NCOP14 regulations, safety and revision

[HeadsUp]

thanks to all for the lively content in this thread

small point on structure of safety devices .

If people are concerned about power being suddenly isolated when a vehicle is on the open road / in traffic / in an intersection etc , but on the other hand aknowledging that ground fault circuit interuption is essential... then how about ground fault detection resulting in battery voltage being lowered by isolating most cells from the pack and an error signal being indicated to the driver.
assuming the controller can handle say 48 volts in emergency mode , then the vehicle can still be moved short distances , and if the voltage is lowered to a safe level , then electrocution is prevented.

just a thought . leave it up to you experts to finish it plopery

edited to add " isolating most battery cells "

[acmotor]

Step ahead there HeadsUp !

Potentially the self protecting battery pack. Combined with TJs smart contactors for current limit the mind boggles.

It might be a bit OTT for EV convertors at present but hey, Lithbattboss could build it into the BMI modules and they could send you an SMS. "Master, I regret to inform you that cell # 18318 has put in its resignation notice and gone to ground"

I could attempt something like that with my 12 x 48V modules. Isolate one with either a battery fault or earth (chassis) fault and continue on. Ummmmmmm

weber, You have written the very requirement that should be in NCOP14 IMHO. There will be complaints but as you say, safety is the aim.
TJ are you on board with this ?

Now those bender devices are almost ? what I need. I note they are for grounded and high resistance grounded systems. Looks like I would need 2 with centre ground although voltage 286VDC? is a bit low.

weber, tell me more about the AC currents you consider may flow in the earth line ?

[Tritium_James]

The requiring a tool for access part was in there already in my revision (straight out of the UN standard). It also strongly recommended (but not mandated) the ground fault detection - not mandated mostly because I couldn't find one to buy either. I'm working on it!

I had not added the <120V breakup. I don't have any real problems adding it in, but in reality it probably is a bit over the top if the other two measures are present also (tool access & ground fault). I'd say the more important variant would be to mandate pack breakup for each individual physical battery box/pack, rather than set voltage limits. Breaking into physical packs means all the wiring running around the car between packs goes safe when the contactors are open. The voltage on the plug for each section of the pack is less important IMHO.

[weber]

Now those bender devices are almost ? what I need. I note they are for grounded and high resistance grounded systems. Looks like I would need 2 with centre ground although voltage 286VDC? is a bit low.

They are _exactly_ what you need. You definitely don't need two of them. It doesn't matter where the earth is. And that 286 V DC limit is on the power supply for the device itself, not the system being monitored. It has no galvanic connection to the system being monitored so voltage is irrelevant. All Bender devices appear to have a part number variation that lets you power them from 12 Vdc.

It turns out I was wrong to bad-mouth hall-effect electronic types in favour of directly-operated current relays. I was out of date. The electronic ones (like the Benders) have now been proven to be more reliable. The so-called "current transformer" that is used, is really a 4-wire electronic device that measures total RMS current, combining AC and DC measurements (and presumably contains a hall-effect sensor). Actually they call them a "measuring current transformer" (MCT) to duistinguish them from a plain ordinary 2-wire current transformer (CT).

I note that some datasheets say "Do not put the protective earth wire through the MCT". Others say more correctly, "Do not put the protective earth wire _and_ the supply wires through the MCT". In a situation like an EV, where you have control over where and how many times the source of supply is earthed (once), by far the best thing is to pass _only_ the protective earth through the MCT.

Of course we still don't know what these things cost, and it would be nice to find another manufacturer to compare.

weber, tell me more about the AC currents you consider may flow in the earth line ?

If you get a (less-than-fuse-blowing) fault current from a VF drive phase to chassis (e.g. through a human touching something they shouldn't or motor insulation beginning to break down or water in the VF drive etc.) then the fault current will be an AC current and the same AC current must flow through the earth wire to the centre of the battery.

We need to ensure that any earth leakage device is "class B".

[Rob M]

Tritium_James is making a lot of sense here. We need to be careful not to build too many fences around ourselves. Safety recommendations that are too complex or onerous are unlikely to be considered. It seems that basic ones are difficult enough to enforce.
To take a leaf out of the mining industry's history book would be useful. In the early days, safety was dumped on management and the workers subsequently felt they were being looked after. Unfortunately this didn't work very well and accident rates crept up. The reason being that workers assumed less responsibility for safety as they became less aware of dangerous situations.
Today, safety is a very big part of everyones work day. It is the workers at the coal face who have to be alert for dangerous situations and report them to their bosses.
If we imposes too many safety nets around EV's then home convertors and service personell might just become too complacent and assume everything is safe.
Basics are the most important thing here.
Dont build too many fences so that a false sense of security is felt and the whole EV business becomes ridiculously complex and expensive.
A word on voltages, 150 volts can kill, 600 volts can kill. The analogy given to me yesterday was, "would you prefer a 3 tonne block of concrete to fall on your head or a 6 tonne block of concret to fall on your head".
The aim of NCOP 14 2nd version is to develop sensible guidlines so as to make electric vehicles safe to drive and to work on. Common sense is needed. For example, concentrate on preventing electric shocks by using simple rules such as having terminals properly covered rather than worrying about the voltage. That way a fault is not going to kill anyone under normal cicumstances. Unusual situation can always occur and cannot be covered 100%. A contactor might fail to open for some reason or an ELCB might not operate properly.
The only way we can cover these situations is to be careful, have a bit of common sense and follow the basics.

[HeadsUp]

i agree on avoiding complexity Rob M , but discussing perfect design puts us on a path where next generation devices can be designed and built specifically for EV's

i anticipate that once a " foolproof " design structure is determined , manufacturers will design and build safety devices in volume and the price , size and weight will come down.

hopefully such devices will be a plug-in module that connects easily to the mainstream controllers and has its own self test and error reporting indicator.

[Rob M]

Absolutely correct HeadsUp. I think it might be useful to start another thread so readers dont link all these good ideas to NCOP14 version 2 which will hopefully be finalised by end of April.
Call it "NCOP 14 version 3" perhaps. That is where the the "floating versus grounded pack" has finished up.

[weber]

The requiring a tool for access part was in there already in my revision (straight out of the UN standard). It also strongly recommended (but not mandated) the ground fault detection - not mandated mostly because I couldn't find one to buy either. I'm working on it!

I agree that insulation alarms for floating systems, and residual current disconnectors for earthed systems, should not be mandatory at this point in time as they are still too difficult to get, and (I expect) too expensive, and would be rather like the icing on the cake safety-wise.

To all, I note that Australian and European standards use the word "earth" rather than "ground". But in any EV standards we are going to have to stop calling the chassis "earth" or "ground". Because there are issues of possible lethal voltages between the chassis and the _real_ earth during charging. We don't want any confusion here. Language problems occur with the verb phrase "connect to the chassis" and the adjective phrase "connected to the chassis". It is so tempting just to shorten them to "earth" and "earthed".

I suggest we adopt the hyphenated verb "chassis-earth" and adjective chassis-earthed" as in, "In the chassis-earthed case we recommend you chassis-earth the centre of the battery".

Plain "earthed" is defined in AS/NZS 3000 as

"1.4.43 Earthed

Connected to both the supply neutral and the general mass of earth in accordance with the appropriate requirements of this Standard."

If you want to be absolutely clear about which earth is meant you would use "supply earth" versus "chasis earth".

I had not added the <120V breakup. I don't have any real problems adding it in, but in reality it probably is a bit over the top if the other two measures are present also (tool access & ground fault).

Firstly, I don't think you will have the other _two_ because of the aforementioned expense and unavailability of ground fault devices. Secondly, ground fault devices do not protect against someone putting themselves across a lethal voltage between two active conductors (e.g. when installing or maintaining a battery).

ELV segmentation is mandatory for batteries in buildings and for photovoltaic arrays. I've heard no reason why we should make an exception for EV batteries. However I must point out that this segmentation is not required to be made automatically or with contactors, or with switches of any kind. It can be made manually by the use of connectors. But I feel strongly that it must be possible to perform the segmentation without breaching the insulation. e.g. unbolting a battery link is not an acceptable means. And any connectors used for this purpose must be touch-safe when disconnected as well as when connected.

However, it seems far simpler to do it the way acmotor has done it, by using contactors. Since you need to have many contacts in series to get the required voltage rating anyway, why not distribute them around the pack and use them to break it up into ELV segments (<= 120 V).

The appropriate voltage to consider here is the highest voltage obtained on charge, which means that generally 84 V would be the highest allowable nominal voltage for a segment.

I'd say the more important variant would be to mandate pack breakup for each individual physical battery box/pack, rather than set voltage limits. Breaking into physical packs means all the wiring running around the car between packs goes safe when the contactors are open. The voltage on the plug for each section of the pack is less important IMHO.

That is an important point. Although I don't agree with the last sentence, and nor do AS 3011 or AS 5033.

The battery box boundary is a very good place to do ELV segmentation, but if any single battery box still contains a voltage over 120 Vdc then it still needs a touch-safe means to break it up further.

I would not mandate battery-box segmentation because it may be that you wish to break the battery up into sections of identical (extra-low) voltage (e.g. to charge them all in parallel) but some small battery box contains less than a full ELV segment. However, in that case, cables leaving the box must have greater than usual insulation and mechanical protection e.g. in PVC conduit under a steel top-hat. See AS 3000 2.5.4.3.1.

[acmotor]

weber, tell me more about the AC currents you consider may flow in the earth line ?

If you get a (less-than-fuse-blowing) fault current from a VF drive phase to chassis (e.g. through a human touching something they shouldn't or motor insulation beginning to break down or water in the VF drive etc.) then the fault current will be an AC current and the same AC current must flow through the earth wire to the centre of the battery.

We need to ensure that any earth leakage device is "class B".

But I understood that this is one reason the VFD is expecting DC pack centre to be motor frame.(simulating the MEN principle). VFD already monitors for winding insulation errors including moisture in the motor. So the 'leakage detection' for the motor side of things is already built into the VFD.

Yes, class 'B' for EL (AC + DC) (as per page 4 of Danfoss manual.)

A word on voltages, 150 volts can kill, 600 volts can kill.

The key word with voltage is potential. The potential to kill. The potential for 600V to kill is a lot greater than 150V.

I don't disagree with the sentiment of KISS.
But it must not dominate our thinking.
Attention to safety will, by its very nature, mean that the simplest option is rarely the safest.

Keep in mind that a 2009 SAAB 93 for instance, didn't get to be a safe vehicle by keeping to the 'simple' saftey standards of 100 years ago.
We need to understand and incorporate safe practice, not say it is too much trouble.

We will achieve a compromise I guess. I'm for best practice though.

[weber]

A word on voltages, 150 volts can kill, 600 volts can kill. The analogy given to me yesterday was, "would you prefer a 3 tonne block of concrete to fall on your head or a 6 tonne block of concret to fall on your head".

Hi Rob M, I'm afraid that isn't a very good analogy. Death from electric shock is more like Russian Roulette. 150 Vdc is like having one bullet in the gun, 600 Vdc is like having four.

[acmotor]

weber, that earth talk and segmentation all makes so much sense. Even LBB is off to segment the 144V BMI !

The 120V ELV segment puts >120V EVs in almost compliance with AS3000.

Even if smart safety and AS3000 etc compliance cannot be mandated in the likes of NCOP14 then it can be suggested.

[weber]

But I understood that this is one reason the VFD is expecting DC pack centre to be motor frame.(simulating the MEN principle). VFD already monitors for winding insulation errors including moisture in the motor. So the 'leakage detection' for the motor side of things is already built into the VFD.

In that case, a DC-only earth leakage monitor would be fine on the battery. But I note that Bender don't make any DC-only devices, and a second opinion on any AC leakage shouldn't be a problem.

I see that Bender is a German company and its sole Australian agent is in New Zealand. http://www.ebbco.co.nz/bender_products.html

But you raise a point I hadn't appreciated before. One that might require an earthed battery rather than allowing a choice of earthed versus floating, for industrial AC conversions. Does the VF drive's fault monitoring _require_ that the motor frame be connected to battery centre? I would not expect so.

I agree that in conventional mains usage, DC bus centre is normally at the same potential as supply neutral and therefore the same potential as supply earth. But it is not actually connected to it.

[Johny]

Now there's a curiosity. Since the DC Bus is derived from a 3 phase full wave bridge the +ve and -ve sides of the DC Bus represent some point close to the peak value of the 415 V AC. The "center" of the DC Bus is somewhere around neutral but certainly not able to be coupled to it do to the possibility of large currents flowing.

VFDs have a connection on them with a name like "protective ground" which should be connected to mains ground.

Assumption. The VFD measures output leakage with respect to protective ground.

Does tying DC Bus center to "protective ground" actually cause ground currents to flow that would otherwise not be there? This might cause an imbalance in the DC Bus (-ve vs +ve) to show up as a motor ground fault (as seen by the VFD).

[HeadsUp]

does somebody with more talent than me feel like writing a letter to bender as a product design recommendation or request , specify where things are at in australia with our own discussions on EV's , maybe even add any known details about standards implementation overseas ie , Japan , USA .

in time there WILL be a requirement for the product , if not legislation ,writing such a letter will give bender time to design and release a product.

why not take a long term approach and kick a few balls now


sow good seeds . get good fruit

[acmotor]

Johny's assumption that the VFD measures output leakage with respect to protective earth seems correct. You've spotted the "centre" point which is part of my original reasoning with the VFD/battery system.
It is motor leakage on the motor side of the IGBTs being tested for.
I see no test on the DC bus or mains side. Protective earth and mains neutral are expected to be the same potential.

Note. there is no physical 'centre of DC bus' in the controller and there is no neutral input terminal, only protective earth. The controller does report ripple (unbalance) errors as 'missing mains phase'. Not an issue in EV mode.

No leakage faults occur. I am running with pack centre to protective earth now, so no question there. I also know that leakage detection is working. I've tested it (although should read the actual current I guess). Keep in mind the current detected is most likely aimed at VFD and motor protection, not human.

If the power source (mains neutral or battery bank centre) is not connected to protective ground then the VFD cannot sense motor leakage. (no circuit)
Also, this centre connection limits the voltage across motor winding insulation to frame (chassis ground) to 1/2 DC bus voltage.

Sorry, this is hyjacking the thread a bit, but probably still just on the topic of leakage detection.

[weber]

does somebody with more talent than me feel like writing a letter to bender as a product design recommendation or request ...

HeadsUp,

As I see it, Bender already have products which fit the bill exactly, whether you want to go floating or chassis-earthed. I wrote of "unavailability" above. I should really have said "relative unavailability" or "difficulty of obtaining".

[weber]

C'mon guys. This is Australia. We don't have grounds here (except in our coffee), we have earths.

If the power source (mains neutral or battery bank centre) is not connected to protective ground then the VFD cannot sense motor leakage. (no circuit)

I expect the VFD is doing AC residual current detection over the 3 output phases. So I don't think it will matter where the battery is chassis-earthed.

acmotor, I would be grateful if you would do the experiment of shifting your battery earth off-centre by one of your ELV segments and seeing if it all still works. Coulomb and I are considering having an odd number of 48 V segments.

And if that works, maybe you'd be willing to try a soft earth to battery positive or negative via say a 100 k 1000 volt resistor (e.g. a string of 10 ordinary 1 watt resistors). I know that's a lot to ask. Feel free to say no.

[acmotor]

Good point. I shall experiment.

Hey, weber. you tick us off for 'grounds' then you add dirt to the story with 'soft earth'. As long as we all know what we mean !
Feel free to push for correct nomenclature though.


So if I ground the soft earth connection to the local earth mass namely the chassis is that OK ? Sorry, must be the coffee. I'll get it right soon. I have been told.

[Hemonster]

Hi everybody,

Let's see if I can get my head around this thread. Basically for any series string that is getting up in voltage (mine will be 600VDC), you have to consider some safety measures. This should be done irrespective of the law and be in consideration for Joe Anybody to drive and operate the car without safety concerns with regards to accidental electrocution. This may be a stranger, friend, or family member - none of whom may have any idea how the car works under the hood, nor have an appreciation of the danger of HVDC busses.

The question is, how do you make a 600V HVDC bus safe? (or for that matter even a 144V HVDC bus) There are several issues to consider:

1/ Insulation breakdown on the HVDC pack (due to accidental contact, or bad wiring, or aged insulation on wires)

Methods that have been discussed so far include
a) using an RCD on a floating HVDC pack

- the floating pack requires a short at two points on the HVDC pack to chasis for a short to occur
- this method is a bit pointless as it doesn't warn if there is 1 short to the chasis, but also will not trip if there are two shorts in the middle of the pack to the chasis.
- it will only trip if there is a leak "after" the RCD, but there is a substantial area "before" the RCD where the problem could still occur and go undetected.

b) using an earth leakage detector with a hard earth to the chasis at the middle of the HVDC pack

- this is one step better in that (if the correct EL swich is used)it will be able to sense a fault current in the chasis and either give a warning or shut down the main pack contactors and also open the breakup contactors.
- however this requires a fast acting solution that ensures that the fault current is detected fast enough and reacts well. ie. specialised hardware which will cost money.
- if a single short occurs whilst driving, may cause a dangerous situation where the pack may be disconnected and the car isn't able to limp to the kerbside. This implies less redundancy and potential for added danger.

c) using a soft connection (high impedance) to the chasis, at any point on the HVDC pack (might as well be centre?)

- this would seem the best combination. Here you still need two points before a short occurs, but if there is one short to the chasis, you will be given a warning and still retain the control of the vehicle, perhaps in a limp mode?
- doesn't break the circuit however if there are two shorts and relies on fuses blowing for protection? Could be wired so that if a fuse does blow, the breakup contactors WILL break the pack down to safe voltages automatically.



2/ Excessive short currents

- fuses will be essential to stifle fault currents caused by direct shorts to chasis. They also act as fall back system as long as the fault current is beyond its current rating.
- I'm leaning towards each battery module (mine will be 48V modules) to include a fuse, perhaps in a common fusebox for easy inspection and access.



3/ Breakup contactor ratings and kill sequence

- breakup contactors are likely to be much lower rated than total pack voltage. So it is important to ensure that the main HVDC contactors trip first before the battery modules are broken up. This will avoid damaging the breakup contactors if the fault currents were to occur during high load currents (motor accelerating). If an arc is sustained on the breakup contactors/relays, a fire may start as a result.
- the main contactors cannot stop a short across battery modules internally, hence why fuses on each battery module is important. Either that or ensure that the module relay/contactor will reliably break the arc at worst case short circuit currents (may start to get expensive!),
- however a high resistance short via the chasis might result in the fault currents that is significant, but under the fuse rating - hence this could cause deep discharge of the battery pack and/or excessive heating leading perhaps to a fire. The battery breakup relays thus need to be rated to at least the fuse rating (or higher) so that when the user removes the key and the breakup relays release, it doesn't cause a potential arcing problem that may lead to a fire.

That's my summary (and a few additional ideas), flame away ...