Method, device and system for handling termination errors in a contactor control system in a traction system

Abstract

The present invention relates to a method for handling a termination error in a contactor control system in a traction system with a modular battery, at least one electric motor, and a central controller (10) with a hardware-programmable processor unit on which a state machine (16) is configured as a control program for controlling the contactors, wherein a respective state is coupled with a predetermined switching position of the contactors, wherein termination error handling is carried out on the central controller when a termination error (8) occurs in the traction system by assigning a respective termination error state to a respective state, and switching directly to the respective termination error state when the termination error occurs;After the respective termination fault state and the associated switching position of the contactors are reached, a hardware-coupled feedback from each contactor is processed immediately, and when the termination fault occurs, values ​​of the current intensity of a current flowing through the respective contactor and / or the time duration until the specified switching position of the respective contactor is reached are stored in a termination fault protocol. Furthermore, a central controller and a termination fault processing system (1) on which the procedure is executed are presented.

Description

[0001] The present invention relates to a method for handling aborted errors in a contactor control system in a traction system. Furthermore, a device and a system on which the method is implemented are presented.

[0002] A modular battery is used in electric vehicles to supply power to a traction system. Each battery module has an energy storage device or a DC voltage source, whereby one or more phases for supplying AC power to a traction motor are generated by continuously alternating interconnection of the battery modules. Such a modular battery can be implemented using a modular multilevel converter system, for example, as described in "Goetz, SM; Peterchev, AV; Weyh, T., "Modular Multilevel Converter With Series and Parallel Module Connectivity: Topology and Control," Power Electronics, IEEE Transactions on, vol. 30, no. 1, pp. 203-215, 2015. doi: 10.1109 / TPEL.2014.2310225."

[0003] The energy storage device in each battery module is connected to the respective input and output terminals via half-bridges. Depending on the design, the battery module can assume various switching states, such as "serial," "parallel," or "bypass," which each indicates the connection of the respective energy storage device within the string of battery modules. Each switching state then corresponds to a fixed configuration of switching positions of the semiconductor switches in the half-bridges.

[0004] However, if a switching error occurs in the battery modules, short circuits can also occur if the switching error creates a circuit between energy storage devices in neighboring battery modules or if the energy storage device in one battery module is short-circuited via half-bridges of the neighboring battery module. The currents generated by such short circuits quickly reach a level where thermal degradation of the affected battery modules is threatened.

[0005] The publication US 2016 / 0009193 A1 describes a method for controlling a high-voltage system circuit of an electric vehicle. Among other things, it is assessed whether a contactor is in the on state.

[0006] The publication DE 10 2020 129 130 B3 discusses a safety concept for an AC battery. If an abort fault occurs, the AC battery is put into a safe state.

[0007] Document DE 10 2020 129 129 B3 describes a method for contactor control in a traction system, in which the contactors are controlled according to a state machine. The contactor switching positions are stored in a table.

[0008] The document WO 2023 / 089 460 A1 discloses an electrical power supply system for an electrically or hybrid-powered aircraft, which comprises a plurality of battery cells, a power converter, and a load. The load can be avionics instruments or electronic devices. The battery cells are arranged to provide a first DC voltage, specifically between a first DC potential output with a first polarity (+) and a second DC potential output with a second polarity (-), and a third DC potential output with a potential between the first and second DC potentials. The power converter is connected between the battery cells and the load and is configured to provide a second voltage between a first potential output and a second potential output, wherein the first DC voltage is galvanically isolated from the second DC voltage.The second potential output of the power converter is connected to the third DC potential output of the battery cells via a connection that includes an impedance designed to limit an electrical current.

[0009] A state machine for contactor control can, for example, be implemented on a hardware-programmable processor unit, such as an FPGA. FPGA stands for "Field Programmable Gate Array." Such processor units are considered hardware circuitry from a safety perspective and therefore comply with functional safety regulations.

[0010] Against this background, it is an object of the present invention to present a method for contactor control in the event of an abort error in a traction system, which allows centralized and reliable processing while also taking potential damage into account. Since software interfaces themselves are prone to errors, software dependency should be minimized. Furthermore, a system on which the method is executed should be presented.

[0011] To achieve the aforementioned object, a method for handling an aborted error in a contactor control in a traction system is proposed, in which the traction system comprises a modular battery, at least one electric motor, at least one peripheral unit, a plurality of voltage and current sensors, a plurality of contactors, at least one control unit configured to detect an aborted error, and a central controller with a hardware-programmable processor unit. The contactors are arranged in electrical connections to the modular battery, to the at least one electric motor, and to the at least one peripheral unit. A state machine is configured on the hardware-programmable processor unit as a control program for controlling the contactors at the start of operation.After configuration, a fixed semiconductor circuit structure for controlling the contactors is present on the processor unit. Each state is linked to a predefined switching position of the contactors. The traction system has several operating modes, each of which is specified by an overall vehicle control system superordinate to the central controller. At least one state is assigned to each operating mode in the state machine. Abort error handling when an abort error occurs in the traction system is performed on the central controller with the hardware-programmable processor unit. • a respective abort error state is assigned to a respective state; • when the abort error occurs, the system immediately switches from the current state to the respective abort error state; • after the respective abort error state and the associated switching position of the contactors are assumed, a respective hardware-coupled feedback to a switching position of a respective contactor is immediately processed in the central controller with the hardware-programmable processor unit; • when the abort error occurs, values ​​of a respective current strength of a current flowing through the respective contactor and / or a time period until the specified switching position of the respective contactor is assumed are saved in an abort error protocol; • When the traction system is restarted, a technical decision for operation is made due to an existing abort error protocol.

[0012] Since software-controlled triggering is always subject to the safety-related deficiencies of a software program, the state change to the respective abort error state is advantageously implemented "directly" in hardware, i.e., the transition to the abort error state is executed autonomously, i.e., without software triggering or other software interaction, as a "hard-wired" abort error message to the central controller upon the occurrence of the abort error. Transitions between states that are not abort error states can still be executed in a software-triggered manner. This advantageously allows abort error handling to run entirely on the hardware-programmable processor unit, while higher-level software triggers or initiates a transition between states that do not contain the abort error state and serves for status monitoring.

[0013] “Immediate processing of the respective feedback of a respective contactor with regard to its current switching position” means that this feedback or feedback signal is executed without software triggering and is therefore subject to direct error handling.

[0014] The hardware-programmable processor unit of the central controller is advantageously fully testable, so that incorrect activations can be ruled out in advance through test series. In addition, both temporally defined processes and processes defined in their sequence can be ensured, e.g., upon entering a safe state. With this aid, the method according to the invention reliably assigns the respective switching positions of the contactors, i.e., open or closed, to a respective state of the traction system at any time, thus fulfilling all safety requirements for a controlled traction system through hazard and risk analyses as well as functional safety.

[0015] The at least one peripheral unit can be selected from the following list, for example: insulation monitor, low-voltage DC-DC converter, charging plug, CAN bus.

[0016] In one embodiment of the method according to the invention, at least one state is formed in the state machine from the following list as the respective operating mode and associated therewith: charging operation with single-phase alternating current, charging operation with three-phase alternating current, charging operation with direct voltage, motor operation, peripheral operation with motor off. In general, any operating mode that draws battery voltage from the modular battery can be added to the abort error handling according to the method according to the invention.

[0017] In a further embodiment of the method according to the invention, a respective predefined switching position of the contactors and a respective predefined switching state of battery modules of the modular battery are implemented for each abort error state. If an abort error state is entered from charging operation, open motor contactors are selected and a passive switching state is selected as the switching state for all battery modules. In contrast, if an abort error state is entered from motor operation, closed motor contactors and a bypass switching state are selected, whereby the bypass switching state is generally entered within less than 50 microseconds, while a switching operation for the motor contactors generally takes approximately 20 milliseconds. These are only examples of a selection of contactor switching positions or switching states of the battery modules that can be adapted to the respective operating state.Further switching positions of the contactors are noted, for example, in the publication DE 10 2020 129 129 B3. Furthermore, depending on the symmetrical or asymmetrical design of the battery modules (the respective energy storage device is connected exclusively via half-bridges to both module terminals or directly to one module terminal on one side), a bypass switching state (implemented as a bypass plus or bypass minus via two half-bridges each) is advantageous over a semi-bypass (implemented as a semi-bypass plus or semi-bypass minus via only one half-bridge to the respective module terminal).

[0018] In yet another embodiment of the method according to the invention, a transition between two states, each associated with a different operating state, is performed via an intermediate state, wherein, upon the occurrence of an abort error, a direct transition to the at least one abort error state is also performed from the intermediate state. During a development phase of the traction system, such an intermediate state can, for example, offer additional control or diagnostic options, but may also be omitted outside of development, e.g., during series production. An example of such an intermediate state is a sensor check or self-test of a current sensor, which ensures that, for example, an overcurrent circuit dependent on this current sensor is functioning.

[0019] In a further embodiment of the method according to the invention, when the abort error occurs, the abort error protocol is created if the current flowing through the respective contactor exceeds a predetermined current intensity, e.g., 350 A per AC phase, and / or if a predetermined time period, e.g., 50 ms (where a "normal" closing or opening time can be, for example, approximately 20 ms), is exceeded until the respective contactor assumes the predetermined switching position, and the state machine is terminated with a "Maintenance" state. If the current flowing through the respective contactor falls below the predetermined current intensity and the predetermined time period until the respective contactor assumes the predetermined switching position is also exceeded, the state machine is terminated with an "Error" state.Since contactor sticking or at least degradation of the affected contactor can be expected if the aforementioned current strength or duration is exceeded, the method according to the invention advantageously enables immediate initiation of maintenance measures. Furthermore, the method according to the invention advantageously provides a dedicated final state of the state machine with "error" and "maintenance", so that not only an error abort occurs, but also conclusions about the causes of the error are made possible. This advantageously classifies an abort error that has occurred, so that, for example, for a contactor after disconnection due to excessive current, there is a clear instruction for replacing the contactor. This also avoids immediate shutdown after a restart without any information remaining.

[0020] In a further embodiment of the method according to the invention, the occurrence of the abort error is reported by the at least one control unit to the state machine via hardware. The hardware-coupled forwarding of the abort error message to the hardware-programmable processor unit means that no interaction with software is necessary. Thus, for example, there is no need to wait for a software-triggered transition in the state machine.

[0021] In a further embodiment of the method according to the invention, at least one control unit, to which an abort error message is forwarded by the state machine in the event of an abort error, itself feeds the abort error message back to the state machine. This means that the at least one control unit affected by state changes in the state machine can also itself forward the occurrence of an abort error, which has either been reported to it or is occurring in it, to other control units, without the abort error message first having to run through the state machine, thus losing valuable time, particularly since the shortest possible latency compared to the switching time of the motor contactors should be achieved. A latency in the microsecond range for receiving the abort error message can thus advantageously be achieved for all relevant units.Example: Modules of the modular battery, which are connected to the central control via a high-speed bus.

[0022] In a further embodiment of the method according to the invention, an FPGA is selected as the hardware-programmable module control unit. Implementation with a CPLD or an ASIC is also conceivable. FPGA stands for "Field Programmable Gate Array." For example, a respective processor program can be configured on an FPGA for starting the electric vehicle featuring the contactor control according to the invention. This processor program is considered a hardware implementation and can therefore be executed reliably. The state machine is implemented as a hardware program by the control program, for example, using a VHDL module on the FPGA.VHDL stands for "Very High Speed ​​Integrated Circuit Hardware Description Language," also known as "VHSIC Hardware Description Language," and was developed to execute system processes described as state machines according to a hardware controller when implemented on a hardware-programmable processor. Implementation using Verilog is also conceivable.

[0023] Furthermore, a central controller is claimed, which comprises a hardware-programmable processor unit and is arranged in a traction system. The traction system comprises a modular battery, at least one electric motor, at least one peripheral unit, a plurality of voltage and current sensors, a plurality of contactors arranged in electrical connections to the modular battery and to the at least one electric motor and to the at least one peripheral unit, at least one control unit configured to detect an abort error, and the central controller. The central controller is configured to implement a state machine as a control program for controlling the contactors. A respective state is coupled to a predetermined switching position of the contactors.The traction system has several operating modes, each of which is specified by an overall vehicle control system superordinate to the central controller. The state machine has at least one state for each operating mode. Abort error handling can be performed on the hardware-programmable processor unit of the central controller when an abort error occurs in the traction system, or is performed by • a respective abort error state is assigned to a respective state; • when the abort error occurs, the system immediately switches to the respective abort error state; • after the respective abort error state and the associated switching position of the contactors are assumed, a respective hardware-coupled feedback signal from a respective contactor is immediately processed in the hardware-programmable processor unit; • when the abort error occurs, values ​​of a respective current strength of a current flowing through the respective contactor and / or a time period until the specified switching position of the respective contactor is assumed are saved in an abort error protocol; • When the traction system is restarted, a technical decision for operation is made due to an existing abort error protocol.

[0024] Furthermore, an abort error processing system is claimed, which comprises a central controller with a CPU central controller and a central controller according to the invention with a hardware-programmable processor unit, a modular battery, a high-speed bus, and an error loop. The high-speed bus and the error loop are arranged between the central controller and the modular battery. The abort error processing system is configured to execute an inventive method. In an overall vehicle system, a central abort error processing system is thus advantageously provided, in which all events leading to an abort error converge and thus lead to the shutdown of safety-critical vehicle components, such as the modular battery or motor, with the shortest possible latency in the microsecond range.

[0025] Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

[0026] It is understood that the features mentioned above and those to be explained below can be used not only in the combination specified in each case, but also in other combinations or on their own, without departing from the scope of the present invention. Fig. 1 shows a system architecture of an embodiment of an abort error processing system according to the invention. Fig. 2 shows a diagram of a state machine for contactor control in an embodiment of the method according to the invention.

[0027] In Fig. 1 shows a system architecture of an embodiment of an abort error processing system 1 according to the invention, wherein, in particular, a sequence of an abort error message 9 is shown in a central controller with a hardware-programmable processor 10. The abort error processing system 1 represents a centralized treatment of an abort error 8, which comes from various control units, such as a high-speed bus command transaction unit 17, a performance monitor 11, a feedback monitor 12, an analog / digital conversion synchronization unit 13, or a microcontroller temperature error 14 (e.g., detected by a Zync processor), consolidated in a concatenation unit 15 and forwarded to a state machine of the contactor control 16.The abort error message 9 is either forwarded to battery modules of a modular battery 3 as set HSB-CMD abort error bits for current phases U, V, W6, or queried by a software-controlled CPU central controller 2 at a time of less than, for example, 500 microseconds 7. On the other hand, the modular battery 3 itself can detect an abort error 8 and report it to the high-speed bus command transaction unit 17 via an error loop for current phases U, V, W5, just as the CPU central controller 2 itself transmits an abort error message 9 to the high-speed bus command transaction unit 17 upon the occurrence of an abort error 8 or the arrival of an abort error message 9. Abort error message 9 is processed on the hardware-programmable processor central controller 10 with the shortest possible latency in the microsecond range.

[0028] In Fig.Figure 2 shows a diagram of a state machine 100 for contactor control in one embodiment of the method according to the invention. In an associated legend 101, a solid arrow 102 corresponds to a transition between two states due to an external command, a dashed arrow 103 corresponds to a transition due to programmed logic, a circle or round block 104 corresponds to a stable state or an optional intermediate state, a hatched dashed circle or round block 105 corresponds to an abort error state, and a dashed circle at a block 106 corresponds to a blocked delay state with a predetermined time duration. After reset, the state machine 100 begins with an input action 109, which enters a "PowerOnReset" state 110.An "Idle" transition 113 switches to a "CHK" state 111. Once reached, a "Idle" transition 114 switches to a "CSCP" state 112, in which a test of a current sensor, e.g., for the power supply, is carried out. If an abort error 116, 117 occurs, a switch is made from both states 111 and 112 to a "BRKC" state 180 for power interruption. Subsequently, with the power supply switched on, a further "Idie" transition 115 switches to the stable "Idie" state 120, from which it can return to the "PowerOnReset" state 110 via a "Powerdown" transition 121. The traction system waits in the "Idle" state 120 while switched on, for a command from an overall vehicle system to execute a respective operating mode.If the operating mode is "charging with single-phase alternating current," an "AC charging" transition 123 switches to an intermediate state "CSCA" 131, in which a current sensor for charging the modular battery with alternating current is tested. If an abort error occurs, an "On abort error" transition 139 switches to the "BRKC" state 180; otherwise, an "ACCh" command 133 switches to a "ACCh" state 130, in which single-phase alternating current charging of the modular battery takes place. After the alternating current charging is complete, an "Idle" transition 132 switches back to the "Idle" state 120, or, in the event of an abort error, a "On abort error" transition 138 switches to the "BRKC" state 180.Depending on the provision of additional AC phases by a charging station, states 131 and 130 with their respective transitions 132, 138, 139 can be arranged multiple times according to the number of AC phases. When an operating mode "charging operation with direct voltage" is specified, a "DC charging" transition 124 switches to an intermediate state "CSCD" 141, in which a test of a current sensor for charging the modular battery with direct current is carried out. In the event of an abort error, a "On abort error" transition 149 switches to the "BRKC" state 180; otherwise, a "DCCh" transition 144 switches to a "DCCh" state 140, in which direct current charging of the modular battery takes place. After DC charging is complete, an “Idle” transition 142 returns to the “Idle” state 120, or, in the event of an abort error, an “On Abort Error” transition 148 returns to the “BRKC” state 180.When a "Motor Operation" operating mode is specified, a "Motor" transition 125 switches to an intermediate state "CSCM" 151, in which a test of the motor current sensor is performed. In the event of an abort error, a "On Abort Error" transition 158 switches to the "BRKC" state 180. Otherwise, a further "Motor" transition 153 switches to another intermediate state "CSC2 Motor" 152, in which the system remains for a self-selected time period 155 of, for example, 50 ms. If an abort error occurs, a "On Abort Error" transition 159 switches to the "BRKC" state 180. However, if there is no abort error in the “CSC2 Motor” state 152 and the self-selected time period 155 has elapsed, a “Motor” transition 154 is used to change to a “Motor” state 150 in which, for example, a driving activity can be carried out.After the "Motor" state 150 has ended, an "Idle" transition 157 switches to a "PIDLE" state 170, which is maintained for a predefined time period 177 of, for example, 50 ms. An "Idle" transition 172 switches to the "Idle" state 120. However, if an abort error occurs in the "PIDLE" state 170, the "On Abort Error" transition 176 reaches a "PERROR" state 160. However, an abort error can also occur in the "Motor" state 150, after which a "On Abort Error" transition 156 switches to the "PERROR" state 160, whereby the "PERROR" state 160 represents an abort error state in the "Motor" operating module. The "PERROR" state 160, which prepares for an abort error state, is maintained for a predefined period 166 of, for example, 50 ms to 2 s. Condition 168 is determined depending on the phase currents U, V, W present, i.e., depending on whether their current strengths are smaller than, for example,50 A or greater than 350 A or a time period of 2 s has elapsed, the system switches to the "BRKC" state 180. After entering the "BRKC" state 180, in which a current interruption is carried out, there is a predetermined delay 188 of 50 ms, during which a selection of contactors is given time to assume predetermined switching positions. Depending on the existence of a condition 184, for example, that at the time of the current interruption a respective phase current is above 350 A or there is no feedback for more than 50 ms about selected contactors assuming a predetermined switching position, the system switches to a "Maintenance" state 182, or if the opposite condition 183 is met, it switches to an "ERROR" state 181. The state machine 100 is implemented by a control program on a hardware-programmable processor unit.For each state 110, 111, 112, 120, 130, 131, 140, 141, 150, 151, 152, 160, 170, 180, 181, 182, a respective switching position of a respective contactor of the traction system is specified and controlled by the control program. During the respective transitions between the respective states 110, 111, 112, 120, 130, 131, 140, 141, 150, 151, 152, 160, 170, 180, 181, 182, the control program observes which switching times must be observed for the respective contactors. List of reference symbols 1 Abort error processing system 2 CPU central controllers 3 battery modules 5 fault line signals phase U, V, W 6 HSB-CMD abort error bits U, V, W 7 Query by CPU with duration < 500 microseconds 8 abort errors 9 Abort error message 10 central controllers with hardware-programmable processor 11 Performance Monitor 12 Feedback monitor 13 Synchronization Analog / Digital Conversion 14 Microcontroller temperature error 15 Linking unit 16 State machine of the contactor control 17 High-speed bus command transaction (HSB-CMD-TX) 100 state machine for contactor control 101 Legend 102 Transition due to external command 103 Transition due to programmed logic (PL) 104 State or intermediate state 105 abort errors 106 Blocked delay state with specified time duration 109 Entry action 110 PowerOnReset 111 CHK 112 CSCP: Power current sensor test 113 Idle 114 Idle 115 Idle 116 In case of abort error 117 In case of abort error 120 Idle state 121 PowerDown 123 ACCh: AC charging command 124 DCCH: DC charging command 125 engine 130 ACCH: AC charging 131 CSCA: AC current sensor test 132 Idle 133 ACCh 138 In case of abort error 139 In case of abort error 140 DCCH: DC charging 141 CSCD: DC current sensor test 142 Idle 144 DCCh 148 In case of abort error 149 In case of abort error 150 engine 151 CSCM: Motor current sensor test 152 CSC2 engine 153 Engine 154 Engine 155 Delay 50ms 156 In case of abort error 157 Idle 158 In case of abort error 159 In case of abort error 160 Abort error state PERROR: Prepare Error State 166 Delay 50ms 168 windward <= 50 A || I UVW >= 350 A ||Delays in the range of 2s expected 170 PIDLE: Prepare Idle State 172 Idle 176 In case of abort error 177 Delay 50ms 180 Abort error condition BRKC: Power interruption 181 ERROR 182 MNTNC: Maintenance 183 I UVW < 350 A occurred during deceleration 184 luvw >= 350 A occurred during deceleration 188 Delay 50ms

Claims

[1] Method for handling an abort error in a contactor control in a traction system, in which the traction system comprises a modular battery (3), at least one electric motor, at least one peripheral unit, a plurality of voltage and current sensors, a plurality of contactors which are arranged in electrical connections to the modular battery (3) and to the at least one electric motor and to the at least one peripheral unit, at least one control unit (11, 12, 13, 14, 17) which is designed to detect an abort error (8), and a central controller (10) with a hardware-programmable processor unit on which a state machine (16, 100) is configured as a control program for controlling the contactors at the start of operation, wherein a respective state (110, 111, 112, 120, 130, 131, 140, 141, 150, 151, 152, 160, 170, 180, 181, 182) is coupled with a predetermined switching position of the contactors,wherein the traction system has a plurality of operating modes, wherein a respective operating mode is predetermined by an overall vehicle control system superordinate to the central controller (10), wherein in the state machine (16, 100) at least one state (110, 111, 112, 120, 130, 131, 140, 141, 150, 151, 152, 160, 170, 180, 181, 182) is assigned to the respective operating mode, wherein an abort error handling is carried out on the central controller with the hardware-programmable processor unit (10) when an abort error (8) occurs in the traction system by, • a respective abort error state (160, 180) is assigned to a respective state (110, 111, 112, 120, 130, 131, 140, 141, 150, 151, 152, 160, 170, 180, 181, 182); • when the abort error (8) occurs, the system immediately switches to the respective abort error state (160, 180); • after the respective abort error state (160, 180) and the associated switching position of the contactors are assumed, a respective hardware-coupled feedback signal from a respective contactor is immediately processed in the central controller with the hardware-programmable processor unit (10); • when the abort error occurs (8), values ​​of a respective current intensity of a current flowing through the respective contactor and / or a time period until the respective contactor assumes the specified switching position are stored in an abort error protocol; • When the traction system is restarted, a technical decision for operation is made based on the existing abort error protocol. [2] Method according to claim 1, in which at least one state (110, 111, 112, 120, 130, 131, 140, 141, 150, 151, 152, 160, 170, 180, 181, 182) in the state machine (16, 100) is formed from the following list as the respective operating mode and respectively associated therewith: charging operation with single-phase alternating current, charging operation with three-phase alternating current, charging operation with direct voltage, motor operation, peripheral operation with motor off. [3] Method according to claim 2, wherein in the respective abort error state (160, 180) a respective predetermined switching position of the contactors and a respective predetermined switching state of battery modules of the modular battery (3) are carried out, wherein when an abort error state (180) is entered, open motor contactors coming from a charging operation and a passive switching state are selected and when an abort error state (160) is entered, closed motor contactors coming from a motor operation and a bypass switching state are selected. [4] Method according to one of the preceding claims, in which a transition between two states (110, 120, 130, 140, 150), which are each assigned to a different operating state, is carried out via an intermediate state (111, 112, 131, 141, 151, 152), wherein a direct transition to the at least one abort error state (160, 180) is also carried out from the intermediate state (111, 112, 131, 141, 151, 152) when an abort error (8) occurs. [5] Method according to one of the preceding claims, in which, when the abort error (8) occurs, the abort error protocol is created when a predetermined current intensity of the current flowing through the respective contactor is exceeded and / or when a predetermined time period until the respective contactor is assumed to be in the predetermined switching position is exceeded, and the state machine (16, 100) is terminated with a "maintenance" state (182), and in which, when the predetermined current intensity of the current flowing through the respective contactor is undershot and when the predetermined time period until the respective contactor is assumed to be in the predetermined switching position is undershot, the state machine (16, 100) is terminated with an "error" state (181). [6] Method according to one of the preceding claims, in which the occurrence of the abort error (8) is reported by the at least one control unit (11, 12, 13, 14) to the state machine (16, 100) in a hardware-coupled manner. [7] Method according to claim 6, in which at least one control unit (17), to which an abort error message (9) is forwarded by the state machine (16, 100) in the event of an abort error (8), itself returns the abort error message (9) to the state machine (16, 100). [8] Method according to one of the preceding claims, in which an FPGA is selected as the central controller with the hardware-programmable processor unit (10). [9] Central controller comprising a hardware-programmable processor unit (10) and arranged in a traction system, wherein the traction system comprises a modular battery (3), at least one electric motor, at least one peripheral unit, a plurality of voltage and current sensors, a plurality of contactors arranged in electrical connections to the modular battery (3) and to the at least one electric motor and to the at least one peripheral unit, at least one control unit (11, 12, 13, 14, 17) designed to detect an abort error (8), and the central controller (10), wherein the central controller (10) is designed to implement a state machine (16, 100) as a control program for controlling the contactors, wherein a respective state (110, 111, 112, 120, 130, 131, 140, 141, 150, 151, 152, 160, 170, 180, 181, 182) is coupled with a predetermined switching position of the contactors,wherein the traction system has a plurality of operating modes, wherein a respective operating mode is predetermined by an overall vehicle control system superordinate to the central controller (10), wherein the state machine (16, 100) has at least one state (110, 111, 112, 120, 130, 131, 140, 141, 150, 151, 152, 160, 170, 180, 181, 182) for the respective operating mode, wherein an abort error handling can be carried out or is carried out on the hardware-programmable processor unit of the central controller (10) when an abort error (8) occurs in the traction system, • a respective abort error state (160, 180) is assigned to a respective state (110, 111, 112, 120, 130, 131, 140, 141, 150, 151, 152, 170); • when the abort error (8) occurs, the system immediately switches to the respective abort error state (160, 180); • after the respective abort error state (160, 180) and the associated switching position of the contactors are assumed, a respective hardware-coupled feedback signal from a respective contactor is immediately processed in the hardware-programmable processor unit (10); • when the abort error occurs (8), values ​​of a respective current intensity of a current flowing through the respective contactor and / or a time period until the respective contactor assumes the specified switching position are stored in an abort error protocol; • When the traction system is restarted, a technical decision for operation is made based on the existing abort error protocol. [10] Abort error processing system comprising a central controller with a CPU central controller (2) and a central controller with a hardware-programmable processor unit (10) according to claim 9, a modular battery (3), a high-speed bus (6) and an error loop (5), wherein the high-speed bus (6) and the error loop (5) are arranged between the central controller (10) and the modular battery (3), wherein the abort error processing system (1) is configured to carry out a method according to any one of claims 1 to 8.

Images