Serial communication safety controller
Serial communication verification and safety control is disclosed. A multi-part system such as a battery management system can include distributed or subsidiary components for determining status of various parts of the system with the components in serial or point-to-point communication with a collective main controller. A safety controller can be implemented to passively be coupled to the serial or point-to-point communication between the main controller and the subsidiary units. The safety controller can monitor and verify the communication between the main controller and the subsidiary units and send a safety command or verification indicator in another line of communication separate from the communication bus between the main controller and the subsidiary units.
1. A communication apparatus comprising:
a main controller;
a subsidiary unit connected to the main controller through a data bus, wherein the data bus is a serial peripheral interface (SPI), and wherein the main controller is in communication with the subsidiary unit through the data bus using a SPI protocol; and
a safety controller connected to the data bus and configured to:
receive data and/or commands communicated from the main controller to the subsidiary unit through a first master-out-slave-in (MOST) pin of the safety controller;
receive data and/or commands communicated from the subsidiary unit to the main controller through a second MOSI pin of the safety controller;
monitor one or more communications between the main controller and the subsidiary unit through the data bus;
evaluate one or more communications between the main controller and the subsidiary unit through the data bus for evidence of a fault condition; and
output a safety signal that is based at least in part on the results of the evaluating to an output connection separate from the data bus.
2. The communication apparatus of claim 1 further comprising safety action circuitry, wherein the main controller is configured to output a main action signal, and wherein the safety action circuitry is configured to perform a safety action based at least in part on the safety signal output from the safety controller.
3. The communication apparatus of claim 1 further comprising a plurality of the subsidiary units, each of which is connected to the main controller through the data bus.
4. The communication apparatus of claim 1 , wherein the safety controller is configured to evaluate communications between the main controller and the subsidiary unit by comparing expected data and/or commands with actual data and/or commands communicated between the main controller and the subsidiary unit through the data bus.
5. A method of detecting fault conditions in a circuit, the method comprising:
receiving, at a first master-out-slave-in (MOSI) pin, data and/or commands communicated from a main controller to at least a first subsidiary unit through a data bus, wherein the data bus is a serial peripheral interface (SPI) port, and wherein the main controller and the first subsidiary unit are in communication using a SPI protocol;
receiving, at a second MOSI pin, data communicated from the first subsidiary unit to the main controller through the data bus;
comparing the received data and/or commands from the main controller to the first subsidiary unit with expected data and/or commands from the main controller to the subsidiary unit;
comparing the received data from the first subsidiary unit to the main controller with expected data from the first subsidiary unit to the main controller; and
outputting a safety signal through a connection separate from the data bus.
6. The method of claim 5 further comprising:
verifying command issuance from the main controller to the first subsidiary unit; and
evaluating data values communicated from the first subsidiary unit to the main controller.
7. The method of claim 5 further comprising:
receiving data and/or commands communicated from the main controller to a second subsidiary unit;
receiving data communicated from the second subsidiary unit to the main controller; comparing the received data and/or commands from the main controller to the second subsidiary unit with expected data and/or commands from the main controller to the second subsidiary unit; comparing data communicated from the second subsidiary unit to the main controller with expected data from the second subsidiary unit to the main controller.
8. The method of claim 5 , wherein the first subsidiary unit is coupled to a battery module, and wherein the data communicated from the subsidiary unit to the main controller comprises battery status data of the battery module.