DE102016112764B4 - INTERFACE MODULE FOR A VEHICLE ON-BOARD NETWORK, POWER DISTRIBUTOR AND ON-BOARD NETWORK FOR A MOTOR VEHICLE - Google Patents

Abstract

Interface module (102) for an on-board network (100) of a motor vehicle (104) with a conventional sub-on-board network (106) and -a highly available safety on-board network (108), the sub-on-board network (106) - a primary power supply (110) and a secondary voltage supply (116), at least one load (112, 114) being arranged in the on-board safety network (108) for which functional safety and a redundant power supply are to be ensured by means of the primary voltage supply (110) and the secondary voltage supply (116), wherein the interface module (102) is arranged between the sub-on-board network (106) and the safety on-board network (108) and is designed, a fault in a component of the on-board network (100) in the form of an unplanned voltage change and / or current change between the sub-on-board network (106) and the Block safety electrical system (108), with a number of primary switches (Tp1, Tp2, Tpn) each for switching the primary voltage control supply (110) to the at least one load (112, 114) in the on-board safety network (108), - a number of secondary switches (Ts1, Ts2, Tsn) each for switching the secondary voltage supply (116) to the at least one load (112, 114 ), and a control device (122) for controlling the number of primary switches (Tp1, Tp2, Tpn) and secondary switches (Ts1, Ts2, Tsn) in order to prevent a fault in a component of the vehicle electrical system (100) in the form of an unplanned voltage change and / or to block a current change between the sub-on-board network (106) and the safety on-board network (108), the number of primary switches (Tp1, Tp2, Tpn) being designed to block a current flow in the direction of the conventional on-board network (106) even in the closed state, and the number of secondary switches (Ts1, Ts2, Tsn) is designed to block a current flow in the direction of the on-board safety network (108) even in the closed state.

Description

Technical field

The present invention relates to an interface module for an electrical system of a motor vehicle, a power distributor with such an interface module and an electrical system for a motor vehicle. The on-board electrical system includes a conventional sub-electrical system and a highly available safety on-board electrical system.

State of the art

The vehicle electrical system connects an energy source via distributors and sub-distributors to the various loads or consumers in the motor vehicle. This means that the components of the on-board electrical system include power distributors such as distributors and sub-distributors as well as loads, but also cables connecting them. The cables can be connected to interfaces of the distributors, sub-distributors or loads via plug connections.

More and more electronic circuits are used in the vehicle electrical system in motor vehicles. An increasing number of (networked) control devices using electronic circuits are installed in a motor vehicle, which exchange switching information or switching commands with one another or switch loads. With the development towards autonomous driving, the subject of functional safety (FuSi) is becoming increasingly important. A distinction is made between a quasi-conventional part and a highly available safety part both in the control units and in the connected loads.

Safety-relevant functions already exist in today's vehicles, e.g. automated steering of the parking function. These functions must be designed as fail-safe, which means that when an error is detected, the safe state is "off" and the driver is notified via display instruments. Autonomous driving systems, on the other hand, must be designed fail-operational with an error state transition to the safe state "on". The failure of the supply of energy (supply line) or communication (bus line) for this function can directly endanger people. This safe state "on" must be kept until the vehicle can be stopped in a safe place or until the driver can take control. Since the safe state is "on", the supply becomes relevant for compliance with the safety target.

The German patent application describes how to increase functional safety DE 10 2016 106 296 a method for monitoring a connection quality between components of an on-board network using a data mining approach. The German patent application DE 10 2016 111 690 discloses a modular power distributor, in which a busbar is arranged separately from a printed circuit board having controls and fuses.

For the on-board electrical system, the requirement for freedom of interference arises for the subarea relevant for functional safety. Interference is understood as a retroactive effect of errors in the conventional, non-FUSI-relevant sub-area that endanger the safety target. Examples of this include a voltage drop due to a short circuit in the auxiliary heater or a fault in sensors or control units due to EMC negative feedback. Such interference is more likely to occur than a complete line failure. In other words, in addition to direct faults in the supply (line break), repercussions of the faults in other systems can endanger the safety target. If the FUSI requirements are passed on to the “non-FUSI”, conventional part of the vehicle electrical system, this will have considerable cost implications.

The DE 10 2008 062 203 A1 relates to an electrical system for a vehicle.

The DE 10 2007 062 955 A1 relates to a circuit for voltage stabilization of an electrical system.

The DE 199 13 131 A1 relates to a power supply system with two batteries of different voltages and at least one consumer, which is connected to the two batteries in parallel in such a way that the failure of one battery ensures the other the power supply.

The DE 198 55 245 A1 relates to a redundant power supply for electrical consumers in a vehicle electrical system.

The US 5,784,626 A relates to a battery connection device for a computer system.

The WO 2009/012 843 A1 relates to an electronic switch for separating different areas of a vehicle electrical system.

Description of the invention

It is therefore an object of the invention to “cut free” the FUSI portion of the vehicle electrical system using means that are as simple as possible in terms of construction and to introduce a dedicated FUSI layer in the vehicle electrical system.

The object is solved by the subject matter of the independent claims. Advantageous developments of the invention are specified in the dependent claims, the description and the accompanying figures.

An interface module is set up to be arranged between a conventional sub-electrical system and a highly available safety electrical system. The interface module is designed to block a malfunction of a component of the vehicle electrical system in the form of an unplanned voltage change or unplanned current change between the sub-electrical system and the safety electrical system. For example, a fault in the form of a short circuit in the sub-electrical system or in the safety electrical system is thus isolated and electrically isolated from the other areas of the electrical system.

The on-board electrical system comprises a plurality of loads, which can be arranged both in the conventional sub-on-board electrical system and in the safety on-board electrical system. A load can be understood here to mean any (electrical) consumer, such as sensors. At least one primary voltage supply and one secondary voltage supply are additionally arranged in the conventional sub-electrical system in order to supply the electrical system. A voltage supply can be understood to mean both an energy store and a generator and a combination of these. The voltage supply can also have DC-DC converters. The voltage position of the energy store or of the generator can correspond to the voltage position of the connected load (s) or, alternatively, the voltage position can be adapted via a DC voltage converter, also referred to as a DC / DC converter.

At least one load is arranged in the on-board safety system that is system-relevant and thus requires, among other things, a redundant power supply according to the principles of functional safety. Depending on the required security level or security requirement level, additional security measures must be taken in addition to the redundant power supply via primary power supply and secondary power supply. Malfunctions and failures are advantageously isolated and blocked by the interface module. The safety on-board network includes the loads relevant for functional safety (FUSI), which is why these are also referred to as FUSI-relevant loads.

In international standardization according to IEC 61508 / IEC61511, the term safety requirement level also refers to a safety integrity level (SIL). With regard to the reliability of safety functions, the safety requirement level serves to assess electrical / electronic / programmable electronic (E / E / PE) systems. The safety-related design principles result from the desired level, which must be observed so that the risk of malfunction can be minimized.

As shown at the beginning, a special feature of the loads arranged in the on-board safety system is that a safe state is defined. If a system detects a malfunction through its self-diagnosis, it should change to a state in which there is no longer any danger from the system. This safe state depends on the type of overall system. With an engine control system for a car, this could be the "engine off" state, with a steering control system for autonomous driving, the safe state would be "on".

An interface module for the supply of dedicated, highly available safety on-board power supply modules is presented. One (or more) interface module (s) separate the FUSI part from the conventional part. Disorders such as A voltage dip or failure or overvoltage are blocked by the interface module. This has the advantage that the conventional part of the vehicle electrical system is local, i.e. can be used together with vehicles without autonomous driving and causes no additional costs in the conventional part. The presented interface module advantageously achieves a freedom from interference in the safety on-board network for the components relevant for functional safety.

The interface module comprises a number of primary switches for switching the primary voltage supply to the load (s) in the safety on-board network, and a number of secondary switches for switching the secondary voltage supply to the load (s) in the safety on-board network as a redundant supply branch. The switches are controlled by a control device in order to block a malfunction of a component of the on-board electrical system in the form of an unplanned voltage change and, additionally or alternatively, a change in current between the partial on-board electrical system and the safety on-board electrical system. A component of the vehicle electrical system can be understood here to mean a load or a connection such as a cable or a busbar, a distributor or the like. At least one primary switch and one secondary switch can be assigned to each load in the on-board safety system. In this way, a fault can be isolated and only a small part of the vehicle electrical system, ideally a load, can be switched from the primary voltage supply to the secondary voltage supply or separated from the vehicle electrical system.

The primary switches are designed to block a current flow in the direction of the conventional electrical system, even in the closed state, and the secondary switches are designed to block a current flow in the direction of the safety electrical system, even in the closed state. In the equivalent circuit diagram this can be thought of as a diode. In this way, faults or failures in the vehicle electrical system can always be isolated in the appropriate direction.

The primary switches and secondary switches can be implemented as transistors. In particular, the primary and secondary switches can be designed as MOSFETs. In the open state, these block a current flow from the source towards the drain. The interface module can thus be easily implemented as an integrated circuit.

If the switches of the interface module are designed as transistors, it is advantageous if the primary voltage supply is connected to the source of the primary switch and the secondary voltage supply is connected to the drain of the secondary switch. With the primary switches, a current flow in the closed state can simply be blocked in the direction of the conventional electrical system, and with the secondary switches a current flow in the closed state in the direction of the safety electrical system.

In a favorable embodiment, the secondary switches are designed as electronic fuses. If the electronic fuses detect a short circuit together with a control device, they can switch to the open state. If the load has an additional redundant power supply, the load can continue to be supplied via the latter. By using electronic fuses, a higher level of safety can be achieved in cooperation with a control device, since additional error detection takes place.

In order to increase the safety level, a safety switch can be arranged between the secondary switches and the secondary voltage supply. The safety switch is designed to prevent feedback from the primary voltage supply to the secondary voltage supply. The safety switch advantageously blocks a current flow in the direction of the secondary voltage supply even in the closed state. This secures the secondary power supply against damage due to a short circuit in the area of the interface module or the safety on-board network.

The safety switch can be designed as a safety transistor, the source of which is connected to the secondary voltage supply. This enables the switch to be implemented cost-effectively and efficiently.

Furthermore, the interface module can have a monitoring device for monitoring a supply voltage of the load (s) in the safety on-board electrical system in order to sense, evaluate and recognize a fault in a component of the on-board electrical system in the form of an unplanned voltage change and additionally or alternatively an unplanned current change. The monitoring device can provide monitoring information representing the supply voltage. The control device is designed to control the switches using the monitoring information.

The control device is advantageously designed to control the switches in such a way that the corresponding switch is opened when the voltage drops below a threshold value. Whenever the voltage falls below the predefined threshold value, this indicates an error. In the 12 V vehicle electrical system, this threshold can be around 11 V. If the primary voltage supply from the load is switched off in this way, the secondary voltage supply is switched on in parallel, that is to say the associated secondary switch is closed. If the fault is in the following supply branch and thus the secondary power source cannot supply the load, the secondary power supply is also cut off via the affected supply branch, i.e. the switch is opened.

In addition to voltage monitoring, the monitoring device can also monitor a current at an input of at least one switch on the side of the sub-electrical system. In this way, the current fed into the on-board electrical system via the switch can be determined. In this case, the monitoring information additionally represents the current. In this way, more information about the state of the safety on-board network can advantageously be evaluated and possibly creeping errors can be recognized at an early stage. In this way, forward-looking measures can be initiated.

To increase safety, a fuse can be arranged between an output of a primary switch and a connection for the load. The fuse can be a mechanical fuse, in particular a fuse. In the case of a plurality of switches, corresponding fuses can be provided separately for each switch.

The inventive idea can be easily integrated into a power distributor. The switches can be used as electronic fuses or as one Combination of switches and mechanical fuses should be formed. A space-saving interface module can be integrated into the power distributor. Depending on the application, a power distributor can be created for loads in the safety on-board network or for loads in the safety on-board network and also in the conventional partial on-board network.

An on-board electrical system for a motor vehicle is also presented, which comprises a conventional sub-electrical system and a highly available safety on-board electrical system. The sub-electrical system and the safety electrical system are connected via a variant of an interface module described above.

In one variant, the vehicle electrical system has a second interface module. A load for which the requirements in terms of functional safety are particularly high, for example ASIL level D, is connected both via the first interface module and via the second interface module. The second interface module can switch energy from the primary voltage supply and a second secondary voltage supply to the load. In this way, the supply branches and the voltage supply can be implemented redundantly and the probability of failure can be further reduced.

Figure list

• 1 eine schematische Darstellung eines Bordnetzes mit einem konventionellen Teilbordnetz und einem Sicherheitsbordnetz gemäß einem Ausführungsbeispiel der vorliegenden Erfindung, und
• 2 einen vereinfachten Schaltplan eines Schnittstellenmoduls für ein Bordnetz eines Kraftfahrzeugs gemäß einem Ausführungsbeispiel der vorliegenden Erfindung.

An advantageous exemplary embodiment of the invention is explained below with reference to the accompanying figures. Show it:

• 1 a schematic representation of an electrical system with a conventional sub-electrical system and a safety electrical system according to an embodiment of the present invention, and
• 2nd a simplified circuit diagram of an interface module for an electrical system of a motor vehicle according to an embodiment of the present invention.

The figures are merely schematic representations and serve only to explain the invention. The same or equivalent elements are provided with the same reference numerals throughout.

1 shows a schematic representation of an electrical system 100 in a motor vehicle 104 . The electrical system 100 includes via an interface module 102 connected conventional electrical system 106 and a highly available safety on-board network 108 . The sub-electrical system 106 includes a primary power supply 110 for supplying loads 112 , 113 , 114 . The loads are there 112 and 114 representative of loads in the safety electrical system 108 . These could include control units or actuators for autonomous driving, for example. Weight 113 is in the conventional electrical system 106 arranged. For the loads 112 and 114 a redundant power supply is provided. For this is a secondary power supply 116 in the sub-electrical system 106 arranged and to the interface module 102 tied up. The primary power supply too 110 is with the interface module 102 electrically connected.

Weight 112 is via two separate lines with the interface module 102 connected. Weight 114 is with the interface module 102 connected via a line. In both cases, a redundant power supply can be provided, as required in the context of functional safety.

The interface module 102 is trained, malfunctions and failures in the electrical system between the sub-electrical system 106 and the safety wiring system 108 to isolate. Malfunctions or failures are detected indirectly through unplanned voltage changes or current changes. A drop in a supply voltage U below a threshold value is a clear sign of an error, such as a short circuit or a defect in the voltage supply. An increase in the current flow I above a threshold value indicates, for example, an error in the area of the load. A validation can also be carried out via an evaluation over time, ie in what time period a voltage change or current change has occurred.

2nd shows a simplified circuit diagram of an interface module 102 for an electrical system 100 according to a preferred embodiment of the present invention. The basic structure corresponds to that in 1 illustrated embodiment. The primary power supply 110 includes a 12V battery that has a power distributor 230 and a DC converter 232 with a high-voltage battery 234 is electrically connected. In the illustrated embodiment, the secondary power supply 116 via a loading unit 236 to the high-voltage battery 234 tied up. Both the primary power supply 110 as well as the secondary power supply are with the interface module 102 electrically connected.

The interface module 102 In the illustrated embodiment, comprises three primary switches Tp1, Tp2, Tpn for switching the primary voltage supply 110 at the expense 112 , 114 and three secondary switches Ts1, Ts2, Tsn for switching the secondary voltage supply 116 at the expense 112 , 114 . So is the primary power supply 110 via a power distributor 120 each connected to an input of the three primary switches Tp1, Tp2, Tpn. The secondary power supply 116 is via a power distributor 120 ' connected to an input of the secondary switches Ts1, Ts2, Tsn.

Between the power distributor 120 ' and the secondary power supply 116 a safety switch Tqs is arranged.

The output of the first primary switch Tp1 and the output of the first secondary switch Ts1 are electrically connected via a node (without reference numerals). The node is connected to the load 112 connected. There is a fuse between the node and the output of the first primary switch Tp1 238 arranged. In a preferred embodiment, this is a fuse 238 . The same arrangement is found between the other switches Tp2, Ts2, Tpn, Tsn and the loads 112 , 114 .

A monitoring device 118 is set up to measure the supply voltage U to the loads and the current I at the input to the switches Tp1, Ts1, Tp2, Ts2, Tpn, Tsn and to monitor for exceeding or falling below a specific threshold value. Here is the monitoring device 118 set up monitoring information 124 to provide.

Furthermore, there is a control device 122 provided, which is designed, the monitoring information 124 to receive and process this in order to provide control information derived therefrom for controlling the switches Tp1, Ts1, Tp2, Ts2, Tpn, Tsn, Tqs. In the exemplary embodiment shown, the control device comprises 122 Microcontroller µC as well as application-specific ASICs. A simple implementation is also possible using comparators which have a (temperature-compensated) reference voltage Uref representing a threshold value with the supply voltage U or the monitoring information representing them 126 compare the respective loads.

In a preferred exemplary embodiment, the primary switches Tp1, Tp2, Tpn and the secondary switches Ts1, Ts2, Tsn are transistors, in particular they are designed as MOSFETs. The MOSFETs Tp1, Tp2, Tpn, Ts1, Ts2, Tsn are in 2nd shown with an equivalent circuit diagram. The safety switch Tqs is also designed as a MOSFET in the preferred exemplary embodiment. The safety switch Tqs, which is designed as a MOSFET, prevents feedback from the primary voltage supply 110 into the secondary power supply 116 . Compared to the use of a diode, the MOSFET advantageously has a lower power loss.

When the switches Tp1, Tp2, Tpn, Ts1, Ts2, Tsn, Tqs are implemented as MOSFETS, the primary voltage supply is 110 via the (primary) power distributor 120 connected to the source of the MOSFETs Tp1, Tp2, Tpn. The secondary power supply 116 is via the (secondary) power distributor 120 ' connected to the drain of the MOSFETs Ts1, Ts2, Tsn. In the safety switch Tqs designed as a MOSFET, there is a drain with the (secondary) current distributor 120 ' and source with the secondary power supply 116 connected. The control device 122 is connected to the gate of the MOSFETs Tp1, Tp2, Tpn, Ts1, Ts2, Tsn, Tqs.

The following is the in 2nd circuit shown with the interface module 102 in other words, to highlight the benefits even more. The conventional battery supplies the Fusi load branches via the transistors Tp1..Tpn 112 , 114 . A distinction can be made between three error scenarios.

In the event of a voltage drop in the conventional electrical system component 106 (for example as a result of a short circuit) senses the voltage measurement U that the voltage is less than 11 V, for example, the secondary transistors Ts1..Tsn are turned on and the primary transistors Tp1..n block. The supply then takes place via a secondary source 116 that are part of the interface module 102 can be. As a secondary source 116 For example, a compact 5 Ah 14 V source can be used, which can supply a typical piloted driving arrangement for up to 10 minutes (depending on the power requirement in the "Save State On").

In a second fault, a short circuit occurs with a FUSI load 112 , 114 accepted. Is in the supply path of the load shown on the left 112 a short circuit causes the DRX-TBS fuse to burn 238 after the primary transistor Tp1 through, the transistor Tp1 cannot block in this direction. Since the voltage U drops at the output, the secondary transistor Ts1 also switches through. So the system tries to keep the state-on. The "diversity" required by the ASIL level is therefore given for the protection systems. If the transistor Ts1 designed as electronic fuse Ts1 with DRX-EFASic 122 also detects a short circuit, this will also switch off. The FUSI load 112 can then be supplied via the second path.

In a third scenario, supply lines failing in the FUSI electrical system section 108 accepted. The interface module 102 also supplies loads 114 that have only one power connection. For this purpose, an algorithm for line diagnostics has been implemented that recognizes impending errors such as degrading contacts at an early stage.

Reference list

100

Wiring system

102

Interface module

104

Motor vehicle

106

conventional electrical system

108

Safety electrical system

110

primary power supply

112

load

114

load

116

secondary power supply

118

Monitoring device

120, 120 '

Power distributor

122

Control device

124

Monitoring information

126

Threshold

230

Power distributor

232

DC voltage converter, DC / DC converter

234

High-voltage battery

236

Charging unit from voltage level X

238

Fuse, fuse

Tp1, Tp2, Tpn

primary switch

Ts1, Ts2, Tsn

secondary switch

Tqs

Safety transistor

DC / DC

DC converter

U

Supply voltage

µC

Control device, microcontroller

EFASic

Control ASIC: Driver & control for MOSFETs

Claims (13)

Interface module (102) for an electrical system (100) of a motor vehicle (104) with - A conventional electrical system (106) and - a highly available safety on-board network (108), the sub-on-board network (106) - A primary power supply (110) and - comprises a secondary voltage supply (116), at least one load (112, 114) being arranged in the on-board safety system (108), for which functional safety and a redundant power supply are to be ensured by means of the primary voltage supply (110) and the secondary voltage supply (116) wherein the interface module (102) is arranged and designed between the sub-electrical system (106) and the safety on-board electrical system (108), a fault in a component of the on-board electrical system (100) in the form of an unplanned voltage change and / or current change between the sub-electrical system (106) and to block the on-board electrical system (108) with - a number of primary switches (Tp1, Tp2, Tpn) each for switching the primary voltage supply (110) to the at least one load (112, 114) in the on-board electrical system (108), - A number of secondary switches (Ts1, Ts2, Tsn) each for switching the secondary voltage supply (116) to the at least one load (112, 114), and - A control device (122) for controlling the number of primary switches (Tp1, Tp2, Tpn) and secondary switches (Ts1, Ts2, Tsn) in order to disrupt a component of the vehicle electrical system (100) in the form of an unplanned voltage change and / or current change between to block the sub-electrical system (106) and the safety on-board electrical system (108), the number of primary switches (Tp1, Tp2, Tpn) being designed to block a flow of current in the direction of the conventional electrical system (106) even in the closed state, and the number of secondary switch (Ts1, Ts2, Tsn) is designed to block a current flow in the direction of the safety electrical system (108) even in the closed state. Interface module (102) according to Claim 1 , in which the number of primary switches (Tp1, Tp2, Tpn) and / or the number of secondary switches (Ts1, Ts2, Tsn) are transistors, in particular MOSFETs. Interface module (102) according to Claim 2 , in which the primary voltage supply (110) is connected to the source of the number of primary switches (Tp1, Tp2, Tpn) in the form of transistors and the secondary voltage supply (116) is connected to the drain in the number of secondary switches (Ts1, Ts2, Tsn) in the form of transistors is. Interface module (102) according to one of the Claims 1 to 3rd , in which the number of secondary switches (Ts1, Ts2, Tsn) are designed as an electronic fuse. Interface module (102) according to one of the Claims 1 to 4th , in which a safety switch (Tqs) is arranged between the number of secondary switches (Ts1, Ts2, Tsn) and the secondary voltage supply (116) and is designed to block a current flow in the direction of the secondary voltage supply even in the closed state. Interface module (102) according to Claim 5 , in which the safety switch (Tqs) is designed as a safety transistor (Tqs), the source of which is connected to the secondary voltage supply (116). Interface module (102) according to one of the preceding Claims 1 to 6 , with a monitoring device (118) for monitoring a supply voltage (U) of the load (112, 114) in order to detect a fault in a component of the vehicle electrical system (100) in the form of an unplanned voltage change and / or current change and the supply voltage (U) generating representative monitoring information (124), the control device (122) being designed to control the switches (Tp1, Tp2, Tpn, Ts1, Ts2, Tsn) using the monitoring information (124). Interface module (102) according to Claim 7 , in which the control device (122) is designed to control the switches (Tp1, Tp2, Tpn, Ts1, Ts2, Tsn) when the supply voltage (U) represented by the monitoring information (124) falls below a threshold value (126). Interface module (102) according to one of the Claims 7 to 8th , in which the monitoring device (118) is designed to monitor a current (I) at an input of at least one switch (Tp1, Tp2, Tpn, Ts1, Ts2, Tsn) on the sub-electrical system (106) side, the monitoring information ( 124) represents the current. Interface module (102) according to one of the preceding Claims 1 to 9 , in which a fuse (238), in particular a mechanical fuse (238), is arranged between at least one primary switch (Tp1, Tp2, Tpn) and a connection for the load (112, 114). Power distributor (120) with an interface module (102) according to one of the preceding claims. Vehicle electrical system (100) for a motor vehicle (104) with a conventional electrical subsystem (106) and a highly available safety electrical system (108) with an interface module (102) according to one of the Claims 1 to 10th . Vehicle electrical system (100) according to the preceding claim, with a second interface module (102 ') according to one of the Claims 1 to 10th , wherein a load (112, 114) is electrically connected to both the interface module (102) and the second interface module (102 ').

Images