JP2012137877A - Secondary battery device, processor, monitoring program and vehicle - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a secondary battery device, a processor, a monitoring program and a vehicle which have high availability, maintainability, detectability and reliability.SOLUTION: A secondary battery device comprises: a battery cell BT including plural secondary battery cells; a voltage measurement circuit 10 to measure voltages of the secondary battery cells; a first processor 20 to communicate with the voltage measurement circuit 10 and a host control circuit 40, to control charging and discharging of the battery cell BT and to output a first status signal indicating an active state of itself; and a second processor 30 which receives the first status signal and determines whether the first processor 20 works rightly based on the first status signal and which can output a first reset signal for executing a hardware reset operation relating to the first processor 20 when it is determined that the first processor 20 does not work rightly.

Description

  Embodiments described herein relate generally to a secondary battery device, a processor, a monitoring program, and a vehicle.

  Conventionally, in a secondary battery device, a processor is used to perform processing necessary for battery control (battery protection, fuel gauge calculation, pack capacity calculation, internal resistance calculation, upper control circuit communication, voltage measurement inter-circuit communication, etc.). It is installed. If this processor becomes abnormal, the host control circuit will not be able to obtain the correct information (voltage / temperature) about the battery, but will not be able to obtain current information or obtain incorrect information. Therefore, there is a possibility that the battery may reach an overvoltage state, resulting in an event that causes harm to the user such as explosion and fire.

  For this reason, in the conventional secondary battery device, in order to prevent explosion and ignition, a circuit for monitoring the processor is added, and it is confirmed whether or not the processor is operating with this monitoring circuit. In this case, an abnormality is notified to the upper control circuit.

  Specifically, a square wave pulse with a specified frequency is output to the communication line between the processor and a circuit for monitoring the processor when the processor is operating, but it is specified when the processor is not operating. Square wave pulses (waveforms that are fixed at a high (H) level or low (L) level or whose frequency and duty ratio are different from prescribed) are output.

  When the circuit for monitoring the processor constantly monitors this signal line and the specified square wave pulse is not output, the monitoring circuit immediately resets the hardware by this monitoring circuit, and at the same time, the upper control circuit The processor is not running.

Japanese Patent Application Laid-Open No. 5-46426 JP 2001-63492 A

  The host control circuit that has received an abnormality notification from the circuit for monitoring the processor immediately shuts off the battery and the main circuit connected to the motor driven by the battery because the secondary battery device is abnormal. To do. As a result, the driving force of the vehicle used by the user suddenly disappears, for example, when the vehicle is colliding with a following vehicle when traveling on a highway at high speed, or the vehicle rotates when turning a curve. There was a possibility of accidents.

  In addition, a transition to an abnormal state of the processor due to cosmic rays or noise outside the design guarantee range always occurs, and if these are causes, it can be restored by hardware resetting the processor. In the battery device, as described above, when the processor has fallen into an abnormal state and stopped even once, the hardware reset of the processor and the abnormal notification to the host control circuit are performed. Therefore, an abnormality notification is sent to the host control circuit. For this reason, the probability of occurrence of an abnormality notification is increased, and the availability of the secondary battery device is decreased. As a result, the safety of the device using the secondary battery device is also lowered.

  Also, when using a square wave pulse to indicate the processor status, the monitoring circuit can detect the processor abnormality due to the square wave pulse becoming out of specification, but when the abnormality occurred, It was impossible to know what kind of processing the secondary battery device was performing when an abnormality occurred.

  Also, depending on the state of the abnormality of the processor and the way of writing the program, there is a case where an abnormality occurs in the internal processing even though the prescribed square wave pulse is output. Specifically, when a square wave pulse is output but communication with the host control circuit is not possible, or data communication with the host control circuit but not defined in the contents -There was a possibility that a control command was included. In these cases, the processor abnormality cannot be detected by monitoring only the square wave pulse.

  As described above, conventional secondary battery devices have a high probability of anomaly notification (low availability), a high degree of difficulty in analyzing the cause of the anomaly (low maintainability), and a probability of missing an anomaly Was high (low detectability) and low in reliability.

  The present invention has been made in view of the above circumstances, and an object thereof is to provide a secondary battery device, a processor, a monitoring program, and a vehicle that have high availability, maintainability, and detectability and high reliability. To do.

  The secondary battery device according to the embodiment communicates with a battery including a plurality of secondary battery cells, a voltage measurement circuit that measures the voltage of the secondary battery cell, and the voltage measurement circuit and the host control circuit. A first processor for performing charge and discharge control of the battery and outputting a first status signal indicating its own operating state; receiving the first status signal; and based on the first status signal, the first processor A second processor capable of outputting a first reset signal for hardware resetting the first processor when it is determined whether the first processor is not operating correctly; Is provided.

It is a figure for explaining an example of 1 composition of vehicles concerning an embodiment. It is a figure for demonstrating the example of 1 structure of the secondary battery apparatus of 1st Embodiment. FIG. 3 is a diagram for explaining a configuration example of a main processor and a sub processor of the secondary battery device shown in FIG. 2. It is a figure for demonstrating an example of the operation status of the processor of the secondary battery apparatus shown in FIG. 3 is a flowchart for explaining an example of an operation of a sub processor of the secondary battery device shown in FIG. 2. 3 is a flowchart for explaining an example of an operation of a main processor of the secondary battery device shown in FIG. It is a figure for demonstrating the example of 1 structure of the secondary battery apparatus of 2nd Embodiment. It is a figure for demonstrating the example of 1 structure of the secondary battery apparatus of 3rd Embodiment. It is a figure for demonstrating the example of 1 structure of the secondary battery apparatus of 4th Embodiment.

Hereinafter, embodiments will be described with reference to the drawings.
FIG. 1 schematically shows a configuration example of a vehicle according to an embodiment of the present invention. The vehicle according to the present embodiment is, for example, an electric vehicle or a hybrid vehicle, and has a secondary battery device mounted thereon.

  The vehicle includes a battery management device 300, a battery module 400, an axle driven by power from the battery module 400, an operation control unit 500, a motor 600 to which power is supplied from the battery module 400, and a host control circuit 40. And a chassis 1000 and drive wheels WR and WL.

  The battery module 400 includes a battery BT (shown in FIG. 2) including a plurality of secondary battery cells (not shown), a battery voltage measurement circuit 10 (shown in FIG. 2) that measures the temperature of the battery BT, and the like. The battery management apparatus 300 includes a communication system that sends information. The positive terminal and the negative terminal of the battery BT are connected to the operation control unit 500.

  The battery management device 300 is supplied with a voltage value of a plurality of secondary battery cells, a current value of the battery BT, and a temperature value of the battery BT from the battery module 400, and monitors the voltage value of the battery BT and the like, and is charged and discharged. And a communication system for communicating with the battery module 400 and the host control circuit 40.

  The operation control unit 500 includes an inverter (not shown), converts the voltage supplied from the battery module 400, receives the operation command, performs output current / voltage level control, phase control, and the like. The output of the operation control unit 500 is supplied to the motor 600 as drive power. The rotation of the motor 600 is transmitted to the axle (not shown) and the drive wheels WR and WL through, for example, a differential gear unit.

  The host control circuit 40 receives data such as voltages of a plurality of secondary battery cells from the battery management device 300 and a signal notifying the abnormality of the battery module 400 or the battery management device 300, and operates the battery management device 300. Control.

  FIG. 2 schematically shows a configuration example of the secondary battery device according to the present embodiment. The secondary battery device according to the present embodiment includes a battery BT including a plurality of secondary battery cells (not shown), a battery voltage measurement circuit 10 that measures the voltage and temperature of the battery BT, and a main processor (first Processor) 20, sub-processor (second processor) 30, first memory M 1, and second memory M 2. When the secondary battery device of this embodiment is mounted on a vehicle, the battery BT and the battery voltage measurement circuit 10 are mounted on the battery module 400, and the main processor 20, the sub processor 30, the first memory M1, and the second The memory M2 is mounted on the battery management device 300.

  The battery voltage measurement circuit 10 is connected to the battery BT by a voltage measurement line. The battery voltage measurement circuit 10 acquires the positive terminal voltage and the negative terminal voltage of a plurality of secondary battery cells from the voltage measurement line, and outputs the inter-terminal voltage of each secondary battery cell to the main processor 20. The battery voltage measurement circuit 10 detects the temperature of the battery BT from a temperature sensor (not shown) installed in the battery BT, and transmits the detection result to the main processor 20 through a communication system (not shown).

  The battery voltage measurement circuit 10 notifies the sub processor 30 of an abnormality through a communication system (not shown) when the measured voltage value is abnormal or when the battery voltage measurement circuit 10 is abnormal.

  The main processor 20 includes processing necessary for battery control (battery protection, fuel gauge calculation, battery capacity calculation, internal resistance calculation, communication with the host control circuit 40, communication with the battery voltage measurement circuit 10, etc.), and sub processor 30 operation status monitoring, abnormality notification, and hardware reset are performed. The main processor 20 receives the voltage value and temperature value of the battery BT from the battery voltage measurement circuit 10 and transmits a control command to the battery voltage measurement circuit 10.

  FIG. 3 shows a configuration example of the main processor 20. The main processor 20 includes an instruction memory 21, a data memory 23, a program counter 25, a register 27, and an arithmetic unit 29 that performs various logical operations.

The instruction memory 21 holds an instruction for controlling the secondary battery device.
The data memory 23 holds data such as voltage values and temperature values received from the battery voltage measurement circuit 10.

  The program counter 25 is a register that holds an address of an instruction to be executed next. The main processor 20 reads the instruction indicated by the program counter 25 from the instruction memory 21 and executes it. When an instruction is read, it is updated to point to the instruction to be executed next.

  The register 27 is a storage unit that primarily stores data. A general-purpose register for storing calculation target data and a memory address for memory access, a control register used for program control, a peripheral function register for controlling an input / output device (I / O), and the like are used.

  The main processor 20 outputs, for example, the value of the program counter 25 and the operation status number of the main processor 20 as a status notification signal to the sub processor 30.

  The value of the program counter 25 is updated at a predetermined timing when the program is normally executed. Accordingly, when the program is normally executed by the main processor 20, the value of the program counter 25 changes within a certain period (for example, 1 second). If the program is not normally executed by the main processor 20, the value of the program counter 25 does not change within a certain period (for example, 1 second).

  FIG. 4 shows an example of the operation status number for the processing of the main processor 20. Each process performed by the main processor 20 is assigned an operation status number. The main processor 20 sequentially executes predetermined processing in accordance with the control command received from the upper control circuit 40. The main processor 20 holds the operation status number in the register 27 or the data memory 23, for example, and updates the operation status number every time processing to be executed is changed. When the main processor 20 is executing the process A, the operation status number is 1. When the process of the main processor 20 transitions from the process A to the process D, the operation status number is updated from 1 to 4. When the program is normally executed by the main processor 20, the operation status number changes within a certain period (for example, 1 second). If the program is not normally executed by the main processor 20, the operation status number does not change within a certain period (for example, 1 second).

  The main processor 20 and the battery voltage measurement circuit 10 are connected by a measurement circuit command / data communication interface. The main processor 20 and the upper control circuit 40 are connected by a data communication interface and a control command line. A main processor status notification line, a sub processor status notification line, a sub processor reset signal line, and a main processor reset signal line are connected between the main processor 20 and the sub processor 30.

  The sub processor 30 has the same configuration as that of the main processor 20, and includes an instruction memory 31, a data memory 33, a program counter 35, a register 37, and an arithmetic unit 39 that performs various logical operations. . The sub processor 30 performs monitoring of the operating state of the main processor 20, notification of abnormality, and hardware reset. The sub processor 30 also notifies the upper control circuit 40 of the operating state of the main processor 20.

  The sub processor 30 receives the status signal of the main processor 20 and monitors the operating state of the main processor 20 by monitoring the status signal. While the sub processor 30 can detect that the main processor 20 is operating correctly, the sub processor 30 disables the main processor reset signal and does not reset the main processor 20 by hardware. When the sub processor 30 detects that the main processor 20 is not operating correctly (abnormal), the sub processor 30 enables the main processor reset signal and resets the main processor 20 by hardware. The reset main processor 20 reboots and executes the program again. Thus, the hardware reset of the main processor 20 is performed by the sub processor 30.

  Further, when the main processor 20 is hardware reset, the sub-processor 30 performs the hardware reset, the hardware reset factor and its value (the value of the program counter 25 of the main processor 20 and the operation status number), and The time when the hardware is reset is recorded in the second memory M2.

  When the abnormality of the main processor 20 continues even if the hardware reset is performed a plurality of times, the sub processor 30 uses the abnormality notification line connected between the sub processor 30 and the upper control circuit 40 to use the main processor 20. Notification that is abnormal. Further, when the sub processor 30 notifies that the main processor 20 is abnormal, the sub processor 30 records the time when the abnormality is notified in the second memory M2.

  FIG. 5 shows a flowchart for explaining an example of the operation in which the sub processor 30 monitors the main processor 20. When the sub processor 30 starts monitoring the main processor 20, the status signal that is the target signal of the main processor 20 is monitored (step STA1), and it is determined whether or not the main processor 20 is operating correctly (step STA2).

  Specifically, the sub processor 30 determines whether or not the value of the program counter 25 or the operation status number received as the status signal of the main processor 20 has changed within a certain period. The sub processor 30 determines that the main processor 20 is operating normally when the value of the program counter 25 or the operation status number changes within a certain period, and the value of the program counter 25 or the operation status number is If it has not changed within a certain period, it is determined that the main processor 20 is abnormal.

  If the sub processor 30 determines that the main processor 20 is operating normally, the sub processor 30 continues to monitor the status signal from the main processor 20 (step STA1).

  If the sub processor 30 determines that the main processor 20 is abnormal, the sub processor 30 determines whether or not the number of resets (restarts) of the main processor 20 is greater than a specified value (step STA3). The reset count of the main processor 20 is stored in the second memory M2 or the register 37 or the data memory 33 in the sub processor 30, for example.

  If the number of resets of the main processor 20 is equal to or less than the specified value, the sub processor 30 outputs a reset signal to the main processor 20 to perform hardware reset of the main processor 20 (step STA4), and stores the program counter in the second memory M2. The value 25, the operation status number, and the current time are recorded, and the number of resets of the main processor 20 is incremented (step STA5). Thereafter, the sub processor 30 continues to monitor the status signal from the main processor 20 (step STA1).

  When the number of resets of the main processor 20 is larger than the specified value, the sub processor 30 records the value of the program counter 25, the operation status number, and the current time in the second memory M2, and sends the main processor to the upper control circuit 40. 20 is notified of the abnormality (step STA6), and monitoring of the main processor 20 is terminated. When the sub processor 30 notifies the upper control circuit 40 that the main processor 20 is abnormal, the sub processor 30 sets the reset count of the main processor 20 to zero.

  Receiving the abnormality notification from the sub-processor 30, the upper control circuit 40 immediately detects the battery BT and the main circuit connected to the load such as a motor driven by the battery BT because the secondary battery device is abnormal. Cut off.

  The main processor 20 receives the status signal of the sub processor 30 from the sub processor 30, and monitors the operating state of the sub processor 30 by monitoring the status signal.

  While the main processor 20 can detect that the sub processor 30 is normal, the main processor 20 disables the sub processor reset signal and does not perform a hardware reset on the sub processor 30. When the main processor 20 detects that the sub processor is abnormal, the main processor 20 enables the sub processor reset signal and resets the sub processor 30 by hardware. The reset sub-processor 30 reboots and executes the program again.

  Furthermore, when the main processor 20 resets the hardware of the sub-processor 30, it performs the hardware reset, the hardware reset factor and its value (the value of the program counter 35 of the sub-processor and the operation status number), and The hardware reset time is recorded in the first memory M1.

  If the main processor 20 continues to perform a hardware reset multiple times and the sub processor continues to malfunction, the main processor 20 uses the “data communication interface” from the main processor 20 to the host control circuit 40 to cause the sub processor 30 to malfunction. To be notified. Further, when the main processor 20 notifies that the sub processor 30 is abnormal, the main processor 20 records the time when the abnormality is notified in the first memory M1.

  Further, when the status signal received from the sub processor 30 is the operation status number, the main processor 20 can detect whether or not the sub processor 30 is in the correct operation state by monitoring the status signal.

  The main processor 20 calculates which processing state the sub processor 30 should be currently in from the control command received from the host control circuit 40, and determines whether or not it matches the processing corresponding to the received operation status number. .

  While the main processor 20 can detect that the sub processor 30 is normal, the main processor 20 disables the sub processor reset signal and does not perform a hardware reset on the sub processor 30. When the main processor 20 detects that the sub processor 30 is abnormal, the main processor 20 enables the sub processor reset signal and resets the sub processor 30 by hardware. The reset sub-processor 30 reboots and executes the program again.

  In addition, the main processor 20 first sets the hardware reset when the sub processor 30 is hardware reset, the hardware reset factor and its value (operation status number of the sub processor), and the time when the hardware reset is performed. Record in the memory M1.

  If the abnormality of the sub processor continues even if the hardware reset is performed a plurality of times, the data communication interface from the main processor 20 to the upper control circuit 40 is used to notify that the sub processor 30 is abnormal. . Further, when the main processor 20 notifies that the sub processor 30 is abnormal, the main processor 20 records the time when the abnormality is notified in the first memory M1.

  FIG. 6 is a flowchart for explaining an example of the operation in which the main processor 20 monitors the sub processor 30. When the main processor 20 starts monitoring the sub processor 30, the status signal which is the target signal of the sub processor 30 is monitored (step STB1), and it is determined whether or not the sub processor 30 is operating correctly (step STB2).

  Specifically, the main processor 20 determines whether the value of the program counter 35 or the operation status number received as the status signal of the sub processor 30 has changed within a certain period. The main processor 20 determines that the sub-processor 30 is operating normally when the value of the program counter 35 or the operation status number has changed within a certain period, and the value of the program counter 35 or the operation status number is If it has not changed within a certain period, it is determined that the sub processor 30 is abnormal.

  Further, when the main processor 20 receives the operation status number as the status signal of the sub processor 30, the main processor 20 determines the processing corresponding to the operation status number and the current processing state of the sub processor 30 calculated from the control command. It can also be determined whether or not they match. The main processor 20 determines that the sub processor 30 is operating normally when the processes match, and determines that the sub processor 30 is abnormal when the processes do not match.

  If the main processor 20 determines that the sub-processor 30 is operating normally, it continues to monitor the status signal from the sub-processor 30 (step STB1).

  If the main processor 20 determines that the sub processor 30 is abnormal, the main processor 20 determines whether or not the number of resets (restarts) of the sub processor 30 is greater than a specified value (step STB3). The number of resets of the sub processor 30 is stored in the first memory M1 or the register 27 or the data memory 23 in the main processor 20, for example.

  When the number of resets of the sub processor 30 is equal to or less than the specified value, the main processor 20 outputs a reset signal to the sub processor 30 to perform hardware reset of the sub processor 30 (step STB4), and stores the program counter in the first memory M1. The value of 35, the operation status number, and the current time are recorded, and the reset count of the sub processor 30 is incremented (step STB5). Thereafter, the main processor 20 continues to monitor the status signal from the sub processor 30 (step STB1).

  When the number of resets of the sub processor 30 is larger than the specified value, the main processor 20 records the value of the program counter 35, the operation status number, and the current time in the first memory M1, and sends the sub processor to the upper control circuit 40. 30 is notified by the communication interface (step STB6), and monitoring of the sub processor 30 is terminated. When the main processor 20 notifies the host control circuit 40 that the sub processor 30 is abnormal, the main processor 20 sets the number of resets of the sub processor 30 to zero.

  When the main processor 20 and the sub-processor 30 are monitored as described above, even if either the main processor 20 or the sub-processor 30 transitions to an abnormal state due to cosmic rays or noise outside the design guarantee range, it is normal. The processor that is operating abnormally resets the hardware of the processor that is operating abnormally, and no error notification is sent to the host control circuit 40 during that time. As a result, the upper control circuit 40 does not block the main circuit connected to the battery BT and the load (motor or the like) driven by the battery BT. It is known that the probability of both processors becoming abnormal due to cosmic rays or noise factors outside the design guarantee range is very small.

  Therefore, the driving force of the vehicle or the like does not suddenly disappear due to cosmic rays or noise outside the design guarantee range, and suddenly when the user is driving a vehicle equipped with a secondary battery device and traveling on a highway at high speed. It does not occur that the driving force is lost and the vehicle is bumped into the following vehicle, or that the vehicle does not rotate suddenly when turning a curve.

  Further, when a permanent failure occurs in either the main processor 20 or the sub processor 30, an abnormality is correctly detected by a processor that has not failed, and an abnormality notification is sent to the upper control circuit 40. In this case, the host control circuit 40 can cut off the main circuit connected to the battery BT and a load (motor or the like) driven by the battery BT. When a permanent failure occurs in the processor, the driving force of the vehicle, etc. suddenly disappears. Generally, however, the probability of a permanent failure occurring in the processor is outside the scope of cosmic rays and design guarantees. It is known that the probability of a temporary failure due to noise is much greater.

  As described above, according to the secondary battery device, the processor, the monitoring program, and the vehicle according to the present embodiment, the probability of occurrence of an abnormality notification is lowered (increasing availability), and the cause of the occurrence of the abnormality Reliable secondary battery device, processor, and monitoring can be reduced by reducing the difficulty of analysis (increasing maintainability) and reducing the probability of missing an abnormality (increasing detectability) A program and a vehicle can be provided.

  Furthermore, the main processor 20 detects that the sub processor 30 is not in the correct operation state by comparing the operation status number of the sub processor 30 with the operation state of the main processor 20. When an abnormality is detected, a secondary battery device, a processor, a monitoring program, and a vehicle with higher maintainability and higher detectability can be provided.

  Next, a secondary battery device, a processor, a monitoring program, and a vehicle according to a second embodiment will be described with reference to the drawings. In the following description, the same components as those in the first embodiment described above are denoted by the same reference numerals and description thereof is omitted.

  FIG. 7 schematically shows a configuration example of the secondary battery device according to the present embodiment. In the secondary battery device according to the present embodiment, a control command line connected between the upper control circuit 40 and the main processor 20 is also connected to the sub processor 30. Therefore, a control command transmitted from the upper control circuit 40 to the main processor 20 is also transmitted to the sub processor 30. Except for the above configuration, the secondary battery device according to the first embodiment is the same as the above-described first embodiment.

  In this embodiment, since the control command is transmitted from the upper control circuit 40 to the sub processor 30, the sub processor 30 can further monitor whether or not the main processor 20 is in a correct operation state.

  The sub processor 30 calculates the processing to be performed by the main processor 20 and the time required for the processing from the received control command, and calculates the current processing state of the main processor 20. When the main processor 20 receives the control command, the operation state transitions, but the timing of transition to the next operation state corresponds to the processing amount and is known at the design time. Therefore, in the design stage, the sub processor 30 can calculate the transition timing to the operation state corresponding to the control command in advance.

  When the sub processor 30 determines whether or not the main processor 20 is operating normally in the monitoring operation of the main processor 20 shown in FIG. 5 (step STA2), the sub processor 30 uses the operation status number as the status signal of the main processor 20. It is determined whether or not the process corresponding to the operation status number and the current processing state of the main processor 20 calculated from the control command match.

  For example, when the sub processor 30 calculates from the received control command that the processing state of the main processor 20 transitions from the processing A to the processing B within 100 msec, if the main processor 20 does not transition to the processing B after 150 msec at the latest, the main processor 20 Judge as abnormal.

  The sub processor 30 determines that the main processor 20 is operating normally when the processes match, and determines that the main processor 20 is abnormal when the processes do not match.

  As described above, the sub processor 30 compares the operation status number of the main processor 20 with the current processing (operation state) state of the main processor 20 to determine whether or not the main processor 20 is in the correct operation state. This can be detected by the sub processor 30.

  Thus, according to the secondary battery device, the processor, the monitoring program, and the vehicle according to the present embodiment, the same effect as that of the first embodiment described above can be obtained, and further maintainability and detectability can be obtained. Can be high.

  Next, a secondary battery device, a processor, a monitoring program, and a vehicle according to a third embodiment will be described with reference to the drawings.

  FIG. 8 schematically shows a configuration example of the secondary battery device according to the present embodiment. In the secondary battery device according to the present embodiment, a data communication interface connected between the main processor 20 and the upper control circuit 40 is also connected to the sub processor 30. Therefore, data communicated between the main processor 20 and the upper control circuit 40 is also transmitted to the sub processor 30. Except for the above configuration, the secondary battery device according to the first embodiment is the same as the above-described first embodiment.

  The sub processor 30 receives data output from the main processor 20 to the data communication interface, thereby further monitoring whether or not communication is correctly performed between the main processor 20 and the upper control circuit 40. be able to.

  When the sub processor 30 determines whether or not the main processor 20 is operating normally in the monitoring operation of the main processor 20 shown in FIG. 5 (step STA2), the sub processor 30 makes a certain period (for example, 1 second) from the main processor 20. Monitor whether there was any communication. The sub processor 30 determines that the main processor 20 is normal when there is communication from the main processor 20 within a certain period, and if the main processor 20 does not communicate within the certain period, the main processor 20 Judge as abnormal.

  Further, the sub processor 30 may monitor whether or not the communication content of the main processor 20 is correct, for example, whether or not undefined data, an address, a control command, and the like are included. In this case, the sub-processor 30 determines that the main processor 20 is normal when it does not include data, addresses, control commands, etc., for which the communication contents of the main processor 20 are not defined, and the communication contents of the main processor 20 are not defined. When data, address, control command, etc. are included, it is determined that the main processor 20 is abnormal.

  As described above, the sub-processor 30 can perform a hardware reset of the main processor 20 when determining that the main processor 20 is abnormal. Further, the sub-processor 30 resets the main processor 20 after hardware reset, and executes the hardware reset, the hardware reset factor and its value (communication presence / absence or communication content), and the hardware reset time, in the second memory M2. To record.

  In the secondary battery device according to the present embodiment, if the abnormality of the main processor continues even if the hardware reset is performed a plurality of times, the sub processor 30 uses the abnormality notification line to send the main processor to the upper control circuit 40. Notification that 20 is abnormal can be made. Furthermore, since the sub processor 30 is also connected to the data communication interface to the host control circuit 40, it is possible to notify that the main processor 20 is abnormal by using this data communication interface.

  As described above, whether or not correct communication is performed between the main processor 20 and the upper control circuit 40 by monitoring the communication between the main processor 20 and the upper control circuit 40 by the sub processor 30. Can be detected.

  As a result, according to the secondary battery device, the processor, the monitoring program, and the vehicle according to the present embodiment, the same effects as those of the first embodiment described above can be obtained, and the maintainability and the detectability can be increased. can do.

  Next, a secondary battery device, a processor, a monitoring program, and a vehicle according to a fourth embodiment will be described with reference to the drawings.

  FIG. 9 schematically shows a configuration example of the secondary battery device according to the present embodiment. In the secondary battery device according to the present embodiment, the measurement circuit control command / data communication interface connected between the main processor 20 and the battery voltage measurement circuit 10 is also connected to the sub processor 30, and the main processor A communication signal between 20 and the battery voltage measuring circuit 10 is also input to the sub processor 30.

  The sub-processor 30 receives a communication signal between the main processor 20 and the battery voltage measuring circuit 10 to determine whether or not correct communication is being performed between the main processor 20 and the battery voltage measuring circuit 10. Can be monitored.

  In the monitoring operation of the main processor 20 shown in FIG. 5, the sub processor 30 determines whether or not the main processor 20 is operating normally (step STA2), and the main processor 20 within a certain period (for example, 1 second). Whether or not communication has been performed between the battery 20 and the battery voltage measuring circuit 10 is monitored. The sub processor 30 determines that the main processor 20 is normal when there is communication from the main processor 20 within a certain period, and if the main processor 20 does not communicate within the certain period, the main processor 20 Judge as abnormal.

  Further, the sub processor 30 monitors whether or not the communication contents between the main processor 20 and the battery voltage measurement circuit 10 are correct, for example, whether or not undefined data and control commands are included. May be. In this case, the sub-processor 30 determines that the main processor 20 is normal when the communication contents between the main processor 20 and the battery voltage measurement circuit 10 do not include data, control commands, etc. that are not defined. When the communication contents of the processor 20 include undefined data, control commands, etc., it is determined that the main processor 20 is abnormal.

  As described above, the sub-processor 30 can perform a hardware reset of the main processor 20 when determining that the main processor 20 is abnormal. Further, the sub-processor 30 resets the main processor 20 after hardware reset, and executes the hardware reset, the hardware reset factor and its value (communication presence / absence or communication content), and the hardware reset time, in the second memory M2. To record.

  As described above, the sub processor 30 monitors communication between the main processor 20 and the host control circuit 40, so that correct communication is not performed between the main processor 20 and the battery voltage measuring circuit 10. This can be detected by the sub processor 30.

  As a result, according to the secondary battery device, the processor, the monitoring program, and the vehicle according to the present embodiment, the same effects as those of the first embodiment described above can be obtained, and the maintainability and the detectability can be increased. can do.

  The first to fourth embodiments can be combined. For example, in the secondary battery device according to the first embodiment, the sub processor 30 may be further connected to at least one of a control command line, a data communication interface, and a control command / data communication interface. The sub processor 30 receives the control command input to the main processor 20, the control command output from the main processor 20, the data output from the main processor 20, etc., thereby increasing the accuracy of detecting the abnormality of the main processor 20 This can increase the maintainability and detectability.

  In the plurality of embodiments, it goes without saying that the operations of the main processor and the sub processor may be realized by hardware or may be realized by software. When realized by software, a main processor, a sub processor, or a program that causes both the main processor and the sub processor to function may be installed as means for performing the operations described in the above embodiments.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

  WR, WL: Driving wheel, BT: Battery, M1: First memory, M2: Second memory, 10: Battery voltage measuring circuit, 20: Main processor (first processor), 21, 31: Instruction memory, 23, 33 ... Data memory, 25, 35 ... Program counter, 27, 37 ... Register, 29, 39 ... Arithmetic unit, 30 ... Sub processor (second processor), 40 ... Upper control circuit, 300 ... Battery management device, 400 ... Battery Module, 500 ... operation control unit, 600 ... motor, 1000 ... chassis.

Claims (20)

A battery including a plurality of secondary battery cells;
A voltage measuring circuit for measuring a voltage of the secondary battery cell;
A first processor that communicates with the voltage measurement circuit and the host control circuit to control charging and discharging of the battery and outputs a first status signal indicating its own operating state;
Receiving the first status signal, determining whether the first processor is operating correctly based on the first status signal, and determining that the first processor is not operating correctly; A secondary battery device comprising: a second processor capable of outputting a first reset signal for hardware resetting the first processor. The first processor includes an instruction memory that holds an instruction, and a register that holds an address of an instruction to be executed next.
The secondary battery device according to claim 1, wherein the first status signal includes a value of the register.   The secondary battery device according to claim 1, wherein the first status signal includes an operation status number assigned to each of the processes executed by the first processor.   4. The secondary battery device according to claim 1, wherein the second processor includes a determination unit that determines whether or not the first status signal has changed within a predetermined period. 5.   The second processor includes second recording means for recording the number of times the first processor is reset, and the number of times the first processor is reset when it is determined that the first processor is abnormal is greater than a specified value. In this case, the first control circuit is notified that the first processor is abnormal, and the first reset signal is output when the number of times the first processor is reset is less than a specified value. The secondary battery device according to any one of 4. The second processor outputs a second status signal indicating its operating state to the first processor;
The first processor receives the second status signal, determines whether the second processor is operating correctly based on the second status signal, and the second processor is not operating correctly. 6. The secondary battery device according to claim 1, wherein when the determination is made, a second reset signal for hardware resetting the second processor can be output. 7. The second processor includes an instruction memory that holds an instruction, and a register that holds an address of an instruction to be executed next.
The secondary battery device according to claim 6, wherein the second status signal includes a value of the register.   The secondary battery device according to claim 6 or 7, wherein the second status signal includes an operation status number assigned to each process executed by the second processor.   The first processor includes first recording means for recording the number of times the first processor is reset, and the number of times the second processor is reset when it is determined that the second processor is abnormal is less than a specified value. 7. If larger, notifies the upper control circuit that the second processor is abnormal, and outputs the second reset signal when the number of times the second processor is reset is less than or equal to a specified value. Item 9. The secondary battery device according to any one of Items 8. A communication interface used for communication between the voltage measurement circuit and the first processor and connected to the second processor;
The second processor monitors a communication state between the voltage measurement circuit and the first processor, and determines whether or not communication between the voltage measurement circuit and the first processor is correctly performed. The secondary battery device according to any one of claims 1 to 9, further comprising means for performing the operation. A second communication interface that is used for communication between the first processor and the higher-order control circuit and is also connected to the second processor;
The second processor monitors a communication state between the first processor and the upper control circuit, and determines whether or not communication between the first processor and the upper control circuit is correctly performed. The secondary battery device according to claim 1, further comprising: A second memory for storing a state of the first processor;
The second processor, when the first processor is hardware reset, records the hardware reset, the hardware reset factor, and the hardware reset time in the second memory. The secondary battery device according to any one of claims 1 to 11. A first memory for storing a state of the second processor;
The first processor, when the second processor is hardware reset, records the hardware reset, the cause of the hardware reset, and the time of the hardware reset in the first memory. The secondary battery device according to any one of claims 6 to 12. A secondary battery device according to any one of claims 1 to 13,
And an axle driven by electric power from the secondary battery device. First determination means for receiving a status signal and determining whether the status signal has changed within a predetermined period;
Second determination means for determining whether or not the number of reset times of outputting the reset signal is greater than a specified value when the first determination means determines that the status signal has not changed within a predetermined period;
A reset unit that outputs the reset signal when the second determination unit determines that the number of resets is less than a specified value;
Counting means for incrementing the number of resets after outputting the reset signal. First determination means for receiving a status signal and a control command, and determining whether or not the processing corresponding to the control command and the processing corresponding to the status signal match;
When the first determination means determines that the process corresponding to the control command and the process corresponding to the status signal do not match, it determines whether or not the number of resets that output the reset signal is greater than a specified value. A second determination means;
A reset unit that outputs the reset signal when the second determination unit determines that the number of resets is less than a specified value;
Counting means for incrementing the number of resets after outputting the reset signal.   The processor according to claim 15 or 16, further comprising an abnormality notification unit that outputs an abnormality notification signal when the second determination unit determines that the number of resets is greater than a specified value. First determination means for receiving a status signal and determining whether the status signal has changed within a predetermined period;
Second determination means for determining whether or not the number of reset times of outputting the reset signal is greater than a specified value when the first determination means determines that the status signal has not changed within a predetermined period;
A reset unit that outputs the reset signal when the second determination unit determines that the number of resets is less than a specified value;
A monitoring program for causing a computer to function as counting means for incrementing the number of resets after outputting the reset signal. First determination means for receiving a status signal and a control command, and determining whether a process corresponding to the control command and a process corresponding to the status signal match;
When the first determination unit determines that the process corresponding to the control command and the process corresponding to the status signal do not match, it determines whether or not the number of resets that output the reset signal is greater than a specified value. A second determination means;
A reset unit that outputs the reset signal when the second determination unit determines that the number of resets is less than a specified value;
A monitoring program for causing a computer to function as counting means for incrementing the number of resets after outputting the reset signal.   And causing the computer to further function as an abnormality notification unit that outputs an abnormality notification signal for notifying the abnormality of the first processor when the second determination unit determines that the number of resets is greater than a predetermined value. The monitoring program according to claim 18 or claim.

Images