How to Redefine Electric Vehicle Battery Management System

　　As electrified powertrains become increasingly complex, the number of functions that the BMS needs to perform increases, placing an unprecedented burden on it.

　　Whether it is a simple charge controller or a complex control unit, the demand for battery management systems (BMS) is growing rapidly, especially in the field of electric vehicles. In addition to traditional charge status monitoring, BMS systems must also comply with increasingly stringent safety regulations, focusing on control and standby functions, thermal management and encryption algorithms for protecting OEM battery cells. In the future, even the components and functions of the vehicle control unit (VCU) will be associated with the BMS.

　　In the future, BMS will play an important role in the field of electric vehicles. However, the various sub-functions of BMS are often customized by OEMs and vary greatly depending on the system configuration. Therefore, it is impossible to develop a complete list of BMS requirements that apply to every electric vehicle manufacturer. However, there is no doubt that the scope of tasks handled by battery management systems is constantly expanding. The most common requirements for BMS include safety requirements, control and monitoring functions, standby functions, thermal management, encryption algorithms, and reserved expandable interfaces to add new functions.

　　Security Requirements

　　Within the scope of the ISO26262 safety standard, specific electrical and electronic systems such as BMS will be classified into high safety categories from ASILC to ASILD. The corresponding fault detection rate is at least 97% to 99%. The most dangerous sources of faults in battery systems are: undetected high voltage leakage from the vehicle chassis due to cable wear or accidents; various causes of high voltage battery fire or explosion: such as overcharging the battery (such as on the public grid or due to power outage recovery), premature battery aging (such as explosive gas leakage), liquid ingress and short circuit (such as caused by rain), abuse (such as improper maintenance) and thermal management errors (such as cooling failure).

　　In terms of safety, the main switch (main relay) plays an important role in avoiding accidents related to high voltages by ensuring that the BMS electronic system can respond adequately to faults. In the event of a fault, the BMS module disconnects the switch within an appropriate fault response time (e.g., within 10ms). Non-critical fail-safe conditions are usually characterized by the following: if the BMS microcontroller ( MCU ) fails, or even in the event of a complete failure of the controller logic, independent external safety elements (e.g., window watchdogs) ensure that the main switch relay reliably opens the two high-voltage contacts of the inverter (positive/negative). Other safety functions are also integrated into the BMS system, including leakage current monitoring and main switch relay monitoring.

　　Control and monitoring functions:

　　Other BMS functions include monitoring, care and maintenance of the expensive high-voltage batteries in electric vehicles. The BMS control and monitoring functions are derived from the electronic balancing unit installed in the battery pack. The balancing within each battery group (battery slave pack) is managed while accurately sensing the voltage of each single cell. The balancing chip can usually manage groups of up to 12 single cells. The relevant number of battery groups connected in series can generate high intermediate circuit voltages of up to hundreds of volts for inverter control, which is required for the inverter electric drive of electric vehicles. The measurement of the total current of all high-voltage batteries at the master switch and the precise and synchronous single-cell monitoring of the individual single-cell voltages of the slave chips allow the BMS to evaluate battery parameters such as charge state and health state using specific algorithms (e.g. based on Matlab Simulink models of the battery chemistry). The BMS is usually not installed in the immediate vicinity of the high-voltage batteries, but is usually connected to the electronic balancing slaves via a redundant galvanically decoupled bus system (such as CAN or other suitable differential buses). It is powered by the vehicle voltage (12 V battery) and can therefore be used in conjunction with existing control unit groups via existing network architectures without further galvanic decoupling measures. Finally, it also improves safety because it enables the BMS to ensure proper functionality and safely disconnect the main switch in the event of a mechanical or chemical defect in the high-voltage battery.

　　As battery-specific chemical/electrical algorithms become increasingly complex, it is expected that BMS will require microcontrollers ( MCUs ) such as AURIX with 2.5MB to 4MB flash memory and powerful multi-core processor architecture. This combination ensures sufficient memory for comprehensive calibration parameters and provides sufficient computing power.

　　Standby function:

　　Electric vehicle manufacturers tend to monitor the charge status of the battery pack and individual cells regularly. Therefore, the BMS must provide a dedicated low-power standby function that requires only a very small MCU power consumption in the μA level and can quickly wake up the system with the help of a timer, for example, to record specific single-cell data through the balancing chip in BMS active mode. In order to realize the cyclic wake-up of the BMS with the help of the wake-up timer, there are several models of AURIX microcontrollers that integrate an 8-bit single-chip standby MCU in an independent low-power domain (on the same chip).

　　Thermal Management:

　　For design reasons, high voltage battery modules often include active thermal management, such as heaters for winter and cooling systems for summer. These can be achieved by air cooling or water cooling. In both cases, the BMS is used to sense relevant temperature data of the battery and actively execute and control the heat sink (for example, fan motor or water pump). AURIX microcontrollers have built-in ADC samplers and various timer functions, which are capable of this task.

　　Encryption algorithm:

　　The original OEM batteries of electric vehicles should be protected from unauthorized third-party repairs. Replacing individual cells in a battery group or assembling individual components removed from used batteries can mask safety-related faults or even signs of explosion or fire hazards. To ensure that car manufacturers confirm the normality of battery warranty, appropriate protection modules such as Infineon's Origa chip should be installed directly in each single battery group. At the same time, the logical protection of individual battery data formed by integrating a hardware security module (HSM) in the MCU can be used as a low-cost alternative.

　　In this case, the HSM in AURIX can effectively detect the above parameters of the battery, since the battery can control these parameters and store them in a secure data memory protected by the HSM. In terms of service life, for example, the state of each single cell is stored in this way as an AES encrypted archive, so that unauthorized replacement of individual cells can be detected based on this data. We can compare a typical battery group profile to a fingerprint, whose uniqueness will facilitate the detection of groups that have been replaced. Another field of application of cryptographic algorithms is responsible for monitoring and comparing the charge calculated by an external supplier with the charge actually measured by the BMS.　　Future tasks:

　　Depending on the specific electric topology chosen by the manufacturer for the electric vehicle, there is now an inverter control unit for the high-level drive strategy and a separate vehicle control unit, or VCU. There is also the entire torque control system, which also has other advanced functions such as intelligent power managers. The power processor (through the integrated navigation unit) includes driving route planning and can optimize the entire power system according to the specific route, thus helping to increase the driving range of the battery.

　　Independent OEMs are now considering relocating all components of the previous VCU to the BMS and inverter control unit, thereby reducing the total electronic component costs of the electric vehicle. The prerequisites for removing the VCU are ultimately determined by the microcontroller-specific parameters that the BMS can handle, such as the amount and performance of Flash and SRAM, the independence of the individual control unit functions in terms of real-time capabilities, and the seamless integration of safety-related software functions (from QM to ASIL D) on a shared, scalable microcontroller architecture. For this specific case, Infineon has launched controller hardware based on the AURIX multicore architecture of a three-core processor to integrate all of the above-mentioned required functions in future BMS customer applications.