MONITORING OF A TWO-BATTERY SERVICE POWER SUPPLY GROUP OF A SYSTEM

Abstract

A monitoring method is implemented in a system comprising an on-board network supplied with electrical energy by a power supply group comprising an electrical energy generator capable of recharging a first service battery and a second service battery associated with a safety device allowing its recharging and preventing its discharge except for powering safe electrical equipment. This method comprises a step (10-60) in which it is monitored whether a first voltage, measured between the safety device and the second service battery and representative of a recharging phase of the latter, is consistent with a second voltage measured at the output of the electrical energy generator, and in the event of inconsistency at least one action is carried out in the system. Figure 3

Description

Title of the invention: MONITORING OF A TWO-BATTERY ELECTRICAL POWER SUPPLY GROUP OF A SYSTEM Technical field of the invention

[0001] The invention relates to systems comprising an on-board network supplied with electrical energy by a power supply group comprising an electrical energy generator and two rechargeable service batteries, and more precisely to the monitoring of the power supply group of such systems. State of the art

[0002] As is known to those skilled in the art, certain systems, such as for example certain vehicles (possibly of the automobile type), comprise an on-board network supplied with electrical energy by a power supply group comprising an electrical energy generator and first and second rechargeable service batteries. For example, in the case of a vehicle, this electrical energy generator may be an alternator or an alternator-starter when the vehicle comprises a powertrain (or GMP) comprising at least one thermal motor, or a current converter associated with a main battery of low, medium or high voltage type, when the GMP comprises at least one electric motor.

[0003] In the following and the above, the term "service battery" means a battery rechargeable by at least one electrical energy generator and of the very low voltage type (typically 12 V, 24 V or 48 V).

[0004] Furthermore, in what follows and what precedes, the term "on-board network" means an electrical power supply network to which electrical (or electronic) equipment (or components) consuming electrical energy are coupled and being "non-priority" for at least one of them and "safe" (and therefore priority) for at least one other of them.

[0005] Furthermore, in the following and the preceding, the term "safety equipment (or component)" means equipment (or component) providing at least one so-called "safety" function because it concerns the safety of users of a system, and therefore must be supplied with electrical energy as a priority, if necessary. This is the case, for example, of electric power steering or an all-electric braking device (service brake, emergency brake, braking assistance system or anti-skid, for example), or even a trajectory control device.

[0006] When the power supply group comprises an electric power generator and first and second rechargeable service batteries, it is the power generator electric (associated with the main battery) which is responsible for powering the on-board network and recharging the first and second service batteries when active. When the on-board network requires at a given moment electrical energy (or power) that the (active) electrical energy generator cannot provide alone (possibly due to a failure of the electrical energy generator) or the electrical energy generator is inactive, it is the first service battery (sometimes called the main battery) which must provide the supplement or all of the electrical energy to the on-board network while guaranteeing minimum voltage levels to the safety components. There is then a risk of discharge of the first service battery which could cause a voltage drop at its terminals and therefore a voltage drop at the terminals of the on-board network (a phenomenon known as "collapse") which could then impact the nominal operation of the electrical equipment coupled to the on-board network and in particular those which are safety components.

[0007] The second service battery is responsible for supplying electrical energy to at least one of the safety electrical equipment (hereinafter referred to as associated) when the electrical energy generator and the first service battery are not capable of doing so. It therefore constitutes a backup (or secondary) service battery which improves the operational safety of the system. Generally, the storage capacity of the second service battery is less than that of the first service battery.

[0008] In order for the second service battery to be able to be recharged by the electrical energy generator but to be able to discharge only to power each associated safety electrical equipment, this second service battery is associated with a safety device. The latter generally comprises at least one diode allowing the recharge current (supplied by the electrical energy generator) to pass, but preventing the current generated by the second service battery from passing to reach the on-board network except for each associated safety electrical equipment.

[0009] Sometimes, the safety device is subject to a failure, such as for example a short circuit, which can prevent the passage of the recharging current supplied by the electrical energy generator, and therefore prevents the recharging of the second service battery. In this case, the second service battery gradually discharges, and therefore becomes fairly quickly incapable of providing on its terminals a voltage which is compatible with the minimum performance level expected of each associated safety electrical equipment, which can prove dangerous when the electrical energy generator and the first service battery are not capable of providing this compatible voltage.

[0010] The invention therefore aims in particular to improve the situation by proposing a monitoring the operation of the safety device of a system's power supply group. Presentation of the invention

[0011] For this purpose, it proposes in particular a monitoring method intended to be implemented in a system comprising an on-board network supplied with electrical energy by a power supply unit comprising an electrical energy generator capable of recharging a first service battery and a second service battery associated with a safety device intended to allow its recharging and to prevent its discharge except for supplying safety electrical equipment.

[0012] This monitoring method is characterized by the fact that it comprises a step in which:

[0013] - we monitor whether a first voltage, measured between the safety device and the second service battery and representative of a recharging phase of the latter, is consistent with a second voltage measured at the output of the electrical energy generator, and

[0014] - in case of inconsistency at least one action is carried out in the system.

[0015] This monitoring of the first voltage (downstream of the safety device) now makes it possible to detect a failure of the safety device in real time, and therefore to act accordingly.

[0016] The monitoring method according to the invention may include other characteristics which may be taken separately or in combination, and in particular:

[0017] - in its step we can compare a first value, representative of a difference between the first and second voltages, at a first chosen threshold, and when this first value is greater than this first threshold at least one action can be carried out in the system;

[0018] - in the presence of the first option, in its step one can perform an action consisting of applying to an input of the safety device, with the electrical energy generator, a chosen voltage profile, and monitoring whether the first voltage has a time evolution representative of this applied voltage profile, and if not, at least one other action can be carried out in the system, while if so, it can be considered that there is no failure of the safety device;

[0019] - in the presence of the last sub-option, in its step we can compare the first voltage at a second threshold which is a function of the applied voltage profile, during a first duration of application of the latter, and when the first voltage is lower than this second threshold during this duration of application at least one other action can be carried out in the system, while when the first voltage is greater than or equal to this second threshold during the first duration of application it can be considered that there is no failure of the safety device;

[0020] - also in the presence of the last sub-option, in its step the profile of applied voltage may comprise a first part during which the electrical energy generator applies a constant voltage of a chosen value and for a second chosen application duration on the input of the safety device;

[0021] - also in the presence of the last sub-option, in its step each other action can be chosen from an incrementation by one unit of a current value of a failure counter, an adaptation of a management of the energy supply of the system, a generation of an alert to a user of the system of a need to have the latter checked, and a recording of a fault code representative of a failure of the safety device;

[0022] - in the presence of the last sub-sub-option, in its step, when we carry out the increment, we can then compare the current value of the failure counter to a third chosen threshold, and when this current value is greater than this third threshold we can consider that the safety device is faulty and we can carry out in the system at least one other action chosen from those mentioned above and different from the increment.

[0023] The invention also provides a computer program product comprising a set of instructions which, when executed by processing means, is capable of implementing a monitoring method of the type presented above for monitoring a power supply unit supplying electrical energy to an on-board network of a system and comprising an electrical energy generator capable of recharging a first service battery and a second service battery associated with a safety device intended to allow its recharging and to prevent its discharge except for supplying safety electrical equipment of the on-board network.

[0024] The invention also proposes a monitoring device intended to equip a system comprising an electrical energy generator capable of recharging a first service battery and a second service battery associated with a safety device intended to allow its recharging and to prevent its discharge except for powering safety electrical equipment.

[0025] This monitoring device is characterized by the fact that it comprises at least one processor and at least one memory arranged to carry out the operations consisting of:

[0026] - to monitor whether a first voltage, measured between the safety device and the second service battery and representative of a recharging phase of the latter, is consistent with a second voltage measured at the output of the electrical energy generator, and

[0027] - in case of inconsistency to trigger the realization in the system of at least one action.

[0028] The invention also proposes a system comprising an on-board network supplied with electrical energy by a power supply unit comprising an electrical energy generator capable of recharging a first service battery and a second service battery associated with a safety device intended to allow its recharging and to prevent its discharge except for supplying safety electrical equipment, as well as a monitoring device of the type presented above.

[0029] For example, this system may be a vehicle, possibly of the automobile type. Brief description of the figures

[0030] Other characteristics and advantages of the invention will appear on examining the detailed description below, and the appended drawings, in which:

[0031] [Fig.l] schematically and functionally illustrates an exemplary embodiment of a vehicle comprising a distribution box comprising a monitoring device according to the invention,

[0032] [Fig.2] schematically and functionally illustrates an exemplary embodiment of a computer for supervising the distribution of electrical energy comprising an exemplary embodiment of a monitoring device according to the invention, and

[0033] [Fig.3] schematically illustrates an example of an algorithm implementing a monitoring method according to the invention. Detailed description of the invention

[0034] The invention aims in particular to propose a monitoring method, and an associated monitoring device DSI, intended to allow monitoring in a system S of a power supply group comprising an electrical energy generator GE and first B1 and second B2 service batteries and responsible for supplying electrical energy to an on-board network RB to which electrical equipment is coupled, at least one of which (EES) is safe.

[0035] In the following, it is considered, by way of non-limiting example, that the system S is a vehicle of the automobile type, such as for example a car, as illustrated in [Fig.l]. But the invention is not limited to this type of system. It in fact relates to any type of system comprising an on-board network supplied with electrical energy by a power supply unit comprising an electrical energy generator and first and second service batteries, the second service battery being more particularly responsible for supplying at least one piece of safety electrical equipment (coupled to the on-board network) when the electrical energy generator and the first service battery are not capable of doing so.Thus, the invention relates, for example, to land vehicles (utility vehicles, camper vans, minibuses, coaches, trucks, motorcycles, road machinery, construction machinery, agricultural machinery, leisure machinery (snowmobile, kart), and tracked vehicles, for example), boats, etc. aircraft, electrified installations (possibly industrial type), and electrified buildings.

[0036] Furthermore, it is considered in the following, by way of non-limiting example, that the vehicle S comprises a powertrain (or GMP) of the all-electric type (and therefore whose drive is provided exclusively by at least one electric motor). But the GMP could be of the hybrid type (thermal and electric).

[0037] Furthermore, it is considered in the following, by way of non-limiting example, that the second service battery B2 is responsible for powering a single piece of safety electrical equipment EES constituting an all-electric braking device (service brake and / or emergency brake and / or braking assistance or anti-skid system, for example) of the vehicle S. But the second service battery B2 could be responsible for powering a piece of safety electrical equipment of another type, such as for example electric power steering or a trajectory control device, or several (at least two) pieces of safety electrical equipment.

[0038] [Fig.l] schematically shows a system S (here a vehicle) comprising an electric GMP transmission chain, an on-board network RB, a power supply group comprising first B1 and second B2 service batteries and an electric energy generator GE, and a monitoring device DSI according to the invention.

[0039] The on-board network RB is an electrical power supply network to which electrical (or electronic) equipment (or components) are coupled (or connected) which consume electrical energy and which for some of them are “non-priority” and for some others (EES) are “safe” (and therefore priority).

[0040] It will be noted that in the example illustrated non-limitingly in [Fig.l] only a single piece of safe electrical equipment EES is coupled to the on-board network RB, because it is the one which must, here, be supplied with electrical energy by the second service battery B2 when the electrical energy generator GE and the first service battery B1 are not capable of doing so. But usually several pieces of non-safe electrical equipment and several pieces of safe electrical equipment are coupled to the on-board network RB.For example, in a vehicle, safety equipment (or component) may be electric power steering, or an electric braking device (service brake, emergency brake, braking assistance system or anti-skid system, for example), or a trajectory control device, for example, and non-priority equipment (or component) may be a heating / air conditioning system or a seat heating device or a seat massage device.

[0041] The first service battery B1 is responsible for supplying electrical energy to the on-board network RB, in addition to that supplied by the energy generator. GE electric power generator, and sometimes instead of this GE electric power generator. For example, this first service battery B1 can be arranged in the form of a very low voltage type battery (typically 12 V, 24 V or 48 V). It is rechargeable at least by the GE electric power generator. In the following, as a non-limiting example, it is considered that the first service battery B1 is of the 12 V Lithium-ion type.

[0042] The second service battery B2 is responsible for supplying electrical energy to at least one associated safety electrical equipment EES (here an all-electric braking device) coupled to the on-board network RB, when the electrical energy generator GE and the first service battery B1 are not capable of doing so. For example, this second service battery B2 may be arranged in the form of a very low voltage type battery (typically 12 V, 24 V or 48 V). It is rechargeable at least by the electrical energy generator GE. It is considered in the following, by way of non-limiting example, that the second service battery B2 is of the 12 V Lithium-ion type. Furthermore, it is considered in the following, by way of non-limiting example, that the storage capacity of the second service battery B2 is lower than that of the first service battery B1. But this is not obligatory.

[0043] As illustrated in [Fig.l], the second service battery B2 is associated with a safety device DS2 which is intended to allow its recharging by the electrical energy generator GE and to prevent its discharge into the on-board network RB except to power the associated safety electrical equipment EES. This safety device DS2 is therefore installed between the second service battery B2 and the electrical energy generator GE and between the second service battery B2 and the on-board network RB.

[0044] For example, this safety device DS2 may comprise at least one diode allowing the recharging current (supplied by the electrical energy generator GE) to pass to recharge the second service battery B2, but preventing the current generated by the second service battery B2 from passing to join the on-board network RB if we exclude each associated safety electrical equipment EES.

[0045] The transmission chain has a GMP which is, here, purely electric and therefore which comprises, in particular, an electric motor MM1, a motor shaft AM, a main battery BP and a transmission shaft AT. Here, the term “electric motor” means an electric machine arranged so as to provide or recover torque to move the system S.

[0046] The electric motor MM1 (here an electric motor) is coupled to the main battery BP, in order to be supplied with electrical energy, as well as possibly to supply this main battery BP with electrical energy, in particular during regenerative braking. It is coupled to the motor shaft AM, for provide it with torque by rotating it. This motor shaft AM is here coupled to a reducer RD which is also coupled to the transmission shaft AT, itself coupled to a first train Tl (here of wheels), preferably via a differential Dl.

[0047] This first train T1 is here located in the front part PVV of the system S. But in a variant this first train T1 could be the one which is here referenced T2 and which is located in the rear part PRV of the system S.

[0048] The main (or traction) battery BP may, for example, comprise electrical energy storage cells, possibly electrochemical (for example of the lithium-ion (or Li-ion) or Ni-Mh or Ni-Cd type). Also for example, the main battery BP may be of the low voltage type (typically 450 V for illustration purposes). But it could be of the medium voltage or high voltage type.

[0049] The electric motor MM1 is, here, also coupled to the electric energy generator GE which is also indirectly coupled to the first B1 and second B2 service batteries, in particular to recharge them with electrical energy from the main battery BP and converted.

[0050] This electrical energy generator GE is a current converter, for example. It is also responsible for supplying the on-board network RB with electrical energy from the main battery BP and converted, in addition to ensuring the recharging of the first B1 and second B2 service batteries.

[0051] It will be noted that in the example illustrated non-limitingly in [Fig.l] the system S comprises a distribution box BD to which the first B1 and second B2 service batteries, the electrical energy generator GE and the on-board network RB are coupled. This distribution box BD is responsible for distributing in the on-board network RB the electrical energy produced by the electrical energy generator GE and / or stored in the first B1 or second B2 service battery, for the supply of the electrical components (or equipment) (including the safety EES) according to received power supply requests. The management of the distribution of this electrical energy can be ensured by a supervision computer CS. In the example illustrated non-limitingly in [Fig.l], the supervision computer CS is part of the distribution box BD.But in an alternative embodiment (not illustrated) the supervision calculator CS could not be part of the distribution box BD.

[0052] As mentioned above, the invention proposes in particular a monitoring method intended to enable monitoring of the power supply group of the system S, and more precisely of its safety device DS2, to detect when the latter (DS2) is subject to a failure.

[0053] This (management) method can be implemented at least in part by a DSI monitoring device of the type illustrated in [Fig.2] and comprising at least one processor PR1 and at least one memory MD which are arranged to carry out operations when it has been woken up, for example by the CS supervision computer, or as soon as the on-board electronics are woken up by a master computer of the vehicle.

[0054] It will be noted that in the example illustrated non-limitingly in [Fig.l], the monitoring device DSI is part of the supervision computer CS. But it could be equipment coupled to the supervision computer CS. Generally speaking, the monitoring device DSI is produced in the form of a combination of electrical or electronic circuits or components (or "hardware") and software modules (or "software"). For example, it could be a microcontroller.

[0055] The processor PR1 may, for example, be a digital signal processor (or DSP). This processor PR1 may comprise integrated (or printed) circuits, or several integrated (or printed) circuits connected by wired or wireless connections. An integrated (or printed) circuit is understood to mean any type of device capable of performing at least one electrical or electronic operation.

[0056] The MD memory is live in order to store instructions for the implementation by the processor PR1 of at least part of the monitoring method described below (and therefore of its functionalities).

[0057] As illustrated non-limitingly in [Fig.3], the (management) method, according to the invention, comprises a step 10-60.

[0058] This step 10-60 comprises a sub-step 30 in which one (the monitoring device DSI) monitors whether a first voltage ul, measured between the safety device DS2 and the second service battery B2 and representative of a recharging phase of the latter (B2), is consistent with a second voltage u2 measured at the output of the electrical energy generator GE. The notion of "consistency" here means that the first voltage ul must correspond to the second voltage u2 taking into account the voltage losses introduced by the electrical (or electronic) connections and components separating the electrical energy generator GE from the place where the first voltage ul is measured (namely at the output (or downstream) of the safety device DS2 when considering the direction of circulation of the recharging current from the electrical energy generator GE).Furthermore, it will be understood that the electric power generator GE must be active for the invention to be implemented. Therefore, when the system S is a vehicle, it is preferable to implement the invention during each phase of driving of the vehicle S.

[0059] Step 10-60 also comprises a sub-step 40 in which at least one action is carried out (the monitoring device DSI triggers the carrying out) in the system S in the event of inconsistency between the first ul and second u2 voltages, and therefore when the first voltage ul is abnormal with respect to the second voltage u2.

[0060] Thanks to this monitoring of the first voltage ul (downstream of the DS2 safety device), it is now possible to detect a failure of the device in real time. DS2 safety, and therefore to act accordingly because such a failure can prevent the passage of the charging current supplied by the GE electrical power generator, and therefore prevent the recharging of the second service battery B2, thus making it progressively unable to offer on its terminals a voltage compatible with the minimum performance level expected of the associated safety electrical equipment EES.

[0061] It will be understood that it is the processor PR1 and memory MD which are arranged to carry out the operations consisting of monitoring whether the first voltage ul is consistent with the second voltage u2, and in the event of inconsistency to trigger the performance in the system S of at least one action.

[0062] It will be noted, as illustrated non-limitingly in [Fig.l], that an auxiliary device DA can be inserted between the second service battery B2 and the safety device DS2, in order to facilitate or allow the measurement of each first voltage ul just downstream of the safety device DS2. For example, and as illustrated non-limitingly in [Fig.l], this auxiliary device DA can comprise a switch (or commutator) mounted in parallel with a diode polarized oppositely to the diode of the safety device DS2. Each measurement of the first voltage ul is then carried out by a measuring device (not illustrated) and for example at least partly inserted between the auxiliary device DA and the safety device DS2.

[0063] For example, and as illustrated non-limitingly in [Fig. 3], step 10-60 may comprise a sub-step 20 in which one (the monitoring device DSI) may determine, repeatedly (for example periodically), a first value vl which is representative of the difference between the first ul and second u2 voltages. For example, each first value vl may be equal to the absolute value of the difference (or the difference) between the first ul and second u2 voltages (i.e. vl = Iu2 - ull). This makes it possible to take into account both positive and negative differences. But in an alternative embodiment, one could only take into account positive differences (i.e. (u2 - ul) > 0).

[0064] In this case, in sub-step 30 of step 10-60 one (the monitoring device DSI) can compare each first determined value vl to a first threshold si chosen, and when this first value vl is greater than this first threshold si one carries out (the monitoring device DSI triggers the carrying out) in the system S at least one action. The first threshold si is here chosen to characterize the maximum difference that can normally exist between the first ul and second u2 voltages in the absence of failure of the safety device DS2. Consequently, as long as the first value vl remains less than or equal to the first threshold si, it is because the safety device DS2 is operating normally a priori (and therefore one returns to carry out sub-step 20 (as well as a possible sub-step 10) with new first ul and second u2 voltages), but when the first value vl is greater at the first threshold if this indicates that the safety device DS2 is faulty because the voltage loss it induces is too great (and therefore sub-step 40 is carried out).

[0065] For example, the first threshold si can be between +0.5 V and +1.5 V. For example, the first threshold si can be equal to +1 V.

[0066] It will be noted that in order to prevent the monitoring result from being distorted by an abnormally low voltage at the output of the electrical energy generator GE, step 10-60 may comprise a very first sub-step 10 in which one (the monitoring device DSI) begins by comparing the second voltage u2 to a (fourth) threshold s4 which is representative of the minimum voltage at the terminals of the electrical energy generator GE when it is in an electrical energy supply phase. In this case, when the second voltage u2 is less than or equal to the fourth threshold s4 (i.e. u2 < s4), one returns to perform sub-step 10 with a new second voltage u2. On the other hand, when the second voltage u2 is greater than the fourth threshold s4 (i.e. u2 > s4), one performs sub-step 20 with the first ul and second u2 voltages which have just been measured.

[0067] It will also be noted that in sub-step 40 of step 10-60 it is possible to carry out (the monitoring device DSI can trigger the carrying out) in the system S at least one action which consists of applying to an input of the safety device DS2, with the electrical energy generator GE, a chosen voltage profile. This application of a chosen voltage profile is intended to obtain confirmation or denial of the failure of the safety device DS2.

[0068] In the presence of this application, and as illustrated non-limitingly in [Fig.3], step 10-60 can comprise a sub-step 50 in which one (the monitoring device DSI) can monitor whether the first voltage ul has a temporal evolution which is representative of the applied voltage profile.

[0069] If this temporal evolution of the first voltage ul is not representative of the applied voltage profile (and therefore in the negative), it is possible to carry out (the monitoring device DSI can trigger the carrying out) in the system S at least one other action. It is in fact considered that the failure of the safety device DS2 is confirmed and therefore that it is necessary to act accordingly.

[0070] On the other hand, if the temporal evolution of the first voltage ul is actually representative of the applied voltage profile (and therefore in the affirmative), we can return to perform sub-step 20 (as well as the possible sub-step 10) with new first ul and second u2 voltages. We consider in fact that the failure of the safety device DS2 is invalidated (absence of failure) and therefore that there is no need to perform a new action in the system S.

[0071] For example, in sub-step 50 of step 10-60 one (the monitoring device DSI) can compare the first voltage ul to a second threshold s2 which is a function of the voltage profile applied, for a first duration dl of application of the latter. Then, when in this sub-step 50 the first voltage ul is lower than this second threshold s2 (i.e. ul < s2) during this first duration of application dl, it is possible to carry out (the monitoring device DSI can trigger the carrying out) in the system S at least one other action. On the other hand, when in sub-step 50 the first voltage ul is greater than or equal to the second threshold s2 (i.e. ul > s2) during the first duration of application dl, it is considered that there is no failure of the safety device DS2 and therefore it is necessary to return to carry out sub-step 20 (as well as the possible sub-step 10).

[0072] Also for example, in sub-step 40 of step 10-60 the applied voltage profile may comprise a first part during which the electrical energy generator GE applies a second constant voltage u2, of a chosen value uc and for a second chosen application duration d2, to the input of the safety device DS2. This first (preparatory) part is intended to establish a second stable voltage u2 at the output of the electrical energy generator GE, before temporally varying this second voltage u2 with a second (main) part of the voltage profile during a third application duration d3 which is equal to the difference between the first d1 and second d2 application durations.

[0073] Thus, if the safety device DS2 operates correctly, the temporal variation of the second voltage u2 during the second part of the voltage profile must induce a similar variation of the first voltage ul (downstream of the safety device DS2), and if the safety device DS2 is faulty, the temporal variation of the second voltage u2 during the second part of the voltage profile must not have a significant impact on the first voltage ul (and in any case must not induce a variation similar to this temporal variation).

[0074] For example, the second application duration d2 may be between 200 ms and 1 s. For example, the second application duration d2 may be equal to 500 ms.

[0075] Also for example, when the on-board network voltage is 12 V, the chosen and constant value uc of the second voltage u2 (during the second application duration d2) can be between 12.8 V and 13.2 V. By way of example, this chosen value uc can be equal to 13 V.

[0076] Also for example, during the third application duration d3 of the voltage profile the second voltage u2 can be varied relatively slowly from the chosen value uc and up to a maximum value u2max. In this case, when the on-board network voltage is 12 V, the maximum value u2max can, for example, be between 14 V and 15.5 V. By way of example, this maximum value u2max can be equal to 15 V.

[0077] Furthermore, the third application duration d3 can, for example, be understood between 1.5 s and 3 s. For example, this third application duration d3 can be equal to 2 s.

[0078] Also for example, the second threshold s2 may be a function of the first value ul in the presence of the chosen value uc and of the maximum value u2max. In this case, the second threshold s2 may, for example, be between the first value ul in the presence of the chosen value uc increased by 0.3 V and the first value ul in the presence of the chosen value uc increased by 0.8 V. By way of example, the second threshold s2 may be equal to the first value ul in the presence of the chosen value uc increased by 0.5 V.

[0079] Also for example, in sub-step 40 or in sub-step 60 of step 10-60 each other action can be chosen from:

[0080] - an increment of one unit of the current value vc of a die counter failure,

[0081] - an adaptation of the management of the energy supply of the system S,

[0082] - a generation of an alert from a user of the system S of a need to have checked the latter (S), and

[0083] - a recording of a fault code representative of a failure of the device of DS2 security.

[0084] For example, the alert of a user of the vehicle S can be done by a simple indicator light being lit or by a service message (possibly dedicated to the detected failure of the safety device DS2) which is displayed on at least one screen of the vehicle S (for example on the dashboard) or on the screen of a smartphone (or “smartphone”) of the user, and / or broadcast by at least one speaker of the vehicle S or of this smartphone.

[0085] Also for example, after each detection of a failure of the safety device DS2 at least one fault code can be stored in a memory (possibly read-only) of the supervision computer CS or another on-board computer (for example responsible for storing all the fault codes in the vehicle S). The recording of each fault code makes it possible to inform an after-sales service of each failure of the safety device DS2.

[0086] It will also be noted that in step 10-60, when the current value vc of the failure counter is incremented by one unit, the monitoring device DSI can then compare the current value vc of the failure counter to a third threshold s3 chosen. In this case, when this current value vc is greater than this third threshold s3 (i.e. vc > s3), the monitoring device DSI can consider that the safety device DS2 is actually faulty and at least one other action can be carried out in the system S which is chosen from those mentioned above and different from the incrementation (such as for example the adaptation of the management of the energy supply of the system S and / or the generation of a user alert and / or the recording of a fault code). But, when the current value vc is less than or equal to the third threshold s3 (i.e. vc < s3), one (the DSI monitoring device) can postpone its decision relating to the reality of the failure of the DS2 safety device and therefore one does not carry out (the DSI monitoring device does not trigger the carrying out) another action chosen from those mentioned above and different from the incrementation.

[0087] For example, the third threshold s3 can be between 1 and 3. For example, the third threshold s3 can be equal to 2.

[0088] When the system S is a vehicle, it is preferable to increment the current value vc by one unit only once during a rolling phase of the vehicle S. In this case, during the following rolling phase, the current value vc at the end of the previous rolling phase is restarted. Furthermore, when, at the start of a rolling phase, it is detected that there is no longer a failure of the safety device DS2, the current value vc is preferably set to zero (in any other case, the current value vc is maintained).

[0089] It will also be noted, as illustrated non-limitingly in [Fig. 2], that the supervision computer CS (or the possible computer of the monitoring device DSI) can also comprise, in addition to the RAM MD and processor PR1, a mass memory MM2, in particular for the storage of the first ul and second u2 voltages, and intermediate data involved in all its calculations and processing. Furthermore, this supervision computer CS (or the possible computer of the monitoring device DSI) can also comprise an input interface IE for the reception of the first ul and second u2 voltages, possibly after having shaped and / or demodulated and / or amplified them, in a manner known per se, by means of a digital signal processor PR2.In addition, this CS supervision calculator (or the possible calculator of the DSI monitoring device) can also include an IS output interface, in particular to deliver at least the messages (or orders) for triggering the voltage profile, or messages containing fault codes, or messages signaling a failure.

[0090] It will also be noted that the invention also proposes a computer program product (or computer program) comprising a set of instructions which, when executed by processing means of the electronic circuit (or hardware) type, such as for example the processor PR1, is capable of implementing the monitoring method described above to monitor the power supply group (comprising the electrical energy generator GE and the first B1 and second B2 service batteries) of the system S.

Claims

Claims

1. Monitoring method for a system (S) comprising an on-board network (RB) supplied with electrical energy by a power supply group comprising an electrical energy generator (GE) capable of recharging a first service battery (B1) and a second service battery (B2) associated with a safety device (DS2) intended to allow the recharging of said second service battery (B2) and to prevent the discharging of said second service battery (B2) except for supplying safety electrical equipment (EES), characterized in that it comprises a step (10-60) in which it is monitored whether a first voltage, measured between said safety device (DS2) and said second service battery (B2) and representative of a recharging phase of the latter (B2), is consistent with a second voltage measured at the output of said electrical energy generator (GE),and in the event of inconsistency at least one action is carried out in said system (S).

2. Method according to claim 1 characterized in that in said step (10-60) a first value, representative of a difference between said first and second voltages, is compared to a first chosen threshold, and when said first value is greater than said first threshold at least one action is carried out in said system (S).

3. Method according to claim 2, characterized in that in said step (10-60) an action is carried out consisting of applying to an input of said safety device (DS2), with said electrical energy generator (GE), a chosen voltage profile, and monitoring whether said first voltage has a time evolution representative of said applied voltage profile, and if not, at least one other action is carried out in said system (S), while if so, it is considered that there is no failure of said safety device (DS2).

4. Method according to claim 3, characterized in that in said step (10-60) said first voltage is compared to a second threshold depending on said applied voltage profile, during a first duration of application of the latter, and when said first voltage is lower than said second threshold during said duration of application, at least one other action is carried out in said system (S), while when said first voltage is greater than or equal to said second threshold during said first duration of application, it is considered that there is no there is no failure of said safety device (DS2).

5. Method according to claim 3 or 4, characterized in that in said step (10-60) said applied voltage profile comprises a first part during which said electrical energy generator (GE) applies a constant voltage, of a chosen value and for a second chosen application duration, on said input of said safety device (DS2).

6. Method according to one of claims 3 to 5, characterized in that in said step (10-60) each other action is chosen from an incrementation by one unit of a current value of a failure counter, an adaptation of a management of the energy supply of said system (S), a generation of an alert to a user of said system (S) of a need to have the latter (S) checked, and a recording of a fault code representative of a failure of said safety device (DS2).

7. Method according to claim 6, characterized in that in said step (10-60), when said incrementation is carried out, said current value of said failure counter is then compared to a third chosen threshold, and when said current value is greater than said third threshold, said safety device (DS2) is considered to be faulty and at least one other action chosen from said group and different from said incrementation is carried out in said system (S).

8. Computer program product comprising a set of instructions which, when executed by processing means, is capable of implementing the monitoring method according to one of claims 1 to 7 for monitoring a power supply group supplying electrical energy to an on-board network (RB) of a system (S) and comprising an electrical energy generator (GE) capable of recharging a first service battery (B1) and a second service battery (B2) associated with a safety device (DS2) intended to allow the recharging of said second service battery (B2) and to prevent the discharge of said second service battery (B2) except for supplying safety electrical equipment (EES) of said on-board network (RB).

9. Monitoring device (DSI) for a system (S) comprising an on-board network (RB) supplied with electrical energy by a power supply group comprising an electrical energy generator (GE) capable of recharging a first service battery (Bl) and a second service battery (B2) associated with a safety device (DS2) intended to allow the recharging of said second service battery (B2) and to prevent the discharging of said second service battery (B2) except for powering safety electrical equipment (EES), characterized in that it comprises at least one processor (PR1) and at least one memory (MD) arranged to carry out the operations consisting of monitoring whether a first voltage, measured between said safety device (DS2) and said second service battery (B2) and representative of a recharging phase of the latter (B2), is consistent with a second voltage measured at the output of said electrical energy generator (GE), and in the event of inconsistency to trigger the performance in said system (S) of at least one action.

10. System (S) comprising an on-board network (RB) supplied with electrical energy by a power supply group comprising an electrical energy generator (GE) capable of recharging a first service battery (B1) and a second service battery (B2) associated with a safety device (DS2) intended to allow the recharging of said second service battery (B2) and to prevent the discharge of said second service battery (B2) except for supplying safety electrical equipment (EES), characterized in that it further comprises a monitoring device (DSI) according to claim 9.

Images