DE102022002080B3 - Battery for a vehicle electrical system - Google Patents

Abstract

The invention relates to a battery (6, 7), comprising a cell stack (10) made up of several galvanic individual cells connected in series, which can be connected to the vehicle electrical system (21, 24) via a charging protection switch (13) and a discharging protection switch (14). first microcontroller (15) and a second microcontroller (17) independently configured to monitor data including currents, voltages and temperatures of the cell stack (10), both microcontrollers (15, 17) each having an enable output (CCB) for the Opening the charging protection switch (13), both microcontrollers (15, 17) each having an activation output (DCB) for opening the discharging protection switch (14), the second microcontroller (17) being designed differently from the first microcontroller (15), wherein the activation outputs (CCB) for opening the charging protection switch (13) are logically linked to one another via an OR element (18) and connected to the charging protection switch (13), the activation outputs (DCB) for opening the discharging protection switch (14) being connected via a another OR element (19) are logically linked with one another and additionally connected to the discharge protection switch (14) via a delay element (20), so that this opens after a specified time delay if at least one of the two microcontrollers (15, 17) based on the from The data determined by it decides that the discharge protection switch (14) is to be opened, with the delay element (20) being connected to the discharge protection switch (14) via a further OR element (22), with the activation outputs (DCB) of the two microcontrollers (15 , 17) for opening the discharge protection switch (14) are also logically linked to one another via an AND element (23), the output of which is also applied to the further OR element (22), so that the discharge protection switch (14) either opens immediately , if both microcontrollers (15, 17) decide based on the data they have determined that the discharge protection switch (14) is to be opened, or opens after the specified time delay if only one of the two microcontrollers (15, 17) based on the determined data decides that the discharge protection switch (14) is to be opened.

Description

The invention relates to a battery for a vehicle electrical system according to the preamble of claim 1.

Highly automated driving functions (e.g. steer-by-wire without a mechanical fallback level) require an on-board network with ASIL D power supply.

This is a so-called ASIL requirement for availability, which can be achieved with two redundant components, for example. In a decomposition, two implementations of the service provision function that are as different as possible are required, both of which are assigned ASIL B(D) or ASIL C(D). Two different components are used for this, for example. It is required that the battery of an on-board network for highly automated driving functions protects itself against dangerous operating states with ASIL B; at the same time, however, the vehicle electrical system should be reliably supplied with power with ASIL B/C (D). This represents a conflict between two conflicting security goals.

• - einem ersten Bordnetzteil und einem zweiten Bordnetzteil, wobei der zweite Bordnetzteil ein Hauptnetz und ein Redundanz-Netz aufweist,
• - mit zumindest einem ersten sicherheitsrelevanten Verbraucher im Hauptnetz,
• - mindestens einem zum ersten sicherheitsrelevanten Verbraucher redundanten zweiten sicherheitsrelevanten Verbraucher im Redundanz-Netz,
• - einem ersten Trennelement zum Trennen des Hauptnetzes von dem Redundanz-Netz,
• - einer Energieversorgung für die Verbraucher, die einen Gleichspannungswandler umfasst, der mit dem ersten Bordnetzteil und dem zweiten Bordnetzteil verbunden und im Redundanz-Netz angeordnet ist, so dass über den ersten Gleichspannungswandler eine Versorgung des Redundanz-Netzes mit elektrischer Energie sichergestellt ist, wenn dieses durch das erste Trennelement vom Hauptnetz getrennt ist, wobei
• - im Hauptnetz nicht-sicherheitsrelevante Verbraucher angeordnet sind und das Hauptnetz ein erstes Unternetz und ein zweites Unternetz aufweist und zumindest ein Teil der nicht-sicherheitsrelevanten Verbraucher im ersten Unternetz angeordnet ist, wobei die beiden Unternetze durch ein zweites Trennelement voneinander trennbar sind und
• - der zweite Bordnetzteil eine Bordnetzbatterie aufweist, die in dem ersten Unternetz angeordnet ist.

DE 10 2018 210 943 B4 describes a vehicle electrical system for a vehicle

• - a first on-board power supply and a second on-board power supply, the second on-board power supply having a main network and a redundancy network,
• - with at least one first safety-relevant consumer in the main network,
• - at least one second safety-relevant consumer redundant to the first safety-relevant consumer in the redundancy network,
• - a first separating element for separating the main network from the redundancy network,
• - An energy supply for the consumers, which includes a DC-DC converter, which is connected to the first on-board power supply and the second on-board power supply and is arranged in the redundancy network, so that the first DC-DC converter ensures that the redundancy network is supplied with electrical energy when it is separated from the main network by the first isolating element, wherein
• - non-safety-relevant loads are arranged in the main network and the main network has a first sub-network and a second sub-network and at least some of the non-safety-relevant loads are arranged in the first sub-network, with the two sub-networks being separable from one another by a second separating element and
• - The second on-board power supply has an on-board power supply battery, which is arranged in the first sub-network.

DE 10 2011 076 757 A1 describes a safety architecture, a battery and a motor vehicle with a corresponding battery, which can be used in particular to combine battery packs with a lower safety integrity level into a battery system with a higher safety integrity level. A safety architecture for at least two batteries is provided for this purpose, with each battery comprising at least one electrochemical cell. The at least two batteries are each combined with at least one data processing unit to form a module. The safety architecture is set up in such a way that the at least one data processing unit of at least one first module processes input signals of at least one second module.

DE 10 2010 041 492 A1 describes a method and an arrangement for monitoring at least one battery, a battery with such an arrangement and a motor vehicle with a corresponding battery, which can be used in particular for reliable monitoring of the battery condition with reduced hardware complexity. To this end, it is proposed to monitor the at least one battery by evaluating measured variables from at least one of the at least one battery using at least one data processing device, and for at least one monitoring of signals exchanged via a communication link between the at least one battery and the at least one data processing device to take place.

DE 37 43 962 A1 describes a power supply of an electronic circuit in a vehicle with a battery of the vehicle, a circuit breaker inserted between the battery and the circuit and a switch switching the power supply on and off, e.g. B. the ignition lock. After the power supply has been switched off, a delay circuit which can be controlled by the switch controls the isolating switch into its blocking state with a delay.

DE 10 2017 218 734 A1 describes a high-voltage battery system with a battery module and at least two switching elements, wherein an electrical connection of the battery module to a voltage network can be switched by the switching elements. The high-voltage battery system also includes a first detection unit, through which a first cell voltage measured value of a cell voltage of the Battery module can be detected, and a first evaluation unit, by means of a comparison of the first cell voltage measured value with a first threshold value, a first control signal can be generated. A switching signal can be generated using the first control signal. The switching signal can be transmitted to at least one first control unit for the first switching element and to a second control unit for the second switching element, the first and second switching elements being switchable independently of one another as a function of the switching signal.

EP 1 107 344 A1 describes a protection circuit for protecting a rechargeable battery from battery failure caused by prolonged overcharging and a protection element incorporated in this circuit. A main protection circuit is provided with a main controller for turning off a first FET or a second FET when overcharge, overdischarge, or excessive discharge current is detected. A sub-protection circuit is equipped with a sub-controller for turning off a third FET when the anti-overcharge function of the main controller does not work properly.

CN 2 09 600 311 U describes a redundant battery management system based on dual chips. The system consists of multiple collectors, an overall collection control unit, a battery control module and a main control unit, with the collector connected to a battery unit of the battery module; an additional monitoring module is also available. The additional monitoring module is configured to independently sample and calculate the voltage, current and temperature of the battery pack. The sampling data is sent to the main control unit. The main controller serves to receive two sets of data from the main acquisition controller and the auxiliary monitor module. The main control unit is used to receive the two groups of data, to compare and analyze the two groups of data, and to generate and send a signal to the battery control module to interrupt a charge and discharge loop of the battery module when the difference value of physical data in the two groups of data exceeds a specified threshold.

US 2019/0 031 042 A1 describes a method for operating a battery system for providing electrical energy for a vehicle. Sensor signals are generated that represent the physical variables of individual cells and/or individual modules of at least one battery in the battery system. The sensor signals are transmitted to a first and a second system controller. Both the first and the second system control evaluate the sensor signals and control the battery system depending on the corresponding evaluation results. The first system controller operates in combination with a first monitor and the second system controller operates in combination with a second monitor. The first monitor monitors an operation of the second system controller, and the second monitor monitors an operation of the first system controller. The battery system is controlled depending on the monitoring results of the first monitoring device and the second monitoring device.

US 2014/0 108 896 A1 describes an error detection device of a dual controller system. The first controller receives detection data from a sensor to calculate and generate first data and outputs final data when no fault is detected by comparing the first data with second data transmitted from a second controller. The CAN transceiver receives the final data from the first controller and sends the final data over a CAN bus. The second controller receives the detection data from the sensor to calculate and generate second data, and sends the first controller an interrupt signal that prevents output of the final data when an error is detected by comparing the second data with the final data reported back from the CAN transceiver. Accordingly, the output transmission to the vehicle is controlled, and the stability and reliability of the output data is increased.

The invention is based on the object of specifying a new type of battery for a vehicle electrical system.

The object is achieved according to the invention by a battery for a vehicle electrical system according to claim 1.

Advantageous configurations of the invention are the subject matter of the dependent claims.

A battery according to the invention for an on-board network of a vehicle comprises a cell stack made up of several galvanic individual cells connected in series, the cell stack being able to be connected to the on-board network via a charging protection switch and a discharging protection switch, and also a first microcontroller and a second microcontroller, the two microcontrollers being used independently of one another for monitoring and/or validating data including currents, voltages and temperatures of the cell stack are configured, with both microcontrollers also being configured to mutually validate their data, with both microcontrollers each having an activation output for opening the charge protection switch, with both microcontrollers also each having an activation output for opening the discharge protection switch. According to the invention, the second microcontroller is designed differently from the first microcontroller, with the activation outputs for opening the charging protection switch being logically linked to one another via an OR element and connected to the charging protection switch, the activation outputs for opening the discharging protection switch being logically linked to one another via a further OR element and also being connected to the discharging protection switch via a delay element, so that it opens after a predetermined time delay if at least one of the two microcontrollers decides on the basis of the data it has determined that the discharging protection switch is to be opened .

In one embodiment, the cell stack can be connected to the vehicle electrical system via a series connection made up of a fuse, the charging protection switch and the discharging protection switch.

In one embodiment, the charging protection switch and the discharging protection switch are each designed as field effect transistors that are connected in anti-series fashion, so that their body diodes are conductive in opposite directions.

In one battery embodiment, a battery monitoring chip is also provided, which is configured to monitor cell voltages of individual cells of the cell stack, a temperature of the cells, and a current through the cell stack, the first microcontroller being configured to validate the data provided by the battery monitoring chip.

In one embodiment, the second microcontroller has an integrated battery monitoring functionality.

In one embodiment, the second microcontroller is configured to monitor a voltage of all cells of the cell stack in series, a voltage at a battery positive terminal, a current through the cell stack, and a temperature of the cells.

In one embodiment, the first microcontroller and optionally the battery monitor chip are ASIL C(D) compliant and the second microcontroller is ASIL B(D) compliant.

In one embodiment, the predetermined time delay is two minutes.

In one embodiment, the first microcontroller has a communication interface, which is designed as a CAN transceiver, via which an error can be signaled by the first microcontroller, with the second microcontroller having a warning output which is configured to switch off the communication interface of the first microcontroller when activated or to switch to a pure receive mode.

According to the invention, the delay element is connected to the discharge protection switch via a further OR element, with the activation outputs of the two microcontrollers for opening the discharge protection switch also being logically linked to one another via an AND element, the output of which is also applied to the further OR element, so that the discharge protection switch either opens immediately if both microcontrollers decide based on the data they have determined that the discharge protection switch is to be opened, or opens after the specified time delay if only one of the two microcontrollers based on the data determined by it decides that the discharge protection switch is to be opened.

The present invention provides a battery management system for 12V Li-ion on-board batteries. In this case, two batteries are used for redundancy, but since both batteries are based on the same hardware and software, a systematic error cannot be ruled out in conventional solutions, so that no redundancy would result. According to the invention, it is therefore provided to use a second internal microcontroller of the battery in order to represent a separate part of the battery management system. This divides the battery management system into two parts that can monitor each other and cover different aspects. If there is an error or a difference between the two subsystems, a warning can be issued and the battery can remain connected via a delay element for a while, for example 2 minutes, to ensure that the vehicle is safely switched off and only then can the charging protection switch and the discharging protection switch be opened.

Instead of redundancy at the system level of two independent 12V Li-Ion vehicle electrical system batteries, the approach according to the invention pursues the goal of representing redundancy at the component level.

Exemplary embodiments of the invention are explained in more detail below with reference to drawings.

• 1 eine schematische Ansicht eines Hochvoltnetzes eines Fahrzeugs und zweier damit verbundener Niederspannungs-Bordnetze,
• 2 eine schematische Ansicht einer Ausführungsform einer Niederspannungs-Batterie, und
• 3 eine schematische Ansicht einer weiteren Ausführungsform einer Niederspannungs-Batterie.

show:

• 1 a schematic view of a high-voltage network of a vehicle and two associated low-voltage vehicle electrical systems,
• 2 a schematic view of an embodiment of a low-voltage battery, and
• 3 a schematic view of another embodiment of a low-voltage battery.

Corresponding parts are provided with the same reference symbols in all figures.

1 is a schematic view of a high-voltage network 1 of a vehicle, for example an electrically powered vehicle, with a high-voltage battery 2 which is connected to the high-voltage network 1 via a circuit breaker 3 . Furthermore, two or more low-voltage vehicle electrical systems 21, 24, for example 12V vehicle electrical systems, are provided, which are used to supply consumers 4, 5, for example safety-related consumers, in particular steer-by-wire and/or brake-by-wire. The two or more low-voltage vehicle electrical systems 21, 24 can be connected/disconnected by a switch, but this is not necessary. Each of the low-voltage vehicle electrical systems 21, 24 contains a respective battery, in particular a low-voltage battery 6, 7, and is connected to the high-voltage network 1 via a respective DC-DC converter 8, 9. The consumers 4, 5 of the vehicle are supplied selectively from one or from both low-voltage vehicle electrical systems 21, 24. If one of the two low-voltage vehicle electrical systems 21, 24 fails, the redundant/remaining low-voltage vehicle electrical system 21, 24 is used.

Both low-voltage electrical systems 21, 24 each include a low-voltage battery 6, 7, in particular a Li-ion battery, each having at least one circuit breaker for self-protection. The DC-DC converter 8, 9 has no safety targets in terms of availability, but the low-voltage battery 6, 7 has safety targets in terms of availability. The vehicle therefore places safety requirements on the availability of the low-voltage battery 6 , 7 . This creates requirements for the independence of the two low-voltage batteries 6, 7. Dependent errors in which the same error occurs in both low-voltage batteries 6, 7 must be prevented in order to reliably rule out a simultaneous failure of both low-voltage batteries 6, 7. This contradicts using the same type for both low voltage batteries 6, 7 and normally requires a completely independent component. This independence is taken into account by the realization of two independent decision paths within each low-voltage battery 6, 7, without having to use and develop two completely different, independent low-voltage batteries 6, 7. The same or a similar low-voltage battery 6, 7 can therefore be used both on the primary and on the secondary side (main network and redundant network).

• - ein Ladeschutzschalter der Niederspannungs-Batterie 6, 7 wird geöffnet,
• - die Niederspannungs-Batterie 6, 7 deklariert bei einem erkannten Fehler in der Redundanz ihr Lebensdauerende (EoL - end of life),
• - es wird eine sogenannte Rotbewarnung an den Fahrer des Fahrzeugs ausgegeben. Dies bedeutet eine Aufforderung zum sofortigen sicheren Anhalten und eine Funktionsabschaltung mit einem Übergang in den batterielosen Betrieb;
• - mit einer vorgegebenen Verzögerung von beispielsweise zwei Minuten wird ein Entladeschutzschalter der Niederspannungs-Batterie 6, 7 geöffnet, um innerhalb der Verzögerungszeit ein sicheres Anhalten sicherzustellen.

A safe state (safe state) of a low-voltage battery 6, 7 of a low-voltage vehicle electrical system 21 within the meaning of the present invention should include the following features:

• - a charging protection switch of the low-voltage battery 6, 7 is opened,
• - the low-voltage battery 6, 7 declares its end of life (EoL - end of life) when a fault is detected in the redundancy,
• - A so-called red warning is issued to the driver of the vehicle. This means an immediate safe stop request and a functional shutdown with a transition to battery-free operation;
• - With a predetermined delay of two minutes, for example, a discharge protection switch of the low-voltage battery 6, 7 is opened to ensure safe stopping within the delay time.

The present invention implements a system-side independence and/or redundancy with regard to systematic faults within a component, in particular a low-voltage battery 6, 7, so that it can be used unchanged in both channels in low-voltage vehicle electrical systems 21, 24 that are designed redundantly with two channels for reasons of availability.

In the case of the low-voltage vehicle electrical systems 21, 24 under consideration, the DC-DC converter 8, 9 does not contribute to availability; this must be ensured purely by the low-voltage battery 6, 7 (for example LiBB—12V lithium-ion vehicle electrical system battery) (system property).

For example, in vehicle construction there may be a requirement to reduce variance in the vehicle by using uniform hardware and software, which is diametrically opposed to independence.

2 is a schematic view of a low-voltage battery 6. The low-voltage Battery 6 comprises a cell stack 10 whose negative pole is connected to ground, i.e. terminal 31 KL31, via a shunt 11, and whose positive pole is connected to terminal 30 KL30 (battery positive) via a series connection of a fuse 12, a charging protection switch 13 and a discharge protection switch 14.

The charging protection switch 13 and the discharging protection switch 14 can both be in the form of field effect transistors which are connected anti-series, so that their body diodes are conductive in opposite directions.

The low-voltage battery 6 also includes a first microcontroller 15 (for example Aurix) and a battery monitoring chip 16 (analog front end), which is configured, for example, to monitor cell voltages U_cell of individual cells in the cell stack 10, a temperature T_bat of the cells, and a current I_bat2 through the cell stack 10. The first microcontroller 15 validates the data provided by the battery monitoring chip 16 .

Furthermore, a second microcontroller 17 is provided, which is designed differently than the first microcontroller 15. While the battery monitoring chip 16 is designed as a separate unit from the first microcontroller 15, the second microcontroller 17 has an integrated battery monitoring functionality, comprising the monitoring of a voltage U_pack of all cells of the cell stack 10 in series connection, a voltage U_T30 at terminal 30 KL30, the current I_bat through the cell stack 10 and the temperature T_bat2 of the cells. The current I_bat and the current I_bat2 are each determined by their own redundant sensors, for example on the shunt 11. The temperatures T_bat and T_bat2 are also determined by their own redundant sensors.

The first microcontroller 15 and the battery monitoring chip 16 correspond to ASIL C(D), for example.

The second microcontroller 17 corresponds to ASIL B(D), for example.

The first microcontroller 15 and the second microcontroller 17 are also configured to mutually validate their data.

The first microcontroller 15 and the second microcontroller 17 each have an activation output CCB for opening the charging protection switch 13, which is logically linked via an OR element 18 and connected to the charging protection switch 13, so that the latter opens when at least one of the two microcontrollers 15, 17 decides, based on the data it has determined, that the charging protection switch 13 is to be opened.

The first microcontroller 15 and the second microcontroller 17 each have an activation output DCB for opening the discharge protection switch 14, which is logically linked via a further OR element 19 and also connected to the discharge protection switch 14 via a delay element 20, so that it opens after a predetermined time delay of, for example, two minutes if at least one of the two microcontrollers 15, 17 decides based on the data it has determined that the discharge protection switch 14 is to be opened.

The path that is critical in terms of availability is the discharge protection switch 14 , since only this can prevent the voltage supply in the direction of the low-voltage vehicle electrical system 21 . The charging protection switch 13 is to be rated as non-critical in this regard.

In order to maximize availability, the second microcontroller 17 present next to the first microcontroller 15 designed as the main channel is upgraded to achieve all safety goals with regard to self-protection.

For this purpose, this second microcontroller 17 is designed completely independently of the first microcontroller 15 at all levels (input signals, output signals, hardware, software, development processes, voltage supply, etc.) and developed with ASIL B(D).

This enables both microcontrollers 15, 17 independently of one another to monitor the self-protection goals of the low-voltage battery 6 and to activate the charging protection switch 13 and/or the discharging protection switch 14 if these thresholds are violated.

The logic circuitry of the activation outputs CCB, DCB of the two microcontrollers 15, 17 using the OR elements 18, 19 and the delay element 20 prevents a (possibly faulty) single-channel access to the discharge protection switch 14 and replaces it with a time delay.

Since both microcontrollers 15, 17 continuously monitor each other's input and output values, this enables each of the two microcontrollers 15, 17 to detect an incorrect decision by the other microcontroller 15, 17.

Both an erroneously triggered disconnect request and an incorrect one Untriggered disconnect request for the charging protection switch 13 and / or the discharge protection switch 14 can be detected. Both lead to the triggering of a process to achieve a safe state without unexpectedly interrupting the availability of the energy supply.

With regard to the warning, the second microcontroller 17 plays a special role, since it does not have a dedicated communication interface to reduce the system complexity. The first microcontroller 15, on the other hand, has a communication interface CAN_FD, which is designed as a CAN transceiver, via which the first microcontroller 15 can signal an error (red warning).

An error signal or red warning on the part of the second microcontroller 17 is achieved by means of a warning output Alert on the second microcontroller 17 by switching off or switching to a pure receive mode ("listen only mode") of the communication interface CAN_FD of the first microcontroller 15. This reliably prevents communication in the direction of the vehicle, which is reliably recognized by the vehicle and automatically triggers a red warning.

• - der Ladeschutzschalter 13 geöffnet und so ein wesentlicher Umfang der Sicherheitsziele des Komponenteneigenschutzes errreicht wird, ohne das Sicherheitsziel der Verfügbarkeit negativ zu beeinflussen,
• - eine Rotbewarnung und optional Funktionseinschränkungen des Fahrzeugs ausgelöst werden, um einen sicheren Zustand herbeizuführen,
• - aufgrund der Erkennung eines kritischen Zustands das Lebensdauerende der Komponente, insbesondere der Niederspannungsbatterie 6, 7 nichtflüchtig gespeichert wird,
• - nach einer vorgegebenen Verzögerung von beispielsweise ein oder mehreren, insbesondere zwei, Minuten der Entladeschutzschalter 14 geöffnet wird.

The safe state is characterized by:

• - the charging protection switch 13 is opened and thus a significant extent of the safety goals of the component's own protection is achieved without negatively affecting the safety goal of availability,
• - a red warning and optional functional restrictions of the vehicle are triggered to bring about a safe state,
• - Due to the detection of a critical state, the end of the service life of the component, in particular the low-voltage battery 6, 7, is stored in non-volatile memory,
• - After a predetermined delay of, for example, one or more, in particular two minutes, the discharge protection switch 14 is opened.

3 FIG. 12 is a schematic view of another embodiment of a low-voltage battery 7 compatible with the embodiment according to FIG 2 largely agree. It is therefore on the description of 2 referred. The embodiment according to 3 differs from the embodiment according to FIG 2 .

The first microcontroller 15 and the second microcontroller 17 each have an activation output CCB for opening the charging protection switch 13, which is logically linked via an OR element 18 and connected to the charging protection switch 13, so that the latter opens when at least one of the two microcontrollers 15, 17 decides, based on the data it has determined, that the charging protection switch 13 is to be opened.

The first microcontroller 15 and the second microcontroller 17 each have an activation output DCB for opening the discharge protection switch 14, which is logically linked via a further OR element 19 and also connected to the discharge protection switch 14 via a delay element 20 and a further OR element 22. Furthermore, the activation outputs DCB of the first microcontroller 15 and of the second microcontroller 17 for opening the discharge protection switch 14 are connected to one another via an AND element 23, the output of which is also applied to the further OR element 22, so that the discharge protection switch 14 either opens immediately if both microcontrollers 15, 17 decide based on the data they have determined that the discharge protection switch 14 should open, or opens after a predetermined time delay of, for example, two minutes , if only one of the two microcontrollers 15, 17 decides based on the data determined by it that the discharge protection switch 14 is to be opened.

A safe state of the low-voltage battery 6, 7 may be necessary, for example, to protect against excessive current.

The low-voltage battery 6, 7 should therefore implement measures against impermissible operation as a result of excessive current, which can lead to dangerous situations for people (such as sudden outgassing). For this purpose, charging currents and discharging currents are interrupted by opening the charging protection switch 13 and the discharging protection switch 14 . After fault detection and shutdown, the current flowing through the cell stack 10 is 0.

The error can be detected independently of one another by both microcontrollers 15, 17 by means of redundant measurements. If the fault causes fuse 12 (for example a fuse) to trip, the first microcontroller 15 can signal the end of the service life (EoL—end of life) of the low-voltage battery 6 . In the normal case, there is a reversible separation of the charge protection switch 13 and the discharge protection switch 14 in two channels.

A discrepancy (mismatch) between the measurements of the two microcontrollers 15, 17 can be recognized by both microcontrollers 15, 17 and the safe state can be assumed.

A safe state of the low-voltage battery 6, 7 can also be required, for example, to protect against excessively high voltage.

The low-voltage battery 6, 7 should therefore implement measures against impermissible operation as a result of excessive voltage, which can lead to dangerous situations for people (such as sudden outgassing). For this purpose, charging currents are interrupted by opening the charging protection switch 13 . After fault detection and shutdown, the current flowing in the cell stack 10 is 0.

The error can only be detected by the first microcontroller 15 based on the cell voltage U_cell of the individual cells.

An error or a discrepancy (mismatch) in the sum of the cell voltages U_cell, which should correspond to the voltage U_pack, can be detected by the second microcontroller 17 and the safe state can be assumed.

A safe state of the low-voltage battery 6, 7 can also be required, for example, to protect against excessive temperatures.

The low-voltage battery 6, 7 should therefore implement measures against impermissible operation as a result of excessive temperatures, which can lead to dangerous situations for people (such as sudden outgassing). For this purpose, charging currents and discharging currents are interrupted. After fault detection and shutdown, the current flowing through the cell stack 10 is 0.

The charging protection switch 13 can be opened by both microcontrollers 15, 17. A single fault tolerance can be achieved by using a safety fuse to interrupt the current flow in the discharge direction in the event of a short circuit.

A discrepancy (mismatch) between the measurements of the two microcontrollers 15, 17 can be recognized by both microcontrollers 15, 17 and the safe state can be assumed.

A safe state of the low-voltage battery 6, 7 can also be required, for example, to protect against charging a deeply discharged cell.

The low-voltage battery 6, 7 should therefore implement measures against impermissible operation as a result of charging after a deep discharge, which can lead to dangerous situations for people (e.g. sudden outgassing). For this purpose, charging currents are interrupted. After fault detection and shutdown, the current flowing in the cell stack 10 is 0.

The charging protection switch 13 can be opened in one channel by both microcontrollers 15, 17.

The requirements for a safe state can be recognized by both microcontrollers 15, 17 (two-channel independent). Any discrepancy (mismatch) between the measurements of the two microcontrollers 15, 17 leads to a safe state.

Furthermore, the low-voltage battery 6, 7 should ensure a necessary discharge into the low-voltage vehicle electrical system 21, provided that such a discharge does not violate the safety requirements of the low-voltage battery 6, 7. This relates in particular to driving operation of the vehicle.

The low-voltage battery 6, 7 may only interrupt its discharge path if its own ASIL B safety requirements would otherwise be violated. Otherwise, the discharge path of the low-voltage battery 6, 7 should remain securely connected.

For example, in the event of an overvoltage or overcurrent error while charging the low-voltage battery 6, 7, the discharge path should remain connected so that the low-voltage battery 6, 7 can continue to supply the low-voltage vehicle electrical system 21.

This is ensured by linking the signals of the two activation outputs DCB of the two microcontrollers 15, 17 by means of the AND element 23 on the one hand and by the delay element on the other hand, whereby single-channel errors in the discharge direction are prevented. A single error can therefore not lead to an immediate complete interruption, but only to a safe state.

Reference List

1

high-voltage network

2

high-voltage battery

3

circuit breaker

4

consumer

5

consumer

6

low-voltage battery, battery

7

low-voltage battery, battery

8th

DC converter

9

DC converter

10

cell stack

11

shunt

12

fuse

13

charge protection switch

14

discharge protection switch

15

first microcontroller

16

battery monitoring chip

17

second microcontroller

18

OR gate

19

another OR element

20

delay element

21

Low-voltage vehicle electrical system, vehicle electrical system

22

further OR element

23

AND gate

24

Low-voltage vehicle electrical system, vehicle electrical system

Alert

warning exit

CAN_FD

communication interface

CCB

activation output

DCB

activation output

I_bat, I_bat2

Electricity

KL30

Terminal 30, battery positive connection

KL31

Terminal 31, ground

T_bat, T_bat2

temperature

U_cell

cell voltage

U_pack

Tension

U_T30

Tension

Claims (9)

Battery (6, 7) for an on-board network (21, 24) of a vehicle, comprising a cell stack (10) made up of several galvanic individual cells connected in series, the cell stack (10) being connectable to the on-board network (21, 24) via a charging protection switch (13) and a discharging protection switch (14), further comprising a first microcontroller (15) and a second microcontroller (17), the two microcontrollers (15, 17) being used independently of one another for monitoring and / or validation of data including currents, voltages and temperatures of the cell stack (10) are configured, both microcontrollers (15, 17) are also configured to mutually validate their data, both microcontrollers (15, 17) each having an activation output (CCB) for opening the charging protection switch (13), both microcontrollers (15, 17) each having an activation output (DCB) for opening the discharging protection switch (14), the activation from outputs (CCB) for opening the charging protection switch (13) are logically linked to one another via an OR element (18) and connected to the charging protection switch (13), the activation outputs (DCB) for opening the discharging protection switch (14) being logically linked to one another via a further OR element (19),characterizedthat the second microcontroller (17) is designed differently from the first microcontroller (15), the activation outputs (DCB) for opening the discharge protection switch (14) being additionally connected to the discharge protection switch (14) via a delay element (20), so that the latter opens after a predetermined time delay if at least one of the two microcontrollers (15, 17) decides on the basis of the data it has determined that the discharge protection switch (14) is to be opened, the delay element (20 ) is connected to the discharge protection switch (14) via a further OR element (22), the activation outputs (DCB) of the two microcontrollers (15, 17) for opening the discharge protection switch (14) also being logically linked to one another via an AND element (23), the output of which is also connected to the further OR element (22), so that the discharge protection switch (14) either opens immediately if both microcontrollers (15, 17) determine using the en data agree that the discharge protection switch (14) is to be opened, or opens after the specified time delay if only one of the two microcontrollers (15, 17) decides on the basis of the data it has determined that the discharge protection switch (14) is to be opened. battery (6, 7) after claim 1 , characterized in that the cell stack (10) can be connected to the vehicle electrical system (21, 24) via a series circuit comprising a fuse (12), the charging protection switch (13) and the discharging protection switch (14). battery (6, 7) after claim 1 or 2 , characterized in that the charging protection switch (13) and the discharge protection switch (14) are each designed as field effect transistors which are connected anti-series, so that their body diodes are conductive in opposite directions. Battery (6, 7) according to one of the preceding claims, characterized in that a battery monitoring chip (16) is also provided, which is configured to monitor cell voltages (U_cell) of individual cells in the cell stack (10), a temperature (T_bat) of the cells, and a current (I_bat2) through the cell stack (10), the first microcontroller (15) being configured to validate the data provided by the battery monitoring chip (16). Battery (6, 7) according to one of the preceding claims, characterized in that the second microcontroller (17) has an integrated battery monitoring functionality. Battery (6, 7) according to one of the preceding claims, characterized in that the second microcontroller (17) is configured to monitor a voltage (U_pack) of all cells in the cell stack (10) connected in series, a voltage (U_T30) at a battery positive connection (KL30), a current (I_bat) through the cell stack (10) and a temperature (T_bat2) of the cells. Battery (6, 7) according to any one of the preceding claims, characterized in that the first microcontroller (15) and the battery monitoring chip (16) are ASIL C(D) compliant and the second microcontroller (17) is ASIL B(D) compliant. Battery (6, 7) according to one of the preceding claims, characterized in that the predetermined time delay is two minutes. Battery (6, 7) according to one of the preceding claims, characterized in that the first microcontroller (15) has a communication interface (CAN_FD) which is designed as a CAN transceiver via which an error can be signaled by the first microcontroller (15), the second microcontroller (17) having a warning output (Alert) which is configured to switch off the communication interface (CAN_FD) of the first microcontroller (15) when activated or to switch to a pure receive mode.

Images