Battery Control System Redundant MCU Multiplexer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
High-voltage battery systems used in electric vehicles face challenges in achieving low failure rates required for security-relevant functions, such as emergency shutdown, due to the limitations of microcontrollers used in control units, which often exceed the failure rate specifications like ASIL B.
Innovation Solution
A control system with a redundant relay control mechanism, utilizing two microcontrollers and a multiplexer to ensure reliable disconnection of the battery system from an external load, providing an alternative signal path for emergency shutdown and reducing energy consumption by only activating the secondary MCU upon fault detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single microcontroller is used to control the power switch for battery system shutdown, then the device complexity is reduced, but the reliability is insufficient to meet ASIL B failure rate specifications
Solution Approach 1:
The control system is segmented into two independent microcontrollers (first MCU and second MCU), each capable of independently controlling the power switch. This segmentation allows the system to meet ASIL B reliability requirements by providing redundancy, where if one MCU fails, the other can still perform the safety function of disconnecting the battery from external loads.
Solution Approach 2:
The system changes the operational parameters of the microcontrollers by configuring them with different threshold values for shutdown decisions. The first MCU uses a first threshold value while the second MCU uses a second threshold value, allowing them to make independent shutdown decisions based on their respective parameter evaluations, thereby enhancing system reliability through diversified decision-making.
2Reliability
If both microcontrollers continuously control the power switch, then the reliability is maximized, but the energy consumption increases
Solution Approach 1:
The second microcontroller operates in a periodic or event-driven manner rather than continuously. It is activated only when specific conditions are met, such as when the first MCU is unavailable or when certain threshold values are exceeded. This periodic activation maintains system reliability while significantly reducing energy consumption compared to continuous operation of both MCUs.
Solution Approach 2:
The first microcontroller serves as the primary control unit and handles normal operation independently. The second microcontroller acts as a backup that only activates when needed, essentially serving itself by remaining dormant until triggered by specific conditions. This self-service approach ensures reliability is maintained only when necessary, optimizing energy efficiency.
3Reliability
If redundant control paths are implemented, then the reliability for security functions is improved, but the device complexity increases
Solution Approach 1:
Both microcontrollers are designed with universal functionality to independently perform the complete control function of the power switch. Each MCU can individually evaluate threshold values, make shutdown decisions, and control the power switch without requiring the other. This multi-functionality ensures that either controller can handle emergency shutdown scenarios, providing redundancy without requiring complex specialized circuits.
Data Source
Figure 1~2
Figure 3~3(B)
Figure 4~5
AI summary
The present invention refers to a control system (90) for a battery system (100), the control system (90) comprising a power switch (13) that is configured for disconnecting the battery system (100) from an external load (14) in response to a control signal (41, 42). The control system (90) also comprises a battery system manager, BSM, (20) with a first microcontroller, MCU, (21) configured for performing at least one control function with respect to the battery system (100) and for controlling the power switch (13) via a first control signal (41). The control system (90) further comprises a battery disconnect unit, BDUe, (30) with a second microcontroller, MCU, (31). The BDUe (30) is configured for detecting an output current of the battery system (100) and for transmitting a current signal (44) that is indicative of the detected output current to the BSM (20). The BDUe (30) is also configured for controlling the power switch (13) via a second control signal (42). The control system (90) of the invention further comprises a multiplexer (35) that is configured for receiving the first control signal (41) from the first MCU (21) and for receiving the second control signal (42) from the second MCU (31). The multiplexer is further configure for outputting one of the first control signal (41) and the second control signal (42) to the power switch (13), preferably in response to a fault signal (43) indicative of whether the first MCU (21) is in an operable state or not.