PROCESS FOR PROTECTION IN THE EVENT OF A CRASH IN AN ELECTRIC OR HYBRID VEHICLE

Abstract

The invention relates to a method for protecting an electric or hybrid vehicle, the vehicle comprising a passive safety computer (3) delivering a first crash information item (IC1) in the event of an impact occurring, the vehicle comprising a main battery equipped with a battery management computer (4), configured to receive a second crash information item (IC2) established as a function of the first, the vehicle comprising a high-voltage on-board network powered from the main battery via two isolation contactors (5), the battery management computer being configured to cause, as a function of a reception of the second crash information item, a safety operation comprising a triggering of an active discharge of the high-voltage network, triggering of a sequence for opening the isolation contactors (5),and inhibition of closure of the isolation contactors until a rehabilitation procedure is carried out. Figure 2,

Description

Title of the invention: METHOD FOR PROVIDING PROTECTION IN THE EVENT OF A CRASH IN AN ELECTRIC OR HYBRID VEHICLE

[0001] The present invention relates to a method for protecting an electric or hybrid vehicle in the event of a crash.

[0002] The protection in question here concerns the protection of individuals against electrical risks.

[0003] Indeed, electrified vehicles capable of moving in zero-emission mode usually include an electrical energy storage battery which has a voltage greater than 50 volts at its terminals and an energy reserve capable of delivering a large quantity of electrical current.

[0004] In practice, for example, the voltage across the battery terminals may be 400 volts or 800 volts. Any voltage value above 100 volts is of course included within the scope of the present invention.

[0005] Any contact of the human individual with this type of voltage can cause the circulation of a substantial electric current passing through the body of the human individual in question, which can cause a serious electric shock or even severe electrocution.

[0006] In the case of a hybrid vehicle, any operation of the thermal engine in a post-accident circumstance is also a source of danger.

[0007] It is therefore necessary to take all appropriate measures to avoid such an event, particularly after an accident suffered by the vehicle which can cause significant disruption to the electrical network.

[0008] Here the human individual in question may be an occupant of the shocked vehicle, a passer-by who comes to provide assistance, professional rescue personnel, medical personnel, or more generally any person or animal who comes into contact with the vehicle.

[0009] Furthermore, it should be noted that the vehicle of interest here may be a 100% electric vehicle or a hybrid vehicle, i.e. one which has an internal combustion engine in association with an electric powertrain.

[0010] Thus there remains a need to propose relevant and efficient solutions for managing electrical safety in post-accident situations.

[0011] To this end, the present invention proposes a method for protecting an electric or hybrid vehicle, the vehicle comprising a passive safety computer configured to deliver first crash information in the event of occurrence of an impact suffered by the vehicle, the vehicle comprising a main battery equipped with a battery management computer, configured to receive a second crash information item established as a function of the first crash information item, the vehicle comprising a high-voltage on-board network powered from the main battery via two isolation contactors, characterized in that it is provided that, in the event of an impact occurring to the vehicle, a safety operation is carried out comprising at least: the battery management computer is configured to cause, based on receipt of the second crash information, a sequence of opening the isolation contactors, and to inhibit a closing of the isolation contactors until a rehabilitation procedure is carried out, the safety operation further comprising the triggering of an active discharge of the high voltage network.

[0012] Advantageously, shortly after the crash information is transmitted and received, the high-voltage on-board network no longer presents any problematic voltage, and the electrical risk to human individuals is eliminated.

[0013] Active discharge of the high-voltage network makes it possible to quickly deplete the energy reserves which are downstream of the battery isolation contactors, for example in the capacitors of the inverter of the main electrical machine.

[0014] Thanks to the opening of the isolation contactors, the only elements still under high voltage are confined inside the battery casing, which forms a mechanical protective envelope.

[0015] It should be noted that the inhibition prohibits any re-energization, which could be attempted for example in the case of a small impact which has not seriously damaged the vehicle.

[0016] According to one embodiment, it is provided that the vehicle further comprises an on-board charger and two charging contactors, and the safety operation further provides for opening of the charging contactors.

[0017] Active discharge of the part of the high voltage network between the main isolation contactor and the charging base on the side of the vehicle is provided.

[0018] It is the on-board charger that is responsible for closing and opening the charging contacts.

[0019] These charging contacts are used in normal situations to establish, in the context of rapid direct current charging, the charging lines between the battery and the charging base accessible from outside the vehicle. In the safety situation, they are forced open to prevent the high voltage network from reaching the charging socket on the side of the vehicle.

[0020] According to one embodiment, the first crash information and / or the second crash information passes through a general computer and / or a group supervisor computer. powertrain. In some configurations, this transit is necessary to change the CAN network because the passive safety ECU is not on the same CAN network as the battery management ECU. In other words, the crash information passes through a gateway formed by the general ECU or the powertrain supervisor ECU. In passing, the nature of the information can be transposed, for example, by means of a transposition or calibration table, as will be seen below.

[0021] According to a particular embodiment, the second crash information is a strict copy of the first crash information.

[0022] According to one embodiment, the first crash information is information with at least three levels of impact severity. The passive safety computer is thus capable of reporting the violence of the impact suffered by the vehicle and transcribes it into information with several levels of impact severity.

[0023] According to one embodiment, the second crash information is binary information. As a result, the logic applied by the battery management computer can be relatively simple, namely triggering the safety operation if the logic value is 1 and doing nothing if the logic value is 0.

[0024] According to one embodiment, a calibration table is provided in the general computer or in the powertrain supervisor computer for transforming the first multi-state crash information (three or more) into a second binary type crash information.

[0025] According to one embodiment, the vehicle further comprises a thermal engine with its engine management computer, and it is provided that the safety operation comprises a procedure for inhibiting the engine management computer. Inhibiting the engine management computer causes the thermal engine to stop. In addition, any restarting of the thermal engine is then prohibited unless the rehabilitation procedure is carried out.

[0026] According to one embodiment, the method may further comprise a rehabilitation procedure obtained through a particular interaction carried out by qualified personnel so as to reauthorize at least the normal operation of the isolation contactors.

[0027] How, it is necessary to carry out a re-authorization operation, that is to say to authorize again the closing of the isolation contactors and the control of the electric traction machine, and moreover the engine for a hybrid vehicle, the normal operation of the engine management computer. In practice this operation will be carried out by the personnel of the after-sales network.

[0028] According to one embodiment, the first crash information and / or the second crash information are transmitted in the form of digital messages on a data bus of CAN type. This allows us to benefit from the recognized reliability of the CAN network.

[0029] According to one embodiment, the method may provide that the passive safety computer also transmits directly via a dedicated wired link a third crash information item to the battery management computer.

[0030] This makes it possible to create functional redundancy. In fact, the battery management computer will, on the one hand, directly receive the third crash information directly from the passive safety computer and, on the other hand, the battery management computer will receive the digital message containing the second crash information.

[0031] Depending on the logic applied, the safety operation can be triggered as soon as one of the two messages is received or according to another logic when both messages are received.

[0032] According to one embodiment, it is provided that in the event of triggering a safety operation, a Stop indicator light is illuminated on the vehicle's instrument panel.

[0033] This makes it possible to inform the driver of the safety of the vehicle battery and, where applicable, the thermal engine.

[0034] The invention further relates to an electric or hybrid motor vehicle, comprising a passive safety computer configured to deliver a first crash information item in the event of an impact being suffered by the vehicle, the vehicle comprising a main battery equipped with a battery management computer, configured to receive a second crash information item established as a function of the first crash information item, the vehicle comprising a powertrain supervisor computer, the vehicle comprising a high-voltage on-board network powered from the main battery via two isolation contactors, characterized in that at least the passive safety computer, the powertrain supervisor computer and the battery management computer are configured to implement the method as described above.

[0035] The safety operation is orchestrated by the powertrain supervisor computer and implemented, concerning the battery isolation contactors, by the battery management computer.

[0036] The invention will be further detailed by the description of non-limiting embodiments, and on the basis of the appended figures illustrating variants of the invention, in which: [Fig.l] is a schematic representation of the hardware system involved in an exemplary embodiment of the present invention; [Fig.2] illustrates a functional diagram of the computers used in an exemplary embodiment of the present invention.

[0037] In the various figures, the same references designate identical elements. or similar. For clarity of presentation, some elements are not necessarily shown to scale.

[0038] We are interested here in an electric motor vehicle or a hybrid vehicle equipped, in addition to the thermal engine, with an electric drive train.

[0039] The vehicle comprises an electrical energy storage battery referenced 1, also referred to in this document as the main battery. The main battery may typically be a lithium ion electrochemistry-based battery and have a capacity of between 5 kWh for hybrids and up to 80 kWh for 100% electric vehicles. It should be noted that these capacity values ​​are not considered limiting.

[0040] The vehicle may also be equipped with a conventional 12-volt battery connected to a conventional 12-volt on-board network.

[0041] The main battery 1 is equipped with a battery management computer 4, also designated by the acronym BMU. It is noted that the acronym 'BMS' is also commonly used in jargon to designate such a battery management computer.

[0042] The vehicle comprises a high-voltage on-board network powered from the main battery 1 via two isolation contactors 5.

[0043] The high-voltage on-board network comprises the positive HV+ supply line marked 11 and the negative HV- supply line marked 12.

[0044] A first isolation contactor 51 is provided, for example in the form of a relay, which makes it possible to isolate the positive supply line 11 from the positive terminal of the battery.

[0045] A second isolation contactor 52 is provided, for example in the form of a relay, which makes it possible to isolate the negative supply line 12 from the negative terminal of the battery.

[0046] The first isolation contactor 51 and the second isolation contactor 52 are arranged inside a mechanical protection casing in which the main battery is located.

[0047] It is noted that a precharging circuit as known per se, therefore not described in detail here, can be provided in parallel with the first isolation contactor.

[0048] It should also be noted that the first isolation contactor and the second isolation contactor are not controlled strictly simultaneously, but are controlled with a time lag of a few tens of milliseconds.

[0049] The vehicle further comprises an on-board charger 2. The on-board charger 2 makes it possible to manage, on the one hand, a conventional recharge from an AC network, either single-phase or three-phase, and on the other hand to manage a so-called rapid recharge from a rapid recharge terminal in direct current mode. For the rapid recharge function, two recharge contactors 50 are provided which make it possible to establish contact direct between the positive and negative terminals of the battery and the positive and negative terminals of the charging station via the charging base 24.

[0050] The high-voltage on-board network supplies high-voltage consumers generically denoted CHV, such as the inverter of the main electrical machine. Other consumers of the high-voltage network may include the electrical machine on the rear axle, as well as a voltage converter to supply the 12-volt network with a voltage close to 13.9 volts.

[0051] The on-board charger controller and the battery management computer 4 are both connected to a digital data bus 75, typically here a CAN network.

[0052] The vehicle includes a passive safety calculator 3, designated by the acronym RBG.

[0053] The passive safety calculator 3 is configured to deliver a first crash information item noted HERE in the event of an impact occurring to the vehicle.

[0054] The severity of the impact can be graded from 0 to 3. For example, a value of 0 corresponds to a minor impact, a value of 1 corresponds to a slightly more severe impact with the deployment of some protective airbags and seat belt pretensioners. A value of 2 corresponds to an even more severe impact, and a value of 3 corresponds to the highest category of impacts.

[0055] It should be understood that the passive safety calculator 3,RBG has an electromechanical spring element which makes it possible to validate, in redundancy with the electronic sensors and accelerometers, the presence of an impact.

[0056] The vehicle includes a general computer 6, designated by the acronym BSI, which means intelligent servitude box; in fact this box manages most of the passenger compartment and bodywork functions of the vehicle.

[0057] In the example shown in [Fig.2], the first crash information is transmitted from the passive safety computer to the general computer 6. The general computer 6 pushes this information, after having retranscribed it if necessary, to the supervisor computer of the powertrain which is discussed immediately after.

[0058] The vehicle includes a powertrain supervisor computer 7, designated by the acronym eVCU.

[0059] The powertrain supervisor computer 7 is responsible for determining the engine torque to be applied to the wheels, possibly the regenerative braking torque, depending on the driving circumstances. It works in close dialogue with the battery management computer 4.

[0060] The powertrain supervisor computer 7 is also responsible for implementing the safety operation, this is evident from the representation illustrated in [Fig.2], in particular by giving orders to the front and rear electric machine controllers if present, by giving a stop order to the on-board charger, and in the case of a hybrid vehicle by giving a stop and inhibition order to the engine and gearbox control computer.

[0061] The vehicle includes a front electric machine MEAV marked 9 and optionally a rear electric machine MEAR marked 91.

[0062] The battery management computer 4 is configured to receive a second crash information item IC2. This second crash information item IC2 is established as a function of the first crash information item ICI. In a particular embodiment, the function in question may be the identity function. In a particular example illustrated, the function in question directs the graduation value delivered by the passive safety computer to a value 0 or 1, namely to a binary output.

[0063] This arrowing can be carried out by referring to a transposition table or a calibration table which can be found in the general computer or in the powertrain supervisor computer 7.

[0064] The first crash information ICI and the second crash information IC2 are presented as digital messages which transit on one or more CAN type buses. These messages transit directly or pass through a computer which acts as a gateway to pass from one CAN bus to another CAN bus.

[0065] Furthermore, the vehicle includes an instrument cluster denoted 63. This instrument cluster includes a stop indicator light, otherwise called a 'stop' indicator light. This 'stop' indicator light is activated when the safety operation is implemented.

[0066] When the vehicle is a hybrid vehicle, namely equipped with a thermal engine, the vehicle comprises a gearbox control computer noted 81 and an engine management computer noted 82.

[0067] When crash information is delivered by the passive safety computer and transmitted to the powertrain supervisor computer 7, the latter transmits orders on the one hand to the battery management computer 4, on the other hand to the on-board charger 2. The powertrain supervisor computer 7 also transmits orders to the control computer 9 of the front electric machine, optionally to the control computer of the rear electric machine 91, optionally to the gearbox control computer denoted 81 and to the engine management computer denoted 82.

[0068] According to a particular embodiment, the transmission of crash information via data messages on the CAN bus is redundant by another information transmission channel. Thus, a direct wired link 34 is provided which connects the passive safety computer 3 to the battery management computer 4.

[0069] This direct wired connection can carry binary information or information at several levels, for example several PWM cycling levels due to a necessary self-diagnosis of this line. This direct wired connection thus carries a third crash information noted IC3.

[0070] Compared to what has been described previously, depending on the architectures of the multiplexed buses on the vehicle platforms, a message 37 may be provided which is sent by the passive safety computer 3 and which may be received directly by the powertrain supervisor computer 7, or even directly by the battery management computer 4.

[0071] The safety operation orchestrated by the powertrain supervisor 7 and includes triggering of an opening sequence of the isolation contactors 5 which is implemented by the battery management computer 4. For this purpose, the battery management computer asks the CHV computers which control consumers on the high voltage network, or the on-board charger 2 which controls the recharging of the battery, to decrease the current which enters and / or leaves the battery towards 0.

[0072] This precaution prevents damage to the physical electrical contacts of the isolating contactors when they are opened.

[0073] The effective opening of the isolation contactors 5 is carried out in all cases by the battery management computer 4 after a time delay of a few hundred milliseconds, even if the computers which control the consumers have not given positive feedback regarding the request to cancel the current consumed.

[0074] At the time the crash occurs, the vehicle may be moving, either in effective traction mode or in regenerative braking mode.

[0075] At the time the crash occurs, the vehicle may also be in a charging situation at a charging station.

[0076] In the various cases, at the moment when the crash occurs, a significant quantity of current enters or leaves the battery.

[0077] Upon receipt of crash information, the powertrain supervisor computer 7 and / or the battery management computer 4 request a power cut in order to be able to open the low-current isolation contactors 5.

[0078] Depending on the situations (effective traction, regenerative braking, recharging in progress) waiting times DM1, DM2, DM3 are provided.

[0079] According to an exemplary embodiment, the values ​​of these time delays can be calibrated and set by default to 500 milliseconds.

[0080] The safety operation further comprises an active discharge of the high voltage network 11, 12.

[0081] Such an active discharge consists of circulating current in resistive parts of the circuit to exhaust any energy reserves that the capacitors located in the electrical circuits of the control circuits may contain.

[0082] Such an active discharge may require a duration of between 1 second and 3 seconds.

[0083] It should be noted that even if the active discharge cannot be carried out, a passive discharge still occurs which exhausts over a slightly longer period any energy reserves that the capacitors located in the electrical circuits of the control circuits may contain.

[0084] The rehabilitation operation can be carried out using a tool available in the after-sales network of the vehicle brand, for example a “scan tool” type tool.

[0085] Advantageously, a professional is thus required to inspect the vehicle before any return to service of the vehicle's high-voltage electrical functions.

[0086] This prevents damaged vehicles from being put back into circulation with an increased risk of thermal runaway at the level of one or more modules of the main battery.

Claims

Claims

1. Method for protecting an electric or hybrid vehicle, the vehicle comprising a passive safety computer (3) configured to deliver a first crash information item (ICI) in the event of an impact suffered by the vehicle, the vehicle comprising a main battery (1) equipped with a battery management computer (4), configured to receive a second crash information item (IC2) established as a function of the first crash information item (ICI), the vehicle comprising a high-voltage on-board network (11, 12) powered from the main battery (1) via two isolation contactors (5), characterized in that it is provided that, in the event of an impact suffered by the vehicle, a safety operation is carried out comprising at least: the battery management computer (4) is configured to cause, as a function of a reception of the second crash information item (IC2),an opening sequence of the isolation contactors (5), and to inhibit a closing of the isolation contactors until a rehabilitation procedure is carried out, the safety operation further comprising the triggering of an active discharge of the high voltage network (11,12).,

2. Method according to claim 1, in which the vehicle further comprises an on-board charger (2) and two charging contactors (50), characterized in that the safety operation further provides for opening of the charging contactors (50).

3. Method according to any one of claims 1 to 2, characterized in that the first crash information (ICI) and / or the second crash information (IC2) passes through a general computer (6) and / or a powertrain supervisor computer (7).

4. Method according to any one of claims 1 to 3, in which the first crash information (ICI) is information with at least three levels of crash severity.

5. Method according to any one of claims 1 to 4, wherein the second crash information (IC2) is binary information.

6. Method according to any one of claims 1 to 5, in which the vehicle further comprises a thermal engine with its engine management computer (82), characterized in that the safety operation comprises a procedure for inhibiting the management computer engine.

7. Method according to any one of claims 1 to 6, further comprising a rehabilitation procedure obtained through a particular interaction carried out by qualified personnel, so as to reauthorize at least the normal operation of the isolation contactors.

8. Method according to any one of claims 1 to 7, characterized in that the first crash information (ICI) and / or the second crash information (IC2) are transmitted in the form of digital messages on a CAN type data bus.

9. Method according to any one of claims 1 to 8, characterized in that the passive safety computer (3) further transmits directly via a dedicated wired link (34) a third crash information item (IC3) to the battery management computer (4).

10. Electric or hybrid motor vehicle, comprising a passive safety computer (3) configured to deliver a first crash information item (ICI) in the event of an impact suffered by the vehicle, the vehicle comprising a main battery (1) equipped with a battery management computer (4), configured to receive a second crash information item (IC2) established as a function of the first crash information item (ICI), the vehicle comprising a powertrain supervisor computer (7), the vehicle comprising a high-voltage on-board network (11, 12) powered from the main battery via two isolation contactors (5), characterized in that at least the passive safety computer, the powertrain supervisor computer and the battery management computer are configured to implement the method according to any one of claims 1 to 9.

Images