4. Monitored parameters

This section describes the parameters monitored by foxBMS. The parameters are monitored periodically, using the diag module. A counter is dedicated to each parameter. Each time an error condition is detected, the corresponding counter is increased, otherwise it is decreased. If the threshold configured for the parameter is exceeded by the counter, an error occured and the BMS takes an appropriate action. This mechanism avoids false error detections, e.g. in case of short peaks. As the parameters are monitored periodically via the periodic tasks, the counter threshold corresponds to the response time between error happening and error detection. A default response time of 100ms is selected as a trade-off between peak detection and safety. It must be adapted to the application. foxBMS provides three different error levels. The first error level is called Maximum operating limit (MOL), the second error level is called Recommended Safety Limit (RSL) and the third error level is called Maximum Safety Limit (MSL). The first two error levels indicate that a parameter is reaching the limits of the recommended operating area and counter measures should be initiated to prevent an unwanted opening of the contactors. A violation of a Maximum Safety Limit means the safety of the system and the persons cannot be guaranted anymore and leads to the opening of the contactors. The BMS state machine consequently switches to the Error State to prevent a further closing of the contactors. The Error State can only be left if the cause of the error has been removed and the Standby State is requested. After that the BMS is back in normal operational mode. All error flags are available on CAN messages, allowing the system to react accordingly to prevent hazardous situations.

4.1. Battery Cell

4.1.1. Parameter: Cell voltage

Error condition Response time Cause Counter measures Actions of the BMS
Cell voltage > overvoltage limit 100 ms Overcharging (derating error, charger defect)
  • Reduce/stop charge current
  • Discharge battery
  • Set flag at violation of MOL (2550mV)
  • Set flag at violation of RSL (2600mV)
  • Set flag at violation of MSL (2650mV) and switch to Error State
Cell voltage < undervoltage limit 100 ms Deep-discharge (derating error, high standby/ leakage current)
  • Reduce/stop discharge current
  • Charge battery
  • Set flag at violation of MOL (1700mV)
  • Set flag at violation of RSL (1750mV) and
  • Set flag at violation of MSL (1780mV) and switch to Error State
  • Set flag that deep-discharge (below MSL) was detected (stored in nonvolatile memory) to prevent closing of contactors until defect cell is replaced and reset command is received over CAN

4.1.2. Parameter: Cell temperature

Error condition Response time Cause Counter measures Actions of the BMS
Cell temperature > overtemperature limit charge 100 ms
  • Current too high
  • Ambient temperature
  • Cooling defect
  • Reduce/stop charge current
  • Increase cooling
  • Set flag at violation of MOL (35 °C)
  • Set flag at violation of RSL (40 °C)
  • Set flag at violation of MSL (45 °C) and switch to Error State
Cell temperature > overtemperature limit discharge 100 ms
  • Current too high
  • Ambient temperature
  • Cooling defect
  • Reduce/stop discharge current
  • Increase cooling
  • Set flag at violation of MOL (55 °C)
  • Set flag at violation of RSL (50 °C)
  • Set flag at violation of MSL (45 °C) and switch to Error State
Cell temperature < undertemperature limit charge 500 ms Ambient temperature
  • Reduce/stop charge current
  • Activate heating
  • Set flag at violation of MOL (-10 °C)
  • Set flag at violation of RSL (-15 °C)
  • Set flag at violation of MSL (-20 °C) and switch to Error State
Cell temperature < undertemperature limit discharge 100 ms Ambient temperature
  • Reduce/stop discharge current
  • Activate heating
  • Set flag at violation of MOL (-10 °C)
  • Set flag at violation of RSL (-15 °C)
  • Set flag at violation of MSL (-20 °C) and switch to Error State

4.1.3. Parameter: Cell current

Error condition Response time Cause Counter measures Actions of the BMS
Cell current > maximum charge current 100 ms
  • Derating error
  • Charger defect
Reduce charge current
  • Set flag at violation of MOL (170A)
  • Set flag at violation of RSL (175A)
  • Set flag at violation of MSL (180A) and switch to Error State
Cell current > maximum discharge current 100 ms
  • Derating error
  • Short circuit
Reduce discharge current
  • Set flag at violation of RSL (170A)
  • Set flag at violation of RSL (175A)
  • Set flag at violation of MSL (180A) and switch to Error State

4.2. System

4.2.1. Parameter: Battery system current

Error condition Response time Cause Counter measures Actions of the BMS
Current > precharge current limit no response time Precharge resistor defect
  • Set warning flag that current is too high (50mA) and abort precharge process
  • Do not retry and switch to Error State
Contactors opened/closed under current no response time System failure detected Set flag that contactors were operated under current (10A)

4.2.2. Parameter: HV measurement

Error condition Response time Cause Counter measures Actions of the BMS
Voltage difference(Vbat - Vdc,link) > precharge voltage limit No response time
  • DC link short circuit
  • Precharge contactor defect
  • Check contactor
  • DC link capacitor
  • Set warning flag that voltage difference is too high (5000mV) and abort precharge process
  • Do not retry and switch to Error State
Fuse tripped (Vbat - Vfuse) > limit 100 ms Fuse tripped Replace fuse Set warning flag that tripped fuse is detected (10000mV)
Voltage difference (Vfuse - Vdc,link) < limit 100 ms Precharge contactor defect Check contactor Measurement only done when contactors are open. Set error flag that defect precharge contactor is detected (2000mV), switch to Error State

4.3. Contactor feedback

Error condition Response time Cause Counter measures Actions of the BMS
Contactor feedback unequal to requested state 100 ms
  • Contactor defect
  • Wiring error/defecter
Check contactor Set warning flag that measured contactor feedback is different from requested state. switch to Error State

4.4. CAN communication

Error condition Response time Cause Counter measures Actions of the BMS
No CAN staterequest message (ID: 0x120) on CAN0 received 1000 ms
  • VCU defect
  • Wiring error/defect
  • Check VCU
  • Check wiring
Set warning flag if state request message (0x108) is not received in an interval of 100ms +/- 5ms. Switch to Error State.
No CAN currentsensor messages on CAN0 received 1000 ms
  • Current sensor defect
  • Wiring error/defect
  • Check Current Sensor
  • Check wiring
Set warning flag if for 200ms no new current sensor message received and switch to Error State

4.5. Slave communication

Error condition Response time Cause Counter measures Actions of the BMS
Daisy-chain communication not working 5 ms
  • Slave defect
  • Wiring error/defect
  • Check daisy-chain connection
  • Check Slaves
Set warning flag that daisy-chain communication fails and switch to Error State

4.6. Open wire check

Error condition Response time Cause Counter measures Actions of the BMS
Cell voltage open-wire check detects error No response time Wiring error/defect Check voltage sense wiring Set warning flag that open wire is detected and switch to Error State

4.7. Master

4.7.1. Parameter: MCU die temperature

Error condition Response time Cause Counter measures Actions of the BMS
MCU die temperature > maximum junction temperature 1000 ms Ambient temperature Reduce thermal stress Set warning flag that maximum junction temperature is violated (T > 105 °C, T < -40 °C)

4.7.2. Parameter: Coin cell voltage

Error condition Response time Cause Counter measures Actions of the BMS
Coin cell voltage < minimum cell voltage limit 1000 ms Coin cell discharged at end of life Replace coin cell if voltage is below threshold Set warning flag that minimum coin cell voltage threshold is violated to prevent loss of data (2200mV). Typical lifetime of a coin cell is 2-3 years.

4.8. Software checks

4.8.1. Plausibility check

Error condition Response time Cause Counter measures Actions of the BMS
Measurement timestamps (I, V, T) not upated 1000 ms
  • Daisy-chain error
  • CAN1 error
  • Check Slaves
  • Check current sensor
  • Check wiring
Set warning flag that measurement timestamps are not updated periodically (200ms) and switch to Error State
Cell temperature < below measurement range 100 ms T-Sensor short circuit
  • Check temperature sensor wiring
  • Set measurement value invalid because measured temperature is below measurement range (T <-50 °C)
  • Set temperature measurement error flag
Cell temperature > above measurement range 100 ms T-Sensor disconnected
  • Check temperature sensor wiring
  • Set measurement value invalid because measured temperature is above measurement range (Tabove > 125 °C)
  • Set temperature measurement error flag
Cell voltage > above measurement range 300 ms
  • Slave defect
  • Wiring error
  • Replace defective part
  • Set measurement value invalid because individual cell voltage > measurement range (5000mV)
  • Set voltage measurement error flag
Cell voltage deviation from average cell voltage too large 300 ms
  • Slave defect
  • Wiring error
  • Cell defect
  • Set measurement value invalid because individual cell voltage deviation from average cell voltage is too large (+/-1000mV)
  • Set voltage measurement error flag
Difference between pack voltage and LTC / current sensor measurement too high 100 ms
  • Slave defect
  • Wiring error
  • Current sensor defect
  • Check Slaves
  • Check wiring
  • Check curent sensor
Set measurement value invalid because Batterypack voltage and LTC / current sensor voltage is too high (3000 mV)