Battery controller with multi-level redundancy
A battery management system and method for enabling a battery system to overcome single point failure in its control system and to deliver electrical charges steadily through redundancy implementation. The battery management system has redundant hardware devices, including multiple microcontrollers (MCU) connected to multiple controller area (CAN) network buses. An active MCU periodically checks health information from a standby MCU.
1 . A fault tolerant battery management system with a plurality of battery cells, comprising:
a plurality of application front end (AFE) devices, each AFE device connected to a plurality of battery cells, a first AFE device in the plurality of AFE devices being in active mode and a second AFE device in the plurality of AFE devices being in standby mode;
a plurality of gauges, each gauge connected to both the first AFE device and the second AFE device, a first gauge in the plurality of gauges being in active mode and a second gauge in the plurality of gauges being in standby mode;
a plurality of micro control units (MCUs), each MCU connected to both the first gauge and the second gauge, a first MCU of the plurality of MCUs being in active mode and a second MCU of the plurality of MCUs being in standby mode, both MCUs are connected to a communication bus and each MCU is assigned an identification (ID) number,
wherein
when the fault tolerant battery management system boots up, each MCU is configured to go through a self-check and a healthy MCU with the lowest ID number is assigned as active MCU while a second healthy MCU is assigned as standby MCU, and the standby MCU periodically requests data from the active MCU.
2 . The fault tolerant battery management system of claim 1 , further comprising a plurality of controller area network (CAN) buses to which the plurality of MCUs are connected.
3 . The fault tolerant battery management system of claim 2 , wherein a first CAN bus is designated as active while a second CAN bus is designated as standby.
4 . The fault tolerant battery management system of claim 3 , wherein communication between the plurality of MCUs is done over the first CAN bus and when the first CAN bus fails, the communication between the plurality of MCUs is switched to the second CAN bus.
5 . The fault tolerant battery management system of claim 1 , each MCU further comprising a flash memory for storing state of health information of the MCU.
6 . The fault tolerant battery management system of claim 5 , wherein when a MCU fails self-check, failure of the self-check is recorded in the flash memory.
7 . The fault tolerant battery management system of claim 1 , wherein when neither of the plurality of MCUs can communicate with an external controller, the fault tolerant battery management system stops normal operation.
8 . The fault tolerant battery management system of claim 1 , wherein the data periodically requested by the standby MCU is run-time data from the active MCU, and if the standby MCU fails to receive the run-time data from the active MCU, an alarm is sent to an external controller.
9 . The fault tolerant battery management system of claim 1 , wherein the active MCU periodically requests health data from the standby MCU.
10 . The fault tolerant battery management system of claim 1 , wherein the active MCU periodically broadcasts a message onto a CAN bus to indicate the active MCU is healthy.
11 . A fault tolerant battery management system with a plurality of battery cells, comprising:
a plurality of application front end (AFE) devices, each AFE device connected to a plurality of battery cells, a first AFE device in the plurality of AFE devices being in active mode and a second AFE device in the plurality of AFE devices being in standby mode;
a plurality of gauges, each gauge connected to both the first AFE device and the second AFE device, a first gauge in the plurality of gauges being in active mode and a second gauge in the plurality of gauges being in standby mode;
a plurality of micro control units (MCUs), each MCU connected to both the first gauge and the second gauge, a first MCU of the plurality of MCUs being in active mode and a second MCU of the plurality of MCUs being in standby mode, both MCUs are connected to a communication bus and each MCU is assigned an identification (ID) number; and
a plurality of controller area network (CAN) buses to which the plurality of MCUs are connected,
wherein
each MCU is pre-assigned a CAN bus identification (ID) and each MCU knows its hierarchy compared with other MCU, and if an MCU realizes it does not have a lower CAN bus ID, this MCU sets itself as a standby MCU.
12 . The fault tolerant battery management system of claim 11 , wherein an MCU with a higher CAN bus ID sets itself as an active MCU and sends a message to an external controller.
13 . The fault tolerant battery management system of claim 12 , wherein the active MCU continues to send an “alive” message to the external controller and the standby MCU does not send this “alive” message.