GB2566255A

GB2566255A - Battery safety protection

Info

Publication number: GB2566255A
Application number: GB1713569.0A
Authority: GB
Inventors: Irish Stephen; Shaw Robin
Original assignee: Hyperdrive Innovation Ltd
Current assignee: Hyperdrive Innovation Ltd
Priority date: 2017-08-23
Filing date: 2017-08-23
Publication date: 2019-03-13
Anticipated expiration: 2037-08-23
Also published as: GB2566255B; GB201713569D0; WO2019038553A1

Abstract

A battery safety apparatus for safety protection of a battery 1, said battery comprising a plurality of energy storage cells 5, 7, 9, 11, 13 and 15. The battery safety apparatus comprises a signal interface 25 comprising signal connections for obtaining a cell voltage signal from each of the energy storage cells. The apparatus further comprises a disconnector 23 coupled to a conductive link 17 connected in series with the cells and a terminal of the battery 19, 21. The disconnector is configured to disconnect the conductive link in the event that one of the cell voltages is outside of a selected voltage range. The disconnector may be configured to disconnect the conductive link in the event that one of the cell voltages is less than a first safety threshold or greater than a second safety threshold. The disconnector may physically disconnect a current path though the cells, for example by opening a mechanical switch or by breaking the conductive link. When a mechanical switch is used it may be configured to latch into an open state to inhibit reconnection. The conductive link may be broken by thermally or chemically burning out the link or by deforming it to failure. The disconnector may for example be a cutter or a pyrotechnic trigger.

Description

Battery Safety Protection

Field of Invention

The present invention relates to methods and apparatus for the safety of batteries, and more particularly for the safety of arrays of batteries.

Background

Scalable battery systems, such as the 48 volt modular lithium ion energy storage system available from Hyperdrive

Innovation

Limited (Future

Technology Centre,

Barmston Court,

Nissan Way

Sunderland,

Tyne variety of stationary commercial and Wear, SR5 3NY,

UK) , may be used in a wide

circumstances. For example, they may be	deployed	in
energy storage systems, such as may	be used	in
facilities to mitigate the effects of	failures	in

supply.

mains power

These and other types of battery systems may be deployed in arrays in which a number of batteries are connected together in parallel. This may be useful in a wide variety of circumstances, and particularly where there is likely to be high current demand.

Lithium ion (Li-ion) battery technology is now the battery of choice, both in on-highway and off-highway automotive applications and in other energy storage systems. Such energy storage systems may be used in energy supply systems to support electricity generation (e.g. in domestic alternative energy installations), or with vehicle carried generator units to mitigate the effects of interruptions in the main grid supply of electricity. In such circumstances arrays of batteries connected in parallel may be of particular utility.

Li-ion battery technology has significant advantages with respect to :

• battery life (number of charge-discharge cycles) • self-discharge rate and storage life • high cell voltage; and, • energy density.

Of course, high energy density comes at a price. In the event of a short circuit within a cell, the cell can become thermally unstable and so-called thermal runaway may result. In some circumstances it may lead to an explosion or at least the venting of flaming gases from the cell. In a battery, or in a system of batteries, heat generated by thermal runaway can propagate to the next cell (or even to an adjacent battery) causing it too to become thermally unstable. In some cases, a chain reaction may occur. This can represent a very significant hazard.

Summary

Aspects and examples of the present disclosure aim to address at least a part of the above described technical problems and/or related problems.

An aspect of the disclosure provides a battery safety apparatus for safety protection of a battery. This apparatus may be configured to operate in the event that the battery is (a) in a dormant state while also (b) being connected in parallel with one or more other batteries.

The battery safety apparatus comprises a signal interface for obtaining a set of cell voltage signals, each signal indicating the cell voltage of a corresponding cell of a battery. The battery safety apparatus comprises a disconnector operable to disconnect the cells from a terminal of the battery to prevent charging of the battery. This disconnector is configured to disconnect the cells from the terminal in the event that one of the cell voltages is outside of a selected voltage range.

This can enable the safety protection of an array batteries - for example to protect an array of batteries connected together in parallel. In such an array, in the event of failure of one cell in one failing battery, the disconnector may disconnect the cells of the failing battery from its terminals. The full voltage of the other batteries in the array would otherwise be applied across the terminals of that failing battery. The safety protection apparatus may thus guard against the failing (or failed) cell, creating a short circuit and thereby subjecting the other cells in the failing battery to (potentially dangerous) overvoltage which would otherwise be applied to those cells by the array.

The disconnector may be configured to disconnect the cells from the terminal in the event that one of the cell voltages is less than a first safety threshold. The first safety threshold may be a lower threshold, for example a minimum safe voltage.

The disconnector may also be configured to disconnect the cells from the terminal in the event that one of the cell voltages is greater than a second safety threshold. The second safety threshold may be an upper threshold, for example a maximum safe voltage .

The signal interface may be provided by an interface, (e.g. an analogue front end) of a battery management system - such as a BMS for balancing the cells of a battery. The interface may comprise an ADC for converting sensed cell voltages into digital signals. It may also comprise a DAC for converting digital control signals from a controller into voltage output signals for controlling elements such as the discharge FETS of a battery cell balancing circuit. The battery management system may be configured to switch into a low power or storage mode in the event that the current flow into or out from the battery is less than a selected level for more than a selected time interval. The battery management system may be configured so that, even when it is in this low power mode, the signal interface remains operational for controlling the disconnector. For example, this interface may remain switched on even when the BMS is switched off .

Disconnecting the cells may comprise physically disconnecting the cells from a terminal, as opposed to a mere electrical disconnection such as may be provided by switching a transistor into a non-conducting state. For example, the physical disconnection may be provided by one of: opening a mechanical switch; and breaking a conductive member which links the cells to the terminal.

If a mechanical switch is used, it may be configured to latch into an open (off) state to inhibit reconnection of the cells to the terminal. For example the disconnector may be provided by a trip switch which latches off. For example, once latched, the trip switch may be held in the off state by a restraint which inhibits the switch from being returned to an on state. The restraint may be designed to be breakable, e.g. it may be frangible or weakened in some way. This can permit maintenance whilst allowing unauthorised tampering to be detected.

If a conductive member is physically broken to isolate the cells from the terminal this can be done by application of mechanical

force	to deform the	conductive member	to	failure .	The	mechanical
force	may	comprise	a shear force,	for	example	the	conductive
member	may	be cut	or snapped. The	mechanical	force	may also

comprise tensile stress - in other words, the conductive member may be pulled apart.

In these and other examples, the disconnector may comprise a pyrotechnic trigger arranged, when activated, to isolate the battery cells from the terminals. One example of such a trigger is a Pyroswitch (RTM) unit which may be purchased from Autoliv Inc . (RTM) .

Mechanical force need not be used. For example, it is possible also to chemically or thermally burn out the conductive member. For example it may be burned out in the manner of a fuse (e.g. by the application of excessive current, or by the application of a corrosive substance such as an acid).

Aspects of the disclosure comprise safety protection methods for an array of batteries connected together in parallel, the method comprising determining whether a cell of one of the batteries is in an undervoltage state and, in the event that a cell of a battery in the array is in an undervoltage state, disconnecting at least that cell. This disconnection may isolate that cell, or all the cells of that battery, from a terminal of the battery. It may simply disconnect the current path through the cells.

The battery safety apparatus may be provided, at least in part, by the battery management system. For example, the BMS may comprise the signal interfaces, and one or more signal outputs adapted to trigger operation of the disconnector.

For the avoidance of doubt, the disclosure of this application is intended to be considered as a whole. Any feature of any one of the examples disclosed herein may be combined with any selected features of any of the other examples described herein.

For example, features of methods may be implemented in suitably configured hardware, and the functionality of the specific hardware described herein may be employed in methods which may implement that same functionality using other hardware.

Brief Description of Drawings

Embodiments of the disclosure will now be described in detail with reference to the accompanying drawings, in which:

Figure 1 shows a battery comprising a battery safety apparatus;

Figure 2 shows a battery comprising a battery safety apparatus according to the present disclosure that is implemented, in part, by a battery management system; and

Figure 3 shows an array of batteries connected together in parallel.

In the drawings like reference numerals are used to indicate like elements .

Specific Description

Figure 1 shows a battery 1 comprising a plurality of energy storage cells 5, 7, 9, 11, 13, 15 and a conductive link 17, connected together in series between two terminals 19, 21. The terminals may be carried by a housing 3 of the battery 1. The battery 1 also comprises a battery safety apparatus 23, 25, 27. The housing 3 may encapsulate the cells 5-15, and the safety apparatus may also be encapsulated by the housing 3.

The cells 5-15 may be any appropriate cell for electrical energy storage, and generally they are rechargeable. For example they may comprise Li-Ion cells. It will be appreciated that each such cell may itself comprise a number of smaller cells - but, other than in so far as explained above, the internal structure of the cells 5, 7, 9, 11, 13, 15 is not material.

The battery safety apparatus comprises a signal interface 25, and a disconnector 23. The disconnector 23 comprises a controller 27 connected to the signal interface 25.

The signal connections between the signal interface 25 and the cells 5-15 are each arranged to provide a signal to that interface 25 indicating the voltage across a corresponding one of

those	cells .	The	signal interface	25	is configured	to provide
these	cell	voltage	signals to	the	controller	27 of the
disconnector	23 .	The	controller 27	is	configured to	determine,

based on these signals, whether to operate the disconnector 25 on the conductive link 17 to prevent current flow through the cells 5-15 of the battery 1. This controller 27 may comprise a set of comparators each arranged to compare a cell voltage signal, received via the interface 25, from a corresponding one of the cells 5-15 with a reference signal indicating the safety threshold of each cell 5-15. Equivalent function may be provided by any other appropriately configured control means.

The disconnector 23 is operable to sever the conductive link 17 (which is in series with the cells and the terminals) to prevent current flow between the terminals 19, 21 of the battery 1 and through the cells 5-15. The conductive link 17 may be connected between the cells 5-15 and one of the terminals 19, 21 of the battery (e.g. the positive terminal) so that disconnecting the conductive link 17 also isolates the cells 5-15 from that terminal.

To sever the conductive link 17, the disconnector 23 may comprise a cutter (such as a blade, or blades) and an actuator operable by the controller to force the cutter through the conductive link. The cutter may comprise an insulator, such as a ceramic. The

actuator	may comprise an electromechanical device, such as a
solenoid	or a pyrotechnic trigger. Examples of pyrotechnic
triggers	include automotive air bag initiators. In other words,

the cutter may act as a guillotine that can be propelled through the conductive link by a pyrotechnic charge. Other disconnection means may be used. For example, the conductive link 17 may itself be in part provided by the disconnector

In operation, the signal interface 25 provides a cell voltage signal to the controller 27 for each of the cells 5-15. Each of these signals indicates a voltage across a corresponding one of the cells 5-15 of the battery. The controller 27 then determines, based on these signals, whether the voltage across any one of those cells 5-15 is less than a first safety threshold for the corresponding cell (e.g. whether a dangerous undervoltage condition is developing). An undervoltage across a cell of the battery may cause an overvoltage condition to develop in the other cells of the battery. The controller 27 can determine that such an overvoltage condition is developing in a cell based on the cell voltage signals from the cells of the battery, for example by determining whether the voltage across any one of the cells 5-15 is above a maximum safety threshold.

In the event that a voltage across any one cell 5-15 is outside of a selected voltage range (e.g. less than the first safety threshold or more than the second safety threshold), the controller 27 triggers the disconnector 23 to break the conductive link 17 and prevent flow of current through the cells 5-15. Any physical disconnection means may be used to break the link, for example disconnection may be achieved by one of: opening a mechanical switch; and breaking a physical link.

The battery 1 illustrated in Figure 1 may comprise a battery management system configured to balance the cells 5-15 of the battery (e.g. to ensure that the cells are charged to the same degree). Such a battery management system may provide the signal interface 25, and may comprise a controller coupled to control a set of voltage controlled impedances, VCIs (such as FETs). Each of these VCIs may be connected in parallel with a corresponding one of the cells 5-15. Accordingly, by switching on the VCI, the BMS can dissipate charge from the corresponding cell to balance the cells (e.g. equalise the voltages on the cells). Other types of battery management system, BMS, may be used.

Whatever type of BMS is used, it may comprise a communications interface, adapted to communicate with other similar communications interfaces. For example, this may use a communications bus, connected between the devices which need to communicate on that bus. A variety of different protocols may be used. One example of such a protocol is the CANBUS, or controller area network bus, protocol. A number of variants of this protocol exist - and any of these variants may be used. It will also be appreciated in the context of the present disclosure that, even where a BMS is not present, the safety apparatus such as that described with reference to Figure 1 may include one of these communications interfaces.

The BMS may comprise a so-called analogue front end. This may comprise one or more voltage inputs, and one or more voltage outputs. In some examples, the analogue front end of the BMS may provide the signal interface 25 of the safety apparatus described herein. It may also be configured to provide some or all of the function required to control the disconnector 23. The BMS may be configured to operate in a low power, or sleep, mode when the battery is placed in storage or is otherwise 'off', e.g. dormant. For example the BMS may be configured to switch into a low power or sleep mode in the event that it determines that less than a threshold current has been delivered to or from the battery for a selected interval. The BMS may be configured to switch into the sleep mode in the event that the state of charge of one or more of the cells drops below a selected level. When the BMS is in this low power or sleep mode, the 'analogue front end' may remain switched on and configured for performing the functions of the safety apparatus described above.

Figure 2 shows a battery 1' comprising a plurality of cell modules 5' , 7' , 9', 15' connected together in series between a positive terminal 19, and a negative terminal 21. A conductive link 17 is provided between the cell modules 5'-15' and the positive terminal 19. Each of the cell modules 5'-15' comprises a temperature sensor 31, 33, 35, 37.

The battery 1' comprises a cutter 40 for cutting the conductive link 17, and an actuator 42 for operating the cutter 40. The analogue front end 44 is connected to the actuator 42. The cutter 40 may comprise a blade and may comprise insulating material, such as a ceramic. The actuator 42 may comprise an electromechanical device, such as a solenoid or a pyrotechnic trigger. The actuator is controllable to actuate the cutter to sever the conductive link 17.

The battery 1 also comprises a battery management system 2 also referred to as a BMS. The BMS 2 comprises a battery fuel gauge 46, a controller 48, a CANBUS interface 50, a temperature sensing analogue to digital converter (ADC) 52, and an analogue front end 44. The analogue front end 44 is connected to the controller 48. The controller 48 is also connected to the CANBUS interface 50, and to the temperature sensing ADC 52. The temperature ADC 52 is connected to the temperature sensors 31-37 of each of the cell modules 5'-15' .

The battery 2 also comprises a set of FETs 60, 62, 64, 66 and discharge resistances. One FET 60-66 and one discharge resistance is connected in parallel with each cell module 5'-15' .

The analogue front end 44 provides an analogue to digital and digital to analogue converter (ADC/DAC) for the battery management system 2. Accordingly it comprises a plurality of voltage sensing terminals for obtaining analogue voltage signals from each of the cell modules 5'-15' (each indicating the voltage across a corresponding one of the cell modules) . The analogue front end 44 also comprises a set of voltage outputs, each operable to provide a controllable voltage signal. The voltage sensing terminals of the analogue front end 44 are connected for sensing the voltage across each of the cell modules 5'-15' of the battery. Its voltage outputs are connected to the gate terminals of each of the FETs, and one of the voltage outputs is connected for operating the actuator 42 of the cutter 40. The analogue front end 44 is also configured to provide cell voltage data, based on the voltage signals from each of the cell modules 5'-15' to the controller 48.

The battery fuel gauge 46 is connected to the conductive link 17 and to the controller 48. The battery fuel gauge 46 is configured to determine a state of charge of the battery 2 based on measuring the flow of current into and out from the battery 2.

The CANBUS	interface 50	is	adapted	to communicate,	via a
controller	area	network,	with	other	CANBUS enabled	devices
coupled to	such a	network.
The temperature	sensing	ADC	52 is	configured	to	provide
temperature	data	to the	controller	48 based on	temperature

signals obtained from the temperature sensors 31-37 of the cell modules 5'-15' .

The controller 48 is configured to obtain cell module voltage data from the analogue front end 44, and to obtain cell module temperature data from the temperature ADC 52. The controller 48 is also configured to control the FETs 60-66 via the analogue front end 44 based on the cell module voltage data to balance the cell modules 5'-15' - e.g. so that the voltage across each of the cell modules is equal across the cells. Balancing may be performed according to any one of a number of balancing schemes, but typically the FETs 60-66 may be operated via the analogue front end 44 to discharge current through one of the FETs 60-66 to lower the voltage of the corresponding cell module - e.g. to equalise it with a voltage across the other cell modules. The controller 48 may also be operable to communicate with a battery charger via the CANBUS interface 50 to send charging requests to the charger - e.g. to request a particular charging current and/or a particular charging voltage. The controller 48 may be configured to determine the charging requests based on the cell module voltage data and/or based on state of charge data obtained from the battery fuel gauge 46. Cell module temperature data may also be taken into account in determining these requests.

The battery management system 2 may be configured to switch into a low power, or storage mode, in the event that the battery 2 is left unused. In particular, the controller may be configured to determine the current supplied to and/or drawn from the battery 2 (e.g. based on data obtained from the battery fuel gauge 46) . The controller 48 is configured to switch the BMS 2 into a low power mode in the event that the current flow in to/out from the battery 2 is less than a selected threshold level for more than a selected time interval. Switching into the low power mode may comprise, for example switching off at least one of: the CANBUS interface 50, the controller 48, and the

temperature ADC 52. In the low power mode the analogue front end
44, and perhaps also switched on.	the	Battery	Fuel	Gauge 46 may remain
Referring back now to	the	analogue	front	end 44, the analogue

front end 44 may be configured to determine, based on the cell module voltage signals, whether the voltage across any one of the cell modules 5'-15' is outside of a selected voltage range. For example the analogue front end 44 may be configured to determine whether the voltage across any one of the cell modules 5'-15' is less than a safety threshold (e.g. whether a dangerous undervoltage condition is developing) or above a second threshold (e.g.

whether a dangerous overvoltage condition is developing) .

It is further configured to provide a control signal to the actuator 42 to cause the cutter 44 to sever the conductive link in the event that the voltage across any one of the cell modules 5-15 is outside of the selected voltage range (e.g.

less than the first safety threshold or greater than the second safety threshold). It may also be configured to determine whether the battery management system 2 is operating in low power, or storage mode and, in the event that the BMS is in such a mode, to cause the CANBUS interface 50 to switch on to send an alert message .

If the BMS is powered solely by the cell modules of the battery 1, this may be done prior to operating the actuator and cutter 40 to disconnect the cell

It will be appreciated in the context of the present disclosure that the CANBUS interface illustrated in Figure 2 need not be included. It may also be replaced by any appropriate communications interface. The FETs used for balancing the cell modules may be provided by any voltage controlled impedance (VCI) of an appropriate power rating for the cells. The voltage controlled impedances may comprise transistors such as insulated gate bipolar transistors, IGBTs, field effect transistors, FETs, such as junction field effect transistors, JFETS, insulated gate field effect transistors, IGFETS, metal oxide semiconductor field effect transistors, MOSFETs, and any other type of transistor. The VCIs may be operated as switches. Electromechanical switches such as relays may be used. It will also be appreciated that, although Figure 2 shows resistors as separate elements from these VCIs, the resistances used for discharging the cell modules for balancing may be provided by the VCIs themselves.

Figure 3 shows an array 60 of batteries 62, 64, 66, 68 - these batteries may comprise any batteries such as those described above with reference to Figure 1 and Figure 2.

In Figure 3, the batteries 62-68 are connected together in parallel by a DC BUS 71, 71' for the provision of current between the batteries and a current source such as a battery charger for charging the array 60, and a current sink such as a load to be powered by the array 60.

In addition, in the example illustrated in Figure 3, each battery 62-68 may comprise a BMS for balancing cell voltages during charging and/or discharge of the battery. The safety apparatus of each battery is provided, at least in part, by the BMS of that battery. For example, the BMS of the batteries 62-68 in Figure 3 comprises the signal interface, and a control circuit arranged to control the disconnector. This control circuit may comprise a set of comparators each arranged to compare a cell voltage signal from a corresponding one of the cells with first and second reference signals indicating the selected voltage range, for example by indicating the first and second safety thresholds of each cell. Any other means of making these comparisons may also be used.

The BMSs are configured to switch into a low power or sleep mode in the event that their battery fuel guage indicates that less than a threshold current has been delivered to or from the battery for a selected interval. In some examples the BMSs are configured to switch into the sleep mode in the event that no messages are received by the CANBUS interface during a selected interval. The BMS may be configured to switch into the sleep mode in the event that the state of charge of one or more of the cells drops below a selected level. And, the BMS is arranged so that, when it is in the low power state, the signal interface and the control circuit remain active so that the safety apparatus continues to operate. For example, as described with reference to Figure 2, the analogue front end of the BMS may be configured to perform this function.

In the event that the safety apparatus in one of the batteries determines that voltage across one of its cells is outside of a selected voltage range (e.g. less than a first safety threshold or greater than a second safety threshold) , the controller of that safety apparatus triggers the disconnector. This prevents passage of current through that battery from the other batteries of the array, thus protecting the other cells of that battery from being subjected to overvoltage by those other batteries as the low voltage cell fails. It will be appreciated that this disconnection may be provided by any of the methods described or claimed herein.

It will also be appreciated in the context of the present disclosure that the comparators mentioned above may be provided by op-amps arranged to provide voltage comparators, or by current comparators (such as may be provided by opposed current mirrors arranged to subtract a current based on the cell voltage from a current indicating the safety threshold for the cell).

Other variants are contemplated. For example, the disconnector may be configured to disconnect the cells from the terminal only in the event that the battery is in an off state, for example a dormant state. The off state may be detected in a number of ways. For example, the battery safety apparatus may be configured to determine whether the battery is off based on whether one or more components of a battery management system (BMS) of the battery have been switched off - for example it may detect that the BMS is in a power save or sleep mode. A dormant state may be defined as the battery remaining in an off state for more than a threshold duration.

Other ways of sensing an off state are also envisaged, for example the apparatus may sense whether the battery is in an off state, the signal interface may be coupled to sense current being drawn from or provided to the cells - e.g. by being coupled to a current transducer arranged to provide a signal to the interface indicating the delivery of charging current or discharging current.

The battery safety apparatus may be configured to detect whether the battery is in an off state based on this current. For example, by determining whether the current being drawn from or provided to the cells is less than a threshold level. The battery safety apparatus may be configured to detect whether the battery is in a dormant state based on the duration of the off state. For example, it may be configured to determine whether the off state persists for more than a threshold duration.

Although such functionality may be provided by a BMS, because the off or dormant state can be sensed without checking the state of operation of the BMS, it will be appreciated in the context of this disclosure that the battery safety apparatus, and the methods described herein, may operate independently from any BMS. The BMS need not always be present at all.

The method described with reference to Figure 3, and other methods described and claimed herein, may comprise determining whether the array is in an off state (e.g. a dormant state) and performing said disconnecting only in the event that the array of batteries is in the off state (e.g. the dormant state) . As noted above, such an array of batteries may be connected together by a DC BUS for external current supply to or from the array.

Determining whether such an array is in an off state may be based on an indication of the external current. The method may thus distinguish (a) the active charging of batteries in the array or the provision of electrical power by the array, from (b) current flow due to voltage differences between batteries when the array is in an off state. For example, the method may comprise detecting a mismatch between (a) current flow in one or more batteries of the array and (b) the external current.

When there is no external current, but current is flowing into a battery in the array, this may indicate that that battery is being charged by the other batteries in the array. Also, if external current is flowing out from the array, but current is flowing into a battery in the array, this may also indicate that that battery is being charged by the other batteries in the array. In the event that either of these two conditions is detected and it is detected that a cell of that battery is also outside of a selected voltage range such that it is in an undervoltage state or an overvoltage state (e.g. cell voltage less than a first safety threshold or greater than a second safety threshold), the cells of that battery may be disconnected from the array.

To determine the external current, a current transducer may be provided at each output from the DC BUS and arranged to provide signals indicating the external current to the safety control apparatus described herein. Other methods of determining the external current may also be used. For example, the currents provided from each battery may be measured locally (e.g. by safety apparatus in each of those batteries) and those currents may be summed to determine the external current. For example a safety apparatus in each battery may determine the current flow in that battery, and send a signal indicating that current to the other batteries of the array. Each safety apparatus in each battery may thus determine the external current based on those signals .

There may be no need to determine external current at all - or indeed to detect the existence of an off state. For example, based on those signals from other batteries, each safety apparatus in a battery array may determine whether its cells are being charged by the other batteries in that array (e.g. because current is flowing into that battery while it is flowing out of the other batteries). The safety apparatus in each battery may be configured so that, in the event that this condition is detected and it also detects that a cell of its battery is outside of a selected voltage range, so that the cell is in an undervoltage or overvoltage state (e.g. cell voltage less than a first safety threshold or more than a second safety threshold), it disconnects the cells of that battery from a terminal of that battery. This disconnection may be performed by any method or means described herein.

The 'off-state' or dormancy threshold may be based on power instead of simply on current alone (e.g. the apparatus may also sense the voltage across the cells in addition to the current being drawn/delivered) . The load of the apparatus described with reference to Figure 2 may act as a current source, particularly

in electric	motor applications, in	which regen braking	may
occur.
It will be	appreciated from the	discussion above that	the
embodiments	shown in the Figures	are merely exemplary,	and

include features which may be generalised, removed or replaced as described herein and as set out in the claims. With reference to the drawings in general, it will be appreciated that schematic functional block diagrams are used to indicate functionality of systems and apparatus described herein. It will be appreciated however that the functionality need not be divided in this way, and should not be taken to imply any particular structure of hardware other than that described and claimed below. The function of one or more of the elements shown in the drawings may be further subdivided, and/or distributed throughout apparatus of the disclosure. In some embodiments the function of one or more elements shown in the drawings may be integrated into a single functional unit.

In some examples the functionality of the controller may be provided by a general purpose processor, which may be configured to perform a method according to any one of those described herein. In some examples the controller may comprise digital logic, such as field programmable gate arrays, FPGA, application specific integrated circuits, ASIC, a digital signal processor, DSP, or by any other appropriate hardware. In some examples, one or more memory elements can store data and/or program instructions used to implement the operations described herein. Embodiments of the disclosure provide tangible, non-transitory storage media comprising program instructions operable to program a processor to perform any one or more of the methods described and/or claimed herein and/or to provide data processing apparatus as described and/or claimed herein. The controller may comprise an analogue control circuit which provides at least a part of this control functionality. An embodiment provides an analogue control circuit configured to perform any one or more of the methods described herein.

The above embodiments are to be understood as illustrative examples .

Further embodiments are envisaged.

It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. Furthermore, equivalents and modifications not described above may also be 10 employed without departing from the scope of the invention, which is defined in the accompanying claims.

Claims

1. A battery safety apparatus for safety protection of a battery, said battery comprising a plurality of energy storage cells, the battery safety apparatus comprising:

a signal interface comprising signal connections for obtaining a plurality of cell voltage signals, each cell voltage signal indicating a voltage provided by a corresponding one of the energy storage cells;

a disconnector coupled to a conductive link connected in series with the cells and a terminal of the battery;

wherein, the disconnector is configured to disconnect the conductive link in the event that one of the cell voltages is outside of a selected voltage range.

2. The apparatus of claim 1 wherein the disconnector is configured to disconnect the conductive link in the event that one of the cell voltages is less than a first safety threshold.

3. The apparatus of claim 1 wherein the disconnector is configured to disconnect the conductive link in the event that one of the cell voltages is greater than a second safety threshold.

4. The apparatus of any of claims 1 to 3 wherein the signal interface comprises an analogue front end of a battery management system for balancing the cells of a battery.

5. The apparatus of any of claims 1 or 4 wherein the disconnector is operable to physically disconnect a current path through the cells.

6. The apparatus of claim 5 wherein the physical disconnection is provided by one of: opening a mechanical switch in the link; and breaking the link.

7. The apparatus of claim 6 wherein the mechanical switch is configured to latch into an open state to inhibit reconnection.

8. The apparatus of claim 6 wherein breaking the link comprises chemically or thermally burning out the conductive link.

9. The apparatus of claim 6 wherein breaking the link comprises breaking the link by mechanical force, for example by deforming the conductive link to failure.

10. The apparatus of claim 9 wherein the mechanical force comprises at least one of a shear force and tension.

11. The apparatus of claim 10 wherein the disconnector comprises a pyrotechnic trigger arranged to apply said force.

12. The apparatus of any preceding claim wherein the disconnection is irreversible.

13. A method of safety protection for an array batteries, the array comprising a plurality of batteries connected together in parallel, the method comprising disconnecting the cells of one of the batteries in the event that a voltage across a cell of the one of the batteries is outside of a selected voltage range.

14. The method of claim 13 comprising disconnecting the cells of one of the batteries in the event that the voltage across the cell of the one of the batteries is less than a first safety threshold.

15. The method of claim 13 comprising disconnecting the cells of one of the batteries in the event that the voltage across the cell of the one of the batteries is greater than a second safety threshold.

16. The method of any of claims 13 to 15 wherein disconnecting the cells comprises operating a disconnector to disconnect the cells of the one of the batteries from a terminal of that battery.

17. The method of any of claims 13 or 16 wherein disconnecting the cells comprises physically disconnecting the cells from a terminal.

18. The method of claim 17 wherein the physical disconnection is provided by one of: opening a mechanical switch; and breaking a physical link between the cells and the terminal.

19. The method of claim 18 comprising latching the mechanical switch into an open state to inhibit reconnection of the cells to the terminal.

20. The method of claim 18 wherein breaking the physical link comprises breaking a conductive member of the link.

21. The method of claim 20 wherein breaking the conductive member comprises at least one of: chemically or thermally burning out the conductive member; and application of mechanical force to deform the conductive member to failure.

22. The method of claim 21 wherein the mechanical force comprises at least one of a shear force and tension.

23. The method of claim 22 wherein the shear force is applied by a cutter.

24. The method of claim 22 or 23 comprising operating a pyrotechnic trigger to apply said force.

25. The method of any of claims 13 to 24 wherein the disconnection is irreversible.

26. The method of any of claims 13 to 25 comprising obtaining a plurality of cell voltage signals, each cell voltage signal indicating a voltage provided by a corresponding one of the energy storage cells of the batteries, and determining whether the voltage across a cell is outside of a selected voltage range based on the cell voltage signals.

27. The method any of claims 13 to 26 comprising determining whether the battery array is in an off state, and wherein the disconnecting the cells is performed only in the event that the battery array is in an off state.

28. A battery safety apparatus for safety protection of a battery, said battery comprising a plurality of energy storage cells, the battery safety apparatus comprising:

a signal obtaining means for obtaining a plurality of cell voltage signals, each cell voltage signal indicating a voltage provided by a corresponding one of the energy storage cells;

a disconnecting means for disconnecting the cells from a terminal of the battery to prevent charging of the battery in the event that one of the cell voltages is outside of a selected voltage range .

29. The apparatus of claim 28 wherein the disconnecting means is configured to disconnect the cells from a terminal of the battery to prevent charging of the battery in the event that one of the cell voltages is less than a first safety threshold.

30. The apparatus of claim 28 wherein the disconnecting means is configured to disconnect the cells from a terminal of the battery to prevent charging of the battery in the event that one of the cell voltages is greater than a second safety threshold.

31. An apparatus configured to perform the method of any of claims 13 to 27.

32. The apparatus of any of claims 28 to 31, wherein the apparatus comprises a battery management system.

33. A computer program product comprising program instructions operable to program a processor to perform the method of any of claims 13 to 27.