1

Model-Checking Battery Configurations to Detect Thermal Runaway

Ivan RuchkinDionisio De Niz

Sagar ChakiDavid Garlan

Software Research Seminar Institute for Software Research

April 28, 2014

2

Driverless electric car created!

Image credit: machinespider.com

3

Will it cross the intersection safely?

Image credit: thedetroitbureau.com

4

No, its battery will catch fire!

Image credit: johndoug.smugmug.com

5

Outline

● Battery for Electric Vehicles● Electrical Domain: Scheduling● Thermal Domain: Runaway ● Problem: Domain Separation● Solution: Model Checking

6

Battery for Electric Vehicles

● Array of Li-Ion cells – NOT flooded lead-acid.● Rechargeable; powers vehicle movement.● Input & output – (voltage, current).

7

Dynamic Reconfiguration

● Structure: reconfigurable matrix of cells.– Connected in series and parallel.

– Carry different charges.

8

Outline

● Battery for Electric Vehicles● Electrical Domain: Scheduling● Thermal Domain: Runaway ● Problem: Domain Separation● Solution: Model Checking

9

Electrical Domain: Scheduling● Goal – select charging and discharging cells to:

– Maintain required output

– Maximize battery lifetime

10

Electrical Domain: Scheduling● Goal – select charging and discharging cells to:

– Maintain required output

– Maximize battery lifetime

11

Electrical Domain: Scheduling● Discharge schedulers for n parallel cells:

– 1RR: discharge one most charged cell at a time, rotate every time interval.

– 1+1RR: discharge one cell till fully discharged, move to most charged one.

– nRR: discharge all n cells in parallel.– kRR: discharge k<n cells, where k is selected

adaptively based on charge.

12

Electrical Domain: Scheduling● Discharge schedulers for n parallel cells:

– 1RR: discharge one most charged cell at a time, rotate every time interval.

– 1+1RR: discharge one cell till fully discharged, move to most charged one.

– nRR: discharge all n cells in parallel.– kRR: discharge k<n cells, where k is selected

adaptively based on charge.

● Takeaway: electrical modeling deals with cell charge, scheduling, and efficiency.

– Abstractions: electrical circuit, algorithms.

13

Outline

● Battery for Electric Vehicles● Electrical Domain: Scheduling● Thermal Domain: Runaway ● Problem: Domain Separation● Solution: Model Checking

14

Thermal Domain: Runaway

● Cells generate heat from charge and discharge.● At some temperature cells catch fire.● Reaction propagates to other cells – runaway.

15

Thermal Domain: Runaway

● Cells generate heat from charge and discharge.● At some temperature cells catch fire.● Reaction propagates to other cells – runaway.

16

Thermal Modeling for Batteries

17

Thermal Modeling for Batteries

18

Connection Patterns Affect Runaway

19

Thermal Domain Summary

● Goal: seek battery designs resilient to runaway.● Abstractions:

– 3D physical models of cells.

– Lumped differential equations.

20

Outline

● Battery for Electric Vehicles● Electrical Domain: Scheduling● Thermal Domain: Runaway ● Problem: Domain Separation● Solution: Model Checking

21

Domain Separation

● Electrical domain:– Abstraction: circuits

– Decides configuration of cell connections

– Oblivious of heat (assumes any configuration is acceptable heat-wise)

● Thermal domain:– Abstraction: geometry

– Simulates heat propagation

– Cannot scale to dynamic scheduling(assumes fixed configuration)

22

Domain Separation

● Electrical domain:– Abstraction: circuits

– Decides configuration of cell connections

– Oblivious of heat (assumes any configuration is acceptable heat-wise)

● Thermal domain:– Abstraction: geometry

– Simulates heat propagation

– Cannot scale to dynamic scheduling(assumes fixed configuration)

● Problem: is a battery with a concrete scheduler vulnerable to thermal runaway?

23

Outline

● Battery for Electric Vehicles● Electrical Domain: Scheduling● Thermal Domain: Runaway ● Problem: Domain Separation● Solution: Model Checking

24

Solution: Bridge Domains

● Electrical model picks a scheduler.● Thermal simulations encode a connection

pattern.● Model checker verifies if the scheduler respects

the pattern via exhaustive state search.

Electrical domain

Thermal domain

Model checking

Discharge scheduler

Acceptable

configuration patternSchedulerrespects

the pattern

25

Model Checking: Abstraction

● Matrix of cells. Each cell x has:– charge(x) – a Boolean charge.

– group(x) – a serial group it belongs to.

– status(x) – discharging (d), charging (c), idle (i).

26

Model Checking: Abstraction

● Encoding: charge as color, “group, status”:

1,d 1,d 1,i 1,d

2,d 2,i 2,d 2,d

3,d 3,d 3,d 3,i

● Matrix of cells. Each cell x has:– charge(x) – a Boolean charge.

– group(x) – a serial group it belongs to.

– status(x) – discharging (d), charging (c), idle (i).

1,i

3,i

2,i

27

Model Checking: Transition

28

Model Checking: Transition

● Step 1 (deterministic): – Scheduler forms cell groups

– Scheduler decides which groups to discharge

● Scheduler variants: – Fixed cell groups (FG) vs. group packing (GP).

– Weighted (W - pick most charged) vs. unweighted (U - pick sequentially).

● Step 2 (non-deterministic): – For all cells x:

● If status(x) == d then x.charge = 1 ++ x.charge = 0;● If status(x) == c then x.charge = 1 ++ x.charge = 0;

29

Property Checked: Thermal Neighbors

30

Property Checked: Thermal Neighbors

● Cells x1 and x2 are thermal neighbors if: – group(x1) = group(x2)

– status(x1) = d && status(x2) = d

– ||x1 – x2||1 <= Const [used Const = 2]

● TN(n) – number of cells with n thermal neighbors● LTL property “configuration is resilient to runaway”:

– G ( Σi (K(i)*TN(i)) >= 0 ), i = 0..3.

● K(i) are weights determined by thermal simulation.

31

Property Checked: Thermal Neighbors

● Cells x1 and x2 are thermal neighbors if: – group(x1) = group(x2)

– status(x1) = d && status(x2) = d

– ||x1 – x2||1 <= Const [used Const = 2]

● TN(n) – number of cells with n thermal neighbors● LTL property “configuration is resilient to runaway”:

– G ( Σi (K(i)*TN(i)) >= 0 ), i = 0..3.

● K(i) are weights determined by thermal simulation.

32

Validation: Effectiveness

33

Validation: Effectiveness

● Implementation: Promela/Spin.● Effectiveness of bridging domains:

– Does model checker separate schedulers into those that satisfy the property & those that do not?

– Setup: 4x4 battery, K(0) = K(2) = K(3) = 2, K(1) = -1

● Result: – Schedulers with fixed groups satisfy the property.

– Scheduler with group packing doesn't.

34

Validation: Scalability

● Scalability: does model checker handle practically sized tasks?– Electrical experiment in Kim09 has 4 cells.

– Thermal experiment in Pesaran13 has 3 cells.

Cells Time on FGU (s)

Time on FGW (s)

Time on GPW (s)

9 0.13 0.15 0.15

12 0.61 2.34 3.94

16 44.0 31.4 127

20 1060 619 MEMLIM

25 MEMLIM MEMLIM MEMLIM

35

Conclusion

● Electrical and thermal domains are separated:– Checking thermal runaway vulnerability is not

feasible within either domain.

● Model checking of battery configurations:– Bridges the domains.

– Detects thermal runaway vulnerability.

36

Battery Scheduling Architecture

37

Related Work● Thermal abstraction on top of electrical● No reconfiguration and limited fidelity (only

convection)

38

References

● H. Kim and K.G. Shin. Scheduling of Battery Charge, Discharge, and Rest in RTSS 2009.

● S. Ci, J. Zhang, H. Sharif, and M. Alahmad. Dynamic Reconfigurable Multi-Cell Battery: A Novel Approach to Improve Battery Performance in APEC 2012.

● G. Kim and A. Pesaran. Analysis of Heat Dissipation in Li-Ion Cells & Modules for Modeling of Thermal Runaway in LLIBTA Symposium 2007.

● A. Pesaran et al. Tools for Designing Thermal Management of Batteries in Electric Drive Vehicles in in LLIBTA Symposium 2013.