With so much of the ongoing development work for hybrid electric vehicles (HEV), plug-in hybrid electric vehicles (PHEV) and pure electric vehicles (EV) involving the use of lithium-ion (Li-ion) batteries, many discussions at OEMs, electronics suppliers and battery manufacturers focus on how best to structure battery monitoring and management systems. These systems certainly require a primary monitor—typically an analog-to-digital converter (ADC) interfaced with a microcontroller or battery management unit (BMU)—to provide accurate measurement data and perform cell balancing (this ensures that the all the cells are at the same voltage level prior to charging). However, one of the topics invariably debated is whether to include a redundant monitor—sometimes referred to as a safety or back-up monitor—and if so, what should be monitored (Figure 1 shows a block diagram of a typical system). Before addressing the specifics of redundant monitoring, it is important to review some of the attributes of Li-ion batteries.    

Characteristics of Li-ion Batteries
Li-ion is now replacing nickel metal hydride (NiMH) as the battery of choice in the automotive field because of the significant advantages it has with respect to:
• Longer life – can withstand more charge cycles
• Higher energy density – lighter weight or greater range
• Low self-discharge rate – longer storage life
• Higher cell voltage – higher voltage is always better
• Flexible form factor – fits in places where NiMH can not

These advantages make Li-ion batteries the future choice for automotive use and will undoubtedly help to broaden the HEV and PHEV vehicle line that OEMs will produce, while also bringing the possibility of mass produced EVs closer to reality. However, there are some drawbacks relative to NiMH, some related to safety, which may have significant implications on the system design, such as:
• Over-charge – possibility of thermal runaway and escaping gas exists
• Over-discharge – batteries can be damaged and capacity reduced
• Temperature characteristics – high temperatures are dangerous and batteries don’t work well in the cold
• High cost
The degree to which these characteristics exists depends on the particular chemistry (e.g., LiFePO4 is safer and has a lower rate of thermal runaway); nevertheless, all chemistries mass produced today tend to exhibit the above characteristics to some degree.

Should Redundancy be Included?
It is obvious that accurately monitoring cell voltage, state of charge and resistance is required to properly manage a Li-ion battery system. But is just one form of monitoring sufficient? When looking at the traits listed above several issues should be considered:

As they exist today, Li-ion batteries must be treated with respect. Although sufficient history has not yet accrued regarding Li-ion batteries in automotive applications, fires occurring with notebook computers and other applications have made safety a concern. The quality of fabrication has certainly improved, but considering the total energy and sheer volume of the batteries in an automobile versus a notebook, safety has to be the primary issue. Thus, guarding against over-charging and higher temperature conditions is critical.

Battery Damage
Despite their advantages, Li-ion batteries add significant cost to a vehicle. Early published estimates for the cost of a battery system used in a PHEV approach $10,000 or more. Damaging these batteries or decreasing their life can be disastrous to an OEM. If an over-discharge condition that damages the batteries occurs as a result of improper monitoring, and the vehicle owner has to replace the batteries sooner than expected, the reputation of the OEM could significantly suffer. In addition, the OEM also have to absorb the warranty expense.

These two areas alone would make a strong case for redundancy. While adding redundant monitoring certainly increases the system cost, that cost increase is likely to be less than $50 in a 96-cell system. Compare this to the consequences of an over-charge, under-charge or over-temperature occurrence.

Secondary Benefits of Redundancy
While safety is unquestionably paramount, and protecting the investment in the batteries is important, some additional benefits accrue when using a redundant or back-up system:

ISO 26262 – Functional Safety
New regulations for automotive electronics are close to being released in the form of ISO 26262 – Automotive Safety and Integrity Levels (ASIL). This new automotive-specific guideline is modeled after IEC 61508, which is used for industrial electronics. These guidelines focus on guarding against various potential hazards by ensuring that the systems provide a degree of safety to match the hazard. These levels of safety range from A, the lowest level required, to D, the highest level. Most OEMs and suppliers are targeting Level C or D in their battery monitoring designs. While the document is still not yet released, several criteria are emphasized in preliminary versions:

• A system must guard against any single point failure creating a hazard
• Hazards must be detectable even in the event the “primary” monitor fails
• Preferable that any redundant circuit is of a less complex design than the primary and, importantly, the two components are independent (e.g. no shared resources)
• Diagnostic coverage of the components, the extent of which should match the hazard level, is critical

As many OEMs will require that these guidelines be followed, electronics suppliers or battery manufacturers providing the monitoring electronics must consider how to address these concerns. Having a back-up monitoring system will certainly aid in doing so.

FMEA Requirements
Anyone working in an automotive development environment is aware of FMEA (Failure Mode and Effect Analysis) requirements. Performing this analysis involves rigorously working through various potential failures, such as opens and shorts. Clearly, having a redundant system in place will help to address these concerns and allow developers to better address FMEA requirements.

Provides Another Vote in the System
Because of the concerns with Li-ion batteries, developers certainly need to be take action when an over-charge, under-charge or over-temperature condition arises. The action taken may be severe, perhaps as strong as completely shutting down the battery system in a controlled fashion. Relying on a single source of data, the primary monitor, for example, can be risky in making such a decision. Having an additional source of data, or another vote, provided by a back-up monitor, would aid the system in arriving at the correct decision, especially if the primary monitor fails, making its data unreliable.

These three benefits, coupled with the prior two, make a strong case that a back-up or safety monitor shouldn’t just be a consideration; it should be mandatory.

What Should Be Monitored?
Now that we have established a strong case for using a back-up monitor, what form should it take and what should it monitor? Should it be completely redundant (two primary monitors), contain some subset of the primary monitor’s functions, or should it have completely different features?

The answer lies in reviewing the above points. To counter the drawbacks of Li-ion batteries and meet the new safety requirements, and to do so without adding significant cost, the following features are important for any back-up monitor to contain:

• Issue an alarm for over-voltage (OV), under-voltage (UV) and over-temperature (OT) conditions. Separate alarms for each condition may be desirable if the developer is considering different actions for each type of alarm.
• Operate completely independently of the primary monitor (i.e., separate inputs, supplies, and references) to mitigate single point failures
• Contains diagnostics that can validate circuit and alarm operation
• Hardware only solution preferable to mitigate the dependence on software
• Should work with most Li-ion chemistries available for mass production
• Cost-effective, i.e., be a fraction of the cost of the primary monitor

An Example
One example of a back-up monitor is the component outline in the block diagram shown in Figure 2 developed by Analog Devices. Meeting the above requirements, it is designed as a companion to the AD7280, an automotive-grade primary monitor for Li-ion batteries. Other key components in the monitoring system shown in Figure 1, are isolators, such as the ADuM1401, and current sensors, such as the ADuC703x series.

It is very important that the primary and back-up monitors complement each other to collect the necessary information to manage the system, and to provide an additional independent safety mechanism. The back-up monitor was developed based on feedback from some of the leading electronic suppliers, battery manufacturers and OEMs located in the US, Europe and Asia. The component includes many features which are important in a back-up monitor including:

• Minimum of six cell inputs and separate temperature input
• Powered directly from the cell stack, it contains its own LDO to power external isolators or temperature devices
• Has a low-power mode to minimize battery drain during non-use
• Flexible trip points that work over a wide range of alarm voltages making it suitable for all Li-ion battery chemistries
• Can be daisy-chained to reduce the need for costly isolators
• Contains an extensive diagnostic scheme that can be initiated by the user
• Has internal deglitching circuitry to ignore input transients
• Is fully AEC- Q100 qualified to meet stringent automotive quality requirements
• Is robust against EMC events prevalent in vehicles

As OEMs, electronics suppliers and battery manufacturers are eager to capitalize on the benefits provided by Li-ion batteries, they realize that the technology’s inherent characteristics may require a more robust monitoring system for the next generation of HEVs, and the newly developed PHEVs and EVs. So, while there are any number of valid questions that must be answered surrounding the implementation of a back-up system, including: what should it monitor, how will it communicate to the system, what diagnostic capability should it have, how flexible should it be regarding various battery chemistries, and can it help meet ISO26262—the question of whether a system should or should not have back-up is an easy one: redundancy required!

Steven Boyle is an applications engineer for Analog Devices, Inc. He can be reached via email at