Method and system for safely assuming a termination fault state in a modular battery

Abstract

The present invention relates to a method for safely assuming a termination fault state in a modular battery, which comprises a central controller and, along each battery module, a fault loop and a high-speed bus, wherein each battery module has a plurality of module states (211, 212, 213, 221, 222, 223, 224, 231, 232), wherein at least one switching state is implemented for each module state, wherein a module state machine (200) is executed as a control program on a hardware-programmable module control unit, wherein the plurality of module states includes at least one termination fault state (231, 232), wherein at least one module state (211, 212, 213) is directly coupled to a respective gate control of the plurality of semiconductor switches of the respective battery module according to a predetermined switching state, wherein transitions between module states (221, 222, 223,224) are triggered by the central controller via the high-speed bus, wherein the occurrence of a termination error is communicated to all battery modules via the error loop and / or the high-speed bus, and wherein, upon occurrence of the termination error, a direct transition (241, 242, 243, 244) to the at least one termination error state is triggered. Furthermore, a module control unit and a traction system on which the method is executed are presented.

Description

[0001] The present invention relates to a method for safely entering a shutdown fault state in a modular battery in which a shutdown fault occurs in a battery module. Furthermore, a system on which the method is implemented is presented.

[0002] A modular battery is used in electric vehicles to supply power to a traction system. Each battery module has an energy storage device or a DC voltage source, whereby one or more phases for supplying AC power to a traction motor are generated by continuously alternating interconnection of the battery modules. Such a modular battery can be implemented using a modular multilevel converter system, for example, as described in "Goetz, SM; Peterchev, AV; Weyh, T., "Modular Multilevel Converter With Series and Parallel Module Connectivity: Topology and Control," Power Electronics, IEEE Transactions on, vol. 30, no. 1, pp. 203-215, 2015. doi: 10.1109 / TPEL.2014.2310225."

[0003] The energy storage device in each battery module is connected to the respective input and output terminals via half-bridges. Depending on the design, the battery module can assume various switching states, such as "serial," "parallel," or "bypass," which each indicates the connection of the respective energy storage device within the string of battery modules. Each switching state then corresponds to a fixed configuration of switching positions of the semiconductor switches in the half-bridges.

[0004] However, if a switching error occurs in the battery modules, short circuits can also occur if the switching error creates a circuit between energy storage devices in neighboring battery modules or if the energy storage device in one battery module is short-circuited via half-bridges of the neighboring battery module. The currents generated by such short circuits quickly reach a level where thermal degradation of the affected battery modules is threatened.

[0005] The document JP 2022-119458 A discloses a traction battery of an electric vehicle, wherein a failure of the traction battery can be detected by a monitoring device.

[0006] Document DE 10 2020 129 129 B3 describes a method for contactor control in a traction system, in which the contactors are controlled according to a state machine. The contactor switching positions are stored in a table.

[0007] The publication DE 10 2020 129 130 B3 discusses a safety concept for an AC battery. If an abort fault occurs, the AC battery is put into a safe state.

[0008] Multilevel converters with parallel connectivity are discussed in the publication by J. FANG; F. BLAABJERG; S. LIU; S. M. GOETZ: A Review of Multilevel Converters With Parallel Connectivity. In: IEEE Transactions on Power Electronics. Year: 2021 | Volume: 36, Issue: 11 | Journal Article | Publisher: IEEE. With redundancy of switching states, individual switches in a submodule can be eliminated.

[0009] The publication CH. TERBRACK; J. STÖTTNER; CH ENDISCH: Design and Validation of the Parallel Enhanced Commutation Integrated Nested Multilevel Inverter Topology. In: IEEE Transactions on Power Electronics. Year: 2022 | Volume: 37, Issue: 12 | Journal Article | Publisher: IEEE compiles a variety of module designs that can connect energy storage devices in consecutive modules in parallel.

[0010] Against this background, it is an object of the present invention to provide a method for the safe operation of a modular battery, which, in the event of a fault event, ensures a transition from any state of a battery module to a safe abort fault state. Furthermore, a control unit is to be provided that implements the method.

[0011] To achieve the aforementioned object, a method is proposed for safely entering a termination fault state in a modular battery, in which the modular battery connected to a traction machine comprises a central controller, a plurality of battery modules arranged in at least one string, each of which has a plurality of semiconductor switches, at least one energy storage device, and a hardware-programmable module control unit, which is formed, for example, by an ASIC. For each respective string, the battery modules comprise a fault loop and a high-speed bus running between the central controller and along the respective battery modules. Respective switching positions of the plurality of semiconductor switches of a respective battery module correspond to a respective switching state. The respective battery module has a plurality of module states, with at least one switching state being implemented for each module state.The central controller has a processor unit on which a control program for controlling the battery modules is configured via the high-speed bus and the error loop. A module state machine is executed on the hardware-programmable module control unit as a control program for assuming module states and the corresponding switching states to be implemented. The majority of module states have at least one abort error state. At least one module state is directly coupled to a respective gate control of the plurality of semiconductor switches of the respective battery module according to a predetermined switching state. Transitions between module states are triggered by the central controller via the high-speed bus. The occurrence of an abort error is communicated to all battery modules via the error loop and / or the high-speed bus.When the abort error occurs, a direct transition to at least one abort error state is triggered. It is conceivable that all battery modules on a single phase are connected to each other via the error loop, and a so-called "freezing" of the last valid switching state is executed as an immediate error response. It is also conceivable that, as a further reaction, the occurrence of the abort error is sent to all modules simultaneously via the high-speed bus.

[0012] By directly coupling the respective gate control of the semiconductor switches of a battery module to at least one module state, a reliable assumption or implementation of the respective switching state associated with the respective module state is advantageously ensured. Furthermore, this occurs synchronously on all battery modules, since the implementation occurs or is triggered by a command sent via the high-speed bus. The switching state thus assumed by the respective battery module is, for example, a passive switching state, i.e., all semiconductor switches in the respective battery module are open.

[0013] The abort error can, for example, be caused by a switching error in a semiconductor switch. To detect this faulty switching position of a semiconductor switch, targeted monitoring of each individual semiconductor switch is performed.

[0014] Furthermore, the abort error can be caused by a communication interruption between a battery module and the central controller. If a switching command for the next switching state is missing, a short circuit scenario can occur as early as the next switching cycle. While the neighboring module switches its semiconductor switches to assume the new switching state, the battery module does not also switch in synchronization with the communication interruption. Depending on the current switching state of the battery module with the communication interruption, for example, if it is connected in parallel with the energy storage device of the neighboring module, a short circuit can occur.

[0015] In one embodiment of the method according to the invention, the at least one abort error state is formed by a bypass switching state or a semi-bypass switching state during engine operation and by a passive switching state for the semiconductor switches of the respective battery module during charging operation. The bypass switching state or the semi-bypass switching state (which conducts a current only via a single half-bridge of the at least one half-bridge arranged between the at least one energy storage device and a module connection) conducts a current through the respective battery module, bypassing the respective at least one energy storage device. The current is thus bypassed by the at least one energy storage device or one or more cells, i.e. explicitly not conducted through the cells of the battery module. In the passive switching state, all semiconductor switches of the respective battery module are open.This describes two safe switching states which de-energise at least one energy storage device and thus prevent a short circuit with neighbouring energy storage devices.

[0016] In a further embodiment of the method according to the invention, the respective battery module comprises at least one energy storage device and four half-bridges connected in parallel. A two-wire input terminal is formed by a respective center tap on two first half-bridges, and a two-wire output terminal is formed by a respective center tap on two second half-bridges. An electrical connection between adjacent battery modules is formed by the control of the semiconductor switches connected to the respective terminals located relative to one another, carried out by the respective battery module. Switching state changes in both modules are controlled synchronously.Since each battery module has its own hardware-programmable module control unit that controls the respective switching positions of the semiconductor switches, the respective module control units of neighboring battery modules, and thus at least all battery modules in the at least one string, must operate simultaneously. According to the invention, this is achieved by high-speed bus commands for assuming switching states or triggering switching state transitions from the high-speed bus. According to a clock cycle, a respective broadcast message is sent via the high-speed bus, to which each battery module synchronizes. This advantageously implements clock-synchronous control across multiple time domains. All logical interconnection states between battery modules of a phase (or string) are encoded in the broadcast message itself.

[0017] According to the invention, a transition between two module states, each associated with a different operating state, is accomplished via an intermediate state. Upon the occurrence of an abort error, a direct transition to the at least one abort error state is also triggered from the intermediate state. This is particularly advantageous for the safe operation of the modular battery, since depending on the operating state (e.g., "engine" or "charging"), the battery module enters a different abort error state. By providing a respective intermediate state according to the invention, from which a direct transition to the associated abort error state can occur, the state transition between the two operating states is safeguarded.This advantageously enables all battery modules to only switch to the module state of the respective operating mode once they have all previously assumed the respective preparatory intermediate state and a further state change to the module state of the respective operating mode is triggered by the state controller via the high-speed bus. This also ensures that all battery modules reach the same abort error state, particularly when the direct transition to the respective abort error state occurs autonomously, i.e. without control from the central controller. Since in this case, i.e. when there is a clear abort error in the battery module orSince the affected branch also does not have to wait for an instruction from the central controller, this can advantageously be done with the lowest possible latency, since the affected battery modules each have a specification, via the module state machine according to the invention, as to which next abort error state they must transition to. For example, a clock cycle on the high-speed bus is realized in the three-digit kHz range, while the hardware-programmable module control unit is located in the three-digit MHz range.

[0018] In a further embodiment of the method according to the invention, if a switching fault occurs in a semiconductor switch in a battery module of a string of the at least one string, the respective switching state of all other battery modules in the string is maintained unchanged. This behavior, also referred to as freezing, is advantageous over switching the other battery modules to the next switching cycle, since, if a short circuit does not yet exist, a short circuit scenario can only occur upon switching.

[0019] In a still further embodiment of the method according to the invention, an abort error is detected when the same switching error of the semiconductor switch in the battery module occurs a predetermined number of times in succession. The abort error is reported via the error line. The central controller monitoring the error line recognizes the abort error as an abort error event and transmits it synchronously to all battery modules in all strings via the high-speed bus. As soon as the battery modules receive a broadcast message containing the abort error, they switch to the abort error state. The predetermined number of times the same switching error occurs in succession is selected, for example, as four, i.e. after the affected semiconductor switch has attempted four times to assume a "correct" switching position, the abort error is triggered.

[0020] In a further embodiment of the method according to the invention, an FPGA is selected as the hardware-programmable module control unit. The FPGA is operated, for example, at a clock frequency of 100 MHz. It is also conceivable to select a CPLD or an ASIC as the hardware-programmable module control unit.

[0021] In a further embodiment of the method according to the invention, the semiconductor switches are formed by MOSFETs.

[0022] The above-described inventive method advantageously ensures safe operation of the modular battery through targeted monitoring of the semiconductor switches of a respective battery module, the communication means for error notification provided by a high-speed bus and error loop, and the orderly and reliable error response implemented by the inventive module state machine. The inventive module state machine is designed such that a respective state is either firmly coupled to a predetermined switching position of the semiconductor switches in the battery module, or a state transition or transition is executed via a safe intermediate state, so that the state transitions are implemented as safely as possible.

[0023] Furthermore, a module control unit for a battery module for safely entering a shutdown fault state in a modular battery is provided. The modular battery connected to a traction machine comprises a central controller, a plurality of battery modules arranged in at least one string, each of which has a plurality of semiconductor switches, at least one energy storage device, and the hardware-programmable module control unit. For each string, a fault loop and a high-speed bus extending between the central controller and along the respective battery modules are provided. Respective switching positions of the plurality of semiconductor switches of a respective battery module correspond to a respective switching state. The respective battery module has a plurality of module states, with at least one switching state being implemented in each module state.A respective module state is formed by a state of a state machine for the hardware-programmable module control unit. The central controller has a processor unit on which a control program for controlling the battery modules via the high-speed bus and the error loop is configured. The hardware-programmable module control unit is designed to execute a module state machine as a control program for assuming module states and the corresponding switching states to be implemented. The plurality of module states has at least one abort error state. At least one module state is directly coupled to a respective gate control of the plurality of semiconductor switches of the respective battery module according to a predetermined switching state. Transitions between module states are triggered by the central controller via the high-speed bus.The occurrence of an abort fault is communicated to all battery modules via the fault loop and / or the high-speed bus. Upon the occurrence of the abort fault, a direct transition to at least one abort fault state is triggered.

[0024] The module control unit according to the invention is configured to be used when carrying out the method according to the invention.

[0025] Furthermore, a traction system with a modular battery entering a termination fault state is claimed, wherein the traction system comprises a traction machine and a modular battery connected thereto. The modular battery comprises a central controller, a plurality of battery modules arranged in at least one string, each of which has a power board with a plurality of semiconductor switches and a plurality of switching states, and each of which has a hardware-programmable module control unit according to the invention, a fault loop, and a high-speed bus. The traction system is configured to carry out a method according to the invention.

[0026] Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

[0027] It is understood that the features mentioned above and those to be explained below can be used not only in the combination specified in each case, but also in other combinations or on their own, without departing from the scope of the present invention.

[0028] Fig. 1 schematically shows a module state machine running on a control unit of a battery module in an embodiment of the method according to the invention.

[0029] In Fig.1 schematically shows a module state machine 200 running on a control unit of a battery module of a modular battery in one embodiment of the method according to the invention. In an associated legend 299, a diagonally hatched circle 291 corresponds to a state hard-coupled to respective semiconductor switches. A circle 292 corresponds to a state or intermediate state that is triggered or arranged synchronously in all battery modules by a central controller via a high-speed bus. A checkered circle 293 corresponds to a respective abort error state. A dashed arrow 294 corresponds to a direct transition to a respective abort error state 231, 232, while a solid arrow 295 stands for a transition arranged via the high-speed bus (abbreviated to HSB). The module state machine 200 begins after a "PowerOnReset" (POR) or"DesignReset" 210 with a passive module state 211 as POR input state 201, i.e., a "passive" switching state is executed, which corresponds to an open switching position of all semiconductor switches in the battery module. Due to the need to synchronize the switching positions of the respective semiconductor switches in neighboring battery modules, since two neighboring battery modules each control a connection or "interconnection" between them—and in particular between their respective energy storage devices—this passive module state 211 is "hard-coded" 261, i.e., directly connected to the respective gate controls of the semiconductor switches of the battery module. An HSB command 251 switches to a synchronization module state 212 in order to synchronize a module control unit with a command clock in the HSB 202. The synchronization module state 212 is also hard-coded 261 as a "passive" switching state.A switch is made from both the secure passive module state 211 and the synchronization module state 212 to a passive end module state 213 based on an HSB command ShutDown 250 or 252, respectively, whereby the passive end module state 213 is also hard-coded 263. From the synchronization module state 212, an HSB command 253 leads to an area 262 with HSB commands 203 executed synchronously by all modules, whereby the semiconductor switches, formed for example by MOSFETs, are not hard-coded, but due to the previous synchronization of the respective module controller to the high-speed bus, more precisely to a clocking of broadcast messages on the high-speed bus, now convert HSB commands transmitted by the high-speed bus into switching states (e.g. serial, parallel, semi-bypass, etc.). First, a control module state 221 is reached, in which, for example, a charging process can be carried out.A transition to the passive end module state 213 can also occur from the control module state 221 with an HSB command 254, such as ShutDown. While the passive end module state 213 ultimately means that the traction system is forced to perform a restart, it is conceivable to replace the passive end module state 213 with a state that initiates recovery. Furthermore, a transition to a motor preparation module state 222 is possible with the HSB command 255. When an abort error occurs, depending on the assumed module state 221 or 222, a direct transition 241, 242 takes place—i.e., executed immediately by the respective battery module without waiting for an HSB command—to a control abort error state 231 assigned to the "passive" switching state. The control abort error state 231 is again hard-coded 263 as the "passive" switching state.The motor preparation module state 222 is an intermediate state from which a transition to a motor module state 223 occurs upon HSB command 256. In the motor module state 223, for example, a motor operation is running, during which the modular battery is discharged. A transition from the motor module state 223 to a control preparation module state 224 is performed upon HSB command 257. If an abort error occurs, depending on the assumed module state 223 or 224, a direct transition 243, 244 to a motor abort error state 232 assigned to the "semi-bypass" switching state takes place. The engine abort error state 232 is also hard-coded 263 as the “semi-bypass” switching state. Providing two different abort error states 231, 232 as fail-safe states 204 is advantageous because the safe switching state during engine operation is the “semi-bypass” switching state, while this is the “passive” switching state during charging, for example.In the respective intermediate states 222, 224, all modules are switched to the respective switching state (semi-bypass or passive) corresponding to the abort error state 231, 232 in preparation for the motor module state 223 or control module state 221, so that the previously occurring operation is no longer executed. However, if an abort error 241, 242, 243, 244 occurs, it is ensured that all battery modules move from the module state 221, 223 assigned to the respective operating state (motor or charging) to the same abort error state 231 or 232. Finally, a transition to the passive end module state 213 occurs from the two abort error states 231, 232 via an HSB command 259, e.g., ShutDown. List of reference symbols 200 module state machine for module control 201 POR input state 202 FPGA synchronized with HSB-CMD state 203 HSB-CMD controlled states 204 Fail-safe states 210 Input action after POR or design reset 211 Passive State Passive (PSV) 212 Passive State Synchronization (SYNC) 213 Passive State Passive Final (PSVF) 221 HSB-CMD state Control (CTRL) 222 HSB-CMD state Prepare for Motor (PMOT) 223 HSB-CMD-Engine status (MOT) 224 HSB-CMD state Prepare for Control (PCTRL) 231 Passive State Error Control (ERRCT) 232 Half-Bypass Condition Error Motor (ERRM) 241 In case of abort error 242 In case of abort error 243 In case of abort error 244 In case of abort error 250 HSBD-Cmd 251 HSBD-Cmd 252 HSBD-Cmd 253 HSBC Passiv 254 HSBC & Passive or HSBD-Cmd 255 HSBC Passiv 256 HSBC & Half-Bypass 257 HSBC & Half-Bypass 258 HSBC & Passiv 259 HSBC & Passive or HSBD-Cmd (Shut-down) 261 MOSFETs hard-coded 262 MOSFETs HSBC controlled 263 MOSFETs hard-coded 291 States coupled with respective semiconductor switch 292 Synchronously passed states via high-speed bus 293 Abort error states 294 Direct transition to abort error state 295 High-speed bus commanded crossing 299 Legend

Claims

[1] Method for safely entering a termination fault state in a modular battery, in which the modular battery connected to a traction machine comprises a central controller, a plurality of battery modules arranged in at least one string, each of which has a plurality of semiconductor switches, at least one energy storage device and a hardware-programmable module control unit, and for each respective string between the central controller and along the respective battery modules, a fault loop and a high-speed bus, wherein respective switching positions of the plurality of semiconductor switches of a respective battery module correspond to a respective switching state, wherein the respective battery module has a plurality of module states (211, 212, 213, 221, 222, 223, 224, 231, 232), wherein for each module state (211, 212, 213, 221, 222, 223, 224, 231, 232) at least one switching state is realized,wherein the central controller has a processor unit on which a control program for controlling the battery modules via the high-speed bus and the error loop is configured, wherein a module state machine (200) is executed on the hardware-programmable module control unit as a control program for assuming module states (211, 212, 213, 221, 222, 223, 224, 231, 232) and the corresponding switching states to be realized, wherein the plurality of module states (211, 212, 213, 221, 222, 223, 224, 231, 232) has at least one abort error state (231, 232), wherein at least one module state (211, 212, 213) according to a predetermined switching state is directly connected to a respective gate control of the plurality of semiconductor switches of the respective battery module is coupled, wherein transitions between module states (221, 222, 223, 224) are triggered by the central controller via the high-speed bus,wherein the occurrence of an abort error is communicated to all battery modules via the error loop and / or the high-speed bus, wherein upon the occurrence of the abort error, a direct transition (241, 242, 243, 244) to the at least one abort error state (231, 232) is triggered, and wherein a transition between two module states (221, 223), which are each assigned to a different operating state, is carried out via an intermediate state (222, 224), wherein upon the occurrence of an abort error, a direct transition (242, 244) to the at least one abort error state (231, 232) is also triggered from the intermediate state (222, 224). [2] Method according to claim 1, wherein the at least one abort error state (231, 232) is formed by a bypass switching state or a semi-bypass switching state during engine operation and by a passive switching state for the semiconductor switches of the respective battery module during charging operation. [3] Method according to one of the preceding claims, in which the respective battery module has at least one energy storage device and four half-bridges connected in parallel, wherein a two-wire input connection is formed by a respective center tap on two first half-bridges and a two-wire output connection is formed by a respective center tap on two second half-bridges, wherein an electrical connection between adjacent battery modules is formed by a control carried out by the respective battery module of the semiconductor switches connected to the respective terminals located relative to one another, and wherein switching state changes in both modules are controlled synchronously. [4] Method according to one of the preceding claims, in which, when a switching fault of a semiconductor switch occurs in a battery module of a string of the at least one string, the respective switching state of all other battery modules of the string is maintained unchanged. [5] Method according to claim 4, wherein an abort error is detected upon a predetermined number of consecutive occurrences of the same switching error of the semiconductor switch in the battery module, wherein the abort error is reported via the fault line, and wherein the abort error is recognized as an abort error event by the central controller observing the fault line and is transmitted synchronously by the central controller via the high-speed bus to all battery modules in all strings. [6] Method according to one of the preceding claims, in which an FPGA is selected as the hardware-programmable module control unit. [7] Method according to one of the preceding claims, in which the semiconductor switches are formed by MOSFETs. [8] Module control unit for a battery module in a modular battery, in which the modular battery connected to a traction machine comprises a central controller, a plurality of battery modules arranged in at least one string, each of which has a plurality of semiconductor switches, at least one energy storage device and the hardware-programmable module control unit, and for each respective string between the central controller and along the respective battery modules, a fault loop and a high-speed bus, wherein respective switching positions of the plurality of semiconductor switches of a respective battery module correspond to a respective switching state, wherein the respective battery module has a plurality of module states, wherein each module state is assigned at least one switching state, wherein the central controller has a processor unit,on which a control program for controlling the battery modules via the high-speed bus and the error loop is configured, wherein the hardware-programmable module control unit is designed to implement a module state machine as a control program for assuming module states and the correspondingly assigned switching states, wherein the plurality of module states has at least one abort error state, wherein at least one module state is directly coupled to a respective gate control of the plurality of semiconductor switches of the respective battery module according to a predetermined switching state, wherein transitions between module states are triggered by the central controller via the high-speed bus, wherein the occurrence of an abort error is communicated to all battery modules via the error loop and / or the high-speed bus,and wherein upon occurrence of the abort error, a direct transition to the at least one abort error state is triggered, and wherein the module control unit is configured to be used when carrying out a method according to one of claims 1 to 7., [9] A traction system, wherein the traction system comprises a traction machine and a modular battery connected thereto, wherein the modular battery comprises a central controller, a plurality of battery modules arranged in at least one string, each of which has a power board with a plurality of semiconductor switches and a plurality of switching states and each of which has a hardware-programmable module control unit according to claim 8, a fault loop and a high-speed bus, and wherein the traction system is configured to carry out a method according to any one of claims 1 to 7.

Images