Patent Description:
There is known a battery module configured by: configuring an assembled battery by connecting a plurality of secondary battery cells (single batteries) such as lithium-ion batteries serially or in a serial-parallel manner; and further connecting a plurality of assembled batteries serially or in a serial-parallel manner. Generally, with an electrically driven vehicle such as an electric automobile or a hybrid vehicle, a battery (high voltage battery) which is configured by connecting a plurality of the above-described battery modules serially or in a serial-parallel manner is used as an electric storage apparatus together with a battery control apparatus for controlling each battery module. The electrically driven vehicle travels by having an inverter convert high-voltage direct-current power, which is supplied from the electric storage apparatus, into alternating-current power and using this alternating-current power to drive a motor. Moreover, the alternating-current power generated by regenerative electric power generation of the motor is converted into the direct-current power by the inverter and the electric storage apparatus is electrically charged by supplying this direct-current power to the electric storage apparatus.

With an electrically driven vehicle in which the above-described electric storage apparatus is mounted, high voltage relays for establishing or cutting off an electrical connection between the battery and the inverter are provided between the inverter and a positive electrode side and a negative electrode side of the battery, respectively. Furthermore, there may be a case where a precharge relay is included, to which the relay on either its positive electrode side or its negative electrode side is parallelly connected and a current limiting resistor is serially connected. With the electrically driven vehicle equipped with the precharge relay, the precharge relay is firstly electrically connected upon activation of a system in order to limit an inrush current and then the high voltage relay is electrically connected and the precharge relay is cut off.

Typically, the electrically driven vehicle in which the electric storage apparatus configured by using the lithium-ion batteries is mounted is equipped with a system for preventing the batteries from becoming overcharged or overdischarged in order to use the lithium-ion batteries safely. Furthermore, in recent years, the application of functional safety standards such as ISO26262 has been being promoted in response to an increased demand for the functional safety of vehicles. In this case, with the electrically driven vehicle in which the electric storage apparatus configured by using the lithium-ion batteries is mounted, it is required to secure the safety by reliably cutting off the connection between the battery/batteries and the inverter when an electronic circuit fails.

PTL <NUM> is known as a conventional technology related to this technical field. PTL <NUM> discloses a relay control circuit for turning on a relay so as to continue supplying electric power from a high voltage battery only when both an output signal of a vehicle control apparatus and an output signal of a battery control apparatus are signals to issue an instruction to continue supplying the electric power.

PTL <NUM> discloses a control device for safety-critical components in which the outputs of two controllers used to control switches connected in series and pertaining to a switching device for the electrical components or machines to be switched are subjected to an AND operation. PTL <NUM> discloses a malfunction preventing device for on-vehicle electrical equipment in which one end of an ignition switch is connected to a positive side of a battery and the other end is connected to a contact of a neutral start switch. The switch connects the ignition switch to a coil section of a relay when a shift lever is positioned to a P or N range.

Regarding the relay control circuit described in PTL <NUM>, AND circuits for outputting a logical product of the output signal of the vehicle control apparatus and the output signal of the battery control apparatus are connected respectively to two relays and ON/OFF of each relay is controlled by using output signals from theses AND circuits. Accordingly, if either one of the AND circuits fails, there is a possibility that the relays can no longer be switched. Particularly, with the electric storage apparatus using the lithium-ion batteries, if the relay is kept in an ON state, the battery/batteries may become overcharged or overdischarge; and, therefore, a problem occurs when the relay cannot be switched from ON to OFF. Consequently, the conventional technology has the problem of the possibility of causing the battery to be overcharged or overdischarged when a failure occurs at the circuit controlling the relay which establishes or cuts off the electrical connection between the battery and the inverter.

An in-vehicle battery system according to the present invention, which is a battery system connected to an inverter mounted in a vehicle to give and receive direct-current power to and from the inverter, comprises: a battery; a relay for establishing or cutting off an electrical connection between the battery and the inverter; a plurality of switches respectively provided in a current path for switching the relay; and a battery control apparatus that supervises a status of the battery. The plurality of switches include a first switch provided in the battery control apparatus and a second switch provided in a vehicle control apparatus which controls traveling of the vehicle; the first switch and the second switch are serially connected to each other in the current path; the battery control apparatus controls a status of switching the first switch; and the vehicle control apparatus controls a status of switching the second switch.

Even if a failure occurs at either one of the battery control apparatus and the vehicle control apparatus which respectively control the relay to establish or cut off the electrical connection between the battery and the inverter, it is possible to reliably prevent the battery from becoming overcharged or overdischarged according to the present invention.

<FIG> is a diagram illustrating the configuration of a battery system according to a first embodiment of the present invention. The battery system illustrated in <FIG> is connected to an inverter <NUM> mounted in a vehicle and gives/receives direct-current power to/from the inverter <NUM> and includes a high voltage relay <NUM>, a battery <NUM>, a vehicle control apparatus <NUM>, and a battery control apparatus <NUM>. The vehicle control apparatus <NUM> and the battery control apparatus <NUM> are connected to each other via a CAN (Controller Area Network) communication line <NUM> provided inside the vehicle.

The inverter <NUM> converts direct-current power into alternating-current power, and vice versa, mutually between a motor, which is provided in the vehicle and is not illustrated in the drawing, and the battery <NUM>. Specifically speaking, the direct-current power supplied from the battery <NUM> is converted into the alternating-current power by the inverter <NUM> and is output to the motor. Furthermore, the alternating-current power supplied from the motor is converted into the direct-current power by the inverter <NUM> and is output to the battery <NUM>.

The high voltage relay <NUM> is connected between the inverter <NUM> and the battery <NUM> and includes a positive-electrode-side relay <NUM>, a negative-electrode-side relay <NUM>, a precharge relay <NUM>, and a precharge resistor <NUM>. The positive-electrode-side relay <NUM> is connected between a plus-side wire <NUM> for the inverter <NUM> and a plus-side wire <NUM> for the battery <NUM>. The negative-electrode-side relay <NUM> is connected between a minus-side wire <NUM> for the inverter <NUM> and a minus-side wire <NUM> for the battery <NUM>. The precharge relay <NUM> is connected parallelly with the negative-electrode-side relay <NUM> between the minus-side wire <NUM> for the inverter <NUM> and the minus-side wire <NUM> for the battery <NUM>. The precharge resistor <NUM> is connected serially with the precharge relay <NUM>.

Exciting coils for switching the positive-electrode-side relay <NUM>, the precharge relay <NUM>, and the negative-electrode-side relay <NUM> are built in these relays, respectively. The exciting coil for the positive-electrode-side relay <NUM> is connected to current paths <NUM> and <NUM>. The exciting coil for the precharge relay <NUM> is connected to current paths <NUM> and <NUM>. The exciting coil for the negative-electrode-side relay <NUM> is connected to current paths <NUM> and <NUM>. When an electric current is flowing through these current paths, each of these exciting coils generates a magnetic field with that electric current, thereby switching each corresponding really to an ON state. On the other hand, when the electric current is not flowing through these current paths, each exciting coil switches each corresponding relay to an OFF state. Consequently, each relay is switched depending on whether the electric current flowing through each current path exists or not.

The battery <NUM> which is a high voltage battery is configured by connecting a plurality of single batteries <NUM> in a serial-parallel manner. Each single battery <NUM> is configured by using, for example, a secondary battery such as a lithium-ion battery.

The vehicle control apparatus <NUM> is connected to various kinds of sensors and various kinds of actuators, which are mounted in the vehicle and are not illustrated in the drawing, and controls traveling of the vehicle by using these sensors and actuators. Furthermore, the vehicle control apparatus <NUM> has a relay control switch <NUM> inside itself. The relay control switch <NUM> is composed of three switches <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> which are connected to the positive-electrode-side relay <NUM>, the precharge relay <NUM>, and the negative-electrode-side relay <NUM> for the high voltage relay <NUM>, respectively. One end side of the switch <NUM>-<NUM> is connected to the exciting coil for the positive-electrode-side relay <NUM> via the current path <NUM>. One end side of the switch <NUM>-<NUM> is connected to the exciting coil for the precharge relay <NUM> via the current path <NUM>. One end side of the switch <NUM>-<NUM> is connected to the exciting coil for the negative-electrode-side relay <NUM> via the current path <NUM>. Each one of the other end sides of these switches is connected to the low-voltage power source <NUM> in the vehicle. Incidentally, the low-voltage power source <NUM> is, for example, an electrical system power source of a voltage 12V. The switching status of each switch in the relay control switch <NUM> is controlled by the vehicle control apparatus <NUM>.

The battery control apparatus <NUM> is connected to connection points between the respective single batteries <NUM> of the battery <NUM> via a voltage detection line <NUM> and supervises the status of the battery <NUM> by detecting a voltage of each single battery <NUM>. Furthermore, the battery control apparatus <NUM> has a relay control switch <NUM> inside itself. The relay control switch <NUM> is composed of: a switch <NUM>-<NUM> connected to the positive-electrode-side relay <NUM> of the high voltage relay <NUM>; and a switch <NUM>-<NUM> connected to the precharge relay <NUM> and the negative-electrode-side relay <NUM>. One end side of the switch <NUM>-<NUM> is connected to the exciting coil for the positive-electrode-side relay <NUM> via the current path <NUM>. One end side of the switch <NUM>-<NUM> is connected to the exciting coil for the precharge relay <NUM> and the exciting coil for the negative-electrode-side relay <NUM> via the current path <NUM>. Each one of the other end sides of these switches is connected a chassis GND <NUM> which is GND for the low-voltage power source <NUM>. The switching status of the switches <NUM>-<NUM> and <NUM>-<NUM> is controlled by the battery control apparatus <NUM>; and when the battery control apparatus <NUM> normally operates, the switches <NUM>-<NUM> and <NUM>-<NUM> are always switched to the ON state.

With the battery system according to this embodiment as described above, the three switches <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> of the relay control switch <NUM> are provided, in the current paths <NUM> to <NUM>, closer to the low-voltage power source <NUM> than to the exciting coils for the respective relays in the high voltage relay <NUM>, that is, on the high electric potential side. On the other hand, the switches <NUM>-<NUM> and <NUM>-<NUM> of the relay control switch <NUM> in the battery control apparatus <NUM> are provided, in the current paths <NUM>, <NUM>, closer to the chassis GND <NUM> than to the exciting coils for the respective relays in the high voltage relay <NUM>, that is, on the low electric potential side. Therefore, the electric current is made to flow through the exciting coils via the respective current paths by switching these switches to the ON state, so that it becomes possible to switch each relay of the high voltage relay <NUM> to the ON state.

When the battery system in <FIG> is activated and the battery control apparatus <NUM> starts operating, the switches <NUM>-<NUM> and <NUM>-<NUM> in the relay control switch <NUM> are switched to the ON state. Furthermore, the switches <NUM>-<NUM> and <NUM>-<NUM> in the relay control switch <NUM> are switched to the ON state by the vehicle control apparatus <NUM>. Consequently, the electric current flows through the current paths <NUM> and <NUM> and the positive-electrode-side relay <NUM> is switched to the ON state; and also the electric current flows through the current paths <NUM> and <NUM> and the precharge relay <NUM> is switched to the ON state. As a result, the inverter <NUM> and the battery <NUM> are connected in a state where an inrush current is reduced by the precharge resistor <NUM>. Subsequently, when a smoothing capacitor inside the inverter <NUM> is charged to a certain voltage or higher, the switch <NUM>-<NUM> is switched to the ON state and the switch <NUM>-<NUM> is switched to the OFF state. Consequently, the electric current flows through the current paths <NUM> and <NUM> and the negative-electrode-side relay <NUM> is switched to the ON state; and also the electric current in the current path <NUM> is cut off and the precharge relay <NUM> is switched to the OFF state. As a result, the connection between the inverter <NUM> and the battery <NUM> is completed and the direct-current power is given and received between the inverter <NUM> and the battery <NUM>.

Incidentally, in the example of the battery system illustrated in <FIG>, the precharge relay <NUM> and the precharge resistor <NUM> are connected parallelly with the negative-electrode-side relay <NUM> between the minus-side wire <NUM> for the inverter <NUM> and the minus-side wire <NUM> for the battery <NUM>. However, the precharge relay <NUM> and the precharge resistor <NUM> may be connected parallelly with the positive-electrode-side relay <NUM> between the plus-side wire <NUM> for the inverter <NUM> and the plus-side wire <NUM> for the battery <NUM>. Furthermore, if the inrush current does not particularly cause any problem, the precharge relay <NUM> and the precharge resistor <NUM> may not be provided.

Let us assume here that whatever anomaly has occurred at the battery <NUM> or the battery control apparatus <NUM> after the completion of the connection between the inverter <NUM> and the battery <NUM>. In this case, each switch of the relay control switch <NUM> is switched to the OFF state by the vehicle control apparatus <NUM>. Furthermore, the battery control apparatus <NUM> switches the switches <NUM>-<NUM> and <NUM>-<NUM> of the relay control switch <NUM> to the OFF state. As a result, the electric current flowing through the current paths <NUM> and <NUM> is cut off and the positive-electrode-side relay <NUM> is switched to the OFF state; and the electric current flowing through the current paths <NUM> and <NUM> is cut off and the negative-electrode-side relay <NUM> is switched to the OFF state. Accordingly, the battery system according to this embodiment is designed to have a dual system for cutting off the connection between the inverter <NUM> and the battery <NUM>, that is, a system of the relay control switch <NUM> in the vehicle control apparatus <NUM> and a system of the relay control switch <NUM> in the battery control apparatus <NUM>. Therefore, even if a failure occurs in either one of the systems, it is possible to reliably prevent the battery <NUM> from becoming overcharged or overdischarged.

<FIG> is a diagram illustrating one example of an internal circuit for the battery control apparatus <NUM>. The battery control apparatus <NUM> has the switches <NUM>-<NUM> and <NUM>-<NUM>, which constitute the relay control switch <NUM> illustrated in <FIG>, and also has respective terminates with the reference numerals <NUM> to <NUM> and <NUM>, a power supply circuit <NUM>, a supervisory circuit <NUM>, monitoring circuits <NUM>-<NUM> and <NUM>-<NUM>, a driving circuit <NUM>, a microcomputer <NUM>, and a CAN driver <NUM>.

The terminal <NUM> is a terminal for inputting operating power supply for the battery control apparatus <NUM>. The operating power supply which is input from the terminal <NUM> is converted into a voltage by the power supply circuit <NUM> and is output as a power source VCC for the microcomputer <NUM> as indicated with the reference numeral <NUM>.

The terminals <NUM>, <NUM> are connected to the current paths <NUM>, <NUM> in <FIG>, respectively. The switches <NUM>-<NUM> and <NUM>-<NUM> are connected, via the terminals <NUM>, <NUM> and the current paths <NUM>, <NUM> respectively, to the exciting coil for the positive-electrode-side relay <NUM>, the exciting coil for the precharge relay <NUM>, and the exciting coil for the negative-electrode-side relay <NUM> in <FIG>, respectively.

Each of the terminals <NUM>, <NUM>, <NUM> is connected to the chassis GND <NUM>. The switches <NUM>-<NUM> and <NUM>-<NUM> are respectively connected to the chassis GND <NUM> via the terminals <NUM> and <NUM>. The microcomputer <NUM> is connected to the chassis GND <NUM> via the terminal <NUM>.

Consequently, the battery control apparatus <NUM> is provided with a plurality of terminals (the terminals <NUM> and <NUM>) for connecting to the exciting coils of the respective relays and a plurality of terminals (the terminals <NUM>, <NUM>, and <NUM>) for connecting to the chassis GND <NUM>. The reason is to have a configuration with sufficient capacity so that the electric current will not exceed a permissible current for each terminal. Furthermore, if a terminal current becomes high, there is a possibility that a voltage drop caused by contact resistance may cause adverse effects on circuit operations; and, therefore, it is also intended to prevent such adverse effects.

The supervisory circuit <NUM> is a circuit that supervises operations of the microcomputer <NUM> by inputting/outputting specified data to/from the microcomputer <NUM> via a signal line <NUM>. For example, the supervisory circuit <NUM> supervises whether the microcomputer <NUM> operates abnormally or not, by supervising, for example, runaway of the microcomputer <NUM> or mismatches in arithmetic operations between dual cores if the microcomputer <NUM> is a microcomputer equipped with the dual cores. If any of these operational anomalies of the microcomputer <NUM> occurs, the supervisory circuit <NUM> resets the microcomputer <NUM> by outputting a reset signal <NUM> or outputs a microcomputer failure signal <NUM> to the driving circuit <NUM>.

The monitoring circuits <NUM>-<NUM> and <NUM>-<NUM> monitor the status of the switches <NUM>-<NUM>, <NUM>-<NUM> respectively and outputs the results to the microcomputer <NUM>.

The driving circuit <NUM> switches each of the switches <NUM>-<NUM> and <NUM>-<NUM> to the ON state or the OFF state, depending on the driving signal <NUM> output from the microcomputer <NUM> or the microcomputer failure signal <NUM> output from the supervisory circuit <NUM>. Specifically speaking, when the driving signal <NUM> is output from the microcomputer <NUM>, the driving circuit <NUM> switches each of the switches <NUM>-<NUM> and <NUM>-<NUM> to the ON state. Furthermore, when the microcomputer failure signal <NUM> is output form the supervisory circuit <NUM>, the driving circuit <NUM> switches each of the switches <NUM>-<NUM> and <NUM>-<NUM> to the OFF state, regardless of whether the driving signal <NUM> is output or not. Consequently, if an operational anomaly of the microcomputer <NUM> has occurred, each of the positive-electrode-side relay <NUM> and the negative-electrode-side relay <NUM> in <FIG> is switched to the OFF state, thereby cutting off the connection between the inverter <NUM> and the battery <NUM>.

The terminal <NUM> is connected to the CAN communication line <NUM> indicated in <FIG>. The CAN driver <NUM>: converts data, which is output from the microcomputer <NUM>, into a CAN signal and transmits the CAN signal to the CAN communication line <NUM> via the terminal <NUM>; and also converts the CAN signal, which is received from the CAN communication line <NUM> via the terminal <NUM>, into data and outputs the data to the microcomputer <NUM>. The battery control apparatus <NUM> can communicate with the vehicle control apparatus <NUM> via the CAN communication line <NUM> by using the CAN signal by this CAN driver <NUM>.

Incidentally, in the configuration example illustrated in <FIG>, only one driving circuit <NUM> is provided for the switches <NUM>-<NUM> and <NUM>-<NUM>; however, the driving circuit <NUM> may be provided for each of the switches.

Next, operating sequences of the battery system according to this embodiment will be explained below by using the respective flowcharts in <FIG>, <FIG>, and <FIG>.

<FIG> is a flowchart illustrating the operating sequence when the battery control apparatus <NUM> is activated normally. When the vehicle is activated in step <NUM> and the battery control apparatus <NUM> is activated normally in step <NUM>, the battery control apparatus <NUM> outputs the driving signal <NUM> from the microcomputer <NUM> to the driving circuit <NUM> and thereby switches the built-in switches <NUM>-<NUM> and <NUM>-<NUM> to the ON state in step <NUM>. Subsequently, in step <NUM>, the battery control apparatus <NUM> outputs specified data from the microcomputer <NUM> to the CAN driver <NUM> and thereby outputs a relay-ON enabling signal, which is a CAN signal for permitting switching of the high voltage relay <NUM> to the ON state, to the vehicle control apparatus <NUM>.

When receiving the relay-ON enabling signal transmitted from the battery control apparatus <NUM> in step <NUM>, the vehicle control apparatus <NUM> switches each switch of the relay control switch <NUM> to the ON state in step <NUM>. When this happens as described earlier, the switches <NUM>-<NUM> and <NUM>-<NUM> are firstly switched to the ON state; and after the smoothing capacitor in the inverter <NUM> is charged to a certain voltage or higher, the switch <NUM>-<NUM> is switched to the ON state and the switch <NUM>-<NUM> is switched to the OFF state. As the electric current flows through each current path according to switching of this relay control switch <NUM>, the respective relays of the high voltage relay <NUM> are sequentially switched to the ON state in step <NUM> and electric charging/discharging of the battery <NUM> is started in step <NUM>.

<FIG> is a flowchart illustrating the operating sequence when detecting an anomaly upon activation of the battery control apparatus <NUM>. In this case, when the vehicle is activated in step <NUM>, the battery control apparatus <NUM> detects the anomaly upon the activation in step <NUM>. Incidentally, there may be various kinds of anomalies, including minor failures and critical failures, as the anomaly to be detected by the battery control apparatus <NUM>; however, a critical failure for which the connection between the inverter <NUM> and the battery <NUM> should be cut off is particularly assumed here. This does not necessarily apply to any minor failure.

When the battery control apparatus <NUM> detects the anomaly in step <NUM>, the battery control apparatus <NUM> does not output the driving signal <NUM> from the microcomputer <NUM> to the driving circuit <NUM> and thereby does not switch the built-in switches <NUM>-<NUM> and <NUM>-<NUM> to the ON state in step <NUM>. Subsequently, in step <NUM>, the battery control apparatus <NUM> does not output the specified data from the microcomputer <NUM> to the CAN driver <NUM> and thereby does not output the relay-ON enabling signal to the vehicle control apparatus <NUM>.

Since the relay-ON enabling signal is not transmitted from the battery control apparatus <NUM> in step <NUM>, the vehicle control apparatus <NUM> does not switch each switch of the relay control switch <NUM> to the ON state in step <NUM>. As a result, each relay of the high voltage relay <NUM> is not switched to the ON state in step <NUM> and the electric charging/discharging of the battery <NUM> is not started in step <NUM>.

<FIG> is a flowchart illustrating the operating sequence when the battery control apparatus <NUM> detects an anomaly after being activated normally. In this case, after the vehicle is activated in step <NUM>, operations of the same details as those in <FIG> are conducted in steps <NUM> to <NUM>, respectively, and then the electric charging/discharging of the battery <NUM> is started. Then, if the battery control apparatus <NUM> detects an anomaly in step <NUM> while the vehicle is traveling, the battery control apparatus <NUM> outputs specified data from the microcomputer <NUM> to the CAN driver <NUM> and thereby outputs a CAN signal, which requests switching of the high voltage relay <NUM> to the OFF state, to the vehicle control apparatus <NUM> in step <NUM>. Subsequently in step <NUM>, after the elapse of a certain period of time, the battery control apparatus <NUM> stops the output of the driving signal <NUM> from the microcomputer <NUM> to the driving circuit <NUM> and thereby switches the built-in switches <NUM>-<NUM> and <NUM>-<NUM> to the OFF state.

The vehicle control apparatus <NUM> switches each switch of the relay control switch <NUM> to the OFF state in response to the switching request transmitted from the battery control apparatus <NUM> for switching of the high voltage relay <NUM> to the OFF state in step <NUM>, or the battery control apparatus <NUM> switches the switches <NUM>-<NUM> and <NUM>-<NUM> to the OFF state in step <NUM>, so that the electric current flowing through each current path is cut off. As a result, each relay of the high voltage relay <NUM> is switched to the OFF state in step <NUM> and the electric charging/discharging of the battery <NUM> is stopped in step <NUM>.

<FIG> is a diagram illustrating the configuration of a battery system including a battery control apparatus according to a second embodiment of the present invention. The battery system according to this embodiment has the following differences from the battery system according to the first embodiment illustrated in <FIG>: the other end sides of the three switches <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>, which are not connected to the exciting coils, in the relay control switch <NUM> provided in the vehicle control apparatus <NUM> are connected to the chassis GND <NUM>; and the other end sides of the switches <NUM>-<NUM> and <NUM>-<NUM>, which are not connected to the exciting coils, in the relay control switch <NUM> provided in the battery control apparatus <NUM> are connected to the low-voltage power source <NUM>.

With the battery system according to this embodiment as described above, the three switches <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> of the relay control switch <NUM> in the vehicle control apparatus <NUM> are provided, in the current paths <NUM> to <NUM>, at positions closer to the chassis GND <NUM> than to the exciting coils of the respective relays in the high voltage relay <NUM>, that is, on the low electric potential side. On the other hand, the switches <NUM>-<NUM> and <NUM>-<NUM> of the relay control switch <NUM> in the battery control apparatus <NUM> are provided, in the current paths <NUM>, <NUM>, at positions closer to the low-voltage power source <NUM> than to the exciting coils of the respective relays in the high voltage relay <NUM>, that is, on the high electric potential side. Therefore, similarly to the first embodiment, the electric current is made to flow through the exciting coils via the respective current paths by switching these switches to the ON state, so that it becomes possible to switch the respective relays of the high voltage relay <NUM> to the ON state.

Incidentally, a method for switching each switch according to this embodiment is similar to that explained in the first embodiment. Accordingly, the battery system according to this embodiment is also designed to have a dual system for cutting off the connection between the inverter <NUM> and the battery <NUM>, that is, a system of the relay control switch <NUM> in the vehicle control apparatus <NUM> and a system of the relay control switch <NUM> in the battery control apparatus <NUM>. Therefore, even if a failure occurs in either one of the systems, it is possible to reliably prevent the battery <NUM> from becoming overcharged or overdischarged.

The following operational advantages are implemented according to the above-described embodiments of the present invention.

Claim 1:
An in-vehicle battery system, which is a battery system connected to an inverter (<NUM>) mounted in a vehicle to give and receive direct-current power to and from the inverter (<NUM>), comprising:
a battery (<NUM>);
a relay (<NUM>) for establishing or cutting off an electrical connection between the battery (<NUM>) and the inverter (<NUM>); and
a battery control apparatus (<NUM>) that supervises a status of the battery (<NUM>),
characterized by a plurality of switches (<NUM>, <NUM>) respectively provided in a current path (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) for switching the relay (<NUM>),
wherein the plurality of switches (<NUM>, <NUM>) include a first switch (<NUM>) provided in the battery control apparatus (<NUM>) and a second switch (<NUM>) provided in a vehicle control apparatus (<NUM>) which controls traveling of the vehicle;
wherein the first switch (<NUM>) and the second switch (<NUM>) are serially connected to each other in the current path (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) and configured so that the relay (<NUM>) can be switched to an OFF state by switching only one of the switches (<NUM>, <NUM>);
wherein the battery control apparatus (<NUM>) controls a status of switching the first switch (<NUM>); and
wherein the vehicle control apparatus (<NUM>) controls a status of switching the second switch (<NUM>).