SECURE CONTROL OF MAINTENANCE ON A VEHICLE CELL BATTERY COMPUTER

Abstract

A control method is implemented in a vehicle comprising a communication network and a cell battery including at least one sensor, at least one cell module(s) connected to a controller, and a battery computer coupled to the communication network, sensor, and controller via links. This method includes a step (10-50) in which, when maintenance of the battery computer is required, such maintenance is permitted if at least one of the selected links is disconnected from the battery computer. Figure 3.

Description

Title of the invention: SECURE CONTROL OF MAINTENANCE OF A COMPUTER IN A VEHICLE CELLULAR BATTERY Technical field of the invention

[0001] The invention relates to vehicles comprising a rechargeable cellular battery including a battery computer, and more specifically the control of maintenance of such a battery computer. State of the art

[0002] Some vehicles, possibly of the automobile type, include a rechargeable cellular battery, generally referred to as "main" (or traction) when it is responsible for electrically powering a main electrical circuit (sometimes referred to as "high voltage") to which at least one electric motive machine of their powertrain (or PWM) is connected.

[0003] Typically, such a cellular battery comprises at least one sensor (for example, one responsible for measuring the current flowing through it), at least one electrical energy storage cell module(s) connected to a controller, and a battery management computer. The latter (sometimes called a BMS ("Battery Management System")) is coupled via links or interfaces (analog or digital) to each sensor and each controller, and to a communication network of its vehicle (possibly multiplexed).

[0004] The battery control unit is particularly important in a vehicle because it centralizes the current, voltage, and internal temperature measurements taken in its battery cell, and determines parameters of its battery cell based on these measurements, including its internal resistance, minimum voltage, current State of Health (SoH) of each of its cell modules, and current State of Charge (SoC). Therefore, at least some of the maintenance operations (at least data writing and possibly data reading) of this battery control unit must be safe. This is especially true when it is being replaced or when at least one cell module is replaced in its battery cell.

[0005] Currently, once a replacement is completed, a technician performs certain maintenance operations depending on the type of replacement. In the case of a replacement of at least one cell module(s), the technician generally uses UDS (Unified Diagnostic Services) write services to update (or write) The battery computer stores the health status of each replaced cell module(s). When replacing the battery computer, the technician typically uses UDS read services to read the cell-related data stored in the battery computer being replaced, and UDS write services to write the read data to the new battery computer.

[0006] At least the use of the writing services is protected by a secure access (or authentication) mechanism, such as, for example, the one called Security Access (or SA) in English.

[0007] This maintenance method proves insufficiently secure because the secure access (or authentication) mechanism is relatively easy to break (or compromise) and / or lacks a traceability mechanism to track maintenance operations performed and the individuals who performed them. Consequently, data can be written to the battery cell even if the cell module(s) and / or battery control unit are not replaced, for example, to fraudulently modify this data when reselling the vehicle. Such fraudulent modification can endanger the vehicle and its passengers, reduce the vehicle's lifespan, and, moreover, damage the manufacturer's reputation.

[0008] The invention therefore aims in particular to improve the situation. Presentation of the invention

[0009] In particular, it proposes for this purpose a control method intended to be implemented in a vehicle comprising a communication network and a cellular battery including at least one sensor, at least one cell module(s) connected to a controller and a battery computer coupled to the communication network, sensor and controller via links.

[0010] This control method is characterized by the fact that it includes a step in which, when maintenance of the battery computer is required, this maintenance is authorized if at least one of the links, chosen, is disconnected from the battery computer.

[0011] Thanks to the invention, a malicious person, wanting to modify data from the battery computer, is forced to detach the cellular battery and disconnect at least one chosen link connected to an input / output of the battery computer, which is likely to deter him.

[0012] The control method according to the invention may include other features which may be taken separately or in combination, and in particular:

[0013] - in its step, maintenance can be authorized if the connection concerned between the battery calculator and communication network are disconnected and if at least one of the relevant connections, selected, between the battery calculator and the sensor and controller is disconnected;

[0014] - in its step, maintenance can be authorized when a mechanism is bypassed A predefined secure access (or authentication) method was used to request this maintenance;

[0015] - in its stage, authorization may only be necessary in the event of receipt by the predefined maintenance request battery calculator (for example with high cybersecurity stakes);

[0016] - in the presence of the last option, in its step, the predefined queries maintenance options can be chosen from a request to write data representative of the health status of a cell module(s), and a request to write data, previously read in a newly replaced battery computer, into a new battery computer and to be stored in the latter;

[0017] - in its step, a disconnection of a chosen link can be detected in the event of determination in the battery computer of information which is representative of a fault in connection of this chosen link to the battery computer;

[0018] - in its step, one can refuse to issue the authorization when the calculator of battery is placed in an operating mode (generally called "electronic integration") in which it is forbidden to transmit on the communication network or for another operating mode designed to inhibit a diagnosis made on inputs / outputs (digital or analog) of the battery computer.

[0019] The invention also proposes a computer program product comprising a set of instructions which, when executed by processing means, is suitable for implementing a control method of the type presented above, in a vehicle comprising a communication network and a cellular battery having at least one sensor, at least one cell module(s) connected to a controller and a battery computer coupled to the communication network, sensor and controller via links, to control maintenance in the battery computer.

[0020] The invention also proposes a control device intended to equip a vehicle comprising a communication network and a cellular battery including at least one sensor, at least one cell module(s) connected to a controller and a battery computer coupled to the communication network, sensor and controller via links.

[0021] This control device is characterized in that it includes at least one processor and at least one memory arranged to perform the operations consisting, when maintenance of the battery computer is required, of authorizing this maintenance if at least one of the links, chosen, is disconnected from the battery computer.

[0022] The invention also proposes a vehicle, possibly of the automobile type, comprising, on the one hand, a communication network and a cellular battery including at least one sensor, at least one cell module(s) connected to a controller and a battery computer coupled to the communication network, sensor and controller via links, and, on the other hand, a control device of the type of that presented above. Brief description of the figures

[0023] Other features and advantages of the invention will become apparent from an examination of the detailed description below, and the accompanying drawings, in which:

[0024] [Fig. 1] schematically and functionally illustrates an example of an embodiment of a vehicle comprising a powertrain, with an electric drive unit connected to a main electrical circuit to which a cellular battery is connected, and a control device according to the invention,

[0025] [Fig.2] schematically and functionally illustrates an example of an embodiment of a battery calculator comprising an example of an embodiment of a control device according to the invention, and

[0026] [Fig.3] schematically illustrates an example of an algorithm implementing a control method according to the invention. Detailed description of the invention

[0027] The invention aims in particular to provide a control method, and an associated DC control device, intended to allow secure control of maintenance of a CB battery computer forming part of a BC cellular battery of a vehicle V.

[0028] In what follows, vehicle V is considered, by way of non-limiting example, to be of the automobile type. This is, for example, a car, as illustrated in [Fig. 1]. However, the invention is not limited to this type of vehicle. It relates in fact to any type of vehicle comprising a cellular battery capable of supplying or receiving electrical power. Thus, it relates, for example, to land vehicles (commercial vehicles, motorhomes, minibuses, coaches, trucks, motorcycles, road maintenance vehicles, construction equipment, agricultural vehicles, recreational vehicles (snowmobiles, go-karts), and tracked vehicles, for example), boats, and aircraft.

[0029] Furthermore, in what follows, by way of non-limiting example, vehicle V is considered to comprise an all-electric powertrain (or PMT) (and therefore its propulsion is provided exclusively by at least one electric motor MME). However, the PMT could be of the hybrid type (thermal and electric).

[0030] Figure [1] schematically represents a vehicle V comprising an electric powertrain, an on-board network RB, and an electrical circuit main CEP, a BC cellular battery, a CV converter, a BS service battery, an RC communication network, and a DC control device according to the invention.

[0031] The RB on-board network is an electrical power supply network to which electrical (or electronic) equipment (or components) that consume electrical energy are coupled.

[0032] The auxiliary battery BS is responsible for supplying electrical power to the vehicle's electrical system RB, supplementing that supplied by the current converter CV, which is powered by the cell battery BC via the main electrical circuit CEP, and sometimes replacing this CV. For example, this auxiliary battery BS may be configured as a very low voltage type battery (typically 12 V, 24 V, or 48 V). It is rechargeable at least by the current converter CV. In the following, for the sake of non-limiting example, the auxiliary battery BS is considered to be a 12 V lithium-ion type.

[0033] The main electrical circuit (or high-voltage circuit) CEP is connected, on the one hand, to the cellular battery BC, and, on the other hand, to electronic equipment, such as the CV converter and the electric drive machine MME. It also allows the cellular battery BC to be recharged by an external power source and temporarily connected to a charging connector CR of the vehicle V.

[0034] The transmission chain has a powertrain which, in this case, is purely electric and therefore includes, in particular, an electric drive machine. Here, "electric drive machine" means an electric machine arranged to provide torque to move the vehicle V when supplied with electrical energy, and possibly to recover torque in the transmission chain.

[0035] The operation of the transmission chain (and therefore of the GMP) is supervised by a CS supervisory computer.

[0036] The electric drive machine MME (here an electric motor) is here coupled to the cellular battery BC via the main electrical circuit CEP, in order to be supplied with electrical energy, as well as to supply this cellular battery BC with electrical energy, for example during a regenerative braking phase.

[0037] Furthermore, this electric drive machine MME is coupled to a drive shaft to supply it with torque by rotational drive. Here, the drive shaft is coupled to a transmission shaft via a reduction gear RD, and this transmission shaft is coupled to a first set of wheels Tl, preferably via a differential DF.

[0038] This first train Tl is located here in the front part PVV of the vehicle V. But in a variant this first train Tl could be the one which is here referenced T2 and which is located in the rear part PRV of the vehicle V.

[0039] The BC cell battery here powers the electric drive unit MME. It is therefore referred to as the main (or traction) battery. It comprises at least one CC sensor, at least one MC cell module(s) connected to a CM controller, and a CB battery control unit. The latter (CB) is coupled via links or interfaces (analog or digital) to each CC sensor and each CM controller, and to an RC communication network of its vehicle V (possibly multiplexed (for example, of the CAN (“Controller Area Network”), LIN (“Local Interconnect Network”), FLEXRAY, or Ethernet type)). Such an RC communication network allows on-board electronic equipment to communicate with each other to exchange data and / or messages.

[0040] In the example illustrated non-limitingly in [Fig. 1], the CB battery computer is coupled to the RC communication network via a first link, the CC sensor is coupled to the RC communication network via a second link and to the CB battery computer via a third link, and each CM controller (associated with an MC cell module(s)) is coupled to the CB battery computer via a fourth link.

[0041] For example, and as illustrated, but not limited to, in [Fig. 1], each CC sensor, each CM controller, and the CB battery computer can be part of a BB battery housing. Also, for example, the CC sensor can be responsible for measuring the current flowing through its BC cell battery. But it could also be a sensor responsible for measuring the voltage across its BC cell battery or the internal temperature of its BC cell battery.

[0042] Each MC cell module comprises at least one CE electrical energy storage cell. Each CE (electrical energy storage) cell is optionally electrochemical (in which case it may, for example, be of the lithium-ion (or Li-ion) or Ni-MH or Ni-Cd type). Also, for example, the BC cell battery may be of the low-voltage type (typically 450 V by way of illustration). But it could also be of the medium-voltage or high-voltage type.

[0043] The CB battery calculator is notably responsible for centralizing the current, voltage and internal temperature measurements taken in its BC cell battery, and for determining parameters of its BC cell battery based on these measurements, including its internal resistance, its minimum voltage, the current state of health (or SoH (State of Health)) of each MC cell module(s), and its current state of charge (or SoC (State of Charge)).

[0044] It will be noted, as illustrated non-limitingly in [Fig. 1], that the CV converter can be part of a CH charger electrically connected to the CR charging connector.

[0045] It should also be noted that in the example illustrated, but not limited to, in [Fig. 1], the vehicle V also includes a distribution box BD to which the BS service battery, CV converter and RB on-board network. This BD distribution box is responsible for distributing the electrical energy stored in the BS service battery or produced by the CV converter into the RB on-board network, to supply the electrical components (or equipment) connected to the RB on-board network according to power demands received (in particular from the CS supervision computer of the GMP).

[0046] As mentioned above, the invention notably proposes a control method intended to allow secure control of maintenance of the CB battery computer of the BC cellular battery of vehicle V.

[0047] This (control) method can be implemented at least partially by the DC control device (illustrated at least partially in Figures 1 and 2), which for this purpose comprises at least one PR1 processor, for example a digital signal processor (or DSP), and at least one MD memory. This DC control device can therefore be implemented as a combination of electrical or electronic circuits or components (or "hardware") and software modules (or "software"). For example, it could be a microcontroller.

[0048] The MD memory is random access memory (RAM) to store instructions for the implementation by the PR1 processor of at least part of the control process. The PR1 processor may comprise integrated (or printed) circuits, or several integrated (or printed) circuits connected by wired or wireless connections. An integrated (or printed) circuit is defined as any type of device capable of performing at least one electrical or electronic operation.

[0049] In the example illustrated, but not limited to, in Figures 1 and 2, the DC control device is part of the CB battery computer. This is advantageous because the latter (CB) stores all the data relating to its cell battery BC. However, this is not mandatory. Indeed, the DC control device could include its own dedicated computer, which is then coupled to the CB battery computer.

[0050] As illustrated non-limitingly in [Fig.3], the (control) method according to the invention includes a step 10-50 which is implemented whenever maintenance (reading or writing) of the CB battery computer is required.

[0051] Step 10-50 of the method includes a substep 40 in which, when maintenance of the CB battery computer is required, the (DC control device) permits such maintenance if at least one of the first, second, third(s) and fourth(s), selected, is disconnected from the CB battery computer.

[0052] It will be understood that, depending on the implementation of the DC control device, it can be determined whether only one of the aforementioned links, initially selected, is disconnected, or whether at least two of the aforementioned links, initially selected, are disconnected. It will also be understood that if at least one link initially selected is If the connection is not made, then the DC control unit refuses to authorize the required maintenance. It is important to note that from one vehicle to another, or from one control unit to another that is deeply embedded within the vehicle and very difficult to access, the connections chosen (which must be disconnected to obtain maintenance authorization) may vary from one battery control unit to another, which is intended to enhance maintenance safety.

[0053] Thus, when a malicious person wants to modify (or corrupt) data stored in a CB battery computer, they can only do so after disconnecting the BC cell battery from the vehicle V and disconnecting at least one connection ensuring the coupling of an input / output of the CB battery computer to other equipment that they are not aware of. This is likely to deter unauthorized modifications to the data stored in the CB battery computer.

[0054] For example, in substep 40 of step 10-50, the DC control device can allow maintenance if the first link between the CB battery computer and the RC communication network is disconnected and if, in addition, at least one (selected) of the third and fourth links between the CB battery computer and the CC sensor and CM controller is disconnected. However, as mentioned above, other links that must be disconnected during maintenance can be considered.

[0055] Also, for example, and as illustrated non-limitingly in [Fig.3], step 10-30 may include a substep 30 in which one (the DC control device) can determine in the CB battery computer the connection state of each selected link to be disconnected.

[0056] To this end, in substep 30 of step 10-50, the DC control device can detect a disconnection of a selected connection to the CB battery control unit if the CB battery control unit determines information that indicates a connection fault in that selected connection. This is possible because any input / output that is not connected (and should be) in a control unit results in the transmission of information indicating a connection fault.

[0057] Also, for example, in substep 40 of step 10-50, the DC control device can authorize the required maintenance when, in addition to a predefined secure access (or authentication) mechanism, a secure access mechanism has been used to request this maintenance. This further secures the maintenance by adding computer security to the mechanical security (disconnection(s)). For example, the secure access (or authentication) mechanism could be Security Access. But other secure access (or authentication) mechanisms known to those skilled in the art can be used.

[0058] Also, for example, in step 10-50, authorization may only be required if the battery control unit (BCU) receives predefined maintenance requests, preferably those with high cybersecurity implications (e.g., those related to the System of Health - SoH). In this case, when a maintenance request is received by the control device (CD), the latter (DC) may, for example, in a substep 10 of step 10-50 (as illustrated, but not limited to, in [Fig. 3]), first determine whether it is one of the predefined maintenance requests requiring authorization. If not, the received maintenance request is processed conventionally by the control device (DC) in a substep 20 of step 10-50 (as illustrated, but not limited to, in [Fig. 3]), for example, when a predefined secure access (or authentication) mechanism has been used.Conversely, if yes, the DC control device performs substep 30 to determine if each selected link is indeed disconnected. If no, the DC control device prohibits maintenance in substep 50 of step 10-50 (as illustrated, but not limited to, in [Fig. 3]). If yes, the DC control device authorizes maintenance in substep 40 (possibly after verifying whether the predefined secure access (or authentication) mechanism has been used).

[0059] Also, for example, in step 10-50, the predefined maintenance queries can be chosen from a query to write data representative of the health status of a cell module (MC), and a query to write data previously read from a battery computer (CB) that has just been replaced in a new battery computer (CB) and to be stored in the latter (CB). This list is given by way of example, and therefore at least one of the predefined maintenance queries in this list can be replaced by another and / or at least one other predefined maintenance query can be added to this list.

[0060] Also, for example, in step 10-50 (for example in substep 40), the DC control device may refuse to issue authorization when the CB battery computer is placed in an operating mode in which it is forbidden to transmit on the RC communication network (operating mode generally referred to as "electronic integration") or for another operating mode which is specific to inhibit a diagnosis made on inputs / outputs (digital or analog) of the CB battery computer.

[0061] This last option ensures that there is no maintenance, assembly or repair method that could lead one to believe that the CB battery calculator is disconnected from vehicle V (and more specifically from its RC communication network).

[0062] It should also be noted, as illustrated but not limited to [Fig. 2], that the CB battery computer (or the DC control device computer) may also include a mass storage MM1, in particular for storing information representing the connection states of the CB battery computer links as well as any intermediate data involved in all its calculations and processing. Furthermore, this CB battery computer (or the DC control device computer) may also include an input interface IE for receiving at least the connection states of the CB battery computer links and maintenance requests, for use in calculations or processing, possibly after having shaped and / or demodulated and / or amplified them, in a manner known per se, by means of a digital signal processor PR2.Furthermore, this CB battery calculator (or DC control device calculator) may also include an IS output interface, notably for delivering maintenance authorization or prohibition messages.

[0063] It will also be noted that the invention also proposes a computer program product (or computer program) comprising a set of instructions which, when executed by processing means of the type of electronic circuits (or hardware), such as for example the PR1 processor, is suitable for implementing the control method described above to control maintenance in the CB battery computer of the BC cellular battery of vehicle V.

Claims

Demands

1. A control method for a vehicle (V) comprising a communication network (RC) and a cell battery (BC) having at least one sensor (CC), at least one cell module (MC) connected to a controller (CM) and a battery computer (CB) coupled to said communication network (RC), sensor (CC) and controller (CM) via links, characterized in that it comprises a step (10-50) in which, when maintenance of said battery computer (CB) is required, such maintenance is permitted if at least one of said links between the battery computer (CB) and the sensor (CC) and controller (CM), in the event of determination in the battery computer of information which is representative of a connection fault, is disconnected from said battery computer (CB).

2. Method according to claim 1, characterized in that in said step (10-50) said maintenance is permitted if said link between said battery computer (CB) and communication network (RC) is disconnected and if at least one of said links, selected, between said battery computer (CB) and said sensor (CC) and controller (CM) is disconnected.

3. Method according to claim 1 or 2, characterized in that in said step (10-50) said maintenance is permitted when in addition a predefined secure access mechanism has been used to request said maintenance.

4. A method according to any one of claims 1 to 3, characterized in that in said step (10-50) said authorization is required in the event of receipt by said battery computer (BC) of predefined maintenance requests.

5. Method according to claim 4, characterized in that in said step (10-50) said predefined maintenance queries are chosen from a query to write data representative of a health state of a cell module(s) (CM), and a query to write data previously read in a battery computer (BC) which has just been replaced in a new battery computer (BC) and which is to be stored in the latter (BC).

6. A method according to any one of claims 1 to 5, characterized in that in said step (10-50) the disconnection of the link between is detected the battery computer (CB) and the sensor (CC) and controller (CM), in the event of determination in said battery computer (CB) of information representative of a fault in connection of this link chosen to said battery computer (CB).

7. A method according to any one of claims 1 to 6, characterized in that in said step (10-50) said authorization is refused when said battery computer (CB) is placed in an operating mode in which it is forbidden to transmit on said communication network (RC) or for another operating mode suitable for inhibiting a diagnosis made on inputs / outputs of said battery computer (CB).

8. Product computer program comprising an instruction set which, when executed by processing means, is suitable for implementing the control method according to any one of claims 1 to 7, in a vehicle (V) comprising a communication network (RC) and a cell battery (BC) having at least one sensor (CC), at least one cell module(s) (MC) connected to a controller (CM) and a battery computer (CB) coupled to said communication network (RC), sensor (CC) and controller (CM) via links, to control maintenance in said battery computer (CB).

9. Control device (DC) for a vehicle (V) comprising a communication network (RC) and a cell battery (BC) having at least one sensor (CC), at least one cell module(s) (MC) connected to a controller (CM) and a battery computer (CB) coupled to said communication network (RC), sensor (CC) and controller (CM) via links, characterized in that it comprises at least one processor (PR1) and at least one memory (MD) arranged to perform the operations consisting, when maintenance of said battery computer (CB) is required, of authorizing such maintenance if at least one of said links, between the battery computer (CB) and the sensor (CC) and controller (CM), in the event of determination in the battery computer of information which is representative of a connection fault, is disconnected from said battery computer (CB).

10. Vehicle (V) comprising a communication network (CR) and a cellular battery (CBD) having at least one sensor (SC), at least one cell module(s) (CM) connected to a controller (CM) and a battery calculator (CB) coupled to said communication network (RC), sensor (CC) and controller (CM) via links, characterized in that it further comprises a control device (DC) according to claim 9.

Images