DE102020213771A1 - Method for monitoring an energy source in an on-board network - Google Patents

Abstract

Method for monitoring an energy source in a vehicle electrical system (10), the energy source serving to supply at least one consumer (14, 16, 20, 22, 24, 32, 34, 36) in the vehicle electrical system (10), with a first unit a functional variable of the energy source is determined and evaluated and the functional variable of the energy source is also determined and evaluated with a second unit, the determination and evaluation of the two units being carried out independently of one another.

Description

The invention relates to a method for monitoring an energy source in an on-board network and such an on-board network for carrying out the method.

State of the art

A vehicle electrical system, which can also be referred to as an energy supply network, is to be understood in automotive use as the entirety of all electrical components in a motor vehicle. This includes both electrical consumers and supply sources, such as batteries. In the motor vehicle, it must be ensured that electrical energy is available in such a way that the motor vehicle can be started at any time and that there is an adequate power supply during operation. But even when switched off, electrical consumers should still be able to be operated for a reasonable period of time without a subsequent start being impaired.

The vehicle electrical system therefore has the task of supplying the electrical consumers with energy. It should be noted that due to the increasing electrification of units and the introduction of new vehicle functions, higher demands are placed on the safety and reliability of the electrical energy supply in vehicles.

In this context, the lead-acid battery on the 12V side in particular is a key component whose performance must be monitored because it is primarily responsible for supplying safety-relevant consumers in almost all existing vehicle electrical system architectures.

From the pamphlet DE 10 2015 200 124 A1 a method for supplying at least one consumer in a vehicle electrical system is known, in which the consumer is supplied from a number of partial vehicle electrical systems. In order to ensure the supply, it is also known to provide a unit which, based on the value of the internal resistance of a particular secondary battery, for example a lead battery, determines the degradation of this battery. The internal resistance of the battery is determined using a battery sensor. It can further be determined independently by means of a voltage controller of a DC-DC converter whether there is an abnormality of a sub-grid.

Due to the increasing electrification and automation of vehicle functions, the relevance of an associated secure energy supply is increasing. The level of safety that must be ensured during development is described by an Automotive Safety Integrity Level (ASIL) and defined in the specific application by the vehicle function for the electrical energy supply.

In this context, certain vehicles already have a requirement for a secure energy supply in accordance with ASIL C, even without an additional automated driving function, which must be represented by the 12V electrical system. For this purpose, the 12V power supply system must also supply energy from the energy source, i. H. Power source for conventional vehicles: alternator/power source for electrified vehicles: DC/DC converter, and ensure the 12V battery.

The security requirements can be allocated to the different components and decomposed in the security or safety context. Due to complex interactions between the energy supply from the energy source (generator/DCDC) and the vehicle's drive train, the greater safety load with ASIL C(C) is often allocated to the 12V battery.

Disclosure of Invention

Against this background, a method according to claim 1 and a vehicle electrical system with the features of claim 8 are presented. Embodiments result from the dependent claims and from the description.

The method presented serves to monitor an energy source in an on-board electrical system, with the battery serving to supply at least one consumer in the on-board electrical system. A functional variable of the energy source is determined and evaluated with a first unit. This functional variable of the energy source is also determined and evaluated with a second unit, with the determination and evaluation of the two units being carried out independently of one another.

This means that the two units record or measure quantities independently of one another, which enable the function quantity or a value of the function quantity to be determined. Two values for the function variable or two curves of the function variable are thus determined independently of one another and can also be evaluated independently of one another. In this way it is possible to make a statement about the state and also the future state of the energy source with a high degree of certainty.

The method presented is based on the consideration that due to the technical limitations of the battery sensor, an ASIL C(C) Requirement, as described above, cannot be represented by the EBS component alone. Instead, several battery sensors or additional external components must be used, which can implement redundant monitoring of the energy source, e.g. a 12V battery.

Redundant monitoring is thus provided by an on-board network component that implements a power distribution and power control function. This is referred to herein as vehicle electrical system monitoring or Powernet Guardian (PNG). In principle, a device that is able to measure the current and the voltage of the battery, for example a control device or an electronic power distributor, can be used here. In this case, already existing measurement hardware is used in the design and synergies are thus created in the overall system.

The condition of the battery is redundantly determined via a functional variable, in one case the internal resistance R _i of the battery. This means that the function variable is determined or measured and evaluated independently of one another in two ways. In an embodiment, the SSOF (safety state of function: safety state of the function), which is provided by the electronic battery sensor (EBS), can be derived from the internal resistance R _i taking other variables into account, while the internal resistance R _i of the battery, which is provided by the PNG is provided also represents the feature size. It will appear in this context 2 referred.

The function variables have a different level of accuracy with regard to the detection of different error patterns, but are also individually capable of detecting each error pattern with a specific accuracy, which is also referred to as failure mode coverage. Thus, in the security or safety context, a decomposition of the "battery status monitoring" functionality to the evaluation of the two different function variables is permissible. This applies both to the redundant battery condition monitoring of the same battery using two different components and to the monitoring of two different batteries. In both cases, the determination of different function variables on different monitoring or monitoring components ensures technical independence, which is absolutely necessary for ASIL decomposition.

In the overall system context, each functional variable must initiate a transition to the safe state if it exceeds or falls below a specified battery performance limit. A previous plausibility check or other offsetting of the two function variables is not permitted.

By decomposing the "battery condition monitoring" functionality to different components, the components only have to be developed according to a lower ASIL. This offers advantages in the individual component, which can be implemented more cost-effectively with lower ASIL integrity. In addition, the combination of different measures also enables better scalability of the product portfolio to different vehicle applications, since no single component, e.g. B. EBS, has to be scaled to different ASIL requirements, but this scaling is made possible by the combination of the components in the overall system.

In the case of the version with a combination of EBS and PNG, the components already in the vehicle and their measurement options are used and adapted to the application. It is therefore not necessary to install additional components. Such additional components, which cause increased costs for the overall system, include additional energy stores, such as DLC capacitors, Li-Ion batteries, or an ASIL qualification of 48V and high-voltage vehicle electrical systems for a secure energy supply.

In addition to other components, such as consumers and energy sources, the vehicle electrical system presented typically has an energy source, for example a battery, which can be monitored using the method presented. The monitoring of this energy source means that the function of this energy source is monitored in order to be able to guarantee its functional and operational safety, d. H. that a degradation in the function of this component or even its failure can be detected in good time.

Further advantages and refinements of the invention result from the description and the attached drawings.

It goes without saying that the features mentioned above and those still to be explained below can be used not only in the combination specified in each case, but also in other combinations or on their own, without departing from the scope of the present invention.

character list

• 1 shows a vehicle electrical system in a simplified block diagram.
• 2 shows representations of the background of functional safety.
• 3 shows an embodiment of the presented method in a block diagram.
• 4 shows a possible sequence of the presented method in a flowchart.
• 5 shows the background of the cvm module in a graph.

Embodiments of the invention

The invention is shown schematically in the drawings using embodiments and is described in detail below with reference to the drawings.

1 shows a vehicle electrical system in a block diagram, which is denoted overall by reference number 10 . The illustration shows a DC-DC converter 12 to whose 12V output a first consumer 14 and a second consumer 16 and a PNG 18 are connected. A third consumer 20, a fourth consumer 22, a fifth consumer 24 and a power distributor 26 as well as a battery 30, in this case a 12V battery 30, are connected to the PNG 18 in turn. A sixth consumer 32 , a seventh consumer 34 and an eighth consumer 36 are connected to the power distributor 26 . An EBS 38 is assigned to the battery 30 .

It should be noted that the energy supply is split for ASIL QM(C) from the DC-DC converter 12 and for ASIL C(C) from the battery 30. The third consumer 20, which represents an EPS, requires a safe supply according to ASIL C. The Battery 30 must be monitored with ASIL C(C). However, the development of the EBS 38 is only carried out according to ASIL B. Therefore, the monitoring of the battery 30 with the EBS 38 and the PNG 18 is split. The PNG 18 is set up to monitor the battery 30 according to ASIL A(C).

2 illustrates the redundant calculation of a resistance (RCR: redundant calculation of resistance), in this case the internal resistance R _i of the battery. The illustration above shows a voltage prediction according to ASIL B(C) of the SSOF (safety state of function) and below a Ri calculation according to ASIL B(C) of the PNG according to the RCR function.

The illustration shows a battery 50 at the top with the equivalent circuit 52 used to predict a voltage to perform a safe stopping maneuver. The equivalent circuit diagram 52 includes a voltage source 54, an internal resistance R _i 56, a resistance R _pol 58, the transfer resistance that occurs when the electron transfers from the electrolyte to the lattice or vice versa, and a capacitance 60.

• Wenn der Verlauf der vorhergesagten Spannung über der kritischen Spannungsgrenze 88 liegt, dann ist eine sichere Energieversorgung nach ASIL B gegeben.

A first graph 70, on whose abscissa 72 the time is plotted and on whose ordinate 74 the current is plotted, shows a current curve for controlling and braking until the vehicle stops. A second graph 80, on whose abscissa 82 the time is plotted and on whose ordinate 84 the voltage is plotted, shows the course of the predicted voltage, which at a point in time 86 falls below a critical voltage limit 88. A condition 90 provides:

• If the course of the predicted voltage is above the critical voltage limit 88, then a safe energy supply according to ASIL B is given.

Also shown below is a battery 100 connected to output channels 102 for electrical steering and braking. The PNG determines a R _iwwiring , the internal resistance R _i of the battery together with the cable resistance R _wiring , as an indicator for a reliable supply of the output channels 102. A first graph 110, on whose abscissa 112 SOC and on whose ordinate 104 R _iwwiring is plotted, shows a course of this resistance. A second graph 120, on whose abscissa 122 the temperature of the battery is entered and on whose ordinate 124 R _iwwiring is plotted, shows a course of this resistance. A third graph 130, on whose abscissa 132 the vehicle service life is entered and on whose ordinate 134 R _iwwiring is plotted, shows a course of this resistance. Furthermore, a resistance threshold 138 is entered for all three graphs 110, 120, 130, and a critical state is reached when this threshold is exceeded.

• Wenn R_iwwiring kleiner als die Widerstandsschwelle 138 ist, so ist eine sichere Versorgung gemäß ASIL A gegeben.

A condition 140 states:

• If R _{iwwiring is} less than the resistance threshold 138, a safe supply according to ASIL A is given.

If both conditions 90 and 140 are met, a safe supply according to ASIL C is given.

The explained RCR function to create a redundant security path on the PNG is in 3 shown. It should be noted that the ohmic internal battery resistance R _i is a simple performance indicator for the battery. In combination with the SSOF of the battery sensor, a higher safety level can be achieved for the supply of safety-relevant components, e.g. B. for the electric power steering.

3 shows a block 200, which illustrates the calculation of the internal resistance R _i of the battery. Input variables are PNG measurement data 202. Output variables are outputs 204 to the vehicle, such as warning and error messages.

• Sri:
  • Ermittlung des ohmschen Batterie-Innenwiderstands Ri, einschließlich des Kabelwiderstand zwischen der Batterie und dem PNG, dieser wird jedoch später mit seinem Begin-of-Life Nominalwert berücksichtigt. Eingesetzt wird hier der EBS-Batterie-Zustands-Erfassung-R_i-Zeitdomänen-Algorithmus, d. h. der Wert des vom EBS bestimmten ohmschen Widerstands, der zukünftig auf ASIL C/D angehoben wird. Dieser Algorithmus liefert bei geeigneten Anregungen auf der Leitungsleitung den R_i sowie ein Signal, das diesen als gültig bzw. valid oder invalid einstuft. Ein Wechsel von valid auf invalid hat aber nicht die Bedeutung, dass der R_i nun falsch ist, sondern er bedeutet lediglich, dass die Anregung auf der Stromleitung nicht ausreicht, um den R_i innerhalb einer Algorithmus-internen Kovarianzschwelle zu bestimmen. Es kann somit als Wechsel von bekanntem auf unbekanntem R_i gesehen werden.
• Rmu:
  • Abschätzung der Messunsicherheit des berechneten R_i auf dem PNG, da diese Unsicherheit später bei der Prüfung gegen ein R_i -Sicherheitslimit mit berücksichtigt werden muss.
• Cvm:
  • Überwachen der Ladespannung und ggf. im Entladefall die Nachführung des letzten validen R_i durch worst case Annahmen. Es wird somit im Falle des Ausfalls der Bestimmung der Funktionsgröße ein Nachführen dieser Größe unter Berücksichtigung des letzten bestimmten Werts der Funktionsgröße vorgenommen.
• Sre:
  • Modul zur Auswertung der Informationen aus vorhergehenden Modulen und Entscheider über Reaktionen nach außen, Anregungs-Anfrage, gelbe, rote Warnleuchte, Konsequenz auf Fahrzeugebene kann durch eine Degradation von verschiedenen Komponenten gegeben sein, um noch eine Fahrt bis zur nächsten Werkstatt durchführen zu können.

In the block 200 are a first module Sri 206 (Safety Battery Resistance Determination (internal)), a second module Rmu 208 (Resistance Measurement Uncertainty Determination), a third module Cvm 210 (Charging Voltage Monitoring) and a fourth module Sre 212 (Safety Battery Resistance Evaluator). The following is stated for the individual modules:

• Sri:
  • Determination of the internal ohmic battery resistance Ri, including the cable resistance between the battery and the PNG, but this is later taken into account with its start-of-life nominal value. The EBS battery condition detection R _i time domain algorithm is used here, ie the value of the ohmic resistance determined by the EBS, which will be raised to ASIL C/D in the future. With suitable excitations on the line, this algorithm supplies the R _i and a signal that classifies this as valid or valid or invalid. However, a change from valid to invalid does not mean that the R _i is now wrong, it simply means that the excitation on the power line is not sufficient to determine the R _i within an algorithm-internal covariance threshold. It can thus be seen as a change from known to unknown R _i .
• Rmu:
  • Estimation of the measurement uncertainty of the calculated R _i on the PNG, since this uncertainty must later be taken into account when checking against an R _i safety limit.
• cvm:
  • Monitoring the charging voltage and, if necessary, tracking the last valid R _i in the event of discharging using worst-case assumptions. In the event that the determination of the functional variable fails, this variable is tracked taking into account the last determined value of the functional variable.
• Sre:
  • Module for evaluating the information from previous modules and decision-maker on reactions to the outside, excitation request, yellow, red warning lights, consequences at vehicle level can be given by a degradation of various components in order to be able to drive to the next workshop.

• In einem ersten Schritt 250 wird ein Anregungssignal, bspw. ein geeignetes Strommuster, angefordert, das eine R_i-Detektion ermöglicht. In einem zweiten Schritt 252 wird R_i ermittelt. In einem dritten Schritt 254 wird R_i gegen die Widerstandssicherheitsschwelle (R_i Safety Limit) sowie 70% von R_i Safety Limit geprüft.
  1. a. Bei Überschreiten von 70% (x%) Safety Limit: bspw. eine Warnung an übergeordnetes Steuergerät senden, um z. B. ein Laden der Batterie anzufordern oder auch eine Degradationsstrategie einzuleiten.
  2. b. Bei Überschreiten des Ri Safety Limit liegt ein Fehler vor, was bedeutet, dass nicht mehr ausreichend Leistungsfähigkeit von Seiten der Batterie zur Verfügung steht, um ein Safe Stopp Manöver durchzuführen.
  3. c. Im iO Fall weiter mit einem vierten Schritt.

A possible sequence of the RCR function while driving, ie no sleep mode, can look like this:

• In a first step 250, an excitation signal, for example a suitable current pattern, is requested that enables R _i detection. In a second step 252, R _i is determined. In a third step 254, R _i is checked against the resistance safety threshold (R _i Safety Limit) and 70% of R _i Safety Limit.
  1. a. If the 70% (x%) safety limit is exceeded: e.g. send a warning to the higher-level control unit, e.g. B. to request charging of the battery or to initiate a degradation strategy.
  2. b. If the Ri Safety Limit is exceeded, there is an error, which means that the battery capacity is no longer sufficient to carry out a safe stop manoeuvre.
  3. c. If OK, continue with a fourth step.

In the fourth step 256, the _RiValid signal, which signals an indicator of sufficient excitation and thus continuous updating of the internal resistance, goes off after some time, as a rule in modern vehicle electrical systems, since the excitation is not sufficient to keep the Ri valid. In a fifth step 258, it is therefore now ensured via the Cvm module that the R _i does not deteriorate. It is related to this 5 referred.

1. a. Das Vorhalten einer ausreichend hohen Batteriespannung, bspw. > 13.2V, oberhalb der Leerlaufspannung von SOC 100%, um somit ein Entladen der Batterie zu verhindern, da dies mit einer Verschlechterung des Innenwiderstands bei PbAc Batterien korreliert. Dies ist die meiste Zeit der Fall.
2. b. Für kurzfristige Strompulse muss jedoch auch ermöglicht werden, dass die Batteriespannung unterhalb des vorstehend genannten Werts sein kann. Diese niedrigere Spannung darf nur eine begrenzte Zeit anliegen, sozusagen als eine Art Entprellen bzw. Debouncing für die Spannung bzw. die zulässige Entlademenge.

This is basically done in two ways:

1. a. Maintaining a sufficiently high battery voltage, e.g. > 13.2V, above the open circuit voltage of SOC 100% in order to prevent the battery from being discharged, as this correlates with a deterioration in the internal resistance of PbAc batteries. This is the case most of the time.
2. b. For short-term current pulses, however, it must also be possible for the battery voltage to be below the value mentioned above. This lower voltage may only be applied for a limited time, so to speak as a kind of debouncing or debouncing for the voltage or the permissible amount of discharge.

A safe one is achieved via the current integration and the tracking of the last valid or valid classified R _i with one or more worst-case derivations dRi/dQ from aged batteries Estimation of the deterioration of the R _i during discharging mapped so that safety is still guaranteed. Here is e.g. For example, the use of different worst-case gradients dR _i /dQ is conceivable, depending on the difference between the current R _i and the safety limit value.

In a sixth step 260, since the tracking is very conservative due to the worst-case dRi/dQ slope, the tracked R _i is checked against z. B. 70% of the safety limit requires an extra excitation for the R _i . As a result, the R _i value is readjusted to the "real" R _i curve of the battery, and sufficient availability of the vehicle is therefore maintained. In general, in a seventh step 262 X seconds before the FHTI (fault handling time interval) expires, an excitation signal is again requested, so that the FHTI maintains a maximum time period for the Ri to be up-to-date, for example 5 or 10 minutes. FHTI is a term from the ISO26262 standard, namely the time in which the system must be brought into the safe state after a safety-critical error has occurred.

Furthermore, a battery age indicator can be implemented within the PNG algorithm. B. based on an evaluation of the "extra suggestions" per hour.

5 shows a graph 300 on whose abscissa 302 SOC in % C _N (state of charge in % of the nominal capacity of the battery) and on whose ordinate 304 the ohmic resistance is plotted. A curve 306 shows the course of the internal battery resistance R _i . An Ri safety threshold (R _i Safety Limit) 308 is also entered. Furthermore, a first area 310 for a first mode and a second area 312 for a second mode are entered. The two modes relate to charging and discharging, namely charging above 13.2 V and discharging below 13.2 V.

R_iangenommen ist der nach worst case adaptierte Wert des Batterieinnenwiderstands R_i, wenn nicht ein ausreichend hohes Anregungssignal auf dem Bordnetz vorliegt. letztes Valid R_i ist der letzte vorhandene R_i-Wert, der mit ausreichender Anregung ermittelt wurde. dR_i/dQ sind worst case Steigungen. ΔQ_diS ist die Ladungsmenge durch Entladen (discharge), also das Integral des Entladestroms über der Zeit.A first arrow 320 illustrates a worst case assumption: $${\text{R}}_{\text{accepted}}={\text{lastValidR}}_{\text{i}}+{\text{dr}}_{\text{i}}\text{/dQ}*\Delta {\text{Q}}_{\text{diS}}$$

R _i is assumed to be the worst-case-adapted value of the internal battery resistance R _i if there is not a sufficiently high excitation signal on the vehicle electrical system. last valid R _i is the last existing R _i value determined with sufficient excitation. dR _i /dQ are worst case gradients. ΔQ _diS is the amount of charge by discharging (discharge), i.e. the integral of the discharge current over time.

Only discharge currents are integrated, a reset is made when the RiValid flag becomes true after excitation.

A double arrow 322 illustrates a ΔQ for debouncing. Furthermore, an R _i value 324 from a Sri module with a true RiValid flag is entered.

Another curve 330 shows the course of an aged battery, which is derived from a worst-case slope dR _i /dQ at R _i safety limit. A threshold value 340 for triggering an excitation is also entered. Supposedly when Ri exceeds this value, a stimulus is requested from the DC/DC converter to bring R _i back to the real curve, namely curve 306 .

The method presented enables, for example, an ASIL C isolated on-board network without further measures and improved battery diagnostics in AD vehicles, thereby avoiding breakdowns.

QUOTES INCLUDED IN DESCRIPTION

This list of the documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• DE 102015200124 A1 [0005]

Claims (10)

Method for monitoring an energy source in a vehicle electrical system (10), wherein the energy source is used to supply at least one consumer (14, 16, 20, 22, 24, 32, 34, 36) in the vehicle electrical system (10), wherein - a function variable of the energy source is determined and evaluated with a first unit, - The functional variable of the energy source is also determined and evaluated with a second unit, the determination and evaluation of the two units being carried out independently of one another. procedure after claim 1 , in which a battery (30, 50, 100) is used as the energy source, an electronic battery sensor (EBS) (38) assigned to the battery (30, 50, 100) is used as the first unit and a PNG (18) is used as the second unit. procedure after claim 2 , in which an internal resistance R _i (56) of the battery (30, 50, 100) is used as a function variable. procedure after claim 3 , in which the EBS (38) derives an additional SSOF of the battery (30, 50, 100) from the internal resistance R _i (56) of the battery (30, 50, 100), which during the evaluation determines the internal resistance R _i (56) taken into account. Procedure according to one of Claims 1 until 4 , in which a comparison with a threshold value is carried out when evaluating the function variable. Method according to one of Claims 1 to 5, in which, if the determination of the function variable fails, this function variable is tracked taking into account the last determined value of the function variable. Procedure according to one of Claims 1 until 6 , in which a countermeasure is initiated in the event that the evaluation of the functional variable indicates a possible failure of the energy source. Vehicle electrical system with an energy source that is used to supply at least one consumer (14, 16, 20, 22, 24, 32, 34, 36), with a first unit for monitoring the energy source using a functional variable and a second unit for monitoring the energy source using the functional variable are provided, wherein the vehicle electrical system (10) for performing a method according to one of Claims 1 until 7 is set up. on-board network claim 8 wherein the energy source is a battery (30, 50, 100), the first unit is an EBS (38) and the second unit is a device capable of supplying the current and voltage of the battery (30, 50, 100 ) to measure is. on-board network claim 8 or 9 , Which includes several sub-board networks, wherein the energy source for supplying consumers (14, 16, 20, 22, 24, 32, 34, 36) is used in one of the sub-board networks.

Images