Battery Control Unit Redundant Switch Circuit for ASIL B Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
High-voltage battery systems used in electric vehicles face challenges in achieving low failure rates required for security-relevant functions, such as emergency shutdown, due to the high failure-in-time (FIT) rates of microcontrollers commonly used in control units, which are not sufficient to meet ASIL B standards.
Innovation Solution
A control unit for battery systems that includes a microcontroller and a switch control circuit, where the switch control circuit generates additional control signals to ensure reliable emergency shutdown even in case of microcontroller failure, providing a redundant relay control mechanism with a hardware path that bypasses programmable components, thus reducing FIT rates and ensuring ASIL B compliance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a microcontroller is used to control the power switch for emergency shutdown, then the control functionality is integrated and device complexity is reduced, but the reliability decreases due to high FIT rates of microcontrollers
Solution Approach 1:
The control unit is segmented into two independent parts: a microcontroller for normal control functions and a separate switch control circuit for emergency shutdown. This segmentation allows the critical emergency shutdown function to be implemented with higher reliability hardware while maintaining integration benefits for other functions.
Solution Approach 2:
The switch control circuit acts as an intermediary between the sensor signal and the power switch, providing a dedicated hardware path that bypasses the microcontroller for emergency shutdown commands. This intermediary ensures that critical safety functions can execute independently of the less reliable microcontroller.
2Ease of operation
If a microcontroller is used for controlling the power switch, then ease of operation and control flexibility are improved, but the failure rate increases making it unsuitable for ASIL B standards
Solution Approach 1:
The control functions are segmented into normal operation (microcontroller) and emergency shutdown (switch control circuit). This allows the system to maintain operational flexibility through the microcontroller while ensuring low failure rates for safety-critical functions through the dedicated hardware circuit.
Solution Approach 2:
Different parts of the control system have different quality requirements. The emergency shutdown path uses simple, reliable hardware components suitable for ASIL B, while other control functions can use more flexible microcontroller-based solutions. Each part is optimized for its specific function.
3Reliability
If a redundant switch control circuit is added to bypass the microcontroller, then reliability for emergency shutdown is improved, but device complexity increases
Solution Approach 1:
The critical emergency shutdown control logic is extracted from the microcontroller and implemented as a separate switch control circuit. This extraction isolates the safety-critical function from the complexity of the microcontroller, providing a simpler, more reliable path for emergency shutdown while keeping the overall system modular.
Solution Approach 2:
The switch control circuit implements a simplified copy of the emergency shutdown control logic that is independent of the microcontroller. This copying approach ensures that the critical function can execute reliably even when the original microcontroller fails, adding redundancy without requiring a complete duplicate system.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
The present invention refers to a control unit (20) for a battery system (100), the control unit (20) comprising an input node (21) that is configured for receiving a sensor signal (40) indicative of a state of at least one of a plurality of battery cells (10) of the battery system (100), a front end circuit (22) that is connected to the input node (21) and configured for generating a state signal (41) based on the sensor signal (40), a microcontroller (24) connected to the front end circuit (22) and configured for generating a first control signal (42) based on the state signal (41), and a switch control circuit (25). The switch control circuit (25) is configured for controlling a power switch (13) of the battery system by receiving the state signal (41), the first control signal (42), and a fault signal (43) indicative of an operation state of the microcontroller (24), by generating a second control signal (44) based on the state signal (41), and by transmitting one of the first control signal (42) and the second control signal (44) to an output node (27) of the control unit (20) based on the received fault signal (43). The invention further relates to a battery system (100) with such control unit (20).