level is determined to be low.

[0050] Specifically, such as Figure 3 As shown, S4 further includes the following: (a) Classification of severity Based on the severity of the consequences that functional limitations may cause, the severity can be divided into multiple levels. A typical classification includes five levels: high, relatively high, medium, relatively low, and low. Alternatively, it can be divided into at least four levels depending on actual needs.

[0051] (ii) Analysis of potential occurrence frequency and detectability

[0052] Potential occurrence frequency is categorized based on the statistical probability of functional limitations occurring in typical operating scenarios, and can be divided into three or more levels: high, medium, and low. System detectability is categorized based on the current sensor configuration, algorithm capabilities, and diagnostic strategies' ability to identify functional limitations, and can also be divided into three or more levels: high, medium, and low.

[0053] (III) Matching of Tiered Response Strategies

[0054] Based on a combination of severity, potential frequency of occurrence, and detectability, a corresponding tiered response strategy is matched and implemented. The tiered response strategy includes two or more of the following: early warning alerts, power limiting, enhanced thermal management, and emergency circuit breaker protection.

[0055] For example, the matching rules for a tiered response strategy can be set as follows: When the severity is high, and the potential frequency and detectability are both high or medium, emergency protection measures are implemented, and a vehicle-level alarm signal is output simultaneously. When the severity is high or moderate and the potential frequency of occurrence is medium or low, a forced cooling strategy is activated and safety derating measures are implemented. When the severity is moderate or low and the detectability is moderate or low, power limiting measures are activated. When the severity is low, the potential frequency of occurrence is medium or low, and the detectability is medium or low, early warning measures should be implemented.

[0056] If none of the above conditions are met, it indicates that the risk is temporarily within an acceptable range and no additional countermeasures are necessary, but continuous status monitoring is advisable.

[0057] Executing emergency circuit breaker protection may include controlling the main positive / main negative relay to disconnect, controlling the pre-charge relay to disconnect, controlling the fast-charge relay to disconnect, and disconnecting the corresponding branch circuit within the high-voltage distribution box. Activating forced cooling strategies includes increasing coolant flow, increasing fan speed, starting auxiliary cooling equipment, adjusting radiator damper angles, and activating emergency cooling mode. Safety derating measures include limiting maximum charging and discharging power and limiting maximum charging and discharging current.

[0058] (iv) Risk level assessment

[0059] Based on the above analysis, the risk levels of the functional safety of the battery storage system can be classified into high, relatively high, medium / low, and low levels. When the risk level is high, the battery storage system enters a safety protection mode, prohibiting charging and discharging operations; when the risk level is relatively high, it enters a restricted operation mode, allowing only low-power discharge to a safe area; when the risk level is medium or low, it enters a performance degradation mode, restricting some functions but continuing to operate; when the risk level is low, it enters a normal mode, recording only warning information for subsequent analysis.

[0060] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0061] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for functional safety risk assessment of battery storage systems for temporary ground vehicles, characterized in that, Includes the following steps: S1. Identify potential hazardous scenarios caused by functional limitations of the battery storage system in the absence of hardware failure. S2. Construct a simulation environment that includes the electrochemical and thermal characteristics of the battery, and run the battery management control logic in the simulation environment to test potential hazardous scenarios. Based on the test results, determine improvement strategies to mitigate the impact of functional performance limitations on functional safety; S3. Upload the system status data and corresponding scenario parameters triggered by functional limitations during the testing process or actual operation to the cloud management system. S4. Based on the severity of functional limitations, potential frequency of occurrence, and system detectability, risk levels are classified, and graded response strategies are matched according to the classification results.

2. The functional safety risk assessment method for a battery storage system for temporary vehicles according to claim 1, characterized in that, The functional limitations of S1 include errors in state of charge estimation, abnormal thermal management response, and deviations in charge and discharge control.

3. The functional safety risk assessment method for a battery storage system for temporary vehicles according to claim 1, characterized in that, The simulation environment in S2 includes: a battery simulation model, which includes: a single cell model, a battery pack thermal model, and an electrical load model.

4. The functional safety risk assessment method for a battery storage system for temporary vehicles according to claim 1, characterized in that, The test scenarios in S2 include: charge and discharge load scenarios, ambient temperature scenarios, heat dissipation condition scenarios, and functional limitation triggering events; The charging and discharging load scenario is used to simulate the power demand changes and operating cycle characteristics of vehicles operating on the ground in real-world conditions. The ambient temperature scenario is used to simulate temperature changes and extreme high and low temperature conditions in real environments. The heat dissipation scenario is used to simulate the cooling environment of the battery pack; Functional limitation triggering events are used to inject or simulate specific conditions in the simulation that lead to errors in power estimation, abnormal thermal management response, or charge / discharge control deviations.

5. The functional safety risk assessment method for a battery storage system for temporary vehicles according to claim 1, characterized in that, In S2, the battery management control logic interacts with external hardware through a data acquisition and control interface. The external hardware includes a battery management main control unit, a voltage / temperature sampling unit, a current sensor, a relay drive unit, and a thermal management execution unit.

6. The functional safety risk assessment method for a battery storage system for temporary vehicles according to claim 1, characterized in that, S2 also includes: extracting key parameters corresponding to potential hazardous scenarios identified in S1, and determining target test scenarios by combining external environmental conditions and system operating status; and constructing corresponding simulation test cases in the simulation environment based on the target test scenarios.

7. The functional safety risk assessment method for a battery storage system for temporary vehicles according to claim 1, characterized in that, Severity in S4 is categorized as high, relatively high, moderate, relatively low, and low. The potential occurrence frequency and system detectability are both classified as high, medium, and low; The tiered response strategy includes early warning alerts, power limiting, enhanced thermal management, and emergency protection measures.

8. The functional safety risk assessment method for a battery storage system for temporary vehicles according to claim 7, characterized in that, The matching rules for tiered response strategies include: When the severity is high, and the potential frequency of occurrence and the system detectability are both high or medium, emergency protection measures shall be implemented. When the severity is high or moderate and the potential frequency of occurrence is medium or low, a forced cooling strategy is activated and safety derating measures are implemented. When the severity is moderate or low and the system detectability is moderate or low, power limiting measures are activated. When the severity is low, the potential frequency of occurrence is medium or low, and the system detectability is medium or low, early warning measures will be implemented.

9. The functional safety risk assessment method for a battery storage system for temporary vehicles according to claim 8, characterized in that, When emergency protection measures are implemented or forced cooling strategies are activated, a vehicle-level alarm signal is output simultaneously.

10. The functional safety risk assessment method for a battery storage system for temporary vehicles according to claim 7, characterized in that, The rules for risk level classification in S4 include: When the severity is high, and the potential frequency of occurrence and the system detectability are both high or medium, the risk level is determined to be high. When the severity is high or moderate and the potential frequency of occurrence is medium or low, the risk level is determined to be high. When the severity is moderate or low, and the system detectability is moderate or low, the risk level is determined to be moderate or low. When the severity is low, the potential frequency of occurrence is medium or low, and the system detectability is medium or low, the risk level is determined to be low.

Images