How to Redefine Electric Vehicle Battery Management System (BMS)?

　　Whether it is a simple charge controller or a complex control unit, the demand for battery management systems (BMS) is growing rapidly, especially in the field of electric vehicles. In addition to traditional charge status monitoring, BMS systems must also comply with increasingly stringent safety regulations, focusing on control and standby functions, thermal management and encryption algorithms for protecting OEM battery cells. In the future, even the components and functions of the vehicle control unit (VCU) will be associated with the BMS.

　　
Figure 1. Electric vehicle battery management system (BMS) with all relevant components

　　In the future, BMS will play an important role in the field of electric vehicles. However, the various sub-functions of BMS are often customized by OEMs and vary greatly depending on the system configuration. Therefore, it is impossible to develop a complete list of BMS requirements that apply to every electric vehicle manufacturer. However, there is no doubt that the scope of tasks handled by battery management systems is constantly expanding. The most common requirements for BMS include safety requirements, control and monitoring functions, standby functions, thermal management, encryption algorithms, and reserved expandable interfaces to add new functions.

　　Security Requirements

　　Within the scope of the ISO 26262 safety standard, specific electrical and electronic systems such as BMS will be classified in high safety categories from ASIL C to ASIL D. The corresponding fault detection rate is at least 97% to 99%. The most dangerous sources of failure in battery systems are: undetected high voltage leakage from the vehicle chassis due to cable wear or accidents; various causes of high voltage battery fire or explosion: such as overcharging the battery (for example, on the public grid or due to power outage restoration), premature battery aging (such as explosive gas leaks), liquid ingress and short circuits (for example, caused by rain), abuse (such as improper maintenance) and thermal management errors (such as cooling failures).

　　In terms of safety, the main switch (main relay) plays an important role in avoiding accidents related to high voltages by ensuring that the BMS electronic system can react adequately to faults. In the event of a fault, the BMS module disconnects the switch within an appropriate fault reaction time (e.g. within 10ms). Non-critical fail-safe conditions are usually characterized by the fact that if the BMS microcontroller (MCU) fails, or even in the event of a complete failure of the controller logic, independent external safety elements (e.g. window watchdogs) ensure that the main switch relay reliably opens the two high-voltage contacts of the inverter (positive/negative). Other safety functions are also integrated into the BMS system, including leakage current monitoring and main switch relay monitoring.

　　Control and monitoring functions :

　　Other BMS functions include monitoring, care and maintenance of the expensive high-voltage batteries in electric vehicles. The BMS control and monitoring functions are derived from the electronic balancing unit installed in the battery pack. It manages the balance within each battery slave pack while accurately sensing the voltage of each single cell. The balancing chip can usually manage groups of up to 12 single cells. The series connection of a relevant number of battery groups can generate high intermediate circuit voltages of up to hundreds of volts for inverter control, which is required for the inverter electric drive of electric vehicles.

　　The measurement of the total current of all high-voltage batteries at the master switch and the precise and synchronous monitoring of the individual cell voltages by the slave chips allow the BMS to evaluate battery parameters such as the state of charge and state of health using specific algorithms (e.g. based on a Matlab Simulink model of the battery chemistry). The BMS is usually not installed very close to the high-voltage batteries, but is usually connected to the electronic balancing slaves via a redundant galvanically decoupled bus system (such as CAN or other suitable differential buses). It is powered by the vehicle voltage (12 V battery) and can therefore be used in conjunction with existing control unit groups via existing network architectures without the need for further galvanic decoupling measures. Finally, it also improves safety, as it allows the BMS to ensure normal functionality and safely disconnect the main switch in the event of a mechanical or chemical defect in the high-voltage battery.

　　As battery-specific chemical/electrical algorithms become increasingly complex, it is expected that BMS will require microcontrollers (MCUs) such as AURIX that have 2.5MB to 4MB of flash memory and a powerful multi-core processor architecture. This combination ensures sufficient memory for comprehensive calibration parameters and provides sufficient computing power (Figure 2).

　　
Figure 2 Block diagram of the AURIX microcontroller with TriCore multicore architecture and 2.45MB to 4MB flash memory

　　Standby function :

　　Electric vehicle manufacturers tend to monitor the charge status of the battery pack and individual cells regularly. Therefore, the BMS must provide a dedicated low-power standby function that requires only a very small MCU power consumption in the µA level and can quickly wake up the system with the help of a timer, for example, to record specific single-cell data through the balancing chip in BMS active mode. To implement the cyclic wake-up of the BMS with the help of a wake-up timer, several versions of the AURIX microcontroller integrate an 8-bit single-chip standby MCU in a separate low-power domain (on the same chip).

　　Thermal Management :

　　For design reasons, high voltage battery modules often include active thermal management, such as heaters for winter and cooling systems for summer. These can be achieved by air cooling or water cooling. In both cases, the BMS is used to sense relevant temperature data of the battery and actively actuate and control the heat sink (for example, fan motor or water pump). AURIX microcontrollers have built-in ADC samplers and various timer functions that are up to the task.

　　Encryption algorithm :

　　The original OEM batteries of electric vehicles should be protected from unauthorized third-party repairs. Replacing individual cells in a battery group or assembling individual components removed from used batteries can mask safety-related faults or even signs of explosion or fire hazards. To ensure that car manufacturers confirm the normality of the battery warranty, appropriate protection modules such as Infineon's Origa chip should be installed directly in each single battery group. At the same time, the logical protection of individual battery data formed by integrating a hardware security module (HSM) in the MCU can be used as a low-cost alternative.

　　In this case, the HSM in AURIX can effectively detect the above parameters of the battery, since the battery can control these parameters and store them in a secure data memory protected by the HSM. In terms of service life, for example, the state of each single cell is stored in this way as an AES encrypted archive, so that unauthorized replacement of each single cell can be detected based on this data. We can compare a typical battery group profile to a fingerprint, whose uniqueness will facilitate the detection of replaced groups. Another field of application of cryptographic algorithms is responsible for monitoring and comparing the charge calculated by an external supplier with the charge actually measured by the BMS.

　　Future tasks :

　　Depending on the specific electric topology chosen by the manufacturer for the electric vehicle, there is now an inverter control unit for the high-level drive strategy and a separate vehicle control unit, or VCU. There is also the entire torque control system, which also has other advanced functions such as intelligent power managers. The power processor (through the integrated navigation unit) includes driving route planning and can optimize the entire power system according to the specific route, thus helping to increase the driving range of the battery.

　　Independent OEMs are now considering relocating all components of the previous VCU to the BMS and inverter control unit, thereby reducing the total electronic component costs of the electric vehicle. The prerequisites for removing the VCU are ultimately determined by the microcontroller-specific parameters that the BMS can handle, such as the amount and performance of Flash and SRAM, the independence of the individual control unit functions in terms of real-time capabilities and the seamless integration of safety-related software functions (from QM to ASIL D) on a shared, scalable microcontroller architecture. For this specific case, Infineon has launched controller hardware based on the AURIX multicore architecture with a three-core processor to integrate all of the above-mentioned required functions in future BMS customer applications.

　　By Klaus Scheibert and Björn Steurich, Infineon Technologies AG

　　Klaus Scheibert is Head of Powertrain Electronics at Infineon Technologies AG, Automotive Division, Neubiberg, Germany. He is responsible for analyzing future system requirements and realizing the potential of 32-bit TriCore-based powertrain microcontroller IP soft/hard cores.

　　Björn Steurich is Senior System Manager in the Powertrain Electronics Division of the Automotive Business Unit at Infineon Technologies AG, headquartered in Neubiberg. He is responsible for analyzing market trends and system requirements for new semiconductor solutions for powertrain applications.