DE102011088359A1 - Method for monitoring electrical energy storage device e.g. traction battery, involves transmitting request for down-regulating the current in network, to control unit based on detected predetermined state of storage device - Google Patents

Abstract

The present invention relates to a method for monitoring at least one electrical energy storage device, a battery with a module for monitoring and a motor vehicle with a corresponding battery, which are used in particular to prevent damage to vehicle components, which causes an opening of an isolation relay under high load become.
For this purpose, a method for monitoring at least one electrical energy storage, which supplies a network with electricity proposed. At least one function for detecting at least one predetermined state is provided by a security system. It is further contemplated that in the last stage of safe operation of the at least one electrical energy store upon detection of a predetermined condition, a request to shut down the power in the network is sent to a control unit and a safe state monitor is activated. Subsequently, a relay for the separation of the at least one electrical energy storage is opened by the network.

Description

The present invention relates to a method for monitoring at least one electrical energy store, a battery having a module for monitoring at least one electrical energy store and a motor vehicle with a corresponding battery, which are used in particular to prevent damage to vehicle components, which by opening a disconnect relay be caused under high load.

State of the art

High voltage battery systems are known for use in electric or hybrid vehicles. The battery system must meet various safety criteria or safety requirements with regard to functional safety (for example with regard to the ISO 26262 defined automotive safety integrity level ASIL) meet. For safe operation of the battery, therefore, a battery management (BMS) is present, which monitors the battery cells and sends the information to the vehicle system and / or charger.

For the protection of electronic systems to achieve the necessary security levels (ASIL ratings), different methods are still known. These include the so-called 3-level concept or the monitoring by means of a redundant monitoring device.

These measures generally show a fail-safe behavior (fail-safe behavior) that assumes a safe state in the event of a fault.

The safe state of the battery is determined by the disconnection from the electrical system by a shutdown relay. By switching off so (critical) charging (overcharging) or unloading (by consumers such as the electric drive) can be prevented in a safety-critical error case.

When implementing such a monitoring concept, the safety-critical functions, for example the monitoring of the safety-critical charge / discharge limits, are shifted to specially secured functions or even to a redundant monitoring instance. In a 3-level concept, this is referred to as level-2.

The less critical functions, such as charging control for maximum life or battery capacity, however, are implemented in a simple design and referred to as level-1.

These functions may only operate the battery within (below) the range defined and monitored by the safety limits.

It is also state of the art that, in the event of a violation of the safety limits, this monitoring directly and unconditionally sets the safe state by opening the switch-off relay independently of the remaining control functions.

In conventional systems, there is the disadvantage that opening the relay under high load (high current) very quickly (after a few times) leads to permanent damage to the relay, for example by burning or fusing the contacts.

Disclosure of the invention

A particular advantage of the invention is that when using the invention, the switch-off relay is not necessarily opened under a high load in case of violation of safety limits. This is achieved by inventively proposing a method for monitoring at least one electrical energy store which supplies a grid with energy, in particular electricity. The at least one electrical energy store is preferably a battery which comprises at least one electrochemical cell, preferably a multiplicity of electrochemical cells. A preferred embodiment provides that the electrochemical cells are lithium-ion battery cells. In a preferred embodiment, it is provided that the at least one electrical energy store is a traction battery of a vehicle. In the method according to the invention, predetermined parameters, preferably safety-critical parameters, are monitored by functions of a safety system in order to detect predetermined states. When operating the at least one electrical energy storage different security levels are distinguished. The individual security levels, in particular the last stage of the safe operation of the at least one electrical energy store, are defined by a security error threshold or security limit. In a preferred embodiment, it is provided that the security levels correspond to the levels of a monitoring system according to the E-gas monitoring concept (E-gas: electronic accelerator pedal). The e-gas monitoring concept is for example in Schäuffele, Jörg, Thomas Zurawka: Automotive Software Engineering, Vieweg Verlag, Wiesbaden 2004 described. If at least one of the predetermined states is detected in the last stage of the safe operation of the at least one electrical energy store According to the invention, a shutdown request is sent to a control unit, which causes the control unit to shut down the power in the network. The predetermined state, for example, consist in that by a parameter such. B. the temperature reaches a safety limit is exceeded or fallen below. At the same time, monitoring of a safe state of the at least one electrical energy store is activated. In a preferred embodiment of the invention, it is provided that, for a defined subset of the safety functions, the safe state is defined by a de-energized state of the at least one electrical energy store, that is, by I = 0. After the current has dropped to a predetermined value, a relay is opened to disconnect the at least one electrical energy store from the grid. The default value is set so that it is possible to open the relay at this current value without damaging the relay. By lowering the current to the preset value before opening the relay, the relay can be opened without being damaged.

A preferred embodiment provides that the request to shut down the power within the level-1 of the E-gas monitoring concept is sent. Preferably, such a shutdown request is sent from the monitoring system to the control functions of a BMS.

In a preferred embodiment of the invention it is provided that the power is shut down by a command to a vehicle management.

In a further preferred embodiment, it is provided that the relay is opened after a predetermined time, calculated from the shutdown request, regardless of whether the predetermined reduced current value has been reached in the network. This is provided in particular because in such a case it must be assumed that the functions in level-1 of the e-gas monitoring concept are not functioning correctly. For example, the communication between the monitoring system and BMS or vehicle management could be disturbed so that the shutdown request is not received by the BMS or the vehicle management. Preferably, in this case, the relay is opened by the monitoring system within level-2 of the E-gas monitoring concept. The level-2 is characterized by the fact that the level-2 monitoring functions are specifically secured or that level-2 monitoring functions are performed by redundant monitoring instances.

A further preferred embodiment provides that the de-energized state of the at least one electrical energy store is monitored by two redundant current sensors, which are arranged between the at least one electrical energy store and the relay.

In another preferred embodiment, it is provided that the relay is opened by activating a redundant shutdown path. This is especially provided if the shutdown in level-2 was not successfully completed. In particular, it is provided that a watchdog software or hardware, in particular a CPU watchdog module, is activated. A preferred embodiment provides that the redundant shutdown path in level-3 of the e-gas monitoring concept is activated.

Another aspect of the invention relates to a battery which is combined with a module for monitoring the battery, wherein the module is arranged such that a monitoring method is executable, wherein the battery provides power to a network and wherein by a security system at least one function for Detection of at least one predetermined state is provided, and in the last stage of the safe operation of the battery upon detection of a predetermined state sends a request to shut down the power in the network to a control unit and a safe state monitoring is activated and then a relay for disconnection the battery is opened by the network. The battery is preferably a lithium-ion battery or the battery comprises electrochemical cells which are designed as lithium-ion battery cells.

Another aspect of the invention relates to a motor vehicle having an electric drive motor for driving the motor vehicle and a battery connected or connectable to the electric drive motor according to the invention aspect described in the preceding paragraph. However, the battery is not limited to such use, but may be used in other electrical systems.

The method according to the invention makes it possible to implement component protection as far as possible, even in the event of a security breach. This is achieved by the current does not exceed a certain value when opening the relay.

This is achieved by a graded error response of the monitoring functions. Furthermore, it is possible that other components, such as the charger or the E-machine control, are protected by a warning.

Furthermore, at the same time negative consequences of a sudden battery drop to the entire vehicle, such as by torque peaks, reduced.

The basic prerequisite for the graded fault reaction behavior of the safety functions is that the safe state of the system can be determined with sufficient certainty (integrity).

This is achieved by defining, as the primary safe state, "battery current I = 0 A", which is to be set by opening the relay. This state can be reliably detected by the monitoring, for example, by two redundant current sensors.

Another possibility is to reliably detect the state of the relay by means of suitable signals, for example via auxiliary contacts.

Since battery current I is already detected for battery management and the safety system, however, the first solution results in only minor, possibly even no, additional expenditure.

• 1. Warnung,
• 2. Stromreduktion, etc.

In this case, the method according to the invention should not be confused with methods which, for example, carry out a stepped reaction, for example at different voltage thresholds of the cells, for example via the steps

• 1. Warning,
• 2. Power reduction, etc.

The monitoring referred to here represents the last stage of safe operation in this consideration. Further stages "below" the safety error threshold are therefore conceivable and have no influence on the function described here.

Advantageous developments of the invention are specified in the subclaims and described in the description.

drawings

Embodiments of the invention will be explained in more detail with reference to the drawings and the description below. Show it:

1 a conventional monitoring system for a transaction battery and

2 an exemplary monitoring system according to the invention for a transaction battery.

Embodiments of the invention

In the 1 is a conventional monitoring system 100 for a high-voltage battery 102 shown what a BMS 104 and a disconnect relay 106 includes. The high-voltage battery 102 supplies a network 108 of a vehicle 110 with energy (electricity). The high-voltage battery 102 is from the BMS 104 controlled.

Furthermore, the BMS communicates 104 via a data interface 112 , For example, a CAN interface (CAN = Controller Area Network), with other components, such as a charger or a consumer in the form of an electric drive, the vehicle 110 , The data interface 112 is used, for example, by the BMS 104 Signals to other components of the vehicle 110 to send. In particular, information about the operating behavior of the components, such as the maximum allowable removal or charging current or shutdown requests are sent.

Used in monitoring the high-voltage battery 102 a violation of a safety limit is detected, the disconnect relay 106 through the BMS 104 immediately opened, which leads to the disadvantages described.

The following is intended to use the 2 For example, the invention will be described in greater detail with reference to an embodiment, but the invention is not limited to this embodiment, but includes all solutions as long as it realizes only all features defined in an independent claim. In particular, alternative methods for monitoring the safe state can be used.

One possible realization is in 2 shown. In addition to the components of a conventional monitoring system (corresponding components are provided with the same reference numeral), the exemplary monitoring system according to the invention comprises 200 two current sensors 202 . 204 , The BMS 104 monitors the current sensors 202 . 204 , This redundant monitoring makes it possible to reliably determine whether the safe state of battery current I = 0 A has been reached or maintained.

The monitoring of the high-voltage battery 102 and the opening of the isolating relay 106 takes place in several stages at different levels of a three-level monitoring system according to the e-gas monitoring concept as follows:

Step 1:

When a safety-critical error has been detected, the monitoring initially requires a shutdown request to the control functions (level 1) of the BMS 104 Posted. At the same time a "zero current monitoring" is activated.

If the cause of the safety-critical error only slightly or not affect the operation of level-1 (for example, an external sensor error), there is a possibility that the BMS 104 The power targeted, for example, downshifts by request to the vehicle management. Subsequently, the isolation relay 106 be opened without problems.

If this happens within a specified maximum period of time after the request, no shutdown is triggered by the monitoring function.

However, the zero current condition will continue to be continuously and permanently monitored.

Level 2:

If the level-1 does not react within the maximum permissible period of time (eg there is a level-1 malfunction) or at some point during the shutdown the current increases again, then level-2 is activated. In this case, then the isolation relay 106 immediately opened from monitoring.

Level 3:

Since fail-safe systems, in particular with a 3-level concept, typically have two redundant shutdown paths for monitoring, a third stage can be implemented. This level 3 is optional and is not necessarily realized in other embodiments.

So even if level 2 does not work, the redundant switch-off path (for example, by specific activation of a CPU watchdog block or the like) is also activated.

The monitoring further includes a configurable evaluation, by which a fault different error responses are assigned. In particular, it is envisaged that errors that affect the current sensors 202 . 204 and / or to the signal processing of the current sensors 202 . 204 refer to be detected. In the case of such a current sensor or processing error, the stage 2 (optionally also the stage 3) is activated immediately and unconditionally, since the safe state can no longer be reliably detected. In the same way, the errors are excluded from this stepped reaction, for which the safe state is not synonymous with the "zero-current condition". This could be, for example, adjusting the absence of voltage of the component (s) of the vehicle 110 in an accident of the vehicle 110 be.

The invention is not limited in its embodiment to the above-mentioned preferred embodiments. Rather, a number of variants is conceivable, which makes use of the inventive method, the battery according to the invention and the motor vehicle according to the invention even with fundamentally different types of use.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited non-patent literature

• ISO 26262 [0002]
• Schäuffele, Jörg, Thomas Zurawka: Automotive Software Engineering, Vieweg Verlag, Wiesbaden 2004 [0011]

Claims (10)

A method for monitoring at least one electrical energy storage device, wherein the at least one electrical energy store supplies power to a network and wherein at least one function for detecting at least one predetermined state is provided by a multiple-stage safety system, characterized in that in the last stage of safe operation of the at least one electrical energy store upon detection of a predetermined state, a request to shut down the current in the network is sent to a control unit and a safe state monitor is activated and then a relay ( 106 ) is opened to separate the at least one electrical energy storage device from the network. The method of claim 1, wherein the safe state is defined by a de-energized state of the at least one electrical energy store. Method according to claim 1 or 2, wherein the relay ( 106 ) is opened after a presettable value of the current has been reached. Method according to one of the preceding claims, wherein the request to down-regulate the current in the level-1 of a monitoring system according to the E-gas monitoring concept is sent. Method according to one of the preceding claims, wherein after expiration of a predetermined time the relay ( 106 ) is opened in any case. Method according to claim 5, wherein the opening of the relay ( 106 ) is caused by the level-2 of the monitoring system according to the E-gas monitoring concept. Method according to one of the preceding claims, wherein the safe state by two redundant current sensors ( 202 . 204 ) is monitored. Method according to one of the preceding claims, wherein the relay ( 106 ) is opened by activating a redundant shutdown path in level-3 of the monitoring system according to the E-gas monitoring concept. Battery which is combined with a module for monitoring the battery, wherein the module is arranged such that a monitoring method according to one of claims 1 to 8 executable. Motor vehicle with an electric drive motor for driving the motor vehicle and a battery connected or connectable to the electric drive motor according to claim 9.

Images