DE102022125650A1 - Supply networks for vehicles with electronic fuses and methods for their operation - Google Patents

Abstract

The invention relates to a control device (4) for an electronic fuse (1) in a vehicle. The control device (4) is monolithic. The control device (4) includes a power switch (17), an oscillator (30), a clock system, a voltage supply (5) and an externally provided operating voltage (6). The control device (4) assumes a normal operating state when the operating voltage (6) is available and an emergency operating state when the operating voltage (6) fails. In normal operation, the voltage supply (5) provides the internal supply voltages for the electronic fuse (1) by processing the operating voltage (6) and charges an energy reserve (8). In emergency operation, the power supply (5) draws the energy for the internal supply voltages from the energy reserve (8) instead of from the operating voltage (6). The power supply (5) supplies the oscillator (30) and the clock system in emergency operation from the energy reserve (8). The control device (4) sets the state of the circuit breaker (17) in normal operation and in emergency operation of the control device (4) if the operating voltage (6) fails.

Description

subject of the invention

The invention relates to a control device (4) for an electronic fuse (1) in a vehicle. The control device (4) is monolithic. The control device (4) includes a power switch (17), an oscillator (30), a clock system, a voltage supply (5) and an externally provided operating voltage (6). The control device (4) assumes a normal operating state when the operating voltage (6) is available and an emergency operating state when the operating voltage (6) fails. In normal operation, the voltage supply (5) provides the internal supply voltages for the electronic fuse (1) by processing the operating voltage (6) and charges an energy reserve (8). In emergency operation, the power supply (5) draws the energy for the internal supply voltages from the energy reserve (8) instead of from the operating voltage (6). The power supply (5) supplies the oscillator (30) and the clock system in emergency operation from the energy reserve (8). The control device (4) sets the state of the circuit breaker (17) in normal operation and in emergency operation of the control device (4) if the operating voltage (6) fails.

The following text of the description of this document further explains the technical environment and the technical content of the invention.

Introduction

The document presented here deals with supply networks in automobiles and the use of electronic fuses in such automotive supply networks.

The decarbonization of mobile road traffic will require efficient energy distribution within vehicles (power distribution).

Today, automobile manufacturers use central fuse boxes (switch boxes or fuse boxes) in their vehicles with a car's fuses, which they typically place in an accessible location in the car. Elaborate wiring harnesses distribute the electrical energy centrally from there. Decentralized fuse boxes with supply sub-networks (sub-networks) are to replace this star-shaped structure in the long term.

A platform concept is in the foreground. As a result, automobile manufacturers can more easily adapt the wiring harnesses to individual customer requirements. A plug&play concept is desirable. A platform with a central supply network is being considered. The goal is a modular system for electrical supply networks in cars. This reduces the supply networks in the car as a result and enables a modular system for the supply networks. According to the concept discussed in this document, the electronic fuses should be placed on the circuit boards of higher-level computer systems, the control units. If necessary, these circuit boards should include slots for the fuse housings of the electronic fuses.

The new topology of an energy distribution system of the supply networks should preferably have a tree structure instead of the central star shape of the previous system of the previous supply networks with a switch box with the electronic fuses in the star center of the supply network and the energy consumers at the star beam ends of the supply network. In this case, a plurality of electronically controllable electronic fuses are preferably connected in series one behind the other. A tree structure of the supply network branches out from the central starting point of the supply network to the consumers. The branches (supply branches) of the tree of the supply network are the supply lines. The different supply branches or different supply sub-networks have different importance, in particular in terms of functional safety. Each or at least a majority of the line sections of the supply branches or supply sub-networks is preferably provided with electronic fuses, which carry out a method for protecting the respective downstream supply sub-tree of the supply network or the respective downstream supply sub-network, the protection strategy of which depends on the importance of the downstream supply sub-tree or of the downstream sub-grid and its importance for the safety of vehicle operation in terms of condition and availability. Depending on the meaning and importance of the connected consumers, each electronic fuse carries out a procedure that electrical parameters of the current flow in the relevant line section of the relevant Ver supply branch or the relevant sub-network and, if applicable, the potential on the supply side against a reference potential. If necessary, the computer core of the control device of the electronic fuse exchanges data with other computer cores of the control devices of other electronic fuses in subsequent and preceding branches of the proposed supply tree or in subsequent and preceding supply subnetworks of the supply network. This data exchange can take place via a special backup data bus (also referred to below as backup data bus) or another data bus, for example a Lin data bus or a DSI3 data bus or a PSI5 data bus or a CAN data bus or a CAN FD data bus or an Ethernet Data bus or a Flexray data bus or an LVDS data bus or otherwise wired or wireless, for example via Bluetooth or WLAN or the like. Heretofore, the wiring harness of a vehicle's supply network has been manufactured as a monolith that is supplied as one component and assembled into the vehicle. The document presented here now proposes enabling more flexible structures. This flexibility can be achieved firstly through software flags and secondly through plugging in further components and supply subtrees and supply subnetworks.

An electric vehicle will typically have a first supply tree or a first partial supply network, which the vehicle will then operate at approximately 48V, ie less than 50V.

An electric vehicle will typically have a second supply tree or a second partial supply network, which the vehicle then operates at approximately 800V, ie at significantly more than 50V.

One idea of using the electronic fuses (E-Fuses) is to enable the additional booking of the power supply to sub-components and/or sub-devices of the vehicle.

To this end, the orderer, who is typically a user or driver of the vehicle, preferably transmits a command to a server, for example to the automobile manufacturer's server. The orderer preferably authenticates himself on the server. For example, the customer can provide identification data for his mobile phone or his vehicle or another personalized device that enable a legally secure conclusion of a contract.

A typical control device for the operation of an electronic fuse also includes the so-called system basis chip functionality. This functionality provides all functions to be able to operate a computer core, for example a microcontroller. This can include, for example, the power supply, the emergency power supply, the provision of a data bus interface in the form of a bus transceiver and a watchdog timer (also referred to as a watchdog for short) for monitoring the correct functioning of the computer core of the fuse control device. These are preferably part of the fuse control device. The watch-dog timer takes on al general monitoring device, possibly further monitoring specifications within the meaning of the document presented here.

The detection of non-extinguishing arcs in the 48V network is an important function that such an integrated control device for an electronic fuse must fulfill. The computer core of such a control device of a fuse should therefore recognize such a non-extinguishing arc independently and/or in cooperation with the computer cores of the other control devices of the other fuses and/or in cooperation with one or more higher-level computer systems and individually or in cooperation and/or in cooperation with the computer cores of the other control devices of the other fuses and/or in cooperation with one or more higher-level computer systems through countermeasures, such as temporarily switching off energy sources, consumers and/or partial supply networks, contain and preferably combat the identified problem.

A spectral analysis of the electric current on the line section to be protected, in which the electronic fuse is inserted, is known from the prior art. For this purpose, the electronic fuse uses a current measuring device, for example a shunt resistor 24, to record the time profile of typically successive values of the electric current through the line section to be protected and carries out a spectral analysis of this value profile. If certain structures are present in the frequency spectrum determined in this way, the computer core of the control device of the electronic fuse concludes that there is an arc and, if necessary, switches off the flow of current using the power switch of the fuse, which is typically a fuse transistor. Instead of the computer core of the control device of the fuse, a higher-level computer system, for example a control unit, can optionally also be used of the vehicle, or a computer core of a control device of another electronic security system, carry out this evaluation and initiate, carry out and/or coordinate any necessary countermeasures. To do this, the computer core of the control device of the electronic fuse transmits suitable data to this other device, for example the higher-level control device of the vehicle or the other computer core of the control device of the other electronic fuse. Suitable data can be, for example, the raw measured values or further processed measured values, in particular voltage and/or current values.

However, for the necessary time resolution of the current value profile over time, an increased sampling rate of analog-to-digital converters of the control devices of the relevant fuses is then typically necessary for the application of such a spectral analysis.

Distributed measurement methods are also preferred and necessary. In this case, the control devices of a plurality of electronic fuses preferably record one or more measured values by means of corresponding measuring devices of these control devices of these fuses. Preferably, the electronic fuses each have a respective timer. The control device of the respective electronic fuse preferably uses the respective timer to determine a time stamp value for preferably each measured value or for a group of measured values that they determine. The control device of the fuse in question preferably transmits these measured values together with the associated time stamps to a higher-level computer unit, e.g. a higher-level control unit, or to the computer core of another electronic fuse. The higher-level computer unit or the computer core of the control device of the other electronic fuse compares the measured values of preferably similar time stamps with one another and can thus, for example, infer energy losses in line sections between two electronic fuses. Such a loss of energy can possibly indicate the said arc. The control devices of the fuses or the superordinate computer system preferably take into account any ground offset of the reference potential connection that may occur. If the measured values or the ratio of the measured values to one another or a difference between such measured values or variables derived from them do not correspond to one or more expected values, the higher-level computer unit or the computer core of the evaluating control device of the evaluating electronic fuse can take countermeasures. These can correspond to the countermeasures already described. The data communication can again take place via the security data bus or one of the data buses mentioned above or via a wireless interface, depending on the requirements.

Monitoring the current and/or voltage curves enables so-called health management for the vehicle. For example, the system of the supply network can then detect changes in the power consumption or the spectra of the voltage curve, current curve or energy transport, which may not correspond to the expected curves or values. Possibly, the system of the supply network can thereby inform the workshop or the vehicle owner or another person or institution via the Internet etc. or a display about the condition or the wear or potential damage or the impending failure of electrical consumers. Such data is of particular interest to the vehicle manufacturer. It is therefore conceivable that the computer core of a fuse control device sends measured values and/or operating data recorded via the data bus and via a higher-level computer system and the Internet to a server owned by the automobile manufacturer, where the latter collects this data, processes it further and evaluates it, e.g to obtain preventive maintenance work and to obtain indications of future improvements to its vehicles.

For the purpose of the document presented here, energy-generating components are consumers in which either the direction of current or the direction of voltage is reversed compared to these directions in an energy-dissipating consumer.

Special states, so-called ECO modes, are known for cars, in which a higher-level computer system in the vehicle switches off individual consumers in a targeted manner. Today, the higher-level computer system switches off these individual consumers by means of a command sent to the consumer via the data bus. According to the proposal, the higher-level computer system can also switch off individual consumers in such a way that the higher-level computer system interrupts the entire supply of a supply tree branch or a supply sub-network using an electronic fuse that opens its circuit breaker on command from the higher-level computer system. As a result, the so-called stand-by currents of the large number of consumers, which this supply sub-branch or this supply sub-network supplies with electrical energy, are eliminated for this supply sub-network.

If a consumer at another, higher-priority point in the vehicle's supply network requires a larger amount of energy for a short time, the higher-level computer system of a higher-level control device or the computer core of a control device of an electronic fuse can be connected via the data bus to which the computer cores of the control devices of the relevant Fuses are connected, or switch off a functionally equivalent other data transmission path other supply sub-trees of the supply tree or other supply sub-networks of the supply network at times. Incidentally, a supply tree is a supply network in the sense of the document presented here.

If, at another, higher-priority point in the vehicle's supply network, the supply network is to transport a larger amount of energy over a line section to one or more first consumers for a short time, the higher-level computer system of a higher-level control device or the computer core of a control device of an electronic fuse can use the data bus, to which the computer cores of the control devices of the relevant fuses are connected, or a functionally equivalent other data transmission path other supply sub-trees of the supply tree or other supply sub-networks of the supply network temporarily switch off. This switching off increases the proportion of the current-carrying capacity of the affected line section, which the first consumer uses in the energy supply, in favor of the first consumer. If the short-term additional requirement is over, the higher-level computer system of the higher-level control device or the computer core of the control device of the electronic fuse can restore the original state via the data bus or said data connection. It is therefore a matter of temporarily switching off consumers, e.g. to achieve a kick-down.

It is known from the prior art that relays, for example, are unsuitable for isolating a high-voltage supply sub-grid (HV grid) by means of such relays. This refers to supply sub-networks that have voltages of more than 400V above the reference potential. With such separations, switch-off currents of 5kA can occur. Today, the relays in electric cars only switch between the operating states “charge mode” (charging) and drive mode (driving).

In the prior art, the SiC transistors that are customary today are typically switched via smart FETs. These are FET transistors with little integrated logic. There is therefore a need for adequate control of SiC transistors by suitable control devices for the fuses when such SiC transistors are used as power switches in fuses.

motivating factors

• • Gewichtsreduktion des Autos,
• • Flexibilität der Architektur,
• • Kreatives Power-Management,
• • Funktionale Sicherheit,
• • Bessere Systemzuverlässigkeit.

The following motivating factors are relevant for the use of an electronic fuse (E-Fuse):

• • weight reduction of the car,
• • flexibility of the architecture,
• • Creative power management,
• • Functional safety,
• • Better system reliability.

• • Die Schmelzsicherung ist immer billiger.

The following disadvantages arise when using electronic fuses:

• • The fuse is always cheaper.

To reduce the weight of the car

Electronic fuses can be manufactured with high precision. A vehicle's computer systems can accurately model the switching behavior of the electronic fuses, in contrast to the switching behavior of conventional fuses. This precise predictability of the switching behavior enables the reduction of the safety margins when designing the conductor cross-sections of the line sections in the supply tree and the reduction of similar tolerances, which can reduce the material used for the cable harness in the vehicle and thus the vehicle weight. A lower vehicle weight leads to reduced energy consumption.

Workshops and end users can preferably enlarge the supply trees and supply networks in the vehicle using plug-in modules.

However, this fully modular and non-hierarchical supply network concept is still a long way off. In a first step, the first supply networks, which include electronic fuses, retain the central fuse box (junction box) in the vehicle. The idea is to provide the electronic fuses as pluggable modules. It is possible to install the electronic fuses as plug-in modules instead of the previous fuses in the junction box. These plug-in security modules preferably have a plug-in connection for a data bus plug, which connects the data bus of the computer core of the electronic security control device via a data interface of the electronic security control device to a data bus of the junction box or of the vehicle and thus to a higher-level computer system of the vehicle, for example, a control unit of the vehicle connects.

It is therefore preferably an evolutionary procedure that further develops the functionality of the junction box in that the junction box becomes more intelligent in a first step. Later, it is conceivable to divide the junction box into various smaller junction boxes within the vehicle and finally, in the last step, to equip the vehicle's consumers and energy sources with individual electronic fuses. An electronic fuse in the sense of the proposal discussed here therefore not only fulfills the security function per se, which interrupts the circuit in which the fuse is inserted when a current passed through is exceeded over a longer period of time. An electronic fuse in the sense of the document presented here also provides a) also measuring devices, for example for the acquisition of measured current values of the relevant line section and/or b) also measuring devices for the acquisition of measured voltage values of the relevant line section and c) actuators for changing the state of the relevant line section and d) communication options with other electronic fuses and d) communication options with higher-level computer systems and e) communication options with other device parts of the vehicle, in particular control devices, and f) time-related data and possibly other advantageous services and device parts.

The 37 shows today's protection of the cable of a supply line section. The safety fuse does not respond adequately, particularly for very high impulse currents. The tolerances require a large safety range, which requires an increase in the cable cross-section and thus more material and vehicle weight.

The insertion of electronic fuses can cover various needs of the market. The 38 is intended to present and illustrate this fact.

First of all, the electronic fuse can simulate the behavior of a safety fuse precisely compared to a safety fuse, depending on the electric current that flows through the line protected by the electronic fuse, with practically no tolerance. For this purpose, the electronic fuse uses a measuring device within the electronic fuse to continuously and repeatedly determine the value of the electric current through the circuit breaker of the electronic fuse in the relevant supply line section. The computer core of the control device of the electronic fuse preferably calculates an intermediate value with the aid of a polynomial of the zeroth, first, second or third degree. A polynomial of a straight line greater than one is preferred here in order to more precisely model the quadratic dependency of the electrical energy fed into the secured line section on the current value of the electrical current. The variables of this polynomial are typically the current values of the electric current recorded by the measuring means of the electronic fuse. The computer core of the control device of the electronic fuse preferably integrates this intermediate value over time to form a second intermediate value. The polynomial is preferably a second degree polynomial. This second intermediate value can then, for example, emulate the thermal heating of the safety wire of a safety fuse, given correct parameterization with suitable polynomial coefficients. The advantage is that the behavior of the electronic fuse is practically tolerance-free thanks to suitable calibration. If the second intermediate value exceeds a predefinable threshold value, the computer core of the control device of the electronic fuse switches off the circuit breaker of the electronic fuse connected to the protected line of the supply branch of the supply tree in this model. In this variant, the electronic fuse preferably comprises one or more devices that emulate a fuse. It is typically characteristic here that the electronic fuse comprises one or more device parts which preferably measure the values of the electric current square and integrate wisely. In the sense of the description presented here, this is the case if the device part has a function that corresponds or is functionally equivalent to the processing of the measured values of the current through the circuit breaker of the fuse in the line section to be protected by means of a polynomial of at least a second degree and subsequent integration . This means that an analog and/or digital circuit and/or an analog or hybrid computer can explicitly perform this function. This analog and/or digital circuit and/or the analog or hybrid computer can be part of the control device of the electronic fuse. The electronic safety device preferably has one or more device parts that monitor essential parameters. These are preferably part of a control device for the fuse. It is typically characteristic here that the electronic fuse comprises one or more device parts which process the values of the electric current and/or the voltage of the potential of the line section to be protected against a reference potential only by means of a first-degree polynomial, ie linearly. In the sense of the description presented here, this is the case if the device part has a function that corresponds to the processing of the measured values of the current and/or the voltage in the line section to be protected by means of a polynomial of a degree smaller than the second degree, or is functionally equivalent. This means that an analog and/or digital circuit and/or an analog or hybrid computer can explicitly perform this function, it being possible for this to be part of the control device of the electronic security device. Preferably, these parts include temporal filters that temporally filter and/or temporally integrate these signals. Typically, a particularly favorable filter time of 500 ns can be assumed as the filter time constant of a low-pass filter (filtering time).

In addition to the emulation of a fuse, the proposed electronic fuse preferably also quickly disconnects the circuit breaker of the electronic fuse if the value of the current that the measuring device of the control device of the electronic fuse detects exceeds a permitted maximum value or is not plausible for the usage situation. The plausibility monitoring is preferably carried out by a computer core of the control device of the security device and/or a higher-level computer system outside of the electronic security device. A higher-level computer system of a higher-level control device or the computer core of another electronic fuse can preferably change this maximum value depending on the usage situation and/or the required energy distribution within the vehicle by means of a control command via a wireless and/or wired data transmission path to the electronic fuse. The document presented here only collectively refers to this wireless and/or wired data transmission path as a data bus.

It is important that the control device of the electronic fuse, i.e. typically the computer core of the control device or a functionally equivalent device part of the electronic fuse, switches the circuit breaker of the fuse off or on and does not limit the electric current through the circuit breaker by changing the internal resistance of the circuit breaker, as this would lead to a high power loss in the circuit breaker. The circuit breaker should preferably be switched off in a few ns in such switch-off situations of the supply network, part of which is the electronic fuse.

The automobile manufacturers currently pay less attention to this rapid switch-off and typically still assume a switch-off within a period of several ms.

The car manufacturers and the relevant automotive suppliers typically deal with dynamic loads in the vehicle. They therefore feel the need for the electronic fuse to behave like a fuse in order to avoid unforeseen cross-effects when electronic fuses replace fuses in new, more modern designs. The fuse should therefore also allow the current values to be exceeded within a certain range up to a maximum current value of the electrical current in the electrical line to be protected. This means that the switch-off curve of the electronic fuse should be essentially parabolic in the main area of use.

An important proposal within the document presented here is therefore an electronic fuse with a rapid tripping of the fuse circuit breaker in a time less than 200ms, better less than 100ms, better less than 50ms, better less than 20ms, better less than 10ms, better less than 5ms, better less than 2ms, better less than 1ms, better less than 500µs, better less than 200µs, better less than 100µs, better less than 50µs, better less than 20µms, better less than 10µs, better less than 5µs, better less than 2µs, preferably less than 1µs, preferably less than 500ns, preferably less than 200ns, preferably less than 100ns, preferably less than 50ns, preferably less than 20ns, better less than 10ns, better less than 5ns, better less than 2ns, better less than 1ns. The circuit breaker is inserted into the electrical line to be protected within the electronic fuse as a separating element. This switching off is carried out by the computer core of the control device of the electronic fuse, preferably when a maximum permissible current exceeds a maximum current value and/or when a voltage of the line against a reference potential falls below a minimum voltage value by means of corresponding sub-devices of the control device of the electronic fuse. What is special about the proposal described here is that, at the same time, a switch-off takes place after a permissible time due to the emulation of a fuse characteristic, as described above.

The computer core of the electronic fuse controller could perform the current measurement by means of a shunt resistor in the line and an analog-to-digital converter of the fuse controller. However, this comes with many disadvantages.

The computer core of the control device for the electronic fuse preferably uses the analog-to-digital converter of the control device for the fuse to record voltages between the terminals of the circuit breaker and/or voltages between the terminals of an auxiliary circuit breaker which is connected in parallel with the circuit breaker and is equipped with a shunt resistor in Is connected in series, or functionally equivalent values of physical parameters and determines from this a value for an electric current through the circuit breaker of the fuse, which is switched on in the electrical line to be protected.

When measuring the current through the circuit breaker of the fuse, the computer core of the control device of the electronic fuse can feed an additional test current into the circuit breaker of the electronic fuse using a first test current source. The time course of the current value of this additional test current is preferably modulated with a modulation signal. Preferably the modulation signal has a known amplitude and a known frequency and phase. The modulated additional current thus preferably has a maximum amplitude. The control device of the electronic fuse detects the time profile of the electric current through the circuit breaker and checks whether the signal of the time profile of the measured values of this electric current includes signal components whose modulation correlates with the modulation of the modulation signal. For this purpose, for example, a synchronous demodulator can carry out the correlation between the time profile of the measured values of this electric current on the one hand and the time profile of the modulation signal. This can be done, for example, in such a way that the synchronous demodulator multiplies the modulation signal or a signal derived from it or a signal that has a fixed time relationship with the modulation signal with the signal of the time profile of the measured values of this electrical current or a signal derived from it and the signal resulting from the multiplication is then filtered, preferably low-pass filtered. Instead of a synchronous demodulator, the control device can also include a matched filter optimized for the modulation signal and/or an optimal filter and/or a Kalman filter or another estimation filter.

1. 1. Es darf kein Überstrom in dem abgesicherten Versorgungsleitungsabschnitt auftreten. Diese Funktion ist neu, da eine Schmelzsicherung nur den thermischen Überlastungsschutz, nicht aber einen Schutz vor kurzzeitigen Überströmen gewährleistet.
2. 2. Es darf keine Überlastung der Leitung in dem abgesicherten Versorgungsleitungsabschnitt auftreten. Dabei soll sich die elektronische Sicherung so verhalten, wie eine Schmelzsicherung aus dem Stand der Technik, um eine Plug&Play-Funktionalität sicherzustellen und keine neuen Probleme durch Seiteneffekte zu erzeugen. Neue Konstruktionen sollen die SOA (safe operating area) der Leitung, als den sicheren Betriebsbereich, maximal ausnutzen, um den Materialeinsatz in Form des Leitungsdurchmessers der abzusichernden Leitung zu minimieren. (Schutzfunktion der elektronischen Sicherung d.h. der E-Fuse)
3. 3. Die oben genannten Organisationen haben ein Interesse an einer Erfassung weiterer Parameter im Versorgungsnetzwerk, um beispielsweise eine Strommessung ohne Temperatursensor durchführen zu können und so ggf. auf die Temperatur der Leitungen im Versorgungsnetzwerk zurückschließen zu können.
4. 4. Die Versorgung der Vorrichtungsteile eines Fahrzeugs soll im Parkzustand mit möglichst geringer Ruhestromaufnahme erfolgen. Für eine elektronische Sicherung bedeutet das, dass diese geringe Reststromaufnahme bei einem minimalen Schutz zu erfolgen hat und dass die der elektronischen Sicherung im Versorgungsteilbaum nachfolgenden Verbraucher von Zeit zu Zeit aufwachen können sollen.
5. 5. Die Automobilhersteller wünschen sich ideale Dioden, um den Rückstrom elektrischer Energie kontrollieren und/oder verhindern zu können.

The automotive manufacturers and their suppliers have the following needs

1. 1. There must be no overcurrent in the protected section of supply line. This function is new because a fuse only provides thermal overload protection, but not protection against short-term overcurrents.
2. 2. There must be no overloading of the line in the protected section of the supply line. In this case, the electronic fuse should behave like a fuse from the prior art in order to ensure plug and play functionality and not create any new problems due to side effects. New designs should make maximum use of the SOA (safe operating area) of the line, as the safe operating area, in order to minimize the use of materials in the form of the line diameter of the line to be protected. (Protective function of the electronic fuse i.e. the E-Fuse)
3. 3. The organizations mentioned above have an interest in recording further parameters in the supply network, for example to be able to carry out a current measurement without a temperature sensor and thus be able to draw conclusions about the temperature of the lines in the supply network.
4. 4. The supply of the device parts of a vehicle should take place in the parked state with the lowest possible quiescent current consumption. For an electronic fuse, this means that this low Residual current consumption has to take place with a minimum of protection and that the consumers following the electronic fuse in the supply part tree should be able to wake up from time to time.
5. 5. Automakers want ideal diodes to control and/or prevent the reverse flow of electrical energy.

For the realization of ideal diodes, the document presented here proposes that the computer core of the control device of an electronic fuse should measure the electric current through the circuit breaker in the direction from the energy source to the consumers, but also in the opposite direction of the current using suitable measuring devices on the fuse and/or the control device the fuse can capture preferentially. The computer core of the control device of an electronic fuse can, for example, detect the voltage drop across the circuit breaker using an analog-to-digital converter or the like and switch off this circuit breaker when the electric current through the circuit breaker reverses. The proposed electronic fuse and/or the control device of the electronic fuse should therefore include means for registering and detecting a current flowing backwards. Typically, the computer core of the control device of the electronic fuse evaluates the measured values recorded in this way and forwards these or measured values derived from them to other computer cores of other electronic fuses in the supply network via a security data bus or the like or to a higher-level computer system, for example a vehicle control unit.

battery

Electronic fuses are also ideal for monitoring batteries. The document presented here therefore proposes a battery with a diagnostic function. At least one connection of the battery is preferably provided with an electronic fuse, as proposed here. For example, the battery may include a supply tree and/or supply network having one or more supply branches. For example, several electronic fuses within the battery can be connected in series in a supply branch of a supply tree and/or a supply network. For example, a supply tree and/or a supply network can also include only one supply branch with a plurality of electronic fuses that are inserted into the supply branch. A battery preferably comprises one or more battery cell modules. One or more battery cell modules are preferably electrically connected in series. One or more electronic fuses are preferably connected between the battery cell modules of the battery. Exactly one electronic fuse is preferably connected between two battery cell modules that are connected to one another in series. One electronic fuse is very particularly preferably provided for each battery cell module. An electronic fuse is very particularly preferably assigned to each battery cell module or to one or more groups, in particular battery cell modules connected in series. Very particularly preferably, one or more or all of these electronic fuses have a first circuit breaker that is suitable for preventing the flow of current through the battery cell module or the group of battery cell modules in question, i.e. the electrical connection between a first battery cell module and a second battery cell module or a first group of battery cell modules and a second group of battery cell modules connected in series to separate when the first circuit breaker is open. Very particularly preferably, one or more or all of these electronic fuses of the battery have a second circuit breaker that is suitable for bypassing the battery cell module or the group of battery cell modules when the second circuit breaker is closed.

In this case, the computer core of the control device of the electronic fuse can preferably only close the second circuit breaker when the first circuit breaker is definitely open. For this purpose, the computer core of the control device of the electronic fuse examines the switching state of the first circuit breaker, preferably before the second circuit breaker is closed, for example by feeding a test current into the first circuit breaker and by drawing this test current downstream of the first circuit breaker and by detecting and checking the voltages at the terminals of the circuit breaker.

In this case, the computer core of the control device of the electronic fuse can preferably only close the first circuit breaker when the second circuit breaker is definitely open. For this purpose, the computer core of the control device of the electronic fuse examines the switching state of the second circuit breaker, for example by feeding a test current into the second circuit breaker and removing this test current, preferably before the first circuit breaker is closed mes after the second circuit breaker and by detecting and checking the voltages at the terminals of the second circuit breaker.

The interconnection between the battery cell module or the group of battery cell modules and the first circuit breaker and the second circuit breaker preferably has three electrical nodes. In this case, the first circuit breaker is preferably connected to a first node with a first connection of the first circuit breaker. In this case, the first circuit breaker is preferably connected to a second connection of the first circuit breaker with a second node. In this case, the second circuit breaker is preferably connected to a first connection of the second circuit breaker with a third node. In this case, the second circuit breaker is preferably connected to the second node with a second connection of the second circuit breaker. In this case, a first connection of the battery cell or the group of battery cells is preferably connected to the third connection. In this case, a second connection of the battery cell or the group of battery cells is preferably connected to the first connection. The electronic fuses for use in a battery preferably have a housing. Electronic fuses for use in a battery preferably have an optical interface. Preferably, said housing of an electronic security comprises an optical window or an optical subsystem for the entry of electromagnetic radiation for the transport of data to this electronic security. Preferably, said housing of an electronic fuse comprises an optical window or an optical subsystem for the emission of electromagnetic radiation for the transport of data from the computer core of the controller of the electronic fuse to the computer core of the controller of another electronic fuse or to a higher-level computer system. The electromagnetic radiation is preferably laser radiation and/or radiation from an LED. The electronic fuse preferably includes a laser or an LED, in particular for this purpose. The electronic fuse preferably comprises a photodetector, for example a photodiode, for receiving optical signals which transport data. In this case, the optical windows are sub-devices of one or more optical data interfaces of the control device of the relevant electronic security device. Optical waveguides and/or other optical functional elements preferably connect the computer cores of the control devices of one or more electronic fuses to one another via these optical data interfaces of these electronic fuses. One or more electronic fuses are preferably connected to a higher-level computer system via such an optical interface and an optical fiber to an optical interface of the higher-level computer system. One or more electronic fuses can also be connected in terms of data technology to the superordinate computer system by means of another data interface, in particular by means of the ones mentioned above. The battery cell module or the group of battery cell modules preferably supply the control device of the electronic fuse and the other parts of the electronic fuse assigned to this battery cell module or this group of battery cell modules with electrical energy for the operation of the same. A battery cell module or a group of battery cell modules can firstly contain the control device of the electronic fuse and secondly the other parts of the electronic fuse and thirdly those battery cell modules or that group of battery cell modules to which this electronic fuse is assigned and to which this fuse is connected Supply branch follows or precedes, provide electrical energy for the operation of this electronic fuse. The battery thus preferably includes an electronic fuse per battery cell module or per group of battery cell modules. The computer core of the control device of the electronic fuse preferably records voltage values and/or current values by means of measuring means of the control device of the electronic fuse. The electronic safety device preferably performs a safety function. The computer core of the control device of the electronic fuse preferably interrupts the flow of current through the circuit breaker of the electronic fuse by means of the circuit breaker of the electronic fuse if a disconnection condition is met. Such a disconnection condition can be, for example, exceeding a maximum current value of the electric current through the circuit breaker of the fuse or the like. The computer core of the control device of the electronic fuse preferably interrupts the flow of current using the circuit breaker of the electronic fuse and bypasses the battery cell module or the group of battery cell modules if a disconnection condition is met and a bridging condition is met. The computer cores of the control devices of one or more electronic fuses preferably transmit one or more measured values and/or values derived therefrom and/or status values and/or status information of the respective electronic fuses to a higher-level computer system. One or more control devices for the electronic fuses preferably include one or more temperature sensor evaluation devices, preferably with one or more temperature sensors. The electronic fuse preferably includes one or more temperature sensors. The electronic fuse can also include a thermal fuse, which is a fusible link includes a fuse with a loaded spring that de-energizes the circuit breaker of the electronic fuse when the circuit breaker exceeds a maximum temperature. The computer core of the control device of the safety fuse preferably evaluates measured temperature values of the one or more temperature sensor evaluation devices, which record these using temperature sensors external to the electronic fuse and/or using temperature sensors of the electronic fuse.

One or more electronic fuses preferably include two data interfaces, which can be optical. The computer cores of the control devices of the electronic fuses in devices with increased requirements for electrical isolation are preferably connected in terms of data technology by an optical data bus, into which the data interfaces of the control devices of the electronic fuses are respectively inserted.

Data interfaces of the control devices of the electronic fuses are preferably connected wired and/or wirelessly at least by an electronic single-wire data bus and/or by a two-wire data bus and/or another data bus and/or another data communication means. The data interfaces of the control devices of the electronic fuses are inserted into such a data bus. The interconnection of the data buses can be star-shaped or linear in a chain or a closed ring. Depending on the type of data bus, the data buses may also have branches. A particularly preferred data bus within a battery can be an optical data bus ring of optical data buses connected in a ring. The optical waveguides of the optical data bus are preferably designed to be electrically insulating. The control device of an electronic fuse can preferably comprise a silicon-based LED as an LED. An optical data interface of the control device of an electronic fuse can also include a silicon-based LED as an LED, for example. Such a silicon-based LED can be a silicon avalanche LED. For example, the silicon-based LED can be a SPAD diode, which the control device of the fuse operates as an LED with sufficient blocking voltage in blocking mode in the breakdown range. The control device for the electronic fuse then preferably includes a control device which uses a voltage converter to generate the operating voltage for the silicon LED, in particular the SPAD diode, from the operating voltage of the electronic fuse. The technical teaching presented here also suggests, among other things, that the silicon LED can also be used as a receiver. For this purpose, the computer core of the electronic fuse control device separates the silicon LED from the electrical supply of the voltage converter by means of a circuit breaker in the electronic fuse control device and uses the voltage signal and/or photocurrent signal of the silicon LED as an input signal for an optical data receiver of the electronic fuse control device .

Architecture flexibility

An electronic fuse, as proposed here in the document presented here, can reduce the effort involved in constructing the automotive fuse box (the junction box). Since a higher-level computer system in particular can access the computer cores of the control devices of the electronic fuses via the vehicle's control units via data buses, new designs can position the electronic fuses at different points in the vehicle and thus minimize the wiring effort for the supply network. This enables the electronic fuses to be decentralized. New constructions preferably implement one or more supply branches of the supply network for supplying electrical loads within the vehicle with electrical energy as a ring of a supply line if the body serves as a return ground line, and/or as two rings of two supply lines in the other case. The respective circuit breakers of the respective electronic fuses are preferably inserted into the respective supply line of the supply network. Two fuses are preferably inserted into the respective supply line for each consumer at the respective tapping point of the electrical energy for this consumer in the respective supply line. This means that in the event of a fault in a supply line section, the respective computer cores of the respective control devices of the two electronic fuses assigned to this faulty load typically open their respective circuit breakers, so that this opening of the circuit breakers of the fuses isolates the faulty line section. As a result, in the event of a fault in a consumer, the respective computer cores of the respective control devices of the two electronic fuses assigned to this consumer typically open their respective circuit breakers, so that this opening of the circuit breakers isolates the faulty consumer. Such a fault does not therefore affect the supply of electrical energy to the other consumers.

Active power generation configuration and active power distribution configuration

(Active Power Management)

• • Adaptives Management des Leitungszustands,
• • Adaptives Strom-Management mittels adaptiver Abschaltschwellen,
• • Reduktion des Ruhestroms in HV-Domänen,
• • Effiziente Park Systemzustände,
• • Remote-Recovery,
• • Preventive Maintenance (KI).

The so-called Active Power Management includes, for example:

• • Adaptive management of line status,
• • Adaptive power management using adaptive switch-off thresholds,
• • Reduction of the quiescent current in HV domains,
• • Efficient parking system states,
• • remote recovery,
• • Preventive Maintenance (AI).

The respective computer cores of the respective control devices of several electronic fuses particularly preferably record the respective electric current through their respective circuit breaker and, if applicable, the respective potential of one or more connections of this circuit breaker among themselves and/or against a reference potential of a reference potential contact as a reference potential. Depending on the current value of the energization of the respective circuit breaker of the respective fuse, the respective computer core of the respective control device of the respective fuse preferably calculates a theoretical ground offset by means of modeling and, if necessary, corrects the corresponding measured voltage values recorded by it.

This calculation of the computer core of the control device of the fuse can also be performed by other computer cores of other control devices of other electronic fuses in the overall system or by higher-level computer systems of the vehicle etc.

One or more computers of the overall system, which can also be computer cores of the control devices of the electronic fuses and/or the higher-level computer system, can, for example, infer status parameters of the supply line sections using the parameters recorded in this way, such as current values and voltage values. This can include, for example, resistance layers and/or temperatures and/or thermal deflections etc. of the supply line sections. The status parameters of a supply line section can include its temperature. The computer cores of the control devices can determine the temperature of copper lines very well, for example, using the known temperature coefficients of copper and the known design data of the supply line section and/or using the energy fed into the supply section and/or using the energy absorbed in the supply line section. The same applies to other materials.

The use of electronic fuses makes it possible to program equipment variants. In order to prevent improper activation or deactivation of the energy supply option of sub-trees of the supply tree and/or sub-supply networks of the supply network, the communication between the computer core of a control device of an electronic fuse and the computer core of the control device of another electronic fuse is preferably encrypted. In order to prevent improper activation or deactivation of the energy supply option of sub-trees of the supply tree and/or sub-supply networks of the supply network, the communication between the computer core of a control device of an electronic fuse and a higher-level computer system is preferably encrypted. The activation and/or deactivation of an electronic fuse, i.e. the switching on or off of the circuit breaker, preferably requires the transmission of a digital password from the computer core of the control device of another electronic fuse or from the higher-level computer system via a data bus to the computer core of the control device of an electronic fuse . The communication between the computer core of the control device of an electronic security device and its environment is preferably encrypted via such data connections. Such a data connection is preferably encrypted using a PQC method. (PQC=post quantum cryptography). The communication via the data bus can take place, for example, by means of a protocol similar to PSI5 or the like. The electronic fuses, which are sub-devices of a supply network, preferably also communicate with one another by means of power-line communication via the supply network or their possibly separate supply voltage lines.

After a significant change in the operating state of the vehicle, preferably not all electronic fuses change the switching state of their circuit breakers at the same time. Such a significant change in the operating state of the vehicle can be, for example, the switching-on process when the vehicle is transferred from the parked state to the driving state. Electronic fuses preferably receive a start signal from a central control device, for example a higher-level computer system. If necessary, the higher-level computer system distributes beforehand the values of waiting times that the electronic fuses should wait between the arrival of the start signal from the control device and the closing of their respective circuit breaker. These respective values of the respective waiting times can also be programmed into a non-volatile memory of the respective electronic fuse. This programming can be done at the factory or by the higher-level computer system or another computer in the vehicle, and thus also by the computer core of another electronic fuse. As a result, the typically very high starting current of a vehicle's electrical system drops massively. This starting current is also referred to as in-rush current. As the in-rush current decreases, new designs with electronic fuses can in turn make the wiring network for supplying the electrical loads in the vehicle weaker with less thick cables. This reduces the weight of the vehicle.

Increase in system reliability

The document presented here proposes that the computing cores of the control devices of the electronic fuses at the respective terminals of their respective circuit breakers located on the energy source side check the respective voltages between these terminals and a reference node and/or among themselves. If one of these respective voltages falls below a respective minimum value and at the same time the respective electric current through the respective circuit breaker of the respective electronic fuse exceeds a respective predetermined threshold value, the respective power supply delivers more energy than intended into the respective supply sub-network protected by this respective electronic fuse. The respective electronic fuse then preferably switches off the electrical supply of this partial supply network by switching off its respective circuit breaker. This results in a limitation of the respective voltage dip due to the speed of the respective electronic fuse.

Depending on the security scheme, the computer core of the control device of the electronic fuse can carry out one or more switch-on attempts after it has been switched off. If the number of unsuccessful attempts to switch on exceeds a predetermined number, the computer core of the control device of the electronic fuse preferably transmits an error message to the computer core of the control device of another electronic fuse or to a higher-level computer system.

Electronic fuses for partial supply networks and supply branches with the highest possible availability should have the option of single or multiple switch-on attempts (retry) in the event of shutdowns as a result of overcurrent or the like.

Fuse data bus (Fuse bus)

As already described above, it makes sense if the computer cores of the control devices of the electronic fuses can communicate with other computer cores of the control devices of other fuses in the vehicle's supply network or with higher-level computer systems of the vehicle. There is typically a need for communication here for configuration data (write/read), switching commands (write/read), diagnostic data (write/read), measured values (read), comparison value settings (write/read).

The computer cores of the control circuits of the electronic fuses preferably use a fuse data bus for communication with one another in the vehicle or within a fuse box. The backup data bus is preferably a two-wire data bus. The backup data bus is preferably a differential data bus, since considerable ground currents and ground etching can occur in the body of a vehicle. The backup data bus is preferably a CAN data bus or a data bus with a physical interface of a CAN data bus, a CAN FD data bus or a Flexray data bus or an LVDS data bus or the like. The backup data bus is preferably bidirectional. The control devices for the electronic fuses preferably include two data bus interfaces for the fuse data bus, so that new constructions can control the electronic fuses using these can insert two data bus interfaces in the backup data bus. As a result, the electronic fuses can form a linear chain of electronic fuses along the fuse data bus, so that a higher-level computer system - for example a control unit - which is connected to the beginning of the fuse data bus, uses auto-addressing to use the fuse addresses as bus node addresses for controlling the computer cores of the control devices of the electronic fuses transmitted to the computer cores of the control devices of the electronic fuses.

The computer cores of the control devices of the electronic fuses preferably transmit parameters of the connected partial supply networks and/or individual accounts of the partial supply networks and/or individual supply line sections of the supply network of the supply lines of the vehicle to other computer cores of the control devices of other electronic fuses and/or one or more higher-level computer systems - e.g. control units of the vehicle. If necessary, such parameters can be directly accessible parameters, such as temperature of a temperature sensor, voltage of a node of the supply network against a reference potential, or the current value of an electrical current in a supply line section of the supply network. A computer core of a control device of an electronic security system can also, by applying Kirchhoff's equations to data that the computer core of the control device of the electronic security system has determined using measuring devices of this electronic security system or that the computer core of the control device of this electronic security system derives from the computer cores of the control devices of other electronic invoices or received from higher-level computer systems (e.g. control units of the vehicle), derived parameters, such as leakage currents to other electrical nodes in the vehicle or electrical resistances of supply voltage line sections.

In particular, the computer core of a control device of an electronic fuse can estimate the temperature of a subsequent supply voltage section if its ohmic resistance, its heat capacity, thermal discharge resistances and the ambient temperature in the area of the supply line section are approximately known to the computer core, e.g. by estimation. This procedure typically makes use of the fact that the energy fed into the supply line section essentially corresponds to the time integral of the electrical power fed into the supply line section. This is typically proportional to the square of the current magnitude of the electrical current flowing into the supply line section.

Other ideas presented in this document

Booking the power supply

A first idea is for users to add the power supply to consumers of electrical energy in the supply network that have not yet been supplied. The user buys, for example, via a data connection with the server of a service provider, an activation code from a provider who has generated and/or has generated this activation code using authentication data according to a fixed procedure and has it ready and transmits it to the user via a data transmission channel. One or more computer cores of the control devices of one or more electronic fuses preferably record the energy that the battery of an electric car, for example, feeds into a partial supply branch of the supply network. In this model, the battery is owned by the power company. A higher-level computer system, for example a control unit of the vehicle, preferably reads the determined amount of energy from the computer core and/or a memory of the control device of the electronic fuse and/or the underlying measured values and transmits this data to the energy supplier via a data transmission path, which is preferably encrypted or a vicarious agent who then creates an invoice based on this data. It is conceivable that the supply sub-network also enables the services of other service providers who may determine their billing data in a similar way and bill the user.

Diagnostic ring

New constructions preferably provide a supply network that is ring-shaped in parts, in which the consumers preferably draw electrical energy from the supply network at different points of the ring-shaped supply network. The supply line of the ring-shaped supply network is preferably interrupted to the left and right of the tapping point of electrical energy by an electronic fuse, but at least one electronic fuse, which, with its respective circuit breaker, is connected to the supply line of the supply line section between two tapping points for electrical supply consumer energy is inserted. If a fault occurs, these fuses can first of all isolate the affected supply line section and/or the affected consumer. A higher-level control unit can determine the status of the electronic fuses by addressing the computer cores of the control devices of the electronic fuses and thus localize the cause of a fault without this fault being able to affect other consumers. Typically, the intervention of the fuses occurs so quickly that the disturbance affects only a few sensor values of sensors and/or measuring devices that are connected to the supply network in such a way that their values are unusable. The electronic fuses preferably record the faults in the form of a log table, which can also include just a few bits. The control devices of the electronic security devices preferably provide the entries in the log table with time stamps from a timer unit of the control device of the electronic security device. In this case, the control device of the electronic safety device preferably also uses a time stamp to record the point at which the fault no longer existed. A higher-level computer system preferably queries this data regularly or in the event of a fault. The higher-level computer system can thus determine when which subnetwork or which supply line was disrupted and how long this disruption lasted. As a result, the higher-level computer system can identify potentially affected sensors and measuring systems and mark the measured values acquired from them in the relevant period of time as potentially faulty or discard them immediately. Another advantage of a ring structure of such a supply network with electronic fuses is improved reliability through redundancy. It is therefore particularly suitable for safety-relevant applications.

Satellite with electricity meter

As already explained, it makes sense in many cases if individual consumers are equipped with a wattmeter or something similar. For this purpose, an electronic fuse uses a voltmeter to detect the voltage of a node on the circuit breaker of the electronic fuse or a node associated with it and preferably the current through the circuit breaker of the electronic fuse and thereby determines the current flowing into the consumer or a subsequent supply tree or a subsequent supply line section electricity. The computer core of the control device of the electronic fuse transmits this data, preferably via a data bus, to the computer core of the control device of another electronic fuse or to a higher-level computer system.

Activation of individual consumers

It is conceivable to activate the electrical supply of individual consumers in the supply network of a vehicle using activation codes as described above. Here, a server of the automobile manufacturer or a service provider transmits authentication data, which can include data from the vehicle, the car key, a SIM card, entering a password, biometric user data, etc., to the vehicle or the user, who then transmits this data in the vehicle a terminal or a data interface transfers it to the vehicle. Depending on the activation code, a higher-level computer system in the vehicle then transmits commands to close the circuit breakers to selected electronic fuses in the supply network, as a result of which the supply network then supplies activation-code-specific partial supply networks with electrical energy.

Transmission of energy usage data to electricity providers and/or automobile manufacturers

As described above, a higher-level computer system in the vehicle can transmit the usage and configuration data of the system determined in this way from electronic fuses and supply subnetworks and supply line sections as a transmission of energy usage data to electricity providers and/or automobile manufacturers and/or other service providers.

Detecting a hot-plug event

An electronic fuse is preferably placed in the vicinity of a plug for supplying electrical energy to an electrical consumer in the vehicle. A problem can arise if users and/or workshops, etc., do not de-energize and/or de-energize the device before removing the device, as prescribed, before the plugging or disconnecting process. In the following, this document refers to such an event as a hot-plug event. This de-energization or de-energization is preferably carried out by means of a software command via a data bus from a control device, ie a higher-level computer system, to a computer core of a control device of an electronic fuse, the then opens its circuit breaker. If this has not been done beforehand and an incorrect operation nevertheless triggers a hot-plug event, the control circuit of the associated electronic fuse can be detected by monitoring the transient time profile of the voltage of the potential of a node of the circuit breaker against the potential of a reference node and/or by observing the Such a hot-plug event can be detected by the transient course of the current through the circuit breaker and the circuit breaker can be switched off so quickly that this rapid shutdown minimizes plasma formation. In addition, the electronic fuse can report such an event to the associated control unit, for example a higher-level computer system, via a data line. The higher-level computer system can, if necessary, forward this event so that it is first displayed in a terminal (for example by means of a man-machine interface) or is transmitted to the automobile manufacturer via a data transmission link.

Distributed measurement methods

It was recognized that it makes sense for the control device of an electronic fuse to exchange the above-mentioned measured values with other control devices of other electronic fuses via a data bus. As a rule, the control device cannot ensure that the data is transmitted very quickly. It is therefore useful if the control device of the fuse also sends a time stamp for one or more measured values in addition to the measured values. The electronic fuses preferably have a clock or a timer for this purpose. A higher-level computer system preferably determines correction factors once for correcting the time stamp values of the non-synchronously running clocks of the various control devices of the various electronic fuses. Another method is the recurring synchronization of these clocks and/or timers. First of all, the synchronization can include resetting to a common start value. On the other hand, the synchronization can include the correction of the frequencies of the oscillators and/or clocks, which the synchronization process can set, for example, by setting the dividers of a base frequency. A higher-level computer system can use a data bus command in broadcasting mode, for example, to cause the various control devices of the various electronic fuses to preferably carry out the same measurements at the same time, with the equality of the clock readings of the respective clocks of the various control devices of the different devices being the same electronic fuses. It is then a question of a distributed measurement method with synchronous measurement using synchronized local clocks within the control devices of the various electronic fuses. This enables the essentially time-synchronous measurement of ohmic resistances of supply line sections.

Coupling communication network and supply network

It is expedient to couple a communication network to a supply network. Reference is made here to the backup data bus described above.

Dynamic mapping of current paths

During the elaboration, it was recognized that, in the case of redundancy, the dynamic allocation of energy and energy transport routes within a vehicle can be useful. For this purpose, a higher-level computer system in the vehicle determines the energy requirements of the vehicle's potential energy consumers. The supply lines are preferably designed as a supply network, with two or more supply lines being routed in parallel at least in sections and/or crossing at at least two points in the vehicle. As an example, we now study the crossing of a first supply line with a second supply line. The supply network preferably includes two electrical nodes at each of these crossing points. The document presented here refers to these two electrical nodes at the crossing point as first node of first crossing point and second node of crossing point for the sake of clarity. The crossing point divides the first supply line into a first part of the first supply line on the energy source side and a part of the first supply line on the consumer side. The crossing point divides the second supply line into a first part of the second supply line on the energy source side and a part of the second supply line on the consumer side.

• • Eine erste elektronische Sicherung verbindet oder trennt je nach Schaltzustand des Leistungsschalters der ersten elektronischen Sicherung den energiequellenseitigen ersten Teil der ersten Versorgungsleitung mit dem ersten Knoten.
• • Eine zweite elektronische Sicherung verbindet oder trennt je nach Schaltzustand des Leistungsschalters der zweiten elektronischen Sicherung den energiequellenseitigen ersten Teil der zweiten Versorgungsleitung mit dem ersten Knoten.
• • Der Leistungsschalter der ersten Sicherung ist bevorzugt nur dann geschlossen, wenn der Leistungsschalter der zweiten Sicherung geöffnet ist. Der Leistungsschalter der zweiten Sicherung ist bevorzugt nur dann geschlossen, wenn der Leistungsschalter der ersten Sicherung geöffnet ist.
• • Eine dritte elektronische Sicherung verbindet oder trennt je nach Schaltzustand des Leistungsschalters der dritten elektronischen Sicherung den energiequellenseitigen ersten Teil der ersten Versorgungsleitung mit dem zweiten Knoten.
• • Eine vierte elektronische Sicherung verbindet oder trennt je nach Schaltzustand des Leistungsschalters der vierten elektronischen Sicherung den energiequellenseitigen ersten Teil der zweiten Versorgungsleitung mit dem zweiten Knoten.
• • Der Leistungsschalter der dritten Sicherung ist bevorzugt nur dann geschlossen, wenn der Leistungsschalter der vierten Sicherung geöffnet ist. Der Leistungsschalter der vierten Sicherung ist bevorzugt nur dann geschlossen, wenn der Leistungsschalter der dritten Sicherung geöffnet ist.
• • Der verbraucherseitige Teil der ersten Versorgungsleitung ist mit dem ersten Knoten verbunden.
• • Der verbraucherseitige Teil der zweiten Versorgungsleitung ist mit dem zweiten Knoten verbunden.

In the following, we now describe an electronic crossing safety device that includes four electronic safety devices. In the example that now follows, the electronic safeguards of the electronic crossing safeguard are implemented on the energy source side. It is also conceivable that the electronic fuses vice versa run on the consumer side. The designs can provide load-side and power-side electronic fuses.

• • A first electronic fuse connects or separates, depending on the switching state of the power switch of the first electronic fuse, the first part of the first supply line on the energy source side with the first node.
• • A second electronic fuse connects or disconnects the energy source-side first part of the second supply line to the first node, depending on the switching state of the circuit breaker of the second electronic fuse.
• • The circuit breaker of the first fuse is preferably only closed when the circuit breaker of the second fuse is open. The circuit breaker of the second fuse is preferably only closed when the circuit breaker of the first fuse is open.
• • A third electronic fuse connects or disconnects the energy source-side first part of the first supply line to the second node, depending on the switching state of the circuit breaker of the third electronic fuse.
• • A fourth electronic fuse connects or disconnects the energy source-side first part of the second supply line to the second node, depending on the switching state of the circuit breaker of the fourth electronic fuse.
• • The circuit breaker of the third fuse is preferably only closed when the circuit breaker of the fourth fuse is open. The circuit breaker of the fourth fuse is preferably only closed when the circuit breaker of the third fuse is open.
• • The consumer-side part of the first supply line is connected to the first node.
• • The consumer-side part of the second supply line is connected to the second node.

• • Eine erste elektronische Sicherung verbindet oder trennt je nach Schaltzustand des Leistungsschalters der ersten elektronischen Sicherung den verbraucherseitigen ersten Teil der ersten Versorgungsleitung mit dem ersten Knoten.
• • Eine zweite elektronische Sicherung verbindet oder trennt je nach Schaltzustand des Leistungsschalters der zweiten elektronischen Sicherung den verbraucherseitigen ersten Teil der zweiten Versorgungsleitung mit dem ersten Knoten.
• • Der Leistungsschalter der ersten Sicherung ist bevorzugt nur dann geschlossen, wenn der Leistungsschalter der zweiten Sicherung geöffnet ist. Der Leistungsschalter der zweiten Sicherung ist bevorzugt nur dann geschlossen, wenn der Leistungsschalter der ersten Sicherung geöffnet ist.
• • Eine dritte elektronische Sicherung verbindet oder trennt je nach Schaltzustand des Leistungsschalters der dritten elektronischen Sicherung den verbraucherseitigen ersten Teil der ersten Versorgungsleitung mit dem zweiten Knoten.
• • Eine vierte elektronische Sicherung verbindet oder trennt je nach Schaltzustand des Leistungsschalters der vierten elektronischen Sicherung den verbraucherseitigen ersten Teil der zweiten Versorgungsleitung mit dem zweiten Knoten.
• • Der Leistungsschalter der dritten Sicherung ist bevorzugt nur dann geschlossen, wenn der Leistungsschalter der vierten Sicherung geöffnet ist. Der Leistungsschalter der vierten Sicherung ist bevorzugt nur dann geschlossen, wenn der Leistungsschalter der dritten Sicherung geöffnet ist.
• • Der energiequellenseitige Teil der ersten Versorgungsleitung ist mit dem ersten Knoten verbunden.
• • Der energiequellenseitige Teil der zweiten Versorgungsleitung ist mit dem zweiten Knoten verbunden.

An alternative version of the crossing safety device carries out the electronic safety devices on the consumer side:

• • A first electronic fuse connects or separates, depending on the switching state of the circuit breaker of the first electronic fuse, the first part of the first supply line on the consumer side with the first node.
• • A second electronic fuse connects or separates, depending on the switching state of the circuit breaker of the second electronic fuse, the first part of the second supply line on the consumer side with the first node.
• • The circuit breaker of the first fuse is preferably only closed when the circuit breaker of the second fuse is open. The circuit breaker of the second fuse is preferably only closed when the circuit breaker of the first fuse is open.
• • A third electronic fuse connects or separates, depending on the switching state of the circuit breaker of the third electronic fuse, the first part of the first supply line on the consumer side with the second node.
• • A fourth electronic fuse connects or separates the load-side first part of the second supply line to the second node, depending on the switching state of the circuit breaker of the fourth electronic fuse.
• • The circuit breaker of the third fuse is preferably only closed when the circuit breaker of the fourth fuse is open. The circuit breaker of the fourth fuse is preferably only closed when the circuit breaker of the third fuse is open.
• • The power source side part of the first supply line is connected to the first node.
• • The power source side part of the second supply line is connected to the second node.

Depending on the determined energy requirements, these crossing safeguards can dynamically allocate alternative and redundant power paths to specific consumers. For this purpose, a control unit of the vehicle transmits suitable configuration commands to the electronic fuses of the crossing fuses of the supply network, which cause the opening and closing of circuit breakers of the electronic fuses and thus the electrically effective topology of the supply network of the supply lines dyna Mix and match according to the power requirement and according to the current security requirements.

Switching off parts of the supply network within a vehicle

Another idea is shutting down parts of the network for maintenance and secure access. To do this, the person who wants to carry out maintenance enters a predetermined security code in a higher-level computer system using a terminal or another human-machine interface (HMI). If necessary, the person receives this security code from a server of the automobile manufacturer or a service provider. For this purpose, the person transmits authentication data to the server, which includes, for example, authentication data for the person, the organization for which the person works, or authentication data for the vehicle or car key or the like. A control unit then de-energizes parts of the supply network with the help of electronic fuses. Preferably, at least one electronic fuse is provided in each sub-supply network that can be isolated in this way, which short-circuits the sub-supply network, which is then isolated by opening the circuit breakers of the isolating electronic fuses, by closing the circuit breaker of this one fuse with a reference voltage line, for example ground, and thus discharges it.

Dependence of the power of the satellites depending on the supply line

The reconfiguration of the network topology was described above, for example using differently configurable node protections. For a system emergency it makes sense if the power consumption of a consumer in question is adjusted to the weakest supply line in the path between the energy source and the consumer in question. For this purpose, the higher-level computer system signals that the reconfiguration of the supply network has been initiated by appropriate commands via one or more data buses to the electronic fuses to the consumer in question how much energy this consumer may consume in order not to leave this weakest line. In the simplest case, the consumer can have two states. A state in which he absorbs more energy and a state in which he absorbs less energy.

Network with a reduced cross-section of the wiring harness

According to the proposal, the improved constructions can provide supply lines of the supply network with a smaller cross-section than would normally be possible without electronic fuses due to the optimizations carried out.

quick shutdown

A key idea is the rapid shutdown of a circuit breaker of an electronic fuse when a maximum permissible current through the circuit breaker is exceeded. If this maximum permissible current is not exceeded by the circuit breaker of an electronic fuse, the circuit breaker is preferably only switched off after some time, this time generally depending on the magnitude of the current through the circuit breaker, falling in a parabola shape. Preferably, the controller of the electronic fuse emulates the behavior of a fuse. To do this, the control device of the electronic fuse detects the current value of the electrical current through the circuit breaker. The controller preferably squares the value of the electric current through the circuit breaker and integrates this value over time. As a rule, the integration is low-pass filtering or the like. If the filter output value exceeds a threshold value, the control device opens the power switch of the electronic fuse. It is therefore an electronic fuse with emulation of a fuse characteristic.

Fuse with prevention of reverse current flow.

The electronic fuse preferably prevents electrical energy from flowing back from the consumer to the energy source. For this purpose, the electronic fuse preferably detects the direction of the electric current flowing. If the current does not flow to the consumer, but in the direction of the energy source, the electronic fuse preferably opens the circuit breaker, which stops this flow of current. It is conceivable that in such a case the control device closes a third circuit breaker of the electronic fuse, which is otherwise open in normal operation. The then closed third circuit breaker then preferably closes the load-side supply line by closing of the third circuit breaker, for example, with the reference potential line, i.e. the ground short, as a result of which the current flowing back is now destroyed in the system ground.

Use of silicon LEDs

The electronic fuse preferably includes one or more silicon LEDs. The silicon LEDs are preferably part of an optical data interface of the computer core of the control device of the electronic fuse. These silicon LEDs are also preferably used as photodetectors in the optical data interface. The use of such silicon LEDs is particularly advantageous for the use of electronic fuses in batteries.

In this case, the housings of the electronic fuses preferably have optical windows so that the light from the silicon LEDs can escape.

Electronic security with authentication

The electronic safety device preferably has means for verifying the admissibility of a command that the control device of the electronic safety device has received via a data bus. For example, it can involve methods of encryption and decryption, which secures secure communication between a higher-level computer system and the control device of an electronic security device. It is therefore an electronic security with authentication for modern business models such as the connection of components via software against payment.

Plausibility check of the configuration for identification

Another recognized point is the plausibility check of the configuration to identify manipulations in the supply network. Depending on the task, the electrical currents within the supply network on the supply lines lie in more or less known or precalculated ranges. If the current value of a supply line now leaves the expected value range, then there is either an error or manipulation.

Detection of the switchability of the electronic fuse

An electronic fuse preferably also includes means for detecting the switchability of the electronic fuse. This can involve, for example, feeding a test current into a first connection of the circuit breaker from a second connection of the circuit breaker. If the control device of the electronic fuse cannot take this electric current from the other terminal of the circuit breaker, then the circuit breaker is not open or is not present. The control device of the electronic fuse preferably changes the switching state of the circuit breaker one or more times. The current conductivity of the circuit breaker, which the control device of the electronic fuse determines in each case, should correlate with the expected switching state of the circuit breaker.

If there is no switchability, the control device of the electronic safety device preferably signals an error to a higher-level computer system in the vehicle.

Self-configuring fuse with auto-addressing

The electronic fuses are preferably inserted into a data bus arranged linearly like a string of pearls. As a result, the electronic fuses have an unambiguous physical bus position in relation to this linear data bus that can be counted from the higher-level computer system that drives the data bus. Using an auto-addressing method, the higher-level computer system can now assign a fuse address to each electronic fuse, so that the higher-level computer system can address this fuse in a one-to-one manner. This means that the electronic fuses can now recognize where they are physically located in the data bus. A configuration of threshold values and switch-off thresholds is preferably specified for the electronic fuses for every conceivable physical data bus position within the vehicle. By knowing the physical data bus position, these electronic fuses can now be configured according to their data bus position with the aid of said factory data. It is therefore self-configuration Electronic fuses with automatic addressing, in which the configuration of the electronic fuse depends on the detected physical data bus position.

Electronic fuse with AI

According to the invention, it was recognized that the large number of values recorded by the electronic fuses enable evaluation by a computer core of the control device of an electronic fuse or by a computer in a higher-level computer system. For this purpose, the evaluating unit uses the values that one or more control devices of one or more electronic fuses determine using appropriate measuring means as input values of a neural network model that the computer of the evaluating unit executes. The neural network model is preferably trained with suitable training data from the development period. For example, it can make sense to use this method to detect a failure of one or more consumers or other defects in the system before they actually manifest themselves.

Powerline communication via an electronic fuse (E-Fuse)

Another idea is communication via the data line, with the power switch of the electronic fuse serving as a transmission transistor. It is therefore a powerline communication via the electronic fuse (E-Fuse).

Electronic Fuse (E-Fuse) Load Current Spectral Analysis for Predictive Maintenance

Another idea is to record the time profile of the electric current through the circuit breaker of an electronic fuse and, if necessary, the time profile of the voltage between a terminal of the circuit breaker and a reference potential. A device preferably carries out a spectral analysis of this data from the electronic security device. In the event of significant deviations from expected values, the evaluating devices can draw conclusions that the user and/or workshops can use, among other things, for preventive maintenance of the vehicle.

Check system availability over the spectrum of the electronic fuse (E-Fuse), expected characteristics (positive test)

In an analogous manner, the evaluating device can use the determined spectra to check the system availability via the spectrum on the electronic fuse. If the characteristics of the spectra agree with the expected values within the permitted bandwidths, then the consumer in question is probably available. It is therefore a positive test.

Reduction of the inrush current

Another idea is not to close the circuit breakers of the electronic fuses at the same time when the system is started, but rather with a time delay. As a result, the electrical devices connected to the respective electronic fuses do not start at the same time. This reduces the so-called inrush currents due to the shifting and desynchronization of the switch-on curves of the supply sub-networks.

Limiting the voltage dips

The electronic fuses preferably measure not only the electric current through their circuit breakers, but also the voltage at a connection of the circuit breaker against a reference potential. A voltage dip caused by a short circuit in a partial supply network, for example, is particularly dangerous. An electronic fuse therefore preferably switches off particularly quickly in the event of a voltage drop in the measured voltage values and a simultaneous current rise. This avoids interference from the vehicle's sensors. Such an electronic fuse is therefore a device for limiting the voltage drop in the event of faults in the voltage system of the individual network. The electronic fuse preferably switches off so quickly that the voltage does not drop too far and thus such an event does not disturb other systems or only slightly. Under such switch-off conditions, an electronic fuse preferably switches the circuit breaker off and open faster than within 1 μs not this one with it. Switching off can also depend on the time derivative of the voltage change (du/dt sensitivity.)

accident insurance

The higher-level computer system preferably switches off unneeded or dangerous sub-grids by means of electronic fuses by means of corresponding commands to electronic fuses via the data bus when a higher-level computer system of the vehicle has come to the conclusion that an accident of the vehicle is likely. It is therefore a matter of switching off systems of the vehicle by means of one or more electronic fuses before a predicted accident, in which case the ascertained probability of such an accident should be above a threshold value.

Expectation of high power consumption

In a similar way, a higher-level computer system, for example a control unit, can open one or more power switches of one or more electronic fuses of one or more sub-trees of the supply network via a data bus if, for whatever reason, this higher-level computer system expects an increased current consumption from another device. This eliminates the electrical loads that are switched off and their now unused energy margin in the overall energy budget is then available to this other device with the expected increased power consumption. It is therefore a preventive shutdown of electrical loads preventively when a high power consumption of the other device is expected.

Shutdown of systems by voltage level

The document presented here proposes that the electronic fuses record the voltage between a first connection of the circuit breaker, which is preferably on the energy source side, and a reference potential using suitable measuring means. Since it is usually already known when the vehicle is being constructed which consumers with which function and how important this function is to supply the supply network with electrical energy via which supply line which electronic fuse, it makes sense for the control devices of the electronic fuses to record the measured voltage values Compare the specified threshold values and open the circuit breaker of the electronic fuse if these threshold values are not reached. This results in the vehicle's electrical consumers being switched off depending on the voltage level. The vehicle then preferably operates only the most necessary systems at very low voltage levels. As a result, the vehicle can provide the minimum functionalities up to the last second, in which a minimum of energy is still available.

Voltage dip limitation

An important requirement is the limitation of a voltage dip. This is due to the speed of the switch-off process of the circuit breaker of the electronic fuse. In the case of an electronic fuse with a voltage release, this switch-off takes place in the range of µs.

Backup data bus in electric cars

Electric cars today typically use supply networks with voltages of less than 50V (LV networks) and supply networks with voltages greater than 50V (HV networks). A problem now arises from the fact that the electronic fuses should be able to communicate across the domain boundaries of the LV networks and the HV networks via data buses. If no optical data buses are used, it makes sense to provide a data bus with a galvanic isolation, for example by means of transformers, at the domain boundary between a HV supply network and an LV supply network. It is then a backup data bus with electrical isolation between the LV network and the HV network.

cascading

The cascading of electronic fuses is particularly advantageous. This cascading allows, for example, a supply line to be divided into different sub-supply lines. The more important consumers are preferably arranged in the part of the supply line that is closer to the energy source, while the less important consumers are in the part further from the energy source lying part are arranged. If one of the less important consumers fails and disrupts the energy distribution over the supply line, an electronic fuse inserted in the supply line can disconnect this defective part of the supply line and thus keep the other devices operational. A number of more than one electronic fuse can reduce the number of consumers unnecessarily discarded. The document presented here thus discloses the concatenation of at least two or more electronic fuses. The advantage of this is that new designs can provide thinner lines than supply lines in different sections of a supply line. This means that the switch-off times required for the electronic fuses can vary depending on the position of the electronic fuse. If the distance to the energy source is greater, the corresponding electronic fuse should switch off more quickly. An adaptation to the switch-off characteristics of the respective electronic fuse to the position of this electronic fuse in the supply network is therefore preferably carried out.

Electronic fuse with timer or counter

The electronic safeguard preferably comprises a timer or counter which, for example, enables measurements to be synchronized, as described above. Furthermore, the electronic fuse preferably also includes elements for debouncing the electronic fuse.

Kirchhoff's equations

Different electronic fuses at different points in the supply network preferably determine current and/or voltage, for example, as described above. The control devices preferably provide these measured values with a time stamp based on the count value of an internal counter or an internal clock. Alternatively, these clocks can be synchronized and a higher-level computer system specifies to the control devices of the electronic fuses when the measurements are to be taken. Such data can be used, for example, to detect small leakage currents from supply lines to other electrical nodes in the vehicle.

Electronic fuses without a computer core

It is conceivable that not all control devices of all electronic fuses have a computer core. This means that the computer core of another electronic fuse generally then controls the control device of such a slimmed-down electronic fuse without a computer core. Since the communication between the computer core of the controlling electronic fuse and the control device of the electronic fuse without a computer core can be lost, this slimmed-down version of an electronic fuse without a computer core preferably has fail-safe properties that allow this electronic fuse to provide at least basic protection for the connected supply line ensure.

Functionality signaling (alive signaling)

As already mentioned, it makes sense if the electronic fuses send a signal to a control device via a fuse data bus that may be present, which signalizes that a) the corresponding electronic fuse is still present and b) it is ready for operation. It is a so-called alive signaling on the backup data bus.

It is advantageous if the backup data bus is differential. This leads to increased robustness against mass offset. In addition, a polarity reversal protection makes sense in order to ensure robustness against negative voltage at the inputs and outputs of the control device. Exemplary data buses with such a common mode strength would be the PSI5 data bus and the LVDS data bus.

The safety data bus preferably has a so-called collision detection (bus collision detection) in order to detect bus collisions. The data bus protocol for operating the data bus can also use a time slicing method for bus arbitration.

fuse simulation

The simulation of a safety fuse using the electronic fuse is particularly useful. This simulation is preferably based on a temperature energy simulation.

In the example of the figure above, an input amplifier detects the voltage drop across a shunt resistor, which converts the current through the supply line into a measurement voltage. A subsequent analogue to digital converter converts this value into a digital signal. This value is then squared and then integrated. Other filters may follow. In the example above, multiple comparators compare the values to thresholds.

Temperature estimation of the lines

As described above, the computer core of the control device of an electronic fuse preferably carries out a temperature estimation of the protected supply line.

Quantum Random Number Generator

The quantum random number generator of the control device of the fuse, which the computer core of the fuse can address via the internal data bus, preferably has at least one first SPAD diode and at least one second SPAD diode and at least one optical waveguide. Such a quantum random number generator can also be located, for example, in the higher-level computer system of the supply network. The quantum random number generator is preferably a quantum process-based true random number generator (QRNG). The quantum process-based true random number generator (QRNG) preferably comprises a first SPAD diode as a light source for a quantum optical signal and a second SPAD diode as a photodetector for the quantum optical signal. Furthermore, the quantum process-based true random number generator (QRNG) preferably comprises at least the processing circuit and the optical fiber. The at least one optical waveguide preferably optically couples the at least one first SPAD diode to the at least one second SPAD diode. An operating circuit, preferably in the form of said voltage supply, supplies the first SPAD diode with electrical energy in such a way that the first SPAD diode emits light. In this case, the emission of light requires that the voltage supply (operating circuit) provides a sufficient electrical bias voltage of the first SPAD diode. A processing circuit detects the signal from the second SPAD diode and forms the random number from it. The processing circuit then preferably makes the random number formed in this way available to one or more of the one or more computer cores of control circuits of fuses in the supply network and/or the higher-level computer system of the supply network and possibly other devices in the supply network and/or in the vehicle via a data bus.

The control circuit of the fuse is preferably embodied as a monolithic micro-integrated CMOS circuit. A semiconductor crystal, which is preferably a silicon crystal, preferably comprises the control circuit and, if necessary, the shunt resistor for measuring the current through the auxiliary circuit breaker of the fuse.

The semiconductor crystal preferably has a surface. Typically, the semiconductor crystal has a semiconducting material beneath its surface. In particular when using conventional semiconductor circuit manufacturing processes, such as CMOS processes, bipolar processes and BiCMOS processes, the surface of the semiconductor crystal typically has a metallization stack as structured metal layers and electrical insulation layers. The structured metal layers, for example made of aluminum or copper or the like, typically form the conductor tracks, which are electrically isolated from one another by the optically transparent insulating layers, for example made of silicon dioxide or the like. The metallization stack thus has one or more typically structured and optically transparent and electrically insulating layers as insulation layers. At least part of these typically structured, transparent and electrically insulating layers and at least parts of these layers of the surface preferably form the optical waveguide for the optical connection of the first SPAD diode to the second SPAD diode. The first SPAD diode typically radiates light from the semiconducting material of the semiconductor substrate into this optical waveguide. i.e. As a rule, in contrast to the prior art, the first SPAD diode radiates perpendicularly to the surface of the semiconductor material essentially upwards and not to the side into the semiconductor substrate of the semiconductor crystal, which has a high level of attenuation. Despite this, the emission of the photons from the first SPAD diode in the optical waveguide is not directed. In particular, the broadcast via the Sub strat of the semiconductor material is very dampened, since visible light has a very high absorption in the semiconductor material. The construction with the optical fiber in the metallization stack of the microintegrated circuit allows the device to couple more photons of the first SPAD diode directly to the second SPAD diode and radiate into the second SPAD diode. The optical waveguide transports these photons from the first SPAD diode in the light waveguide to the second SPAD diode with practically no loss compared to the prior art. The optical waveguide irradiates the second SPAD diode with these photons from the first SPAD diode in such a way that the light from within the optical waveguide penetrates back into the semiconducting material of the semiconductor substrate from the surface and hits device parts of the second SPAD diode there. The second SPAD diode then generates a received signal as a function of the irradiation with these photons.

Typically, at least one operating circuit, that is, for example, the voltage supply of the control circuit of the fuse, supplies the at least one first SPAD diode with electrical energy at least temporarily. When supplied with sufficient electrical energy, the at least one first SPAD diode then feeds photons into the at least one optical waveguide. The optical fiber then transports these photons further. The at least one optical waveguide then radiates the transported photons into the second SPAD diode as photons moving essentially vertically. Since this transport of photons from the first SPAD diode 54 to the second SPAD diode loses far fewer photons than in the prior art design using the highly absorptive semiconductor substrate due to the low attenuation in the optical fiber, the quantum efficiency is massively higher. This increases the bit rate at which the device can generate random numbers. Therefore, in the construction presented here, a pair made up of a single first SPAD diode and a single second SPAD diode is already sufficient. The prior art always uses multiple SPAD diodes.

Safe software download

The document presented here also describes a system for a vehicle that enables SW programs, in particular third-party SW programs, to be executed in a secure manner in the vehicle's supply network, namely in the electronic fuses of the supply network. Furthermore, the invention relates to a method for executing SW programs in these electronic fuses.

When integrating a SW program in the control device for securing a supply network and/or in the higher-level computer system of the supply network of a vehicle, it must be ensured that the security of the supply network is not impaired by the SW program. On the other hand, it may be necessary to protect at least parts of the SW program (e.g. parts with confidential information such as billing data, activation codes, encrypted program commands and encrypted configuration and access data) from unauthorized reading and/or writing access. These requirements can lead to a relatively high integration effort.

The present document therefore also deals with the technical task of providing a system and a method that enable flexible and secure integration of software programs in control devices for fuses in a supply network and/or a higher-level computer system in a vehicle supply network.

The document presented here describes a system for providing an application by means of a SW (software) program in a supply network. For example, the application can be designed to network the vehicle with a server 710 of a service provider and/or with an electronic device (e.g. a smartphone) outside the vehicle via the higher-level computer system of the supply network or another data interface in the supply network. Furthermore, the application can be designed to automatically integrate the supply network and/or supply sub-networks into a service (e.g. activation of special consumers, etc.). The SW program can be made available by a server 710 of a service provider for the respective service/equipment variant of the vehicle.

The system includes a first HW (hardware) platform and a second HW platform. In this case, the first HW platform and the second HW platform can comprise separate computers in order to provide particularly reliable isolation between the two HW platforms. For example, the first HW platform can be part of a higher-level computer system of the vehicle's supply network. On the other hand, the second HW platform from the higher-level computer system of the vehicle, esp special be separated from an operating system of the higher-level computer system of the supply network. Typically, the second HW platform is a control device of a backup of the supply network.

Alternatively or additionally, the second HW platform can include a non-volatile memory (e.g. for storing data) and/or a volatile memory (e.g. for operating a SW module), which is separate from the first HW platform. Furthermore, the memory of the second HW platform, ie the control device of the backup, can be protected by one or more security measures. In this case, the memory of the control device of the fuse can be protected with one or more security measures that are not used to protect the first HW platform. The memory (both the "runtime" memory and the "storage" memory) of the second control device of the backup can be protected by one or more security measures in such a way that the memory cannot be manipulated from outside (or by an insecure application).

The security control device is subject to one or more security measures that the first HW platform is not subject to. For example, the one or more security measures may include a verification of SW code of a SW module executed on the controller of the backup by the controller's core. In particular, the SW code can be checked by a manufacturer of the vehicle and/or by a unit of the control device of the fuse that is separate from the provider of the SW program. In this way it can be ensured that no safety-relevant data is released and/or no safety-relevant function (of the supply network) is impaired by a software module on the control device of the fuse. Alternatively or additionally, the one or more security measures may include a restriction of data that can be passed to or from a SW module running on the control device of the backup. The flow of data to and/or away from the fuse control device can thus be restricted.

The SW program includes at least one basic module and at least one safety-related module. The safety-relevant module accesses safety-relevant data and/or a safety-relevant function. On the other hand, the base module typically does not access security-related data and/or a security-related function, or only via defined interfaces. The SW program can thus be divided into one or more safety-critical parts and one or more safety-uncritical parts.

The basic module (i.e. the one or more safety-non-critical parts) can then be executed on the first HW platform, and the safety-relevant module (i.e. the one or more safety-critical parts) can be executed on the control device of the fuse.

The system thus makes it possible to provide SW programs for applications in a supply network of a vehicle in a reliable, safe and efficient manner.

The at least one safety-relevant module (i.e. the one or more safety-critical parts) preferably comprises 20%, 10% or less of the SW code of the SW program and the at least one basic module (i.e. the one or more safety-uncritical parts ) preferably comprises 80%, 90% or more of the SW code of the SW program. In this way, the one or more security measures relating to the control device of the security can be implemented in an efficient manner.

The first HW platform is preferably designed in such a way that a SW module running on the first HW platform (i.e. a basic module) has no access or only access via a defined interface to a safety-related function of the supply network. On the other hand, the control device of the fuse is preferably designed in such a way that a software module running on the control device of the fuse has access to a safety-relevant function of the supply network. In this way, safe execution of SW programs in a supply network can be made possible in a reliable manner.

The base module can be set up to call up the safety-relevant module when the SW program is executed and to cause the safety-relevant module to be executed on the control device of the fuse. When executing the SW program, data can be transferred from the base module to the safety-relevant module. Furthermore, data from the safety-relevant module are transferred to the base module. The safety-relevant module can have a standardized interface via which the data can be transferred to the safety-relevant module or from the safety-relevant module. In this way, a secure execution of SW programs from external SW providers can be made possible in a control device of the security. In particular, this makes it possible to mix fuses from different manufacturers in the supply network of a vehicle.

According to a further aspect, a method for executing a SW program in a supply network is described. The method includes running a basic module of the SW program on a first HW platform, for example the higher-level computer system of the vehicle. The method also includes calling a safety-related module of the software program from the base module, with the safety-related module accessing safety-related data and/or a safety-related function. The method further includes executing the security-relevant module on a security control device of the vehicle, wherein the security control device is subject to one or more security measures to which the first HW platform is not subject.

According to a further aspect, a vehicle (in particular a road motor vehicle, e.g. a passenger car, a truck or a motorcycle) is described which comprises the supply network described in this document.

1. 1 ein beispielhaftes System zur Integration von SW-Programmen;
2. 2 einen beispielhaften Aufbau eines SW-Programms; und
3. 3 ein Ablaufdiagramm eines beispielhaften Verfahrens zur Ausführung eines SW-Programms in einem Fahrzeug.

The invention is described in more detail below using exemplary embodiments. show it

1. 1 an exemplary system for the integration of SW programs;
2. 2 shows an exemplary structure of a software program; and
3. 3 shows a flowchart of an exemplary method for executing a software program in a vehicle.

As explained at the beginning, this document deals with the flexible and secure integration of software programs for different applications on a HW platform of a vehicle.

For example, a SW program for an application can be installed on a user's smartphone, and the smartphone can be connected to the vehicle via a data connection. On the other hand, a SW program can be installed and executed directly on a control unit (e.g. the head unit) of a vehicle. Both of these options come with disadvantages. For example, it may be undesirable for a user to install software from possibly unknown providers on a personal smartphone. On the other hand, the direct integration of SW programs on the higher-level computer system of a vehicle typically requires high integration costs. A complete control and/or verification of the installed software may not be possible due to the high level of complexity. Furthermore, the security of data from a SW program within a head unit may not be adequately guaranteed.

It is therefore proposed to provide a trusted environment (i.e. a secure ecosystem) for third-party software in a vehicle. By providing such a trustworthy environment, an external provider of a SW program can be guaranteed that security-relevant parts of the SW program (e.g. cryptographic keys) are protected against access. Furthermore, it can be ensured in an efficient manner that a software program from an external provider does not impair the safety of the vehicle.

character list

• 1 shows a simplified and schematic system 50 of electronic fuse 1, data bus 9 and higher-level computer system 12. According to the proposal, the electronic fuse 1 preferably comprises a circuit breaker 17 and a control device 4, which controls this circuit breaker 17.
• 2 shows simplified and exemplary a supply network 200 with electronic fuses.
• 3 shows a data bus system with a dashed data bus 9 for the exemplary supply network 200 of FIG 2 .
• 4 shows a schematically simplified example of a fuse box 400 with slots 410 and 420 for accommodating electronic fuses 405 and fuses 415.
• 5 based on the 1 and represents a modification of 1 where fuse 1 is the 5 additionally includes a first test current source 505, which feeds an electrical test current 515 into the first terminal 26 of the circuit breaker 17 of the fuse 1.
• 6 essentially corresponds to the 1 , wherein the control device 4 of the fuse 1 of 4 has an additional second data interface 610 .
• 7 corresponds to the essential parts 3 , wherein the data bus 9 is designed as a ring-shaped data bus ring 9'.
• 8th corresponds in the most important parts to the 4 , where the supply subnetwork is the 8th a further fuse 805, a second further fuse 810, a first connected distribution tree 815, a second connected distribution tree 820, an electronic fuse 825, consumers 830 and further consumers 835.
• 9 time a fuse 1 that is opposite to fuse 1 of the 5 has a second test current source 905 in addition to the first test current source 505, the test current 915 of which is modulated by means of the control signal 910 with a modulation signal {505} of a second signal generator 920.
• 10 shows a proposed energy source-side crossing protection 1000.
• 11 11 shows a proposed supply network 1100 with a higher-level computer system 12 and with a large number of supply lines and with a large number of crossing fuses 1110 to 1118, which enable flexible load and supply-dependent reconfiguration of the supply network 1100.
• 12 shows the basic sequence of a method 1200 for operating a supply network.
• 13 13 outlines a method 1300 for operating a vehicle (consumer-side feature version).
• 14 also shows another simplified method 1400 for operating a vehicle by activating energy sources in the vehicle.
• 15 largely corresponds to the 8th , but now the supply network is divided into a first supply sub-network and a second supply sub-network.
• 16 shows a schematically simplified and exemplary method 1600 for detecting non-extinguishing arcs 1510 in the wiring harness 1515 of a vehicle.
• The 17 essentially corresponds to the 7 , the third supply line section 245 being separated into the third supply line section 245 and the fourth supply line section 246 here.
• 18 provides a schematically simplified example of a method 1800 for operating a supply network 1700 of 17 represent.
• 19 corresponds to the essential parts 15 and the 10 , where while 10 shows a fuse box 1000, 19 shows two lines 1915 and 1505 to be protected, which are parts of a cable harness 1515.
• 20 describes, schematically and in simplified form, a distributed measurement method 2000 for detecting the state of a wiring harness 1515 of a vehicle based on the representation of FIG 19 .
• 21 shows in a schematically simplified manner a proposed battery 2100 with diagnostic function for a vehicle using supply networks 200 as described in the preceding figures in the document presented here.
• 22 equals to 21 with the difference that the first electronic fuse 825 has an additional contact 2210 in order to conduct this current past the electrochemical battery cell 2145 in the event of an incorrect sign of the current 2121 through the first fuse 825 .
• 23 shows a battery cell module 2300, the at least one battery cell 2145 and / or an interconnection of battery cells, a first circuit breaker 17, a second circuit breaker 17 ', a first electrical node 2120, a second electrical node 2135, a third elec ric node 2140, a first battery cell connection 2305 and a second battery cell connection 2310 comprises.
• 24 equals to 6 , where fuse 1 is the 24 a second circuit breaker 17'.
• The 25 corresponds to the battery of 22 , where the 25 a battery cell module 2500 with a plurality of battery cells 2145, 2185 shows.
• 26 shows a housed battery cell module 2600 with a common housing 2605 of the battery cell module 2600 for an electronic fuse 825 and an inner battery cell module 2105.
• 27 shows a battery 2700, in which an electronic fuse 825 of the battery 2200 has a second circuit breaker 17', which is suitable for bridging the battery cell module 2105 assigned to the fuse when the second circuit breaker 17' is closed, and in which the control device consists of the battery cell 2145 is supplied, but only when the circuit breaker 17 is closed.
• 28 shows a battery 2800, in which an electronic fuse 825 of the battery 2200 has a second circuit breaker 17', which is suitable for bridging the battery cell module 2105 assigned to the fuse when the second circuit breaker 17' is closed, and in which the control device 4 consists of the battery cell 2145 continues to be supplied, even if the circuit breaker 17 is open.
• 29 shows a supply network 2900, one or more supply branches of the supply network 2900 for supplying electrical consumers 2930 to 2933 with electrical energy as a ring of a supply line 2910 to 2915, in particular when a body is used as a return ground line, and/or as two rings of two supply lines are.
• 30 equals to 29 with the difference that energy sources and consumers are pluggable.
• 31 shows a schematic and simplified representation of a supply network 3100, which essentially corresponds to the supply network 3000 of 30 corresponds, whereby the plug connections are now secured with their own fuses.
• 32 corresponds to a large extent to 11 , where the supply network 3200 of 32 a first sub-supply network 3201 and a second sub-supply network 3202.
• 33 shows a supply network 3300 similarly 31 to explain the prioritization of consumers and energy sources and a favorable topology of the supply network 3300 to support this prioritization.
• 34 exemplifies and simplifies a method 3400 for active power management in a supply network 1100 (see 11 ) with electrical fuses 1110 to 1118 for supplying electrical consumers 1121 to 1125 in this supply network 1100 with electrical energy from one or more electrical energy sources 1150 to 1155.
• 35 illustrates in a simplified and schematic manner a method 3500 for operating a vehicle with equipment variants, the activation and deactivation of the equipment variants of the vehicle taking place at least in part preferably by means of the supply network and by means of the electronic fuses and their circuit breakers 17 .
• 36 is intended to represent possible levels of a data protocol on the data bus 9 of the supply network 200.
• 37 shows today's protection of the cable of a supply line section.
• 38 shows the advantages of securing a supply line section with an electronic fuse;
• 39 shows the combination of two proposed SPAD diodes in cross section.
• 40 FIG. 12 shows the combination of two proposed SPAD diodes in cross section, with several insulation layers now forming the optical waveguide 44.
• 41 shows the integration of the SPAD diodes and the optical fiber in an evaluation and operating circuit
• 42 equals to 41 , which is now supplemented by monitoring circuits.
• 43 shows a typical output signal of the second SPAD diode.
• 44 shows an example oscillogram of the voltage signal 4104 of the entropy source 4101.
• 45 shows the schematic sequence of a server-client communication using a proposed quantum random number generator.
• 46 shows the schematic sequence of the KeyExchangeServer() and KeyExchangeClient() functions.
• 47 shows the schematic sequence of the setPrimes() function.
• The 48 shows the schematic sequence of the setE() function.
• 49 shows the schematic flow of the findD() function.
• 50 shows the schematic sequence of a secure transmission of quantum-based random numbers between a computer core 2 of the control device 4 of the fuse 1 (server) and a computer core 2 of the control device 4 of the other fuse 1 (client).
• 51 shows schematically the proposed method 5200 for generating a quantum random number.
• 52 Time a general quadruple backup with only one control device 4.
• 53 shows the general quadruple backup of the 52 as a general triple fuse, the three circuit breakers 17, 17 'and 17''are interconnected in the star, so that they z. B. as a triple fuse 3010 'of 31 can be used.
• 54 shows the general quadruple backup of the 52 the four circuit breakers 17, 17', 17'' and 17''' being connected to form a cross fuse 1000.
• 55a shows an example system for the integration of SW programs.
• 55b shows an example structure of a software program.
• 56 shows a flowchart of an exemplary method for executing a software program in a vehicle.

Description of the other figures

figure 1

1 shows a simplified and schematic system 50 of electronic fuse 1, data bus 9 and higher-level computer system 12. According to the proposal, the electronic fuse 1 preferably comprises a circuit breaker 17 and a control device 4, which controls this circuit breaker 17. The power switch 17 is preferably a MOS transistor or the like. Other semiconductor components such as thyristors, bipolar transistors, thyristors, etc. are conceivable but are currently less common.

The power transistor 17 can be integrated with device parts of the control device 4 in a semiconductor substrate. However, different technologies are preferably used for the circuit breaker 17 and the control device 4 . The control device 4 is preferably manufactured using CMOS technology. The power switch 17 is preferably manufactured using MOS technology for power transistors or another semiconductor technology for power transistors. The shunt resistor 24 can be integrated both with the control device 4 on a common semiconductor substrate and can be integrated together with the power switch 17 on a common substrate.

In the 1 For the sake of clarity, not all useful and possibly usual device components are shown. Next device components that the reader as possibly in the 1 can accept present, can be found, for example, in the 5 , 6 , 9 , 24 , 41 , 42 , 52 , 53 , 54 , 55 . The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

The higher-level computer system 12 exchanges data with the control device 4 via the data bus 9 . Typically, the higher-level computer system 4 requests status data from the electronic security tion 1 via the data bus 9 and a data bus interface 10 from a computer core 2 of the control device 4 of the electronic fuse 1. In this case, the computer core 2 preferably accesses the peripheral components of the control device 4 via an internal data bus 11 . These peripheral components can act, for example but not limited to, the data bus interface 10, a watchdog 13, non-volatile memory 14, volatile read-write memory 15 and a gate drive circuit 16 for driving and monitoring the circuit breaker 17.

The one gate drive circuit 16 preferably monitors and controls the power switch 17. A control line 20 for controlling the power switch 17 preferably connects the gate drive circuit 16 to the first terminal of the power switch 17. The gate drive circuit 16 preferably controls the switching state by means of the control line 20 of power switch 17. Gate drive circuit 16 preferably detects one or more voltages between first connection 26 of power switch 17 and/or second connection 28 of power switch 17 and/or control connection 27 of power switch 17 on the one hand and a reference potential 201 on the other. The gate drive circuit 16 preferably detects one or more voltages between the first terminal 26 of the power switch 17 and/or the second terminal 28 of the power switch 17 and/or the control terminal 27 of the power switch 17 with one another. The electronic fuse 1 preferably comprises an auxiliary circuit breaker 23. The auxiliary circuit breaker 23 is preferably used to detect a current which is proportional to the current through the circuit breaker 17 or corresponds in some other way. The electronic fuse 1 preferably comprises a shunt resistor 24. The magnitude of the value of the electric current 36 through the shunt resistor 24 and the auxiliary circuit breaker 23 is typically proportional to the magnitude of the electric current 29 through the circuit breaker 17. A measuring line 25 is used for Detection of the voltage drop across the shunt resistor 24. A monitoring line 21 is used to detect the voltage between the second terminal 19 of the power switch 17 and the control line 20 of the power switch 17. The gate drive circuit 16 preferably uses the measuring line 25 and a monitoring line 21 to detect the Voltage drop across the shunt resistor 24. Typically, the computer 2 of the control device 4 of the electronic fuse 1 controls the circuit breaker 17 depending on the values of these voltages recorded in this way and depending on commands that the computer 2 of the control device 4, for example, from a higher-level computer system 12 for example via said data bus 9.

In terms of the document presented here, the first connection 18 of the electronic fuse 1 is preferably the connection of the electronic fuse on the energy source side. In terms of the document presented here, the second connection 19 of the electronic fuse 1 is preferably the consumer-side connection of the electronic fuse. Since consumers, such as motors, often do not consume energy in certain operating situations, for example braking, but rather recover it, this assignment can possibly be reversed during operation. In this respect, it is only an idea of the predominant use of the first connection 18 of fuse 1 and the second connection 19 of fuse 1.

One watchdog 13 is preferably used to monitor the microcontroller, ie the computer 2. In the simplest case, the watchdog is a timer that counts with the system clock of the control device 4, for example. Typically, the computer 2 signals to the watchdog 13 at more or less regular intervals that it is still functional. Watchdog 13 preferably resets its counter reading to a predetermined start value with each signal from computer 2 . However, if watchdog 13 reaches a predetermined watchdog threshold value, watchdog 13 typically assumes that computer 2 is disrupting the processing of the operating program. The watchdog 13 then typically takes countermeasures. A countermeasure can be, for example, resetting the program execution of the computer 2 to a specified program start address. Another countermeasure can be stopping the computer 2. Another countermeasure can be to open the circuit breaker 17. Another countermeasure can be, for example, a signaling of the watchdog 13 to a higher-level computer system 12 via the internal data bus 11, the data interface 10 and the external data bus 9 to a higher-level computer system 12. Typically, the computer 2 of the control device 4 of the electronic fuse 1 can configure the watchdog 13 via the internal data bus 11 using registers of the watchdog 13 and can read out the status of the watchdog 13 via the watchdog register.

The non-volatile memory 14 can comprise, for example, a flash memory or an EEPROM or a ROM or the like. The non-volatile memory 14 preferably includes data and/or program code. The computer 2 of the electronic fuse 1 preferably accesses it via the internal data bus 11 data and the program code. In particular, the data in non-volatile memory 14 preferably also includes configuration data for electronic fuse 2.

Furthermore, the proposed electronic fuse 1 preferably includes a volatile read/write memory 15. The volatile read/write memory 15 can be, for example, a RAM or an SRAM or a DRAM or an FRAM or an MRAM or the like. The computer 2 of the electronic fuse 1 preferably uses this volatile read/write memory 15 for temporarily storing intermediate results.

An oscillator 30 with a clock supply preferably generates the system clock of the control device 4 of the electronic fuse 1. The higher-level computer system 12 can preferably access the configuration register of the oscillator 30 and the clock supply via the internal data bus 11 and the data bus interface 10 and the data bus 9 and configure them and read their status. Likewise, the computer 2 can preferably access the internal data bus 11 and configure these configuration registers for the oscillator 30 and the clock supply and read their status from status registers.

The control device 4 preferably includes a timer and/or a clock of the control device 4. The computer 2 can then store measured values of the gate control circuit 16 for the control and monitoring of the circuit breaker 17 with a time stamp from a time value of the timer 16 and measured values of voltages and/or or other physical parameters etc. combine.

For example, a temperature measuring device 40 can determine the temperature of the control device 4 and/or the temperature of device parts of the control device 4 . The control device 4 of the fuse 1 can also include an analog-to-digital converter 570, which is shown by way of example in a following figure. For example, such an analog-to-digital converter can provide a measuring line to a temperature sensor, not shown here for the sake of clarity, via which analog-to-digital converter 570 can determine the temperature of circuit breaker 17 or other device parts of fuse 1 and Computer 2 can make available via the data bus 11. For this purpose, this temperature sensor is preferably thermally closely coupled to the circuit breaker 17 . The temperature sensor is preferably a part of the circuit breaker 17. The electronic fuse can have a number of temperature sensors, the measured value signals of which can be recorded by the analog-to-digital converter 570 and made available to the computer 2. For example, the temperature sensor can also determine the temperature of the line at the first connection 18 or at the second connection 19 of the electronic fuse 1 .

The electronic fuse 1 preferably has a voltage supply 5 for the control device 4 and for the operation of any other device parts of the electronic fuse 1 that may be present. A line for the operating voltage 6 and a line for the reference potential 201 preferably supply the electronic fuse 1 with electrical energy. It is also conceivable that the electronic fuse draws its energy from the first connection 18 and/or the second connection 19 on the one hand and the reference potential line 201 . In normal operation, the power supply 5 preferably charges an energy reserve 8. This is typically a capacitor and/or an accumulator and the like.

In the event of a failure of the energy supply via the operating voltage 6, the energy reserve 8 supplies the control device 4 and thus the circuit breaker 17 with the necessary energy via an emergency energy supply 7. In the event of such a failure, the power supply 5 preferably disconnects the operating voltage 6 and possibly also the reference potential 201 by means of isolating switches in order not to discharge the energy reserve 8 .

The voltage supply 5 preferably includes the necessary voltage regulators and/or voltage converters in order to provide the voltages required by the control device 4 from the energy reserve 8 or from the operating voltage 6 for the operation of the control device 4 .

The control device 4 presented here for the operation of an electronic fuse 1 of a vehicle preferably has a system-based chip functionality. This system basis chip functionality provides all the functions to be able to operate a microcontroller as a computer core 2 in the control device 4 of the electronic fuse 1 and at least one data interface 1, so that the computer core 2 has at least errors and/or faults in the control device 4 and/or or other device parts of the backup can be securely transmitted to a higher-level computer system 12 via the data bus 9. This system basis chip functionality includes a boost converter 5 for the power supply 5 of the safety-relevant device parts of the control device 4 of the fuse 1 and for charging and possibly discharging an internal or external energy reserve 8. The energy reserve 8 can comprise an accumulator and/or a capacity. In normal operation, the boost converter 5 preferably prepares an externally provided operating voltage 6 from one or more external energy sources and makes the necessary internal operating voltages available to the device parts of the control device 4 and/or other device parts of the fuse 1 . The computer core 2 of the control device 4 of the fuse 1 monitors the operating voltage 6 of the boost converter 5 by means of an analog-to-digital converter 570, for example . In such an emergency operation mode, the boost converter 5 preferably supplies the control device 4 and/or other device parts of the fuse with electrical energy from the energy reserve 8, insofar as this is absolutely necessary. In normal operation, the boost converter 5 charges the energy reserve 8 with electrical energy. In emergency operation, the energy reserve 8 takes over the energy supply of the control device 4 of the fuse 1. Thus, in the emergency operation, the boost converter 5 and/or a functionally equivalent second voltage control device provide an emergency energy supply 7 for the safety-relevant device parts of the control device 4 of the fuse 1 and/or the fuse 1 .

figure 2

2 shows simplified and exemplary a supply network 200 with electronic fuses. The supply network shows the reference potential node 201 only symbolically. The reference potential node can be, for example, the body ground of a vehicle body made of metal or the like. The proposed supply network thus uses, for example, an electrically conductive vehicle body as an electrical return line. This electrical return is in the example 2 the reference potential node 201. The reference potential node 201 is typically the ground of the vehicle. In the figures of the document presented here, the reference potential node 201 is not always drawn in for better clarity and is also not always denoted by the reference symbol. The circuit symbol for ground designates the reference potential node 2021 in the figures of this document when it is drawn in a figure. The supply network 200 has in the example of FIG 2 different device parts (210 to 213). These typically consume electrical energy.

A first fuse 214 of the first device part 210 of the supply network 200 protects the first line section 240 and the consumers connected to it in the form of further, dependent device parts (220 to 223) of the supply network 200. The first fuse 214 preferably corresponds in terms of its internal structure to an electrical fuse 1 . In the example of 2 the first fuse 214 can electrically connect the third line section 245 to the first line section 240 by means of its circuit breaker 17 or locally separate the third line section (245) from the first line section 240 by means of its circuit breaker 17 . Typically, the first fuse 214 is connected to a data bus 9 which, for simplicity in FIG 1 is not marked. 3 shows an example wiring of the data bus 9, which is also shown in the form in 1 would be applicable.

A second fuse 215 of the second device part 211 of the supply network 200 protects the first line section 240 and the loads connected to it in the form of further dependent device parts (220 to 223) of the supply network 200 . The second fuse 215 preferably corresponds in terms of its internal structure to an electrical fuse 1 . In the example of 2 the second fuse 215 can electrically connect the third line section 245 to the first line section 240 by means of its circuit breaker 17 or locally separate the third line section 245 from the first line section 240 by means of its circuit breaker 17 . Typically, the second fuse 215 is connected to a data bus 9 which, for simplicity in FIG 1 is not marked. 3 shows an example wiring of the data bus 9, which is also shown in the form in 1 would be applicable.

A third fuse 216 of the third device part 212 of the supply network 200 protects the second line section 241 and the consumers connected to it in the form of further dependent device parts (230 to 233) of the supply network 200 . The third fuse 216 preferably corresponds in terms of its internal structure to an electrical fuse 1 . In the example of 2 the third fuse 216 can electrically connect the third line section 245 to the second line section 241 by means of its circuit breaker 17 or locally separate the third line section 245 from the second line section 241 by means of its circuit breaker 17 . Typically, the third fuse 216 connected to a data bus 9, for simplification in the 1 is not marked. 3 shows an example wiring of the data bus 9, which is also shown in the form in 1 would be applicable.

A fourth fuse 217 of the fourth device part 213 of the supply network 200 protects the second line section 241 and the consumers connected to it in the form of further dependent device parts (230 to 233) of the supply network 200 . The fourth fuse 217 preferably corresponds in terms of its internal structure to an electrical fuse 1 . In the example of 2 the fourth fuse 217 can electrically connect the third line section 245 to the second line section 241 by means of its circuit breaker 17 or locally separate the third line section 245 from the second line section 241 by means of its circuit breaker 17 . Typically, the fourth fuse 217 is connected to a data bus 9 which, for simplicity in FIG 1 is not marked. 3 shows an example wiring of the data bus 9, which is also shown in the form in 1 would be applicable.

When the first fuse 214 is connected in parallel with the second fuse 215, as in the example of FIG 1 , the circuit breakers 17 of both fuses (214, 215) must be open in order to separate the first line section 240 from the third line section 245. If the first line section 240 is separated from the third line section 245 by open circuit breakers 17, the first energy source 250 and the second energy source 251 no longer supply the other device parts (220 to 223) with electrical energy. If the first line section 240 is electrically connected to the third line section 245 via closed circuit breakers 17, the first energy source 250 and the second energy source 251 supply the other device parts (220 to 223) with electrical energy if these energy sources (250, 251) supply energy in feed the third line section 245 .

When the third fuse 216 is connected in parallel with the fourth fuse 217, as in the example of FIG 1 , the circuit breakers 17 of both fuses (216, 217) must be open in order to separate 245 the first line section 240 from the third line section. If the second line section 241 is separated from the third line section 245 by open circuit breakers 17, the first energy source 250 and the second energy source 251 no longer supply the other device parts (230 to 233) with electrical energy. If the second line section 241 is electrically connected to the third line section 245 via closed circuit breakers 17, the first energy source 250 and the second energy source 251 supply the other device parts (230 to 233) with electrical energy if these energy sources (250, 251) supply energy in feed the third line section 245 .

A fifth fuse 225 can separate the fifth device part 220 of the supply network 200 from the first line section 240 by means of its circuit breaker 17 and thus prevent an energy supply to the fifth device part 220 or connect the fifth device part 220 of the supply network 200 to the first line section 240 by means of its circuit breaker 17 and thus connect it enable the fifth device part 220 to be supplied with energy.

A sixth fuse 226 can isolate the sixth device part 221 of the supply network 200 from the first line section 240 by means of its circuit breaker 17 and thus prevent an energy supply to the sixth device part 221 or connect the sixth device part 221 of the supply network 200 to the first line section 240 by means of its circuit breaker 17 and thus connect it enable the sixth device part 221 to be supplied with energy.

A seventh fuse 227 can separate the seventh device part 222 of the supply network 200 from the first line section 240 by means of its circuit breaker 17 and thus prevent an energy supply to the seventh device part 222 or connect the seventh device part 222 of the supply network 200 to the first line section 240 by means of its circuit breaker 17 and thus connect it enable the seventh device part 222 to be supplied with energy.

An eighth fuse 228 can separate the eighth device part 223 of the supply network 200 from the first line section 240 by means of its circuit breaker 17 and thus prevent an energy supply to the eighth device part 223 or connect the eighth device part 223 of the supply network 200 to the first line section 240 by means of its circuit breaker 17 and thus connect it enable the eighth device part 223 to be supplied with energy.

A ninth fuse 235 can separate the ninth device part 230 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent an energy supply to the ninth device part 230 or to the ninth device part 230 of the supply Connect the transmission network 200 to the second line section 241 by means of its circuit breaker 17 and thus enable the ninth device part 230 to be supplied with energy.

A tenth fuse 236 can isolate the tenth device part 231 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent an energy supply to the tenth device part 231 or connect the tenth device part 231 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus connect it enable the tenth device part 231 to be supplied with energy.

An eleventh fuse 237 can separate the eleventh device part 232 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent an energy supply to the eleventh device part 232 or connect the eleventh device part 232 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus connect it enable the eleventh device part 232 to be supplied with energy.

A twelfth fuse 238 can isolate the twelfth device part 233 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent an energy supply to the twelfth device part 232 or connect the twelfth device part 233 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus connect it enable the twelfth device part 233 to be supplied with energy.

A thirteenth fuse 255 can isolate the twelfth device part 233 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent an energy supply to the twelfth device part 232 or connect the twelfth device part 233 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus connect it enable the twelfth device part 233 to be supplied with energy.

A thirteenth fuse 255 can isolate the first energy source 250 of the supply network 200 from the third line section 245 by means of its circuit breaker 17 or connect the first energy source 250 of the supply network 200 to the third line section 245 by means of its circuit breaker 17 . As a result, the thirteenth fuse 255 can prevent the power supply to the sub-networks connected to the first energy source 250, here the device parts 210 to 213 and 220 to 223 and 230 to 233, by the first energy source 250 by opening the first circuit breaker 17 of the thirteenth fuse 255 or the Enabling the power supply of the sub-networks connected to the first energy source 250, here the device parts 210 to 213 and 220 to 223 and 230 to 233, through the first energy source 250 by closing the first circuit breaker 17 of the thirteenth fuse 255.

A fourteenth fuse 256 can isolate the second energy source 251 of the supply network 200 from the third line section 245 by means of its circuit breaker 17 or connect the first energy source 251 of the supply network 200 to the third line section 245 by means of its circuit breaker 17 . As a result, the fourteenth fuse 256 can prevent the power supply to the sub-networks connected to the second energy source 251, here the device parts 210 to 213 and 220 to 223 and 230 to 233, by the second energy source 251 by opening the first circuit breaker 17 of the fourteenth fuse 256 or the Enabling the power supply of the sub-networks connected to the second power source 251, here the device parts 210 to 213 and 220 to 223 and 230 to 233, through the second power source 251 by closing the first circuit breaker 17 of the fourteenth fuse 256.

In the 2 For example, the third device part 212 is provided with a plug-in option 262 for the third electronic fuse 216 of the third device part 212. In this way, for example, a workshop can replace the third electronic fuse 216 manually, for example in the event of a fuse failure. If the plug-in option is designed to be compatible with fuses, a workshop, for example, can replace the third electronic fuse 216 with a fuse. Conversely, for example, the workshop can replace a fuse located in the plug-in facility 262 with a third electronic fuse 216 .

All devices 210 to 213 and 220 to 223 and 230 to 233 with a plug-in option for an electronic fuse such as the plug-in option 262 for the electronic fuse would be preferred 216 of the third device part 212 is provided. The downside is that such connectors typically result in reduced reliability.

figure 3

3 shows a data bus system with a dashed data bus 9 for the exemplary supply network 200 of FIG 2 . Each of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 preferably corresponds to an electronic fuse according to FIG 1 . Therefore, each of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 typically has a control device 4 with a data interface 10 .

These control devices 4 are in the 3 exemplarily provided with separate reference numbers 280 to 293 for each electronic fuse 214 to 217 and 225 to 228 and 235 to 238. The higher-level computer system 12 preferably communicates via the respective data interface 10 of the respective control device 4 of the respective electronic fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 with the respective computer core 2 of the respective fuse. This respective computer core 2 of the respective fuse can open or close the circuit breaker 17 of the respective fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 by means of the gate control circuit 16 . The higher-level computer system 12 can preferably use a data message to a computer core 2 of a control device 4 of a fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 to cause this computer core 2 to use control signals to the gate control circuit 16 of the relevant electronic fuse to open or close the circuit breaker 17 of this electronic fuse. The computer cores 2 of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 of the supply network 200 preferably record operating parameters using tools (16, 520, 530, 525, 23, 24, 21, 25, 505, 905, 920 etc.). the associated electronic fuse. A first particularly important parameter is typically the electric current 29 through the circuit breaker 17 of the relevant electronic fuse. Preferably, some electronic fuse sub-devices sense a current reading of this electrical current or model an electrical current that is proportional to this electrical current 29 through the circuit breaker 17 . Another important parameter, which the computer cores 2 of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 preferably determine with additional auxiliary devices of these fuses, each fuse-specific, is preferably the voltage between the first connection 18 of the relevant electronic fuse and the reference potential 201 and /or the voltage between the second terminal 19 of the relevant electronic fuse and the reference potential and/or other voltages between internal electrical nodes and/or external electrical nodes of the respective electronic fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238. The computer cores 2 of the control devices 4 preferably transmit some or better all electronic fuses of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 some or all of these measured values to the higher-level computer system 2 via the data bus 9. The higher-level computer system 12 can do this then evaluate the data. For example, the higher-level computer system is then able to determine the voltage drop across a line section of line sections 240 to 245 by using Kirchhoff's mesh and node rules. In order to avoid a ground offset when the body is used as a return line for the electrical current, it is advantageous if the reference potential line is essentially current-free. However, such an additional reference potential line cannot usually be implemented for cost reasons. It therefore makes sense if one or more or better each of the fuses are set up to detect a ground offset of the reference potential line 201, for example by detecting a rest potential of the data bus 9 at times when the data bus is not being used. It is obvious that a control device 4 of a fuse for the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 with its computer core 2 can assume the role of the superordinate computer system 12 . In that case would be different than in the 3 no separate higher-level computer system 12 is shown.

In exemplary contrast to 2 the first device part 210 now feeds the first line section 240, which only supplies the fifth device part 220 and the sixth device part 221 with electrical energy from the energy sources 250 and 251 via the first fuse 214 of the first device part 210.

In exemplary contrast to 2 the second device part 211 now feeds a fourth line section 242, which instead of the first line section 240 now has the seventh device part 222 and the eighth device part 223 is supplied with electric power from the power sources 250 and 251 via the second fuse 215 of the second device part 211 .

In exemplary contrast to 2 the third device part 212 now feeds the second line section 241, which only supplies the ninth device part 230 and the tenth device part 231 with electrical energy from the energy sources 250 and 251 via the third fuse 216 of the third device part 212.

In exemplary contrast to 2 the fourth device part 213 now feeds a fifth line section 243, which instead of the second line section 241 now supplies the eleventh device part 232 and the twelfth device part 233 with electrical energy from the energy sources 250 and 251 via the fourth fuse 217 of the fourth device part 213.

If one of the circuit breakers 17 of one of the fuses 214 to 217 is opened by its computer core 2 of its control device 4, the energy sources 250 and 251 no longer supply the partial network downstream of this fuse with electrical energy. Preferably, the fuses have a stand-by capability that continues to allow a limited supply of electrical energy for the purpose of stand-by operation.

figure 4

4 shows a schematically simplified example of a fuse box 400 with slots 410 and 420 for accommodating electronic fuses 405 and fuses 415. A slot 410 for an electronic fuse 405 preferably has a first contact 430 for the first connection 18 of the circuit breaker 17 of the electronic fuse that can be inserted there 405 on. Furthermore, the slot 410 for an electronic fuse 405 preferably has a second contact 435 for the operating voltage connection 6 of the electronic fuse 405 . The prerequisite here is that the electronic fuse 405 does not derive the operating voltage for its operation from the potential at its first connection 18 of its circuit breaker 17 . In this case, there is no need for the second contact 435, since the first contact 430 can then assume this function. Furthermore, the slot 410 for an electronic fuse 405 preferably has a third contact 475 for the reference potential connection 201 of the electronic fuse 405 . Furthermore, the slot 410 for an electronic fuse 405 preferably has a fourth contact 440 for connecting the external data bus 9 of the electronic fuse 405 . In the example of 9 the data bus 9 is a so-called single-wire data bus, in which the return line of the data bus is typically identical to the reference potential line 201. The data bus 9 presented here is therefore typically a backup data bus 9 or a fuse data bus 9. In the automotive sector, the data bus 9 is, for example, a Lin data bus 9 or a DSI3 data bus 9 or a PSI5 data bus 9 or a CAN data bus 9 or a CAN FD data bus 9 or an Ethernet data bus or a Flexray data bus 9 or an LVDS data bus 9 or some other wired or wireless data transmission route, for example via a Bluetooth or WLAN data connection or an optical data connection (540). The data communication of the computer core 2 of the control device 4 of the fuse 1 takes place via a wired or wireless interface (610, 10, 551, 550).

It is particularly conceivable that the data bus 9 is a differential data bus 9 . In that case, the contact 440 of the data bus 9 in reality comprises a first electrical contact for the first line of the differential two-wire data bus and a second electrical contact for the second line of the differential two-wire data bus. Such a differential two-wire data bus can be, for example, a CAN data bus and/or a CAN FD data bus, which is used as data bus 9 . Since the CAN data bus protocol or the CAN FD data bus protocol requires a very good local oscillator, the use of a CAN data bus or a CAN FD data bus would lead to an increased effort for clock generation in each individual fuse, which would cause the costs of such a data bus system to explode. The document presented here therefore proposes the use of a CAN physical layer with a special security data protocol for such a case of a differential security data bus 9 . For this purpose, the higher-level computer system 12 signals a synchronization signal to the oscillators 30 of the control devices 4 of the electronic fuses 405 via the data bus 9 . The synchronization signal is preferably a so-called clock run-in in which, for example, a higher-level computer system sends a predefined alternating 1-0 bit sequence from the higher-level computer system 12, for example, to one or more or all control devices 4 of electronic fuses 405 of the supply network 200 sends. (In the 2 and 3 these would be the electronic fuses 214 to 217 and 225 to 225 and 235 to 238 and 255 and 256). The control devices 4 synchronize their oscillators 30 to this synchronization signal, preferably in terms of frequency and phase position. A data packet preferably has a start signal. The start signal is typically designed in such a way that it is recognized by the data interface 10 of the control device 4 of an electronic fuse 405 even when the local oscillator 30 of the electronic fuse concerned in the control device 4 is not synchronous with the oscillator of the higher-level computer system 12 . The oscillators 30 of the control devices 4 of the fuses 405 each provide the control devices 4 of which these oscillators 30 are part, at least one respective clock for the operation of this respective control device 4 .

• • Ein Startsignal START in Form von i Bits mit i als ganzer positiver Zahl mit i-1>m der m Bits des jeweiligen Bit-Strom-Paketes BP mit einem zweiten differentiellen logischen Zustand z2 auf dem seriellen, bidirektionalen, differentiellen Datenbus 9;
• • eine Synchronisationsinformation SYNC aus k Synchronisationsbits, mit k als positiver ganzer Zahl und k<m/3, zur Synchronisation des jeweiligen Abtastsignals CLKAj der jeweiligen Abtastvorrichtung der jeweiligen Datenbusschnittstelle 10 der jeweiligen Steuervorrichtung 4 der jeweiligen elektronischen Sicherung und/oder des jeweiligen Oszillators 30 der jeweiligen Steuervorrichtung 4 der jeweiligen Sicherung mit dem Takt CLK des übergeordneten Rechnersystems 12;
• • Dateninformationen DATA aus den restlichen Bits der m-i-k Bits der m Bits des jeweiligen Bit-Strom-Paketes BP, wobei die Dateninformationen vorzugsweise DATA Adressinformationen ADRD und Nutzinformationen INFO und Prüfinformationen CHKD umfassen.

Typically, the data interface 10 or another sub-device of the control device 4 of an electronic fuse 405 generates a sampling clock from this clock, with which the data interface 10 scans the logical values on the data bus 9 when it receives data via the data bus from the higher-level computer system or from the control device 4 of another fuse or other device connected to the data bus 9 receives. The sending bus user preferably sends the data over the data bus as a data packet with m data bits. Such a data packet preferably begins with a start signal. The synchronization phase for the oscillator 30 of this fuse 405 begins when the start signal is detected by a data interface 10 of a fuse 405. After the synchronization of the oscillator 30, the control device 4 preferably freezes the frequency and phase regulation of its oscillator 30. The data interface 10 then samples the following bits up to the end of the data packet with a constant frequency and phase of the clock of the oscillator 30 of the control device 4 . The end of the data packet is recognized by the data interface 10 of the control device 4 of a fuse 405, preferably with the aid of a stop symbol at the end of the data packet. The data interface preferably recognizes the end of the synchronization phase from a start symbol. This is preferably a predefined bit sequence. The data interface preferably only allows such a start symbol to be recognized a predetermined time after the start of the synchronization phase. The regulation of the frequency and phase of the oscillator 30 of a control device 4 of an electronic fuse 405 preferably ends with this time elapse. The generation of the sampling clock of the data interface 10 from this clock of the oscillator 30. The document presented here accordingly discloses a device for controlling electrical and/or electronic data interfaces 10 of control devices 4 of fuses of a supply network 200 with a serial, bidirectional, differential data bus 9 and with n data interfaces 10 of n control devices 4 of n fuses with n being a positive integer greater than 1 and with a higher-level computer system 12. The serial, bidirectional, differential data bus 9 has a first single-wire data bus and a second single-wire data bus. The voltage value between the first single-wire data bus and the second single-wire data bus typically represents the logical information that may be transmitted—the data that may be present. Each of the n fuses preferably has at least one differential, serial data bus interface 10 as part of its respective control device 4 . Each control device 4 of each of these fuses preferably includes an oscillator 30 which generates a fuse-specific clock CLKj for operating the control device 4 of this fuse—called the jth fuse here. The respective data interface 10 of a control device 4 of a fuse preferably includes a scanning device which scans the data bus 9 with a sampling clock which is preferably derived from the clock of the oscillator 30 of the control device 4 of this fuse. The control device 4 of a fuse preferably includes an address recognition unit and a fuse address register. In this case, for example, the data bus interface 10 or the computer core 2 can include the backup address register. The serial, bidirectional, differential data bus 9 can preferably be at least in a first differential logic state (high, z1) and in a second differential logic state (low, z2). The serial data bus interface 10 of the control device 4 of the at least one fuse of the n fuses is connected in each case to the serial, bidirectional, differential data bus 9 in order to send data via this serial, bidirectional, differential data bus 9 and/or via this data bus 9 from other computer cores 2 other control devices 4 other fuses or a higher-level computer system 12 to receive. Typically, the higher-level control device 12 also receives external control commands for controlling the n fuses. Typically, the higher-level control device 12 converts these externally initiated control commands into bit streams and bus stream packets BP to be sent via the serial, bidirectional, differential data bus 9 to the computer cores 2 of the control devices 4 of the fuses via their data bus interfaces 10 . The higher-level computer system 12 then typically sends the bits of the bit streams and bit-stream packets to be sent by the higher-level computer system 12 as a function of a clock CLK within the higher-level computer system 12 via the serial, bidirectional, differential data bus 9. The higher-level computer system 12 receives from the computer cores 2 the Control devices 4 of the electronic fuses generate bit streams and/or bit stream packets BP via the serial, bidirectional, differential data bus 9. The respective oscillator 30 the respective control device 4 of the respective fuse typically generates a respective sampling signal CLKAj for the respective data bus interface 10 control device 4 of the respective fuse from the respective clock of the respective oscillator 30 of the respective control device 4 of the respective fuse. The sampling device ATj of the respective data bus interface 10 of the respective control device 4 of the respective fuse then samples the bit streams and/or bit stream packets BP sent via the serial, bidirectional, differential data bus 9, preferably as a function of its respective sampling signal CLKAj of the oscillator 30 of the control device 4 of this fuse , in order to obtain a local bit stream from the received bit stream and/or bit stream packet BP in the respective control device 4 of the respective electronic fuse. The higher-level computer system 12 preferably sends the bit streams to be sent as sequences of bits in bit stream packets (frames, BP). According to the technical teaching of the document presented here, the bit stream packets BP include a time sequence of m individual bits of the bit stream packet BP with the same time length t _B . Here m is a positive integer. The time length t _B of the individual bits does not vary by more than a factor of +/-(0.4/m)*t _B within a bit stream packet BP. After the end of the synchronization phase for a bit stream packet, the scanning device of the data bus interface 10 of a control device 4 of a fuse preferably scans the individual bits on the data bus 9 in their middle. Thereafter, the regulation of the frequency and phase position of the clock signal generated by the oscillator 10 and/or of the sampling signal CLKj is frozen for the remainder of the reception of the bit stream packet BP. The temporal length of m periods of the sampling signal CLKj preferably deviates by no more than +/- (0.4/m)*t _B from the length m*t _B of m individual bits of a received bit stream packet, so that the sampling device of the data bus interface 10 of the Control device 4 of the electronic fuse also scans the last single bit in the correct assignment and double scanning of a single bit or non-scanning of a single bit does not take place. In order for this to be possible, at least some of the bit stream packets BP sent by the higher-level computer system 12 preferably have the following contents (see also 36 ):

• • A start signal START in the form of i bits with i as a positive integer with i−1>m of the m bits of the respective bit stream packet BP with a second differential logic state z2 on the serial, bidirectional, differential data bus 9;
• • synchronization information SYNC from k synchronization bits, with k as a positive integer and k<m/3, for synchronizing the respective scanning signal CLKAj of the respective scanning device of the respective data bus interface 10 of the respective control device 4 of the respective electronic fuse and/or of the respective oscillator 30 of the respective control device 4 of the respective fuse with the clock CLK of the higher-level computer system 12;
• • Data information DATA from the remaining bits of the mik bits of the m bits of the respective bit stream packet BP, the data information preferably comprising DATA address information ADRD and useful information INFO and check information CHKD.

The check information CHKD can be CRC checksums and/or parity bits, for example. At least part of the useful information INFO preferably includes configuration information ILD. This configuration information ILD can include, for example, threshold values and values of switch-off thresholds, which can possibly determine, for example, when the computer core 2 of a control device 4 of an electronic fuse opens or closes the circuit breaker 17 of this electronic fuse. The higher-level computer system 12 preferably transmits configuration commands via the fuse data bus 9 to the computer cores 2 of the control devices 4 of the fuses using this configuration information ILD 200 hang out. Such configuration commands in this configuration information ILD can cause circuit breakers 17 of electronic fuses of supply network 200 to be opened and closed by computer cores 2 of these electronic fuses, for example. The higher-level computer system 12 preferably adjusts the electrically effective topology of the supply network 200 of the supply lines dynamically by means of such configuration commands via the fuse data bus 9 to the fuses of the supply network 200 according to the determined energy requirement and/or according to the determined energy supply capability and/or according to the current safety requirement. The computer cores 2 of the control devices 4 of electronic fuses receive and thus send data via the data bus via their respective data interface 10 of the respective control device 4 of the respective electronic fuse, with this data containing configuration information ILD such as configuration data (write/read) and/or switching commands (write/ read), but also diagnostic data (write/read), measured values (read), comparison value settings (write/read). The data bus 9 is preferably direct or indirect, for example via gateways or the like, with a terminal (740) for input to reconfigure the utility network 200 using the electronic fuses. In the event of a system emergency operation scenario, the higher-level computer system 12 adapts the power consumption of a consumer of the consumers of the supply network 300 to the weakest supply line in the path between one or more energy sources of the energy sources of the supply network 200 on the one hand and this consumer of the consumer on the other by reconfiguration or changing the operating parameters of this consumer. In addition, in the event of a system emergency scenario, the higher-level computer system 12 adapts the power supply capability of an energy source from the energy sources of the supply network 200 to the weakest supply line in the path between this energy source from the energy sources in the supply network 200 on the one hand and consumers from the consumers in the supply network 200 by reconfiguring or changing the operating parameters of this energy source from the energy sources of the supply network 200. The higher-level computer system 12 initiates a configuration change in the supply network 200 by corresponding commands via one or more data buses 9 to electronic fuses in the supply network 200. The higher-level computer system 12 preferably firstly determines how much a consumer of the consumer in the supply network 200 who benefits from the configuration change of the Supply network 200 is affected, may consume energy in order to overload the supply network 200 at any point. The higher-level computer system 12 then preferably communicates to this relevant consumer, the consumer of the supply network 200 , how much energy this consumer the consumer of the supply network 200 may consume from the supply network 200 . Secondly, the higher-level computer system 12 preferably determines how much energy an energy source from the energy source of the energy sources of the supply network 200 that is affected by the configuration change in the supply network 200 may supply in order to not overload the supply network 200 at any point. The higher-level computer system 12 preferably communicates to this relevant energy source of the energy sources of the supply network 200 how much energy this energy source of the energy sources of the supply network 200 may supply.

Thus, the configuration information ILD preferably serves to control the energy supply of the device parts and to control the energy consumption from the energy sources and to control the load on the supply lines of the supply network 200. This control is carried out according to the technical teaching of the document presented here by the computer core 2 of a control device 4 an electronic fuse of the supply network 200 preferably depending on this configuration information ILD of a bit stream packet BP if the logical content of the address information ADRD of this bit stream packet BP with the content of the security address register of the computer core 2 or the data bus interface 10 of the control device 4 of the fuse matches. The respective address recognition units of the respective data bus interfaces 10 or the computer cores 2 of the control devices 4 of the electronic fuses evaluate the address information ADRD of the bit stream packets BP and only then allow the useful information INFO contained in the relevant bit stream packet BP to be used by the respective computer core 2 of the respective control device 4 of the respective fuse if the content of the address information ADRD of the bit stream packet BP corresponds to the current content of the fuse address register of the relevant fuse. The control devices 4 of the electronic fuses and their data interfaces 10 preferably have means for carrying out an auto-addressing process in order to fill the fuse address register with a logical fuse address which corresponds to the physical position of this fuse within the serial, bidirectional, differential data bus 9. The higher-level computer system 12 and/or computer cores 2 of control devices 4 of fuses based on the evaluation of the received test information CHKD preferably conclude that an oscillator 30 of one or more fuses is not running correctly. If necessary, these fuses then readjust their oscillators 30 . Preferably, the oscillators 30 of the control devices 4 of the fuses 405 of a supply network 200 each have a frequency stability after the synchronization of these oscillators 30 with the synchronization signal SYNC in the synchronization phase, which is so great that such an error should not occur in the CRC check.

The slot 410 of an electronic fuse 405 of the fuse box 400 preferably has a first contact 430 for the first connection 18 of the circuit breaker 17 of the electronic fuse 405 . This first contact 430 is preferably connected to the energy source 250 via the third supply line section 245 for supplying energy to the corresponding supply line 485 protected by this fuse 405 . The first contact 430 of the slot 410 for the electronic fuse 405 is preferably used to connect the first terminal 18 of the electronic fuse 405. The first contact 450 of the fuse body 425 corresponds to the first contact 430 of the slot 410 of the electronic fuse 405 of the fuse box 400. The first contact 450 of the fuse body 425 is used to connect the first terminal 18 of the electronic fuse 405.

The slot 410 of an electronic fuse 405 of the fuse box 400 preferably has a second contact 445 for the second connection 19 of the circuit breaker 17 of the electronic fuse 405 . This second contact 445 is preferably electrically connected to the corresponding output 485 of the fuse box 400 for supplying a load of the supply network 200 via a subsequent supply line section of the supply line sections (240 to 243) of the supply network 200. The second contact 445 of the slot 410 for the electronic fuse 405 is preferably used to connect the second terminal 19 of the electronic fuse 405. The second contact 470 of the fuse body 425 corresponds to the second contact 445 of the slot 410 of the electronic fuse 405 of the fuse box 400. The second contact 470 of fuse body 425 is used to connect second terminal 19 of electronic fuse 405.

The slot 410 of an electronic fuse 405 of the fuse box 400 preferably has a third contact 440 for connecting the data bus 9 of the data bus interface 10 of the control device 4 of the electronic fuse 405 . This third contact 440 is preferably connected in terms of data technology to the data bus 9 of the fuse box 400 and the supply network 200 . The third contact 440 of the slot 410 for the electronic fuse 405 is preferably used to connect the data bus 9 to the data bus interface 10 of the control device 4 of the electronic fuse 405. The third contact 465 of the fuse body 425 corresponds to the third contact 440 of the slot 410 of the electronic fuse 405 of the fuse box 400. The third contact 465 of the fuse body 425 is used to connect the data bus 9 of the supply network 200 to the data interface 10 of the control device 4 of the electronic fuse 405.

The slot 410 of an electronic fuse 405 of the fuse box 400 preferably has a fourth contact 435 for connecting a supply voltage line for supplying energy to the control device 4 of the electronic fuse 405 . This fourth contact 435 is preferably electrically connected to the supply voltage line for supplying energy to the control device 4 of the electronic fuse 405 . The supply voltage line is connected to an energy source 250 via a third supply line section 245, for example. The fourth contact 435 of the slot 410 for the electronic fuse 405 is preferably used to connect the supply voltage line for supplying power to the control device 4 of the electronic fuse 405. The fourth contact 455 of the fuse body 425 corresponds to the fourth contact 435 of the slot 410 of the electronic fuse 405 of the fuse box 400. The fourth contact 455 of the fuse body 425 is used to connect the energy source 250 by means of the exemplary, third supply line section 245 to the supply voltage line for supplying energy to the control device 4 of the electronic fuse 405.

The slot 410 of an electronic fuse 405 of the fuse box 400 preferably has a fifth contact 475 for connecting a supply voltage line 201—here the reference potential line 201—to supply the control device 4 of the electronic fuse 405 with energy. This fifth contact 475 is preferably electrically connected to the supply voltage line 201 for supplying energy to the control device 4 of the electronic fuse 405 . The supply voltage line—here the reference potential line 201—is connected to the energy source 250 via the body of the vehicle, for example. The fifth contact 475 of the slot 410 for the electronic fuse 405 is preferably used to connect the second supply voltage line - here the reference potential line 201 - for supplying power to the control device 4 of the electronic fuse 405. The fifth contact 460 of the fuse body 425 corresponds to the fifth contact 475 of the slot 410 of the electronic fuse 405 of the fuse box 400. The fifth contact 460 of the fuse body 425 is used to connect the reference potential line 201 of the energy source 250 to the supply voltage line - here the reference potential line 201 - for the power supply of the control device 4 of the electronic fuse 405. The fifth contact 460 of the fuse body 425 is preferably used by the control device 4 of the electronic fuse 405 as a reference potential point.

An operating voltage source 480 for operating the control devices 4 of the electronic fuses 405 feeds the electrical energy for operating the control devices 4 of the fuses 405 into the supply voltage line for the operating voltage 6 . The body ground of the reference potential line 201 is preferably used here again as the return line.

The slots 420 for the fuses 415 are preferably designed in such a way that they are at least mechanically compatible with the slots 410 . The slots 410 for the electronic fuses 405 are preferably designed in such a way that the production and/or maintenance and/or repair work can also alternatively equip them with conventional fuses 415. The safety fuses 415 are preferably designed mechanically in such a way that they fit into a slot 410 for an electronic fuse 405 mechanically and preferably also electrically.

The electronic fuses 405 are preferably designed in such a way that they also fit mechanically into a slot 420 for a conventional fuse. In the event that such a slot 420 for a conventional fuse 415 does not have any contacts 435, 475 for supplying the electronic fuse 405 with electrical energy, the electronic fuse 405 must have an energy reserve 8, which before the installation of the electronic fuse 405 must be provided with power in the connector 420. In this case, for example, the energy reserve 8 can be a battery or an accumulator. Such an electronic fuse 405 then preferably includes a signaling means, for example an LED, in order to be able to query the state of charge at least on request via a—preferably optical—data interface 550.

The technical teaching of the document presented here proposes a fuse box 400 for a supply network 200 of a vehicle. The proposed fuse box 400 includes electronic fuses 405 and/or slots 410 for electronic fuses 405. The proposed fuse box has fuses 415 and/or slots 420 for fuses 415. At least one electronic fuse 405 of the electronic fuses of the proposed fuse box 400 preferably has a first connection 18 and a second connection 19, with this at least one electronic fuse 405 being set up to emulate the behavior of a fuse 415. For this purpose, this electronic fuse preferably detects the value of the electrical current 29 through its circuit breaker 17 and determines the time integral of a polynomial of at least the second order of this current value. The electronic fuse 405 is preferably set up to detect the current value of the amount of the electric current 29 flowing through this electronic fuse 405 from the first connection 18 to the second connection 19 or vice versa. This electronic fuse 405 is preferably set up to determine an intermediate value from this detected current value by means of a polynomial of at least the second degree and to integrate it over time to form an integrated intermediate value. The electronic fuse is preferably set up to prevent the flow of current 29 between the first connection 18 and the second connection 19 by opening its circuit breaker 17 when the integrated intermediate value exceeds a maximum value. This corresponds to the blowing of a conventional thermal fuse. The electronic fuse 405 is preferably housed in a fuse body 425 with connectors that fits mechanically and preferably also electrically in one of the slots 410 for electronic fuses 405 . The fuse box 400 preferably also includes at least sections of the fuse data bus 9.

A slot 410 for an electronic fuse 405 preferably has a first contact 430 of slot 410 and a second contact 445 of slot 410 . The first contact 430 of the slot 410 is preferably set up to establish an electrical connection between this first contact 410 of the slot 410 and a first contact 450 of a connector of a fuse body 425 in order to connect the first terminal 18, 450 of the fuse 405 of the fuse body 425 to the to connect first contact 430 of slot 410 electrically.

The second contact 445 of the slot 410 is preferably set up to establish an electrical connection between this second contact 445 of the slot 410 and a second contact 470 of the plug connector 410 of the fuse body 425 in order to connect the second terminal 19, 470 of the fuse 405 of the fuse body 425 with to connect the second contact (445) of the slot 405 electrically.

In the proposed fuse box 400, a slot 410 for an electronic fuse 405 preferably has a third contact 440 of slot 410, the third contact 440 of slot 405 being set up to establish an electrical connection between this third contact 440 of slot 405 and a third Make contact 465 of the connector 410 of the fuse body 425 in order to electrically connect the data line 9 of the data interface 10 of a control circuit 4 of the electronic fuse 405 of the fuse body 425 to the third contact 440 of the slot 405.

The proposed fuse box 400 preferably has a slot 410 for an electronic fuse 405 with a fourth contact 435 of the slot 410 . The fourth contact 435 of the slot 410 is preferably intended to establish an electrical connection between this fourth contact 435 of the slot 410 and a fourth contact 455 of the connector of the fuse body 425 in order to supply power to the control device 4 of the electronic fuse 405 with the fourth contact 455 of slot 410 to be electrically connected.

The document presented here proposes a fuse body 425 of an electronic fuse 405 for a proposed fuse box 400, in which the connector of the fuse body 425 has a first contact 450 for the first connection 18 of the electronic fuse 405 and a second contact 470 for the second connection 19 of the electronic fuse 405 has. The connector preferably fits mechanically into at least one of the slots 410 for electronic fuses 405.

The plug connector of the fuse body 425 preferably has a third contact 465 for a fuse data bus 9 , the third contact 465 being electrically connected to the data line 9 of a data interface 10 for the control circuit 4 of the electronic fuse 405 of the fuse body 425 .

The plug connector of the fuse body 425 preferably has at least one fourth contact 455 for a voltage supply 6 of the control device 4 of the electronic fuse 405.

The document presented here proposes a fuse 415 for a fuse box 400, in which the connector 410 of the fuse body 425 has a first contact 455 for the first connection 18 of the fuse 415 and a second contact 470 for the second connection 19 of the fuse 415. The connector of the fuse 415 is preferably configured to mechanically mate with at least one of the slots 410 for electronic fuses 405 and to mechanically mate with at least one of the slots 420 for fuses 415 .

figure 5

The 5 based on the 1 and represents a modification of 1 dar. Fuse 1 of 5 additionally includes a first test current source 505, which feeds an electrical test current 515 into the first terminal 26 of the circuit breaker 17 of the fuse 1. The additional first electrical test current 515 is preferably provided with a first modulation signal {505} of a first signal generator 520 by means of the first control signal 510 . The curly brackets are intended to indicate that {505} is the first modulation signal with which the first current 515 of the first test current source 505 is modulated.

In the 5 For the sake of clarity, not all useful and possibly usual device components are shown. Next device components that the reader as possibly in the 1 can accept present, can be found, for example, in the 1 , 6 , 9 , 24 , 41 , 42 , 52 , 53 , 54 , 55 . The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

The control device 4 preferably comprises a first gate drive 530 of the control contact 27 of the first power switch 17 and a first control signal generator for the control signal of the control line 20 of the first power switch 17 for controlling the first power switch 17. The computer core 2 preferably controls the first gate drive 530 via the internal data bus 11.

The proposed fuse 1 preferably includes a first correlator 525. The computer core 2 of the control device 4 of the fuse 1 preferably controls the first correlator 525 via the internal data bus 11. The first correlator 525 preferably includes one or more input amplifiers, which the voltages between the first measuring contacts (21, 25, 27, 28, 22) record, filter and process. The first correlator 525 preferably includes a first synchronous demodulator, for example, which examines one of the measurable voltages for first components of the first modulation signal {505} of the first current 515 of the first test current source 505 .

In this case, the first synchronous demodulator of the first correlator preferably uses a correlation in the form of a scalar product, for example in accordance with the form $$A=〈\left\{505\right\}|V_{xy}\left(t\right)〉={\displaystyle {\int }_0^T\left\{505\right\}\times V_{xy}}\left(t\right)\mathrm{i.e}t$$

Here, A stands for the value of the first component and V _xy for a voltage between the first measuring contacts (21, 25, 27, 28, 22). Preferably, the first correlator 525 uses a voltage V _xy between the second terminal 28 of the first power switch 17 and the first control terminal 27 of the first power switch 17. The proposed fuse 1 preferably has a fuse 1 housing 535 . The housing 535 of the fuse 1 preferably has one or more optical windows 545, via which the control device 4 of the fuse 1 can signal other devices and/or people.

The document presented here proposes an electronic fuse 1 which has a first connection 18 and a second connection 19 . The proposed electronic fuse 1 also has a circuit breaker 17 and a control device 4 . According to the proposal, the circuit breaker 17 has a first connection 26 , a control connection 27 and a second connection 28 . It is preferably a MOS transistor. The first terminal 26 of the circuit breaker 17 is preferably electrically connected to the first terminal 18 of the fuse 1 and the second terminal 28 of the circuit breaker 17 is preferably electrically connected to the second terminal 19 of the fuse 1 . The control connection 27 of the circuit breaker 17 is typically electrically connected to the control device 4 . According to the proposal, the control device 4 of the electronic fuse 1 detects electrical voltages between the terminals (26, 27, 28) of the circuit breaker 17 and/or functionally equivalent values of physical parameters within the fuse 1 and uses this to determine a value for an electrical current 29 through the circuit breaker 17 between the first connection 26 of the circuit breaker 17 and the second connection 28 of the circuit breaker 17.

The electronic fuse 1 has an electronic test current source 505, which is connected to the circuit breaker 17 in such a way that it injects an additional current 515 into the circuit breaker 17 between the first connection 26 of the circuit breaker 17 and the second connection 28 of the circuit breaker 17 depending on a first control signal 510 of the control device 4 can feed. In this case, the control device 4 preferably modulates the control signal 510 with a first modulation signal {505}. This modulation signal {505} in turn modulates the time profile of the current value of the additional current 515. The control device 4 preferably detects or determines the time profile of the current value of the electric current 29 through the circuit breaker 17. The control device 4 preferably checks whether the time profile of the current value of the electric current comprises 29 signal components whose modulation correlates with the modulation of the modulation signal. In order to be able to detect the proportion of the test current 515 modulated in this way in the current 29 through the circuit breaker 17, the control device 4 of a proposed fuse 1 preferably includes a synchronous demodulator 525 or a functionally equivalent device, such as an optimum filter or matched filter. The synchronous demodulator 525 typically determines the correlation between the signal of the time profile of the electric current 29 through the power switch 17 on the one hand and the time profile of the modulation signal {505} on the other hand. For example, a synchronous demodulator 525 can determine the value of the function C _29m = ∫I ₂₉ (t) × M(t)dt, where I ₂₉ (t) for the value profile of the electric current 29 through the power switch 17 and M(t) for the time course of values of the modulation signal {505} and C _29m stands for the correlation value which the synchronous demodulator 525 determines. Other correlation methods are conceivable. In the proposed here, the synchronous demodulator 525 multiplies the modulation signal {505} or a signal derived therefrom or a signal that is in a fixed time relationship with the modulation signal {505}, on the one hand preferably by the time value profile I ₂₉ (t) of the electric current 29 or a signal derived therefrom on the other hand. The synchronous demodulator 525 then filters the signal resulting from the multiplication to form a correlation signal. This filtering is preferably low-pass filtering, so that the synchronous demodulator 525 then implements the function C _29m =∫I ₂₉ (t)×M(t)dt in this way. At the very least, the synchronous demodulator should show the integrating effect of a low-pass filter, at least in terms of frequency ranges. To determine the correlation signal C _29m (t), the synchronous demodulator 525 or the control device 4 can include a matched filter optimized for the modulation signal {505} and/or an optimal filter and/or a Kalman filter or another estimation filter that Value profile I ₂₉ (t) of the electric current 29 to the correlation signal C _29m (t) converts.

Typically, the control device 4 switches the circuit breaker 17 off when the sign of the electrical voltage between the first terminal 18 of the fuse 1 and the second terminal 19 of the fuse 1 does not correspond to a default value. For this purpose, the control device 4 detects the electrical voltage between the first connection 18 of the fuse 1 and the second connection 19 of the fuse 1. For example, the computer core 2 of the control device 4 can use an analog-to-digital converter 570 in order, via corresponding measuring lines 22, 21, 25 to detect the potentials at the circuit breaker 17 or at an auxiliary circuit breaker 23. The auxiliary circuit breaker 23 preferably serves to detect an auxiliary current which is proportional to the current through the circuit breaker (17) or corresponds in some other way. A shunt resistor 24 then enables the computer core 2 of the control device 4 of the fuse 1 to measure this auxiliary current by means of the corresponding measuring lines 25, 21 and by means of the analog-to-digital converter 570. In FIG 5 For the sake of clarity, the connections between the analog-to-digital converter 570 and the measuring lines 20, 21, 22, 25 are not shown. The reader is to accept them as existing and revealed. The computer core 2 of the control device 4 of the fuse 1 preferably switches the circuit breaker 17 off when the electrical voltage between the first connection 18 of the fuse 1 and the second connection 19 of the fuse 1 falls below a first preset value. The computer core 2 of the control device 4 of the fuse 1 preferably switches the circuit breaker 17 off when the electrical voltage between the first connection 18 of the fuse 1 and the second connection 19 of the fuse 1 exceeds a second preset value. The electronic fuse 1 typically has a reference potential connection 201 . The computer core 2 of the control device 4 of the fuse 1 preferably switches the circuit breaker 17 off when the electrical voltage between the first connection 19 of the fuse 1 and the reference potential connection 201 of the fuse 1 falls below a third preset value. The computer core 2 of the control device 4 of the fuse 1 preferably switches the circuit breaker 17 off when the electrical voltage between the second connection 19 of the fuse 1 and the reference potential connection 201 of the fuse 1 falls below a fourth preset value. The computer core 2 of the control device 4 of the fuse 1 preferably switches the circuit breaker 17 off when the electrical voltage between the first connection 18 of the fuse 1 and the reference potential connection 201 of the fuse exceeds a fifth preset value. The computer core 2 of the control device 4 of the fuse 1 preferably switches the circuit breaker 17 off when the electrical voltage between the second connection 19 of the fuse 1 and the reference potential connection 201 of the fuse 1 exceeds a sixth preset value. In this way, the control device 4 of the electronic fuse 1 ensures that the subsequent partial supply network is only operated in a predetermined voltage range.

The circuit breaker 17 and the control device 4 are preferably accommodated in a common housing 535 . This has the advantage that the EMC compatibility is increased.

The control device 4 of the electronic fuse can have an optical data interface 550, for example, in order to achieve good electrical isolation between the protected supply line at the first connection 18 of the fuse 1 and/or at the second connection 19 of the fuse 1. In order to be able to control this optical data interface 550, the housing 535 preferably has an optical window 545, which allows electromagnetic radiation to enter the housing 535 and thus allows the optical data interface 550 to interact with this electromagnetic radiation that has entered, so that the optical data interface 550 can receive an optically transmitted signal 540 in this way. Conversely, the optical data interface 550 can emit electromagnetic radiation 540 which can then exit the housing 535 via this optical window 545 in the housing 535 of the fuse 1 . Thus, such optical windows 545 are preferably sub-devices of one or more optical data interfaces 550 of the control device 4 of the relevant electronic security device 1. Such an optical window 545 thus allows electromagnetic radiation to enter and/or exit for the transport of data from and to the control device 4 of the security device and thus enables an optical interface 550 of the control device 4 of the fuse 1 within the housing 535 to be connected via this optical window 545 to an optical interface 555 of another device 12, for example a higher-level computer system 12, outside the housing 535 via an optical data connection 540 can communicate. Optical functional elements 580 can guide and/or shape the optical data connection 540 . Such optical functional elements can be deflecting functional elements such as mirrors and/or prisms and the like and/or cross-section-modifying functional elements such as diaphragms and/or focusing functional elements such as lenses and/or concave mirrors and/or light-guiding optical functional elements such as optical fibers and the like. Such a fuse with an optical data interface 550 preferably has an optical plug-in connection that mechanically establishes the optical connection between the optical data bus interface 550 and optical data connection 540 allowed. Such an optical window 545 also allows the computer core 4 of the control device 4 or the control device 4 of the fuse 1 to signal a person by means of a visible optical signal. For example, the fuse may emit a red light through optical window 545 when circuit breaker 17 is open. Likewise, the fuse 1 can emit an optical signal recognizable to a person via such an optical window 545 that indicates the state of charge of the energy reserve 8 . The electromagnetic radiation for the transport of data, which the optical interface 550 emits and/or receives, is preferably laser radiation from a laser 560 or radiation from an LED 560 . The document presented here therefore proposes that the proposed fuse 1 preferably comprises a laser 560 or an LED 560. The computer core 2 of the control device 4 of the fuse 1 preferably uses this laser or this LED as a transmitter of data from the optical data interface 550 of the control device 4 of the fuse 1. In certain implementation cases, there may be a need to not have a separate laser or separate LED in the body 545 of the fuse 1, but to manufacture the LED monolithically with the rest of the control circuit 4 of the fuse in one semiconductor crystal. In that case, it is particularly favorable if the control circuit 4 of the electronic fuse 1 has a silicon-based LED 560 as the LED. Typically, the control circuit then includes a drive device 565 for operating the silicon-based LED, which provides the operating voltage for the silicon-based LED. The silicon-based LED 560 is preferably a silicon avalanche LED 560, in particular a SPAD diode 560 operated as an LED. The control device 656 preferably operates this above the breakdown voltage in the reverse direction. The control device 565 generates the necessary operating voltage for the silicon-based LED 560 from the operating voltage of the electronic fuse 1 between the terminals 6, 201 by means of a voltage converter of a voltage supply 5.

Preferably, the optical data bus interface 550 also includes an optical receiver. This optical receiver of the data bus interface 550 is preferably a photodiode. In order to achieve maximum synergy, it can be useful if the control device of the electronic fuse 1 operates the silicon-based LED 560 at least temporarily as a receiver of the optical data bus interface 550. The computer core 2 of the control device 4 of the electronic fuse 4 can preferably disconnect the silicon LED 560 from the electrical supply of the voltage converter of the voltage supply 5, for example by means of an isolating switch of the control device 4 of the electronic fuse 1, and thus the emitted light signal of the silicon LED 560 for the purpose of data transmission modulate or switch the silicon LED from transmit mode to receive mode. In the receive mode, the computer core 2 detects the voltage signal 575 of the silicon LED 560, preferably by means of the analog-to-digital converter 570 of the control device 4 of the electronic fuse 1, and thus generates a digitized input data signal. The computer core 2 of the control device 4 of the fuse 1 uses the value recorded in this way as the input data signal of the optical data interface 550 and extracts the data transmitted to it from this input data signal data stream. Of course, the control device 4 of the electronic fuse 1 can also include a separate photodetector, for example a photodiode 560, and evaluation electronics of the photodetector 560. The electronic fuse 1 is preferably set up so that optical fibers 580 and/or other optical functional means connect the electronic fuse 1 to one or more other electronic fuses (214 to 217, 225 to 223, 230 to 235, 225 to 256) via the respective optical Connect data interface 550 of these electronic fuses. A supply network 200 preferably comprises an optical data network as a data bus 9, with which the optical data interface 555 of a higher-level computer system 12 and/or the data interfaces 550 of the control devices 4 of the fuses of the supply network 200 can communicate with one another. The proposed electronic fuse 1 is, in particular if there is an increased requirement for electrical isolation, preferably via its optical interface 550 and an optical fiber 580 with an optical interface 555 of a higher-level computer system 12, for example a higher-level computer system (12), and possibly with one or more further electronic fuses (214 to 217, 225 to 223, 230 to 235, 225 to 256). In addition to data communication via this optical data interface 550 or the wired data interface 10, the control device 4 of the fuse 1 can be connected to a higher-level control device and/or a higher-level computer system 12 and, if necessary, to the control devices 4 be connected to one or more further electronic fuses (1, 214 to 217, 225 to 223, 230 to 235, 225 to 256). A typical error that occurs is overheating of the fuse 1. In this case, both the power switch 17 and the control device 4 can overheat. The control device 4 of the electronic fuse preferably includes one or more temperature sensor evaluation devices 585. The control device 4 of the fuse 1 preferably includes a temperature sensor 586, for example a PN junction or a PTC resistor or a NTC resistor, which detect the temperature of the control device 4 of the fuse 1 and convert it into an electrical signal that the temperature sensor evaluation device 585 and/or the analog-to-digital converter 570 into a measured variable for the computer core 2 of the control device 4 of the electronic fuse 1 walk. Circuit breaker 17 of fuse 1 preferably includes a temperature sensor 586, for example a PN junction or a PTC resistor or an NTC resistor, which detects the temperature of circuit breaker 17 of fuse 1 and converts it into an electrical signal that temperature sensor evaluation device 585 and /or convert the analog-to-digital converter 570 into a measured variable for the computer core 2 of the control device 4 of the electronic fuse 1. In this way, the computer core 2 of the control device 4 of the fuse 1 can detect a thermal overload of the circuit breaker 17 and/or the control device 4 and open the circuit breaker 17 before damage occurs and/or notify the higher-level computer system 12 via the data bus 9 of an imminent overload of the Circuit breaker 17 and / or the control device 4 of the fuse 1 transmit. The electronic fuse 1 thus preferably includes one or more temperature sensors 586 for monitoring the safe operation of the fuse 1. The control device 4 of the fuse 1 evaluates measured temperature values from the one or more temperature sensor evaluation devices 585 that measure the temperature sensors 586. The temperature sensor evaluation devices 585 record these measured temperature values with the aid of temperature sensors external to the electronic control device 4 and/or with the aid of temperature sensors 586 of the electronic fuse 1 .

In many applications it makes sense for the fuse 1 to have a first connection 18 on the energy source side and a second connection 18 on the load side. In many applications, feedback of electrical energy in the direction of the energy source is not desired. The electric current 29 through the circuit breaker 17 should therefore preferably only flow from the first connection 18 of the fuse 1 to the second connection 19 of the fuse 1 in such applications. In this case, the electronic fuse 1 comprises means (20, 21, 22, 23, 24, 25, 525, 570) for detecting a current 29 flowing backwards. For example, the analog-to-digital converter 570 can record the voltages of the measuring lines (20, 21, 22, 25) among one another and/or with respect to the reference potential 201 and transmit the recorded values to the computer core 2 of the control device 4 of the fuse 1 via the internal data bus 11 submit. The computer core 2 of the control device 4 of the fuse 1 can then, for example, infer the value of the auxiliary current 36 through the shunt resistor 24, which the auxiliary circuit breaker 23 generates proportionally to the current 29 and thus infer the sign of the current 29. For example, the computer core 2 of the control device 4 of the fuse 1 can open the circuit breaker 1 if the estimated and/or determined sign of the electric current 29 does not correspond to an expected sign. This can be the case, for example, when energy is illegally transported from the second connection 19 of the fuse 1 to the first connection 18 of the fuse, although the opposite energy transport direction is the expected energy transport direction.

The computer core 2 of the control device 4 of the electronic fuse 1 then evaluates the measured values of the voltages of the measuring lines (20, 21, 22, 25) recorded in this way and preferably transmits the measured values and/or measured values derived therefrom to other computer cores 2 of other electronic fuses ( 1, 214 to 217, 225 to 223, 230 to 235, 225 to 256) via a backup data bus (9, 540) or the like or to a higher-level computer system 12, for example to a higher-level computer system 12.

In many cases it makes sense if the electronic fuse 1 includes two data interfaces 10 and 610 . The data interfaces can also be multiple optical data interfaces 550 and 551 . It is also conceivable that the electronic fuse 1 includes one or more wired data interfaces 10, 610 and/or one or more optical data interfaces 550, 551 at the same time. An optical fiber 580 can, for example, connect one electronic fuse 1 or several electronic fuses (1, 214 to 217, 225 to 223, 230 to 235, 225 to 256) via the optical data interfaces 551, 550 of one electronic fuse 1 or several electronic Connect fuses to another device 12, for example to a higher-level computer system 12, or to the computer cores 2 of the control devices 4 of other electronic fuses and/or to one another.

The electronic fuse 1 disclosed in the document presented here preferably has a control device 4 and a power switch 17 as the power switch of the electronic fuse 1 . The computer core 2 of the control device 4 uses a gate control circuit 16 for controlling and monitoring the circuit breaker 17 to control whether the circuit breaker 17 is conducting and thus operates as a closed circuit breaker, or whether the circuit breaker 17 is not conducting and therefore operates as an open circuit breaker ner circuit breaker is working. The control device 4 of the electronic security device preferably has a data interface 10 for a security data bus 9 . The computer core 2 of the control device 4 of the fuse 1 receives and/or sends data messages via the fuse data bus 9 and the data interface 10 . Whether the computer core 2 of the control device 4 of the fuse 1 closes or opens the circuit breaker 17 by means of the gate control circuit 16 depends at least partially and at least temporarily on the content of these data messages. In order to prevent the circuit breaker 17 from being opened and/or closed undesirably, the computer core 2 of the control device 4 of the electronic fuse 1 changes the switching state of the circuit breaker 17 based on a data message only if the control device 4 receives a data message with a password. For this purpose, the bit stream packet BP includes that the data message includes in the data part INFO preferably firstly the configuration data ILD and secondly a password for authentication of this command. In a specified method, the computer core 2 compares the received password with an expected password or verifies the validity of the received password in some other way. If the result of this verification is such that the password is valid, the computer core 2 of the control device 4 of the fuse 2 executes the received command and, depending on the content of the command, opens or closes the circuit breaker 17 of the electronic fuse 1.

The document presented here thus describes an electronic fuse 1 with a circuit breaker 17, the electronic fuse 1 detecting and checking the voltage between this terminal 26 and a reference node 201 at the terminal 26 of its circuit breaker 17, which is on the energy source side, and the electronic fuse 1 detects the current 29 through the circuit breaker 17 and / or determines and checks. The electronic fuse 1 preferably switches off the electrical supply of the subsequent subtree of the supply network 200 by switching off its circuit breaker 17 if the amount of the detected value of the voltage falls below a minimum value and if at the same time the amount of the detected value of the electric current 23 through the circuit breaker 17 of the electronic fuse 1 exceeds a predetermined threshold value. This is a clear indication of a short circuit, which fuse 1 is supposed to absorb.

Since the fault may be temporary, for example as a result of the commutation of an inductive load, it may make sense to attempt to switch on again. The computer core 2 of the control device 4 of the electronic fuse 1 then preferably carries out one or more attempts to switch on the circuit breaker 17 after a short-circuit event has occurred, as described above. It could be a real short circuit. It is therefore useful if the computer core 2 of the control device 4 of the fuse 1 precisely controls the number of reclosing attempts and the implementation of the reclosing attempts and, if necessary, also logs their implementation and result. The computer core 2 of the control device 4 of the electronic fuse 1 therefore preferably increases a switch-on attempt counter of the control device 4, in particular a register value of the computer core 2, by a switch-on attempt count step size, which can also be negative and is different from 0, when a short-circuit event occurs when the circuit breaker 17 is attempted to be switched on . The computer core 2 of the control device 4 of the electronic fuse 1 preferably transmits an error message to the computer core 2 of the control device 4 of another electronic fuse or to a higher-level computer system 12 via the data bus 9 if the number of unsuccessful switch-on attempts in the form of the count of the switch-on attempt counter exceeds a predetermined number crosses or reaches the maximum number of switch-on attempts. The computer core 2 of the control device 4 of the proposed electronic fuse 1 sends and receives data such as configuration data (write/read), switching commands (write/read), diagnostic data ( Write/read), measured values (read), comparison value settings (write/read). The corresponding data bus 9 can be, for example, partially or entirely a two-wire data bus, in particular a bidirectional and/or differential two-wire data bus 9 . It is particularly advantageous if the data bus 9 is a standard automotive data bus such as a CAN data bus or a data bus with a physical interface of a CAN data bus, a CAN FD data bus or a Flexray data bus or an LVDS data bus or the like . The fuses can be daisy chained together. For this purpose, for example, control devices 4 of fuses 1 of the supply network 200 can include two data interfaces 610, 10 for the fuse data bus (9). The plug connectors 410 and the fuse bodies 425 of the fuses 405, 1 should then have corresponding additional plugs and contacts. The computer cores 2 of the control devices 4 of the electronic fuses (1, 214 to 217, 225 to 223, 230 to 235, 225 to 256) of a supply network 200 and the higher-level computer system 12, which are connected to the data bus 9, preferably carry out an auto-addressing method , in order to allocate a unique fuse address to each data interface 10 of each control device 4 of each fuse on the data bus 9 . A possible exemplary car address tion procedure describes the EP 1490 772 B1 . The document presented here describes for the first time the use of an auto-addressing method for assigning unique fuse addresses to the electronic fuses of a supply network 200 which are connected to a fuse data bus 9 .

The data interfaces 10, 610 of the control device 4 of the electronic fuses 1 are preferably set up to carry out an auto-addressing method for determining a fuse address or to take part in such an auto-addressing method.

The 5 shows, among other things, the optical data connection 540 between the first optical data interface 550 of the control device 4 of the fuse 1 and the optical interface 555 of the higher-level computer system 12. An optical waveguide 580 carries the electromagnetic radiation of the optical data connection 540. The housing 535 of the electronic fuse 1 preferably has a optical connector that allows the mechanical and optical connection of the electronic fuse 1 with the optical fiber 580. As a result, an LED 560 can feed electromagnetic radiation into the optical waveguide 580 as an optical data connection 540 . As a result, a photodetector of the optical data interface 550 can receive electromagnetic radiation as a data connection 540 from the optical waveguide 580 . The optical connector preferably includes an optical window 545, whereby the housing 535 of the fuse 1 includes such an optical window 545. The optical data interface 550 preferably includes a control device 565 for controlling the LED 560. If the LED 560 is not supplied with electrical energy by the control device 565, the control device 4 can also use it as a photodetector for receiving the optical data connection 540 of the optical data interface 555 of the higher-level computer system 12 use. In that case, for example, an analog-to-digital converter 570 of the control device 4 of the fuse can detect the voltage signal 575 of the silicon LED 560 and feed it to the computer core 2 via the internal data bus 11 for evaluation. Of course, this evaluation and an analog-to-digital converter can also be part of the optical data interface 550 .

The 5 shows, among other things, a second optical data connection 540 between the second optical data interface 552 of the control device 4 of the fuse 1 and an optical interface (not shown) of another higher-level computer system or another control device 4 of another fuse 1. The housing 535 of the electronic fuse 1 preferably has another optical connector that allows the mechanical and optical connection of the electronic fuse 1 with a second, non-illustrated optical fiber. As a result, an LED 561 can feed electromagnetic radiation into the further optical waveguide as an optical data connection 540 of the second optical data interface 551 . A photodetector of the second optical data interface 551 can thereby receive electromagnetic radiation as a data connection 540 from the further optical waveguide (not shown). The second optical connector preferably also includes a second optical window 545, as a result of which the housing 535 of the fuse 1 includes such a second optical window 545. The second optical data interface 552 preferably includes a control device 565 for controlling the second LED 561. If the second LED 561 is not supplied with electrical energy by the control device 565 of the second optical data interface 551, the control device 4 can also use it as a photodetector for receiving the use the second optical data connection 540 of the optical data interface of the further higher-level computer system or the optical data interface of the other electronic fuse 1. In this case, for example, an analog-to-digital converter 570 of the control device 4 of the fuse can detect the voltage signal 576 of the second silicon LED 561 and feed it to the computer core 2 via the internal data bus 11 for evaluation. Of course, this evaluation and an analog-to-digital converter can also be part of the second optical data interface 551 . The second laser or the second LED 561 can, for example, again be a silicon-based LED, in particular a silicon avalanche LED, in particular a SPAD diode operated as an LED.

The control device 4 of the fuse 1 preferably has temperature sensor evaluation devices 585 which, for example, determine measured temperature values using temperature sensors 586 and make them available to the computer core 2 of the control device 4 of the fuse 1 via the internal data bus 11 .

The control device 4 of the fuse 1 preferably includes a random number generator 60 random number generator (RNG=random number generator). The computer core 2 of the control device 4 of the fuse 1 can read the random value of the random number generator 60 via the internal data bus 11 of the control device 4 of the fuse 1 . The computer core 2 of the control device then preferably uses this random number for the encryption of the data communication via the data interface 10 or the optical data interface 550 with other computer cores 2 other control devices 4 other fuses 1 in the supply network 200 and/or for the encryption of the data communication with a higher-level computer system 12. The random number generator 60 is preferably a so-called genuine random number generator (TRNG=true random number generator) . Most preferably, the random number generator 60 is a quantum random number generator (QRNG). According to the proposal, the quantum random number generator 60 has a first SPAD diode which is reverse-biased with a voltage above the reverse voltage. The blocking voltage is preferably supplied by the voltage supply 5 or a device part thereof. As a result, the first SPAD diode begins to emit individual light pulses. An optical fiber of the control device preferably forwards these light pulses from the first SPAD diode to a second SPAD diode. The two SPAD diodes are preferably manufactured monolithically in a silicon semiconductor crystal using CMOS technology. The optical waveguide is preferably manufactured in the metallization stack of the CMOS circuit, which comprises the first SPAD diode and the second SPAD diode. The metallization stack preferably includes a plurality of structured metallic wiring levels and a plurality of isolating insulation levels. The metallic wiring planes can be made of an aluminum alloy, for example, which can be structured in conductor tracks etc. by means of photolithography. The optically transparent insulation levels between these line levels of the metallization stack can be made of silicon dioxide or another optically transparent and suitable insulator, for example. The insulation levels are also typically structured photolithographically and are provided with vias for connecting lines of different line levels. The metallization stack is preferably structured and constructed in the area of the two SPAD diodes in such a way that a larger quantity of the photons that the first SPAD diode emits in the direction of the metallization stack can reach the second SPAD diode and the photons cannot reach the conductor tracks of the metallization stack prevent. Conductor tracks of the metallization stack preferably shield the optical waveguide upwards and to the sides in such a way that these conductor tracks reflect at least some of the photons that want to escape in this direction back in the direction of the second SPAD diode. The interior of the optical waveguide therefore preferably comprises only material from the insulation layers and preferably no material from the conductor tracks. The optical fiber of the quantum random number generator 60 preferably optically connects the first SPAD diode to the second SPAD diode. The optical waveguide of the quantum random number generator 60 preferably covers both the first SPAD diode and the second SPAD diode in order to capture a maximum number of photons from the first SPAD diode and to feed them to the second SPAD diode. This construction allows for a maximum bit rate per second for the generated random bits. The second SPAD diode is preferably also reverse biased with a detection voltage. The detection voltage is preferably supplied again by the power supply 5 and/or a sub-device thereof. The second SPAD diode also generates current pulses of a first maximum level by spontaneously emitting individual photons. If a photon from the first SPAD diode reaches the second SPAD diode, stimulated emission occurs. The resulting current pulse of the SPAD diode current of the second SPAD diode then has a second level. Typically, the first elevation is approximately twice the height of the second elevation. A transimpedance amplifier preferably amplifies the SPAD diode current of the second SPAD diode and thus the current pulses of the second SPAD diode. A comparator compares the amplified SPAD output signal with a threshold. The threshold value is preferably set in such a way that the comparator supplies a logical 1 at its output for current pulses of the second magnitude and supplies a logical 0 at its output for current pulses of the first magnitude and in the case of no current pulses. A counter, which preferably runs with the clock of the oscillator 30 or a clock of the clock system of the control device, preferably counts the time between the occurrence of two ones at the output of the comparator. The counter represents a time-to-digital converter. This is referred to below as a time-to-digital converter. Since the second SPAD diode has a dead time for the detection of photons, the time-to-digital converter of the quantum random number generator preferably discards all pulse pairs of one pulses at the output of the comparator that follow one another too closely, i.e. shorter than this dead time. In this way, the time-to-digital converter of the quantum random number generator 60 generates a first number, which is already substantially dependent on a quantum event, namely the spontaneous emission of the first SPAD diode and a second quantum event, namely the stimulated emission of the second SPAD diode. depends. The subsequent entropy extraction device now uses a first number of the time-to-digital converter and a second number of the time-to-digital converter if the first number of the time-to-digital converter and the second number of the time-to-digital converter Digital converters are different. If the first number of the time-to-digital converter is greater than the second number of the time-to-digital converter, then the entropy extraction generates a random bit with a first logical value and otherwise a random bit with a second logical value, the is different from the first value. The entropy extraction device of the quantum random number generator then generates a random number from several of these random bits, which the entropy extraction device then makes available to the computer core 2 of the control device 4 of the fuse 1 in a register of the quantum random number generator 60 .

The computer core 2 of the control device 4 of the fuse 1 preferably generates a private key and a public key using a random number generated in this way.

The computer core 2 of the control device 4 of the electronic security device 1 then transmits this public key via the data bus 9 to one or more computer cores 2 of other control devices 4 of other security devices and/or to a higher-level computer system 12. These can then use this public key to encrypt data messages in Use bit stream packets BP to the computer core 2 of the control device 4 of the fuse 1 via the data bus interface (10, 610, 550, 551) and send encrypted data to the computer core 2 of the control device 4 of the fuse 1 in this way.

The computer core 2 of the control device 4 of the backup preferably generates a new pair of keys from time to time, preferably regularly, using the random number generator 30 and then distributes the public key again via the data bus 9 to one or more computer cores 2 of other control devices 4 of other backups and/or or to a higher-level computer system 12. The computer core 2 of the control device 4 of the fuse 1 can then use its private key to decrypt the encrypted data messages received.

The higher-level computer system 12 of the supply network 200 preferably also includes one or more such random number generators 60. Here, too, these can be RNGs or QRNGs (quantum random number generators), which provide the higher-level computer system 12 with random numbers for key pair generation.

The higher-level computer system 12 preferably generates a private key and a public key using a random number generated in this way from such a random number generator.

D the higher-level computer system 12 then transmits this public key via the data bus 9 to one or more computer cores 2 of other control devices 4 of other fuses and/or to another higher-level computer system 12 that may be present. These can then use this public key to encrypt data messages in a bit stream Use packets BP to the higher-level computer system 12 and send encrypted data to the higher-level computer system 12 in this way.

The higher-level computer system 12 preferably generates a new pair of keys from time to time, preferably regularly, using its own random number generator and then distributes the public key again via the data bus 9 to one or more computer cores 2 of other control devices 4 of other fuses and/or to the other higher-level computer system 12. The higher-level computer system 12 can then use its private key to decrypt the received encrypted data messages.

figure 6

The 6 essentially corresponds to the 1 , wherein the control device 4 of the fuse 1 of 4 has an additional second data interface 610 . What has already been written about the first data interface 10 should also apply to the second data interface 610 . in particular, it can be a data interface for a single-wire data bus and/or a differential bidirectional data bus. In the automotive field, the data bus 9 of the second data bus interface 610 can, for example, be a Lin data bus 9 or a DSl3 data bus 9 or a PSI5 data bus 9 or a CAN data bus 9 or a CAN FD data bus 9 or an Ethernet data bus or a Flexray -Data bus 9 or an LVDS data bus 9 or some other wired or wireless data transmission path, for example via a Bluetooth or WLAN data connection or an optical data connection 540. The data communication of the computer core 2 of the control device 4 of the fuse 1 runs in addition to the data communication via the first data bus interface 10, 550 via a wired or wireless second interface 610, 551.

In the 6 For the sake of clarity, not all useful and possibly usual device components are shown. Next device components that the reader as possibly in the 1 can accept present, can be found, for example, in the 1 , 5 , 9 , 24 , 41 , 42 , 52 , 53 , 54 , 55 . The combination of the device parts here described figure with those of these figures is expressly part of the disclosure of the document presented here.

In many cases it is desirable for the control device 4 of a fuse 1 to have more than a single data interface 10 . This can be the case, for example, if increased communication security is required due to redundancy or, for example, secure addressing is to take place using a daisy chain. The computer core 2 of the control device 4 can access this second data interface 610 via the internal data bus 11 and communicate with other computer systems 12 and/or other computer cores 2 of other control devices 4 of other fuses 1 in the supply network 200 . The document presented here therefore proposes electronic fuses 1 with control devices 4 which include two data bus interfaces (610, 10) for the fuse data bus 9. Some of these second data bus interfaces 10, 610 can be optical data interfaces 550, 551. A number of such fuses 1 are preferably connected to this fuse data bus 9 with two data interfaces 10, 610 or inserted into the fuse data bus 9 by means of two such data interfaces (10, 551, 550, 610). This results in a supply network 200 in which one or more electronic fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) each have two data interfaces (214 to 217, 225 to 228, 235 to 238, 250 , 251, 610, 10) for each electronic fuse (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) and which are preferably inserted into the data bus 9. (See also 7 ). The computer cores 2 of the control devices (4) of the electronic fuses of the fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) of such a supply network 200 receive and transmit via a data interface (10, 610, 550, 551) via this data bus 9 then data such as configuration data (write/read), switching commands (write/read), diagnostic data (write/read), measured values (read), comparison value settings (write/read). For example, it is conceivable that the computer core 2 of the control device 4 of a fuse 1 receives data via the first data interface 10 from a computer core 2 of the control device 4 of another fuse 1 or from a higher-level computer system 12 and then sends this data directly or after modifying the data via the second data interface 610 sends on to a computer core 2 of another control device 4 of another fuse 1 and/or to a higher-level computer system 12 . In this way, the higher-level computer system 12 can, for example, check the functionality of the computer core 2 of the control device 4 of the fuse 1 . For example, electronic fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) of such a supply network 200 can include two such data interfaces 10 and 610 for the data bus 9 and be inserted into the data bus 9. In this way, the fuses then form a linear chain of fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) of such a supply network 200 along at least part of the data bus 9. As a result, the fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) of such a supply network 200 then a unique physical position, which the computer core 2 of a control device 4 of a fuse 1 can then determine for its fuse 1 as part of an auto-addressing method and into a can convert logical fuse address of its fuse 1 for addressing data messages in bit stream packets BP to this fuse. The computer core 2 preferably transmits the security address determined by it to the higher-level computer system 12 after the auto-addressing method has been completed at the start of operation of the supply network 200. The higher-level computer system 12 then preferably checks whether the transmitted security addresses correspond to the expected values. If this is not the case, the higher-level computer system 12 preferably repeats the auto-addressing method, which typically means that the computer cores 2 of the control devices 4 of the fuses of the supply network 200 discard the fuse addresses already determined in favor of the fuse addresses to be newly determined. A higher-level computer system 12, which is preferably connected to the start of this part of the data bus 9, preferably uses auto-addressing in cooperation with the computer cores 2 of the control devices 4 of the electronic fuses to determine a security address for each of the computer cores 2 of the control devices 4 of the electronic fuses in order to activate the computer cores 2 of the control devices 4 of the fuses of the supply network 200 and transmits them, if necessary, to the computer cores 2 of the control devices 4 of the electronic fuses of the supply network 200. The data communication of the computer core 2 of the control device 4 of the fuse 1 takes place via a wired or wireless interface 610, 10.

figure 7

The 7 corresponds to the essential parts 3 , wherein the data bus 9 is designed as a ring-shaped data bus ring 9'. The data interfaces 280 to 293 of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 256) include the two data interfaces 10, 610 of the 6 . The higher-level computer system 12 controls the supply network 200 again.

The superordinate computer system 12 is connected to the first data bus interface of the data bus interfaces 284 of the fuse 225 of the load 220 via the data bus ring 9 ′ with a second data bus interface.

The second data bus interface of the data bus interfaces 284 of the fuse 225 of the load 220 is connected to the first data bus interface 285 of the fuse 226 of the load 221 via the data bus ring 9 ′.

The second data bus interface of the data bus interfaces 285 of the fuse 226 of the load 221 is connected to the first data bus interface 286 of the fuse 227 of the load 222 via the data bus ring 9 ′.

The second data bus interface of the data bus interfaces 286 of the fuse 227 of the consumer 222 is connected to the first data bus interface 287 of the fuse 228 of the consumer 223 via the data bus ring 9 ′.

The second data bus interface of the data bus interfaces 287 of the fuse 228 of the consumer 223 is connected to the first data bus interface 288 of the fuse 235 of the consumer 230 via the data bus ring 9 ′.

The second data bus interface of the data bus interfaces 288 of the fuse 235 of the load 230 is connected to the first data bus interface 289 of the fuse 236 of the load 231 via the data bus ring 9 ′.

The second data bus interface of the data bus interfaces 289 of the fuse 236 of the consumer 231 is connected to the first data bus interface 290 of the fuse 237 of the consumer 232 via the data bus ring 9 ′.

The second data bus interface of the data bus interfaces 290 of the fuse 237 of the consumer 232 is connected to the first data bus interface 291 of the fuse 238 of the consumer 233 via the data bus ring 9 ′.

The second data bus interface of the data bus interfaces 291 of the fuse 238 of the consumer 233 is connected to the first data bus interface 283 of the fuse 217 of the consumer 213 via the data bus ring 9'.

The second data bus interface of the data bus interfaces 283 of the fuse 217 of the consumer 213 is connected to the first data bus interface 282 of the fuse 216 of the consumer 212 via the data bus ring 9'.

The second data bus interface of the data bus interfaces 282 of the fuse 216 of the load 212 is connected to the first data bus interface 281 of the fuse 215 of the load 211 via the data bus ring 9'.

The second data bus interface of the data bus interfaces 281 of the fuse 215 of the consumer 211 is connected to the first data bus interface 280 of the fuse 214 of the consumer 210 via the data bus ring 9'.

The second data bus interface of the data bus interfaces 280 of the fuse 214 of the consumer 210 is connected to the first data bus interface 292 of the fuse 255 of the energy source 250 via the data bus ring 9 ′.

The second data bus interface of the data bus interfaces 292 of the fuse 255 of the energy source 250 is connected to the first data bus interface 293 of the fuse 256 of the energy source 251 via the data bus ring 9 ′.

The second data bus interface of the data bus interfaces 293 of the fuse 256 of the energy source 251 is connected to the first data bus interface of the superordinate computer system 12 via the data bus ring 9'.

As a result, the data bus ring 9' is closed. A supply network 200 with a data bus ring 9' as data bus 9 has the advantage that if the data bus ring 9' is interrupted at one point by a fault or an accident, all bus users can still communicate with all other bus users. This is of particular importance because supply networks 200 are typically safety-relevant.

The document presented here also refers to the description of the 6 , which essentially fuses the 7 reproduces.

The document presented here explains using the example of 7 the targeted shedding of supply sub-networks. The supply network 200 of the vehicle includes, among other things, device parts 210, a cable harness with line sections 240, 241, 245, at least one energy source 250, 251, at least one control computer 12 - for example a higher-level computer system 12 - and at least two electronic fuses 214, 225. Typically, the Device parts 220 electrical consumers. At least one or more energy sources 250, 251 of the supply network 200 supply at least two of the device parts 210, 220 with electrical energy via the wiring harness with the line sections 240, 241, 245. The electronic fuses 214, 225 are integrated into the wiring harness with line sections 240, 241, 245 inserted. Each of the electrical fuses 214, 225 is preferably assigned to at least one electrical consumer (210, 225), number 1, which is referred to below as the electrical consumer assigned to the respective electronic fuse. A fuse for the fuses 214, 215 can enable or prevent the energy supply to the electrical consumer assigned to this fuse, depending on a control signal from the control computer, ie the higher-level computer system 12. The computer core of the control device of the relevant fuse typically receives such a control signal via the data bus 9, here via the data ring bus 9'. A fuse associated with this consumer can then prevent the power supply of the electrical consumer associated with this fuse by means of the corresponding fuse associated with this consumer. Preferably, control computer 12, i.e. higher-level computer system 12, for example, establishes an encrypted data connection 720 between control computer 12 of the vehicle, i.e. higher-level computer system 12, for example, and a computer 710 of a service provider, in particular a computer system of the automobile manufacturer of the vehicle. The control computer 12 of the vehicle, for example the higher-level computer system 12, preferably authenticates the vehicle with the computer 710 of the service provider. The authentication data of the vehicle can include, for example, the data of the vehicle and/or the car key and/or a SIM card in the vehicle and/or a vehicle-specific password entry or password generation and/or biometric user data of a vehicle owner etc. In return, the computer 710 of the service provider typically authenticates itself with the control computer 12 of the vehicle, for example with a higher-level computer system 12 of the vehicle. If necessary, the requesting person 730 authenticates himself by means of inputs and/or biometric sensor data such as fingerprint recognition via the control computer 12 of the vehicle, for example via the higher-level computer system 12, at the computer 710 of the service provider. The authentication data can include, for example, the data of the vehicle and/or the personalized car key, a personalized SIM card, a personalized password entry, biometric user data, etc. The service provider's computer 710 then preferably generates or provides an activation code. The service provider's computer 710 transmits the activation code via the secure data connection 720 to the vehicle's control computer 12, for example to the higher-level computer system 12. The vehicle's control computer 12, ie the higher-level computer system 12, preferably verifies the admissibility and/or the syntactical correctness and/or or the situational admissibility of the activation code. If this verification was successful, the control computer 12 of the vehicle, i.e. the higher-level computer system 12 of the vehicle, enables the power supply to an electrical consumer 220 assigned to the fuse by means of the corresponding fuse 225 if the activation code is permissible and/or syntactically correct and/or the situation is permissible is. For this purpose, the higher-level control computer 12 of the vehicle, as the higher-level computer system 12, sends a command via the data bus 9 to the computer core 2 of the control device 4 of the corresponding fuse. This command is preferably encrypted so that the computer core 2 of the control device 4 of the backup can verify whether the command was issued by a reliable higher-level computer system 12 . If the computer core 2 of the control device 4 of the corresponding fuse receives a command protected in this way, the computer core 12 of the control device 4 of the corresponding fuse closes the circuit breaker 17 of this fuse and thus allows the power supply of the subsequent partial supply network via this circuit breaker 17. The higher-level computer system 12 preferably transmits billing data via the data connection 720 to a computer 710 of a service provider, in particular to a computer system of the automobile manufacturer, wherein Preferably, memory information in the service provider's computer 710 marks that the bill has not yet been paid. The computer 710 of the service provider or of the automobile manufacturer preferably creates an invoice depending on the billing data transmitted. The service provider's computer 710 then preferably transmits the bill to a computer system 740 of the ordering person 730, or to the ordering person 730. The ordering person 730 or a computer (710) of a service provider then preferably settles this bill. The service provider computer 740 then marks the storage information in the service provider computer (740) that the bill is paid.

A proposed vehicle includes device parts 210, at least one cable harness 1515 with line sections 240, 241, 245, at least one energy source 250, 251, at least one control computer 12 - for example a higher-level computer system 12 - at least two electronic fuses 214, 225. The device parts (220) are typically electrical consumers. The at least two energy sources 250, 251 of the supply network 200 of the vehicle supply one or more of the device parts 210, 220 with electrical energy via the wiring harness with line sections 240, 241, 245. The electronic fuses 255, 256 are in the wiring harness of the supply network, the line sections 240, 241, 245 included. Each of the electrical fuses 255, 256 is preferably assigned at least one, number 1, electrical energy source 250, 251, which is referred to below as the assigned electrical energy source 250, 251. The word "inserted" can mean here that the electronic fuse 255, 256 can connect a line section 240, 241, 241 to the electrical energy source 250, 251 associated with this fuse 255, 256 or the electrical energy source 250 associated with this fuse 255, 256, 251 can be separated from this line section 240, 241, 241. A respective fuse of the fuses 255, 256 can enable or prevent the supply of energy from the respectively associated electrical energy source 250, 251 depending on a control signal from the control computer 12—for example from the higher-level computer system 12. The corresponding associated fuse 255, 260 can prevent the supply of energy from an associated electrical energy source 250, 251. The control computer 12 creates an encrypted connection 720 between the control computer 12 of the vehicle, for example the higher-level computer system 12, and a computer 710 of a service provider, in particular a computer system 710 of the automobile manufacturer. The vehicle's control computer 12 - for example the higher-level computer system 12 - authenticates the vehicle to the service provider's computer 710, the vehicle's authentication data being, for example, the data of the vehicle and/or the car key and/or a SIM card in the vehicle and/or a vehicle-specific Password entry or password generation and / or biometric user data of a vehicle owner, etc. may include. The service provider's computer 710 also authenticates itself to the vehicle's control computer 12, for example to the higher-level computer system 12. If necessary, the requesting person 730 authenticates using the vehicle's control computer 12, for example using the higher-level computer system 12, to the service provider's computer 710, wherein the authentication data can include, for example, the data of the vehicle and/or the personalized car key, a personalized SIM card, a personalized password input, biometric user data, etc. The service provider's computer 710 generates an unlock code or provides this unlock code. The service provider's computer 710 then transmits the activation code to the vehicle's control computer 12, for example to the higher-level computer system 12. The vehicle's control computer 12, for example the higher-level computer system 12, then verifies the permissibility and/or syntactic correctness and/or the situational Eligibility of Unlock Code. If the verification of the activation code is successful, the control computer 12 of the vehicle enables energy to be supplied to an assigned electrical energy source (250, 251) by means of the corresponding, assigned fuse 255, 260. For this purpose, the control computer 12 of the vehicle sends a corresponding command via the data bus 9 to the relevant fuse 255, 260. The communication between the control computer 12 and the fuse 255, 260 is preferably encrypted. The communication is preferably PQC encrypted. The control computer 12 of the vehicle has preferably previously authenticated itself at least once with the computer core 2 of the control device 4 of the fuse 250, 260 in question. The computer core 2 of the control device 4 of the relevant fuse 250, 260 has preferably previously authenticated itself with the control computer 12 of the vehicle, ie the higher-level computer system 12. The control computer 12 of the vehicle preferably transmits billing data to a computer 710 of a service provider, in particular to a computer system of the automobile manufacturer, with storage information in the service provider's computer 710 marking that the bill has not been paid. A computer 710 or the computer 710 of a service provider then preferably creates ters or the service provider, in particular to a computer system of the automobile manufacturer or the computer system of the automobile manufacturer, an invoice depending on the billing data transmitted. The billing data can relate, for example, to the duration of use of certain consumers or energy sources or certain line sections or the determination of certain operating parameters or the provision of certain methods for operating the vehicle or its device parts. A computer 710 or the computer 710 of a service provider or the service provider then transmits the invoice created in this way, preferably to a computer 750 or the computer 750 of a service provider or the service provider, in particular to a computer system or the computer system of the ordering person, or to the ordering person 730 A computer 750 or the computer 750 of a service provider or the service provider and/or the requesting person 730 preferably settles the bill. An input from the requesting person 730 is preferably required for this. Preferably, the service provider computer 710 marks the storage information in the service provider computer 710 that the bill is paid.

For example, a computer 710 of a service provider or the automobile manufacturer can use the transmitted billing data to create a forecast of the probability of failure of a device part of the vehicle using the vehicle data and/or operating data and/or measured values and/or damage data. This computer 710 can then transmit these forecast results to a server 1985 and/or a workshop terminal and/or a terminal 740 and/or a vehicle owner's computer 730 and/or a terminal 740 and/or a vehicle driver's computer 730 or a terminal and /or a server 710 of an automobile manufacturer and/or a terminal and/or server of a logistics company and/or a terminal and/or server of another user of this data and possibly display it there.

The vehicle can also use such a system to detect operating errors. For example, the computer core 2 of a control device 4 of an electronic fuse can send a message to a computer 710, 750 of a service provider in the event of a hot-plug event in the supply network 3100, i.e. the unauthorized disconnection or connection of an electrical plug connection under current and/or voltage and/or the automobile manufacturer. In the event of a hot-plug event in the supply network 200 of a vehicle, the computer core 2 of the control device 4 of an electronic fuse can transmit a message to a computer 710 of a vehicle manufacturer or a service provider directly or with a time delay, or can provide such information, for example, in a memory of a higher-level computer 12 .

The computers in the supply network 200 preferably exchange security codes encrypted using data messages in the bit stream packets BP exchanged via the data bus 9 . These security codes are special activation codes that enable individual circuit breakers 17 of individual fuses in the supply network 200 to be switched on or off. The computer core 2 of the control device 4 of a fuse preferably checks a switch-on or switch-off command received for the circuit breaker 17 of its fuse for admissibility using a security code that is also transmitted to this computer core 2 of the control device 4 of the fuse. The computer core 2 of the control device 4 of the fuse can take into account factors such as the time of transmission, the current strength flowing through the circuit breaker 17, the voltage of connections 18, 19 of the circuit breaker 17 against a reference potential, the state of other fuses in the supply network 200, the priority of the downstream partial supply network and/or consumers contained therein and/or energy sources contained therein and/or originating computer of the security code and/or transmitting computer of the security code, user inputs, messages from other computers 710, 750 etc.

For example, a service provider or the automobile manufacturer or a vicarious agent of the automobile manufacturer can use a server 710 to transmit the security code or data for generating the security code through the higher-level computer system 12 or through computer cores 2 of the control devices 4 of the electronic security devices to the higher-level computer system 12 or a computer core 2 of a control device 4 transmit to the electronic fuse.

For example, the security data bus 9 can be provided directly or indirectly, e.g. via gateways or the like, with a terminal 740 for manual user input for reconfiguration of the supply network 200 by means of the electronic fuses of the supply network.

The terminal 740 can be set up to also serve to transmit authentication data to a server 710 of the automobile manufacturer or an agent of the automobile manufacturer, wherein the authentication data can include authentication data of the operating person 730 and/or authentication data of the organization for which the person 730 works and/or authentication data of the vehicle and/or authentication data of the car key of the vehicle and/or similar authentication data. In particular, the authentication data can be data from a signature card or the like and/or biometric data such as data from a fingerprint scanner and/or a retina scanner or the like or data derived from such data. The terminal 740 is then preferably set up to receive the security code from the server 710 of the automobile manufacturer or one of the automobile manufacturer's vicarious agents as a function of the authentication data ascertained in this way.

One or more computer cores 2 of control devices 4 of electronic fuses of the electronic fuses in the supply network 200 are preferably set up to determine measured values using measuring means for these electronic fuses and to transmit these measured values to a higher-level computer system 12 via the fuse data bus 9 .

The higher-level computer system 12 is preferably set up to execute a neural network model and to use the measured values determined and/or values dependent thereon as input values of the neural network model. At least the switching state of a circuit breaker 17 of an electronic fuse in supply network 200 and/or the switching states of a plurality of circuit breakers 17 of a plurality of electronic fuses in supply network 200 and/or at least one data message from the higher-level computer system 12 are then preferably linked to another computer system 710, 750, 740) or signaling from the higher-level computer system 12 to a user 730 based on an output signal and/or output value of the neural network model.

The higher-level computer system 12 can also be set up to carry out spectral analyzes of the data of the curves of measured values of the measuring devices of the fuses in the supply network, for example by Fourier or Laplace transformation or wavelet transformation, and to determine values of the spectra. The superordinate computer system 12 can then be set up to conclude that preventive maintenance is necessary for the values of the spectra in the event of significant deviations in the values of the spectra from expected value intervals or to signal another computer system 750, 710 or a display 740. The higher-level computer system 12 can also be set up to carry out spectral analyzes of the data of the curves, for example by Fourier or Laplace transformation or wavelet transformation, and to determine values of the spectra and the system availability of device parts of the supply network and/or the supply network 200 itself to evaluate using determined spectra and, if necessary, to signal the evaluation result to other computer systems 710, 750, 740, 4 and/or to change parameters of the vehicle depending on this evaluation. The other computer systems can be terminals 740 of a user 730 and/or computers 710 of a vehicle manufacturer or computers 710, 750 of one or more service providers and/or a workshop or a higher-level computer system 12 of the vehicle or a computer core 2 of a control device 4 of a backup of the supply network 200 .

The supply network presented preferably includes at least part of the time a computer (server) 710 of a service provider, in particular a computer system of an automobile manufacturer and thus possibly also of a workshop. A preferably encrypted data connection 720 between the control computer of the vehicle -. B. a higher-level computer system 12 and a computer 710) of a service provider, in particular a computer system of the automobile manufacturer of the vehicle, ensures the communication. A requesting/operating person or user 730 can access the computers 4, 12 of the supply network 200 and thus the switching state of the circuit breakers 17 of the fuses via a data input device and/or data output device—for example a terminal 740. In addition to the computer 710 of the vehicle manufacturer or a service provider, other computers 750 of other service providers or other computers of the service provider that controls computer 710 can communicate with the computers of the supply network 200 via the data bus 9 and the higher-level computer system 12 via wired and/or wireless data connections in connect.;

figure 8

The 8th corresponds in the most important parts to the 4 .

The supply network of the 8th comprises a further fuse 805, a second further fuse 810, a first connected distribution tree 815, a second connected distribution ment tree 820, an electronic fuse 825, consumers 830 and other consumers 835. The other parts of the 8th have already been linked to the 4 explained.

A computer core 2 of a control device 4 of an electronic fuse 825 preferably transmits parameters of the partial supply trees 815 connected to the electronic fuse 825 and/or individual nodes of the connected partial supply trees 815 and/or individually connected supply line sections of the supply tree of the supply lines of the vehicle to a computer core 2 of a control device 4 another electronic fuse 805 and/or one or more control units of the vehicle and/or a higher-level computer system 12. Such parameters can in particular be measured values that the computer core 2 of the control device 4 of a fuse records using measuring devices of the control device 4 of the fuse. Such parameters can be, for example, a directly accessible parameter, such as the temperature of a temperature sensor 40, the voltage of a node 26, 27, 28 within the fuse to a reference potential 201 and/or the voltage of a node of the supply tree to a reference potential 201, and/or the current value of an electric current in a umbilical section of the umbilical tree 820 connected.

By means of this exchange of recorded measured values and/or parameters, the computer core 2 of the control device 4 of an electronic fuse 825, 805 can, in particular by applying Kirchhoff's equations to data that the computer core 2 of the control device 4 of the electronic fuse 825, 805 use measuring devices of the control device 4 of this electronic fuse 825, 805 or which the computer core 2 of the control device 4 of this electronic fuse 825 has received from the computer cores 2 of the control devices 4 of other electronic fuses 805 or from higher-level computer systems 12, for example a higher-level computer system 12, derived parameters, such as for example leakage currents against other electrical nodes in the vehicle or electrical resistances of supply voltage line sections.

The computer core 2 of the control device 4 of the electronic fuse 825 preferably estimates the temperature of a subsequent supply line section, which is increased as a result of the electric current 29 in this supply line section and the voltage drop across this supply line section. Such an estimate is also possible if its ohmic resistance and its heat capacity and its thermal discharge resistances and the ambient temperature in the area of the supply line section are approximately, e.g. by estimation by the computer core 2 of the control device 4 of the electronic fuse 825 and/or by data transmission from the higher-level computer system 12 are known to the computer core 2 of the control device 4 of the fuse 825 and/or by data transmission from the higher-level computer system 12 .

Preferably, the computer core 2 of the control device 4 of the electronic fuse 825 uses a voltage measuring device 16 to determine the voltage value of the voltage of a node 22, 25, 21 at the circuit breaker 17 of the electronic fuse 825 or of a node associated therewith in relation to a reference potential 201 in order to make such estimates, to enable such as the above and/or to be able to detect overvoltages or undervoltages and to be able to report them to a higher-level computer system 12 via the data bus 9. The computer core of control device 4 of electronic fuse 825 preferably determines the current value of current 29 through circuit breaker 17 of electronic fuse 825. Computer core 2 of control device 4 of electronic fuse 825 and/or a higher-level computer system 12 preferably determine this from the current value and/or the voltage value the power value of the electrical power fed into the load or into a subsequent supply tree 815, 820 or into a subsequent supply line section. If this power feed-in exceeds a power feed-in threshold value, computer core 2 of control device 4 of fuse 825 preferably opens circuit breaker 17 of fuse 825 and signals this opening of circuit breaker 17 to higher-level computer system 12, preferably via data bus 9.

Typically, the computer core 2 of the control device 4 of the electronic fuse 825 uses a voltage measuring device to determine the voltage value of the voltage of a node 22, 25, 21 at the circuit breaker 17 of the electronic fuse 805 or a node associated therewith in relation to a reference potential 201 and the current value of the current 29 through the circuit breaker 17 of the electronic fuse. The computer core 2 of the control device 4 of the electronic fuse 825 and/or a higher-level computer system 12 determine the power value of the electrical power flowing from the energy source or from a preceding supply tree or from a preceding supply line section from the current value and the voltage value. exceeds If this power consumption exceeds a power consumption threshold value, computer core 2 of control device 4 of fuse 825 preferably opens circuit breaker 17 of fuse 825 and signals this opening of circuit breaker 17 to higher-level computer system 12, preferably via data bus 9.

The computer core 2 of the control device 4 of the electronic fuse 805 preferably transmits this power value via the fuse data bus 9 to the control device 4 of another electronic fuse 825 or the higher-level computer system 12 of the supply network 200. The higher-level computer system 12 can also be a server 710, 750 of an energy provider or one of the vicarious agents of an energy worshiper or the vehicle manufacturer or another service provider.

A proposed electronic fuse 825, 1 preferably comprises a control device 4 with a clock or a timer 35. The computer core 2 of the control device 4 of the fuse 1, 85 preferably uses this timer 35 to generate time stamps in a log table, which the computer core 2 of control device 4 of backup 825 preferably creates in a memory of control device 4 of backup 825 or that the higher-level computer system 12 preferably creates in a memory of the higher-level computer system 12 or that the computer core 2 of a control device 4 of another backup 805 in the memory of this control device 4 the other fuse 805 applies.

The clock or the timer 35 of the control device 4 of the electronic fuse 1, 825 preferably has a synchronization option with the clocks and timers 35 of the control devices 4 of other electronic fuses 805, 810 and/or with the clocks and/or timers 1970 of a higher-level computer system 12 having.

In a proposed electronic fuse 825, the computer core 2 of the control device 4 of this electronic fuse 825 preferably switches off the circuit breaker 17 after receiving a switch-off signal and/or a switch-off command via the fuse data bus 9 only after a switch-off delay time has elapsed. The computer core 2 of the control device 4 of the electronic fuse 825 preferably determines the time since the receipt of the switch-off signal or switch-off command using the timer 35 of the control device 4 of the electronic fuse 825. The computer core 2 of the control device 4 of the electronic fuse 825 preferably switches off the Circuit breaker 9 goes off immediately if the amount of the value of the electric current 29 through the circuit breaker 17 of the electronic fuse 825 exceeds a threshold value and/or if the amount of the power feed into the subsequent partial supply network and/or into the subsequent supply line section or into a subsequent consumer exceeds a power feed threshold value exceeds and/or when the amount of power drawn from the preceding utility sub-network and/or in the preceding utility line section or from a preceding energy source exceeds a threshold power draw. Immediately means that the computer core 2 switches off in less than 100 µs, better in less than 50 µs, better in less than 20 µs, better in less than 10 µs, better in less than 5 µs, better in less than 2 µs, better in less than 1 µs , better in less than 500ns, better in less than 200ns, better in less than 100ns.

The switch-off delay time preferably depends on the magnitude of the value of the electric current 29 through the circuit breaker 17 and/or on which the magnitude of the power feed into the subsequent partial supply network and/or into the subsequent supply line section or into a subsequent consumer exceeds a power feed threshold value and/or from the Amount of power consumption from the preceding supply part network and / or in the preceding supply line section or from a preceding energy source.

Preferably, the turn-off delay time also depends on the magnitude of the value of the electrical current 29 through the circuit breaker 17 , falling parabolically as the magnitude of the value of the electrical current 29 through the circuit breaker 17 increases.

The computer core 2 of the control device 4 of the electronic fuse 825 preferably integrates the square of the absolute value of the electric current 29 through the power switch 17 of the electronic fuse 825 over time and in this way emulates the behavior of a fuse. The computer core 2 of the control device 4 of the electronic fuse 825 preferably opens the circuit breaker 17 of the electronic fuse 825 when the amount of the time integral of the square of the Amount of the current 29 through the power transistor 17 exceeds a current square threshold value. Instead of the square of the amount of electric current 29 through power switch 17 of electronic fuse 825, computer core 2 of control device 4 of the electronic fuse can also form the integral of a polynomial of at least the second degree of the value of current 29 through power switch 17 of electronic fuse 825 and then use this value for the comparison with the current squared threshold value for switching off the power switch 17 when the current squared threshold value is exceeded.

The computer core 2 of the control device 4 of the electronic fuse 825 preferably uses corresponding measuring means 16 to record the amount of the value of the electric current 29 through the circuit breaker 17, squares it or applies a polynomial of at least the second degree to it and integrates the result over time. This integration can also be a filter, in particular a low-pass filter. The computer core 2 of the control device 4 of the electronic fuse then compares the recorded, squared and filtered amount of the value of the electric current 29 with a threshold value, in particular the current squared threshold value. The switching state of the circuit breaker 17 of the electronic fuse 825 then depends at least temporarily on the result of this comparison. However, it is possible, for example, for the circuit breaker 17 of the electronic fuse 825 to be opened independently of this by a command via the data bus 9 by the superordinate computer system 12 .

As already indicated, the computer core 2 of the control device 4 of the electronic fuse 825 can detect the amount of the value of the electric current 29 through the circuit breaker 17 by appropriate means 16, the detected amount of the value of the electric current 29 through the circuit breaker 17 by means of a polynomial with a Order of the polynomial greater than one into a mapped value and integrate this mapped value of the electric current 29 through the power switch 17 over time, filtering this time-integrated value of the electric current 29, in particular low-pass filtering. The computer core 2 of the control device 4 of the electronic fuse 825 preferably compares the mapped and filtered value of the electric current 29 with a threshold value, in particular the square current threshold value, with the switching state of the circuit breaker 17 of the electronic fuse 825 preferably, as before, at least temporarily depending on the result of this comparison .

The computer core 2 of the control device 4 of the electronic fuse 825 preferably allows the transport of electrical energy from one or more energy sources 250 to the consumer 835, 830 at least temporarily, in that the computer core 2 of the control device 4 of the fuse 825 closes its circuit breaker 17. Typically, the computer core 2 of the control device 4 of the electronic fuse 825 prevents the transport of electrical energy from the consumer 835, 830 to one or more or all of the energy sources 250.

The electronic fuse 825 and/or the control device 4 of the electronic fuse 825 preferably includes means 24, 23 for detecting the direction of the electrical current 29 through the circuit breaker 17. The computer core 2 of the control device 4 of the electronic fuse 825 preferably detects the direction of the flowing electrical current Current 29 with the help of these means 24, 23. If a return flow of energy in the direction of energy source 250 is not desired, the computer core 2 of the control device 4 of the electronic fuse 825 opens the circuit breaker 17 of the electronic fuse 825 when the electric current 29 from the consumer 830 to a or several energy sources 250 flows through the circuit breaker 17 of the electronic fuse 825.

The control device 4 of the electronic fuse or fuse 825 preferably comprises a third power switch 615 distinct from the power switch 17 of the electronic fuse 825. The computer core 2 of the control device 4 of the fuse 825 typically closes this third power switch 615 when the electrical current 29 flows from the consumer 835 to one or more energy sources 250 through the power switch 17 of the electronic fuse 825. In this case, when the third power switch 615 is closed, this third power switch 615 diverts the electrical current 29 from the load 835 into a current sink, in particular a reference potential line 201 .

figure 9

The electronic fuse 1, and in particular the control device 4 of the electronic fuse 1, preferably includes means 505, 905 for detecting the switchability of the circuit breaker 17 of the electronic fuse 1.

In the 9 For the sake of clarity, not all useful and possibly usual device components are shown. Next device components that the reader as possibly in the 1 can accept present, can be found, for example, in the 1 , 5 , 6 , 24 , 41 , 42 , 52 , 53 , 54 , 55 . The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

Fuse 1 of 9 points to fuse 1 of the 5 in addition to the first test current source 505, a second test current source 905, the test current 915 of which is modulated by the control signal 910 with a modulation signal {505} of a second signal generator 920. The second test current 915 preferably corresponds to the first test current 515. As a result, the control device 4 can feed the test current 515 into the circuit breaker 17 and, after passing through the circuit breaker 17, remove it from the current path again as the second test current 915. If circuit breaker 17 is not, for example, open or closed in the expected state, second test current 915 and/or first test current 515 and/or the voltage drops between terminals 26, 27, 28 of circuit breaker 17 do not correspond to the expected values. From this, the computer core 2 of the control device 4 of the electronic fuse 1 can conclude that there is a fault in the circuit breaker 1 . In such an error situation, the computer core 2 of the control device 4 of the electronic fuse 1 can signal such a fault to a higher-level computer system 12 or to the computer cores 2 of the control devices 4 of other electronic fuses, for example. To control the second test current source 905, a second signal generator 920 preferably generates a second control signal 910 of the second electronic test current source 905, which ensures that the second test current 915, which the second test current source (910) draws from the circuit breaker (17), with the modulation signal {505} is modulated.

The document presented here proposes that the control device 4 of the electronic fuse 1 comprises a first test current source 505 and a second test current source 905 . The control device 4 of the electronic fuse 1 controls the first test current source 505 and the second test current source 905. The first test current source 505 feeds the test current 515 into the first connection 26 of the circuit breaker 17 at the instigation of the control device 4. The second test current source 905 then draws this test current 915 from the second connection 28 of the circuit breaker 17. The second test current source 905 preferably includes means for detecting the drawing of the test current. The computer core 2 of the control device 4 concludes that there is a fault in the circuit breaker 17 of the electronic fuse 1 if, contrary to the respective expectation, the second current source 905 does not or does not detect a drawing of a test current 915 . In this case, for example, the control device 4 can also evaluate a deviation in the absolute value of the second test current 915 outside of an expected value interval as an error. The computer core 2 of the control device 4 of the electronic fuse 1 preferably changes the switching state of the circuit breaker 17 one or more times and checks the switching state of the circuit breaker 17.

For this purpose, the computer core 2 of the control device 4 of the electronic fuse 1 preferably determines measured values using measuring means of the electronic fuse 1 and/or the control device 4 of the electronic fuse 1. The computer core 2 of the control device 4 and/or the higher-level computer system 2 preferably execute a neural network model . The computer core 2 of the control device 4 and/or the higher-level computer system 2 use the measured values determined as input values of the neural network model they execute. In order to make this possible, the computer cores 2 of the control devices 4 of one or more fuses and/or the higher-level computer system 12 preferably transmit the necessary data for the input signals of the neural network to the computer core 2 of the control device 4 of the fuse 1 and/or the higher-level computer system 12, depending on which computer is currently running the neural network model.

The switching status of circuit breaker 17 of electronic fuse 1 and/or at least one data message from computer core 2 of control device 4 of electronic fuse 1 to a higher-level computer system 12 or a computer core 2 of another control device 4 of another electronic fuse 805 then preferably depends on an output signal of the neural network model.

The neural network model is preferably trained with suitable training data from the development period.

For example, the computer core 2 of the control device 4 of the electronic fuse 825 can detect a failure of one or more consumers 835 or a failure of one or more energy sources 250 or another defect in the system of the overall device using an output signal from the neural network model.

The computer core 2 of the control device 4 of the electronic fuse 825 can also exchange data using power-line communication with another computer system 12 and/or with the control device 4 of another electronic fuse 805, for example via a supply voltage line (6, 241, 242, 245). .

To implement power-line communication, the computer core 2 of the control device 4 of the electronic fuse 1 can use the power switch 17 of the electronic fuse 825 as a transmission transistor for data communication via the supply voltage line (6, 241, 242, 245).

The computer core 2 of the control device 4 of the electronic fuse 1 can, for example, open the circuit breaker 17 of the electronic fuse 1 in order to transmit a bit of a first logical value. The computer core 2 of the control device 4 of the electronic fuse 1 can, for example, close the circuit breaker 17 of the electronic fuse 1 in order to transmit a bit of a second logical value, which differs from the first logical value.

Instead of this modeling via complete opening and closing, communication via different internal resistances of the circuit breaker 17 is possible.

The computer core 2 of the control device 4 of the electronic fuse 1 can, for example, set the circuit breaker 17 of the electronic fuse 1 to a first state with a first electrical resistance value between the first connection 26 of the circuit breaker 17 and the second connection 28 of the Bring circuit breaker 17. The computer core 2 of the control device 4 of the electronic fuse 1 can, for example, in order to transmit a bit of a second logical value that differs from the first logical value, switch the circuit breaker 17 of the electronic fuse 1 into a second state with a second electrical resistance value between the first terminal 26 of the power switch 17 and the second terminal 28 of the power switch 17, which is different from the second resistance value.

In order to be able to receive data via the supply voltage line, the control device 4 of the electronic fuse 1 preferably has means for detecting the time course of the electric current 29 through the circuit breaker 17 of the electronic fuse 1 . These means preferably at least temporarily record the course over time of the electric current 29 through the circuit breaker 17 of the electronic fuse 1. These means can, in particular, include an analog-to-digital converter 570 and/or a memory of the computer core 2 of the control device 4 of the electronic fuse 1 or the control device 4 of the electronic fuse 1 include.

The control device 4 of the electronic fuse 1 preferably includes means for detecting the time profile of the voltage between a connection (26, 27, 28) of the circuit breaker 17 of the electronic fuse 1 and a reference potential 201. These means typically record the time profile of the voltage at least temporarily between a connection (26, 27, 28) of the circuit breaker 17 of the electronic fuse 1 and a reference potential 201.

The computer core 2 of the control device 4 of the electronic fuse 1 preferably carries out a spectral analysis of the data of the time curves, for example by Fourier or Laplace transformation or wavelet transformation, and determines values of the spectrum. In the event of significant deviations in the values of these spectra from associated expected value intervals for these values of these spectra, the computer core 2 of the control device 4 of the electronic fuse 1 preferably concludes that preventive maintenance is necessary and/or signals this deviation to a higher-level computer system 12.

The electronic fuse 1 preferably comprises means for detecting the value of the electric current 29 through the circuit breaker 17 of the electronic fuse 1 and for detecting a span voltage at a connection (26, 27, 28) of the circuit breaker 17 of the electronic fuse 1 against a reference potential 201. The computer core 2 of the control device 4 of the electronic fuse 1 switches according to the proposal in the event of a voltage drop in the measured voltage values below a minimum voltage value AND a simultaneous current increase in the value of the current 29 through the circuit breaker 17 above a maximum current value, the circuit breaker 17 of the electronic fuse 1 opens, that is, the circuit breaker 17 opens in this case. So this is the case
if a) the measured voltage value falls below a voltage threshold AND at the same time the measured current value exceeds a current threshold and/or if b) the amount of a speed of a measured change over time in the voltage value drop exceeds a voltage drop speed threshold AND at the same time the amount of the speed of a measured change over time in the amount of the electric current 29 through the circuit breaker 17, so the current rise, exceeds a current rate of rise threshold.

Under such switch-off conditions, the computer core 2 of the control device 4 of the electronic fuse 1 preferably switches off the circuit breaker 17 of the electronic fuse 1 faster than within 1 μs. This has the advantage that in many cases this very short time is sufficient to avoid damage.

The proposed electronic fuse 1 preferably has an emergency operation control 925. The emergency operation control 925 can preferably send data via a data bus 540, 9 and receive data via this data bus 9, 540. The control device 4 of the electronic fuse 1, 825 can, for example, be the control device 4 of another electronic fuse 805 in emergency operation, which, by means of data communication via the data bus 9, 540 and by means of the emergency operation control 925 of the other electronic fuse 805, switches the other electronic fuse 805 on at a Failure of the control device 4 of the other electronic fuse 805 controls. (See also 8th ) The emergency operation control 925 preferably monitors the data communication between the control device 4 and the emergency operation control 925 of the other fuse 805. In the event of a failure of the data communication of the fuse 1, the emergency operation control 925 preferably emulates simple functions of the control device 4 and thus preferably provides at least basic protection for the connected Supply line 19, 815, 820 and / or supply sub-networks and / or consumers and / or energy sources safe.

The computer core 2 of the control device 4 of the electronic fuse 1 sends a signal via the fuse data bus 9, 540 to a higher-level computer system 12, which signals that a) the corresponding electronic fuse 1 is still available and/or that b) the corresponding electronic fuse 1 is ready for operation and/or which fuse identification information the fuse 1 has and/or which operating parameters the electronic fuse 1 has.

figure 10

10 shows a proposed energy-source-side intersection fuse 1000. The exemplary intersection fuse 1000 includes an energy-source-side first supply line section 1005 of a first supply line, a load-side second supply line section 1010 of a first supply line, an energy-source-side first supply line section 1015 of a second supply line, a load-side second supply line section 1020 of a second supply line, a first electrical node 1025, a second electrical node 1030, a first electronic fuse 1035 as previously described, a second electronic fuse 1040 as previously described, a third electronic fuse 1045 as previously described, and a fourth electronic fuse 1050 as previously described . Depending on the switching state of circuit breaker 17 of first electronic fuse 1035, first electronic fuse 1035 connects energy source-side first supply line section 1005 of the first supply line to first node 1025 or separates energy source-side first supply line section 1005 of the first supply line from first node 1025. The second electronic fuse 1040 connects depending on the switching state of the circuit breaker 17 of the second electronic fuse 1040 the energy source-side first supply line section 1015 of the second supply line to the first node 1025 or separates the energy source-side first supply line section 1015 of the second supply line from the first node 1025. The second electronic fuse 1040 connects the energy source-side first supply line section 1015 of the second supply line does not connect to the first node 1025 when the first electronic fuse 1035 connects the power source-side first supply line section 1005 of the first supply line to the first node 1025. The first electronic fuse 1040 disconnects the power source side first feeder line Section 1005 of the first supply line does not connect to the first node 1025 when the second electronic fuse 1040 connects the energy source-side first supply line section 1015 of the second supply line to the first node 1025. Depending on the switching state of circuit breaker 17 of third electronic fuse 1045, third electronic fuse 1045 connects energy source-side first supply line section 1005 of the first supply line to second node 1030 or separates energy source-side first supply line section 1005 of the first supply line from second node 1030. The fourth electronic fuse Depending on the switching state of circuit breaker 17 of fourth electronic fuse 1050, 1050 separates energy-source-side first supply line section 1015 of the second supply line from second node 1030 or separates energy-source-side first supply line section 1030 of the second supply line from second node 1030. Fourth electronic fuse 1050 connects the energy-source-side first supply line section 1015 of the second supply line does not connect to the second node 1030 when the third electronic fuse 1045 connects the power source-side first supply line section 1005 of the first supply line to the second node. The third electronic fuse 1045 does not connect the power source side first supply line section of the first supply line to the second node 1030 when the fourth electronic fuse 1050 connects the power source side first supply line section 1015 of the second supply line to the second node 1030 . The load-side second supply line section 1055 of the first supply line is connected to the first node 1025 . The load-side second supply line section 1060 of the second supply line is connected to the second node 1030 .

A proposed load-side crossing fuse 1000 includes a power source-side first supply line section 1005 of a first supply line, a load-side second supply line section 1015 of a first supply line, a power source-side first supply line section 1055 of a second supply line, a load-side second supply line section 1060 of a second supply line, a third electrical node 1065, a fourth electrical nodes 1070, a first electronic fuse 1035 as previously described, a second electronic fuse 1040 as previously described, a third electronic fuse 1045 as previously described, and a fourth electronic fuse 1050 as previously described. Depending on the switching state of the circuit breaker 17 of the first electronic fuse 1035, the first electronic fuse 1035 connects the load-side second supply line section 1055 of the first supply line to the third node 1065 or separates the load-side second supply line section 1055 of the first supply line from the third node 1065. The second electronic fuse 1040 connects depending on the switching state of the circuit breaker 17 of the second electronic fuse 1040 the load-side second supply line section 1055 of the first supply line to the fourth node 1070 or separates the load-side second supply line section 1055 of the first supply line 1055 from the fourth node 1070. The second electronic fuse 1040 connects the load-side second supply line section 1055 of the first supply line does not connect to the fourth node 1070 if the first electronic fuse 1035 connects the load-side second supply line section 1055 of the first supply line to the third node 1065. The first electronic fuse 1035 does not connect the load-side second supply line section 1055 of the first supply line to the third node 1055 when the second electronic fuse 1040 connects the load-side second supply line section of the first supply line 1055 to the fourth node 1070 . Depending on the switching state of the circuit breaker 17 of the third electronic fuse 1045, the third electronic fuse 1045 connects the load-side second supply line section 1060 of the second supply line to the third node 1065 or separates the load-side second supply line section 1060 of the second supply line from the third node 1065. The fourth electronic fuse Depending on the switching state of circuit breaker 17 of fourth electronic fuse 1050, 1050 connects the load-side second supply line section of second supply line 1060 to fourth node 1070 or separates load-side second supply line section 1060 of the second supply line from fourth node 1070. Fourth electronic fuse 1050 connects the load-side second supply line section 1060 of the second supply line does not connect to the fourth node 1070 when the third electronic fuse 1045 connects the load-side second supply line section 1060 of the second supply line to the third node 1065. The third electronic fuse 1045 does not connect the load-side second supply line section 1060 of the second supply line to the third node 1065 when the fourth electronic fuse 1050 connects the load-side second supply line section 1060 of the second supply line to the fourth node 1070 . The power source side first power line portion 1005 of the first power line is connected to the third node 1065 . the energetic Energy source-side first supply line section 1015 of the second supply line is connected to the fourth node 1070 .

In the intersection fuses described above, the switching status of the circuit breakers 17 of the electronic fuses (1035, 1040, 1045, 1050) of the intersection fuse 1000 depends on a determined energy requirement of one or more consumers (830, 835) and/or on a determined energy supply capability of one or more energy sources (250, 251).

The computer cores 2 of the control devices 4 of the electronic safety devices (1035, 1040, 1045, 1050) of the intersection safety device 1000 are preferably connected to one another and to a higher-level computer system 12 via a safety data bus 9 . The higher-level computer system 12 preferably determines the energy requirements of one or more consumers 835, 830, which can supply the supply lines (1005, 1010: 1015, 1020, 1055, 1060) of the intersection safety device 1000 with electrical energy. The higher-level computer system 12 determines the ability to supply energy from one or more energy sources 250, 251, which can supply electrical energy to the crossing safety device 1000 via the supply lines (1005, 1010: 1015, 1020, 1055, 1060). The computer system 12 transmits to the computer cores 2 of the control devices 4 of the fuses (1035, 1040, 1045, 1050) of the intersection fuse 1000 configuration commands via the fuse data bus 9, which depend on the determined energy requirements of these consumers 830, 831 and/or the determined energy supply capability of these Energy sources 250, 251 depend. These configuration commands from the higher-level computer system 12 preferably cause the opening and closing of circuit breakers 17 of the electronic fuses (1035, 1040, 1045, 1050) of the crossing fuse 1000.

figure 11

11 11 shows a proposed supply network 1100 with a higher-level computer system 12 and with a large number of supply lines and with a large number of crossing fuses 1110 to 1118, which enable flexible load and supply-dependent reconfiguration of the supply network 1100.

The crossing fuses 1110 to 1118 are inserted into supply line pairs of the supply lines of the supply network 1100, respectively. The higher-level computer system 12 is connected to the computer cores 2 of the control devices 4 of the electronic fuses of the cross fuses 1110 to 1118 by means of a fuse data bus 9 .

The electronic fuses of the cross fuses 1110 to 1118 each have control devices 4 with a respective computer core. These fuses are preferably electronic fuses of the type described above.

To simplify the structure, the example four electronic fuses of a respective cross fuse of the cross fuses 1110 to 1118 can also have a common control device (4) so that this individual control device 4 controls four circuit breakers 17 of the four fuses simultaneously.

The higher-level computer system 12 preferably determines the energy requirements of electrical energy consumers 1121 to 1124 in the supply network 1100. The higher-level computer system 12 preferably also determines the energy supply capability of electrical energy sources 1150 to 1155 in the supply network 1100.

The higher-level computer system 12 preferably determines the current safety requirement based on the current driving situation of the vehicle, which means that the higher-level computer system uses measurement data, which can include measurement data from electronic fuses in the supply network 1100 in particular, to conclude, for example, the future ability to deliver energy and the future energy consumption.

The higher-level computer system 12 dynamically adjusts the electrically active topology of the supply network of the supply lines according to the determined energy requirement and/or according to the determined energy supply capability and/or by means of configuration commands via the safety data bus 9 to the computer cores 2 of the control devices 4 of the fuses of the crossing safety devices (1110 to 1118). or according to current security requirements.

figure 12

• Schritt 1: Bereitstellen 1210 eines Versorgungsnetzwerks (250, 251, 210 bis 213, 245) mit einem Vorrichtungsteil des Fahrzeugs, im Folgenden als energieversorgender Vorrichtungsteil 210 bezeichnet, wobei der energieversorgende Versorgungsteil 210 eine Steuervorrichtung 280, 4 und einen Speicher in einem ersten logischen Zustand umfasst;
• Schritt 2: Versorgen 1220 des energieversorgenden Vorrichtungsteils 210 mit elektrischer Energie aus einer Energiequelle 251, 250 des Fahrzeugs;
• Schritt 3: Verbinden 1230 eines ersten Anschlusses eines weiteren Leitungsabschnitts 240 mit dem energieversorgenden Vorrichtungsteil 210 des Fahrzeugs;
• Schritt 4: Verbinden 1240 eines zweiten Anschlusses des Weiteren Leitungsabschnitts 240 mit einem weiteren Vorrichtungsteil 220, 221 des Fahrzeugs;
• Schritt 5: Signalisierung 1250 eines Einschaltsignals an die Steuervorrichtung 280, 4 des energieversorgenden Vorrichtungsteils 210;
• Schritt 6: Ändern 1260 des logischen Zustands des Speichers in einen zweiten logischen Zustand in Abhängigkeit von dem logischen Zustand des Speichers;
• Schritt 7: Versorgen 1270 des Weiteren Vorrichtungsteils 220 bis 221 des Fahrzeugs mit elektrischer Energie über den weiteren Leitungsabschnitt 240 in Abhängigkeit von dem logischen Zustand des Speichers.

12 shows the basic sequence of a method 1200 for operating a supply network. The procedure includes the steps:

• Step 1: Providing 1210 a supply network (250, 251, 210 to 213, 245) with a device part of the vehicle, hereinafter referred to as energy-supplying device part 210, wherein the energy-supplying supply part 210 has a control device 280, 4 and a memory in a first logical state includes;
• Step 2: Supplying 1220 the power-supplying device part 210 with electric power from a power source 251, 250 of the vehicle;
• Step 3: connecting 1230 a first connection of a further line section 240 to the energy-supplying device part 210 of the vehicle;
• Step 4: connecting 1240 a second connection of the further line section 240 to a further device part 220, 221 of the vehicle;
• Step 5: signaling 1250 of a switch-on signal to the control device 280, 4 of the energy-supplying device part 210;
• Step 6: changing 1260 the logic state of the memory to a second logic state depending on the logic state of the memory;
• Step 7: Supplying 1270 the further device part 220 to 221 of the vehicle with electrical energy via the further line section 240 depending on the logic state of the memory.

The switch-on signal is preferably signaled 1250 via a safety data bus 9.

The power-supplying device part 210 preferably has an electronic fuse 215 of the power-supplying device part 250, 251. The supply 1270 of the further device part 220, 221 of the vehicle with electrical energy is preferably carried out via the further line section 240 by switching on the electronic fuse 215 of the energy-supplying device part 210 depending on the logic state of the memory.

• Schritt 1: Bereitstellen 1210 eines Versorgungsnetzwerks 200 mit einem Vorrichtungsteil 210 des Fahrzeugs, im Folgenden als energieversorgender Vorrichtungsteil 210 bezeichnet.
• Schritt 2: Versorgen 1220 des energieversorgenden Vorrichtungsteils 210 mit elektrischer Energie aus einer Energiequelle 250, 251 des Fahrzeugs;
• Schritt 3: Verbinden 1230 eines ersten Anschlusses eines weiteren Leitungsabschnitts 240 mit dem energieversorgenden Vorrichtungsteil 210 des Fahrzeugs;
• Schritt 4: Verbinden 1240 eines zweiten Anschlusses eines weiteren Leitungsabschnitts 240 mit einem weiteren Vorrichtungsteil der Vorrichtungsteile 220 bis 221 des Fahrzeugs, wobei der weitere Versorgungsteil der Vorrichtungsteile 220 bis 221 des Fahrzeugs eine Steuervorrichtung 280, 4 umfasst und wobei der weitere Versorgungsteil der Vorrichtungsteile 220 bis 221 des Fahrzeugs einen Speicher in einem ersten logischen Zustand umfasst;
• Schritt 5: Signalisierung 1250 eines Einschaltsignals an die Steuervorrichtung 280, 4 des weiteren Vorrichtungsteils der Vorrichtungsteile (220 bis 221) des Fahrzeugs;
• Schritt 6: Ändern 1260 des logischen Zustands des Speichers in einen zweiten logischen Zustand in Abhängigkeit von dem logischen Zustand des Speichers;
• Schritt 7: Versorgen 1270 des weiteren Vorrichtungsteils der Vorrichtungsteile 220 bis 221 des Fahrzeugs mit elektrischer Energie über den weiteren Leitungsabschnitt 240 in Abhängigkeit von dem logischen Zustand des Speichers. Vorzugsweise erfolgt die Signalisierung des Einschaltsignals auch hier über einen Sicherungsdatenbus 9. Vorzugsweise weist der weitere Vorrichtungsteil eine elektronische Sicherung 225 zur Absicherung des weiteren Vorrichtungsteils 220 auf. Das Versorgen des weiteren Vorrichtungsteils 220 des Fahrzeugs mit elektrischer Energie erfolgt bevorzugt über den weiteren Leitungsabschnitt 240 mittels des Einschaltens des Leistungsschalters 17 der elektronischen Sicherung 225 des weiteren Vorrichtungsteils 220 in Abhängigkeit von dem logischen Zustand des Speichers erfolgt.

A variant of the method 1200 for operating a supply network 200 comprises the steps:

• Step 1: Providing 1210 a supply network 200 with a device part 210 of the vehicle, hereinafter referred to as device part 210 supplying energy.
• Step 2: Supplying 1220 the power-supplying device part 210 with electric power from a power source 250, 251 of the vehicle;
• Step 3: connecting 1230 a first connection of a further line section 240 to the energy-supplying device part 210 of the vehicle;
• Step 4: Connecting 1240 a second connection of a further line section 240 to a further device part of the device parts 220 to 221 of the vehicle, wherein the further supply part of the device parts 220 to 221 of the vehicle comprises a control device 280, 4 and wherein the further supply part of the device parts 220 to 221 of the vehicle includes a memory in a first logic state;
• Step 5: signaling 1250 of a switch-on signal to the control device 280, 4 of the further device part of the device parts (220 to 221) of the vehicle;
• Step 6: changing 1260 the logic state of the memory to a second logic state depending on the logic state of the memory;
• Step 7: Supplying 1270 the further device part of the device parts 220 to 221 of the vehicle with electrical energy via the further line section 240 depending on the logic state of the memory. Here too, the switch-on signal is preferably signaled via a safety data bus 9 . The additional device part 220 of the vehicle is preferably supplied with electrical energy via the additional line processing section 240 by switching on the circuit breaker 17 of the electronic fuse 225 of the further device part 220 depending on the logic state of the memory.

figure 13

• Schritt 1: Bereitstellen 1305 des Fahrzeugs, (siehe auch 7), wobei das Fahrzeug u.a. Vorrichtungsteile 210 und zumindest einen Kabelbaum mit Leitungsabschnitten 240, 241, 245 und zumindest eine Energiequelle 250, 251 umfasst und zumindest einen Steuerrechner 12, beispielsweise ein übergeordnetes Rechnersystem 12, und zumindest zwei elektronische Sicherungen 214, 225 umfasst. Die Vorrichtungsteile 220 sind hier elektrische Verbraucher. Zumindest eine oder mehrere Energiequellen 250, 251 versorgen zumindest zwei der Vorrichtungsteile 210, 220 mit elektrischer Energie über den Kabelbaum mit Leitungsabschnitten 240, 241, 245. Die elektronischen Sicherungen 214, 225 sind vorzugsweise in den Kabelbaum mit Leitungsabschnitten 240, 241, 245 eingefügt. Bevorzugt jeder der elektrischen Sicherungen 214, 225 ist vorzugsweise zumindest ein, als Zahl 1, elektrischer Verbraucher 210, 225 zugeordnet, der im Folgenden als der jeweiligen elektronischen Sicherung zugeordneter elektrischer Verbraucher bezeichnet wird. Eine Sicherung der Sicherungen 214, 215 kann die Energieversorgung des dieser Sicherung zugeordneten elektrischen Verbrauchers in Abhängigkeit von einem Steuersignal des Steuerrechners, beispielsweise eines übergeordneten Rechnersystems 12, ermöglichen oder unterbinden.
• Schritt 2: Unterbinden 1310 der Energieversorgung eines zugeordneten elektrischen Verbrauchers mittels der entsprechenden Sicherung, der dieser Verbraucher zugeordnet ist;
• Schritt 3: Herstellen 1315 einer verschlüsselten Datenverbindung 720 zwischen dem Steuerrechner 12 des Fahrzeugs, beispielsweise dem übergeordneten Rechnersystem 12, und einem Rechner 710 eines Dienstanbieters, insbesondere einem Rechnersystem des Automobilherstellers des Fahrzeugs;
• Schritt 4: Authentifizierung 1320 des Fahrzeugs durch den Steuerrechner 12 des Fahrzeugs, beispielsweise durch ein übergeordnetes Rechnersystem 12, beim Rechner 710 des Dienstanbieters, wobei die Authentifizierungsdaten des Fahrzeugs beispielsweise die Daten des Fahrzeugs und/oder des Autoschlüssels und/oder einer SIM-Karte im Fahrzeug und/oder einer fahrzeugspezifischen Passworteingabe oder Passworterzeugung und/oder biometrische Nutzerdaten eines Fahrzeughalters etc. umfassen können;
• Schritt 4: Authentifizierung 1325 des Rechners 710 des Dienstanbieters beim Steuerrechner 12 des Fahrzeugs, beispielsweise bei einem übergeordneten Rechnersystem 12;
• Schritt 5: Ggf. Authentifizierung 1330 der anfordernden Person 730 durch den Steuerrechner 12 des Fahrzeugs, beispielsweise durch das übergeordnete Rechnersystem 12, beim Rechner 710 des Dienstanbieters, wobei die Authentifizierungsdaten beispielsweise die Daten des Fahrzeugs und/oder des personalisierten Autoschlüssels, einer personalisierten SIM-Karte, einer personalisierten Passworteingabe, biometrische Nutzerdaten etc. umfassen können;
• Schritt 6: Erzeugen 1335 oder Bereitstellen eines Freischaltcodes durch den Rechner 710 des Dienstanbieters;
• Schritt 7: Übermitteln 1340 des Freischaltcodes durch den Rechner des Dienstanbieters 710 an den Steuerrechner 12 des Fahrzeugs, beispielsweise an das übergeordnete Rechnersystem 12;
• Schritt 8: Verifikation 1345 der Zulässigkeit und/oder syntaktischen Korrektheit und/oder der situativen Zulässigkeit des Freischaltcodes durch den Steuerrechner 12 des Fahrzeugs, beispielsweise durch das übergeordnete Rechnersystem 12;
• Schritt 9: Ermöglichen 1350 der Energieversorgung eines zugeordneten elektrischen Verbrauchers 220 mittels der entsprechenden Sicherung 225, wenn der Freischaltcode zulässig und/oder syntaktisch Korrekt und/oder der situativ zulässig ist;
• Schritt 10: Übermittlung 1355 von Abrechnungsdaten an einen oder den Rechner 710 eines oder des Dienstanbieters, insbesondere an ein oder das Rechnersystem des Automobilherstellers, wobei eine Speicherinformation im Rechner 710 des Dienstanbieters markiert, dass die Rechnung nicht bezahlt ist;
• Schritt 11: Erstellung 1360 einer Rechnung in Abhängigkeit von den übermittelten Abrechnungsdaten durch einen oder den Rechner 710 eines oder des Dienstanbieters, insbesondere an ein oder das Rechnersystem des Automobilherstellers;
• Schritt 12: Übermittlung 1365 der Rechnung an einem oder den Rechner 710 eines oder des Dienstanbieters, insbesondere an ein oder das Rechnersystem 740 der bestellenden Person 730, oder an die bestellende Person 730;
• Schritt 13: Begleichung 1370 der Rechnung durch einen oder den Rechner 710 eines oder des Dienstanbieters und/oder die anfordernde Person 730;
• Schritt 14: Markierung 1375 der Speicherinformation im Rechner des Dienstanbieters 740, dass die Rechnung bezahlt ist.

13 13 outlines a method 1300 for operating a vehicle (consumer-side feature version). It includes the steps:

• Step 1: Providing 1305 the vehicle, (see also 7 ), the vehicle including device parts 210 and at least one cable harness with line sections 240, 241, 245 and at least one energy source 250, 251 and at least one control computer 12, for example a higher-level computer system 12, and at least two electronic fuses 214, 225. The device parts 220 are electrical loads here. At least one or more energy sources 250, 251 supply at least two of the device parts 210, 220 with electrical energy via the wiring harness with line sections 240, 241, 245. The electronic fuses 214, 225 are preferably inserted into the wiring harness with line sections 240, 241, 245. Each of the electrical fuses 214, 225 is preferably assigned at least one electrical consumer 210, 225, number 1, which is referred to below as the electrical consumer assigned to the respective electronic fuse. A fuse for the fuses 214, 215 can enable or prevent the energy supply to the electrical consumer associated with this fuse, depending on a control signal from the control computer, for example a higher-level computer system 12.
• Step 2: Preventing 1310 the energy supply to an associated electrical consumer by means of the corresponding fuse to which this consumer is assigned;
• Step 3: Establishing 1315 an encrypted data connection 720 between the control computer 12 of the vehicle, for example the superordinate computer system 12, and a computer 710 of a service provider, in particular a computer system of the automobile manufacturer of the vehicle;
• Step 4: Authentication 1320 of the vehicle by the vehicle's control computer 12, for example by a higher-level computer system 12, at the service provider's computer 710, with the vehicle's authentication data being, for example, the data of the vehicle and/or the car key and/or a SIM card in the vehicle and/or a vehicle-specific password entry or password generation and/or biometric user data of a vehicle owner etc.;
• Step 4: authentication 1325 of the service provider's computer 710 with the control computer 12 of the vehicle, for example with a higher-level computer system 12;
• Step 5: If necessary, authentication 1330 of the requesting person 730 by the vehicle's control computer 12, for example by the higher-level computer system 12, with the service provider's computer 710, the authentication data being, for example, the data of the vehicle and/or the personalized car key, a personalized SIM card, a personalized password entry, biometric user data, etc.;
• Step 6: generating 1335 or providing an activation code by the service provider's computer 710;
• Step 7: Transmission 1340 of the activation code by the computer of the service provider 710 to the control computer 12 of the vehicle, for example to the superordinate computer system 12;
• Step 8: Verification 1345 of the admissibility and/or syntactical correctness and/or the situational admissibility of the activation code by the control computer 12 of the vehicle, for example by the superordinate computer system 12;
• Step 9: Enabling 1350 the energy supply of an associated electrical load 220 by means of the corresponding fuse 225 if the activation code is permissible and/or syntactically correct and/or the situation is permissible;
• Step 10: Transmission 1355 of billing data to a computer 710 of a service provider, in particular to a computer system of the automobile manufacturer, with storage information in the service provider's computer 710 marking that the bill has not been paid;
• Step 11: Creation 1360 of an invoice as a function of the transmitted accounting data by a computer 710 of a service provider, in particular to a computer system of the automobile manufacturer;
• Step 12: Transmission 1365 of the bill to a computer 710 of a service provider, in particular to a computer system 740 of the ordering person 730, or to the ordering person 730;
• Step 13: settlement 1370 of the bill by a or the computer 710 of a or the service provider and/or the requesting person 730;
• Step 14: Marking 1375 the storage information in the service provider's computer 740 that the bill is paid.

figure 14

• Schritt 1: Bereitstellen 1405 des Fahrzeugs;
• Schritt 2: Unterbinden 1410 der Energielieferung einer zugeordneten elektrischen Energiequelle 250, 251 in dem z.B. das übergeordnete Rechnersystem 12 dem Rechnerkern 2 der Steuervorrichtung 4 der entsprechenden Sicherung 255, 260 signalisiert, den Leistungsschalter 17 dieser elektronischen Sicherung 255, 260 zu öffnen, woraufhin dieser Rechnerkern 2 dieser Steuervorrichtung 4 dieser zugeordneten elektronischen Sicherung 255,260 den Leistungsschalter 17 dieser Sicherung 255, 260 öffnet;
• Schritt 3: Herstellen 1415 einer verschlüsselten Verbindung 720 zwischen dem Steuerrechner des Fahrzeugs, also dem übergeordneten Rechnersystem 12, und einem Rechner 710 eines Dienstanbieters, insbesondere einem Rechnersystem 710 des Automobilherstellers. Hierbei verwenden das übergeordnete Rechnersystem 12 und das Rechnersystem 710 des Dienstanbieters bzw. des Automobilherstellers vorzugsweise eine PQC-Verschlüsselung;
• Schritt 4: Authentifizierung 1420 des Fahrzeugs durch den Steuerrechner des Fahrzeugs, also durch das übergeordnete Rechnersystem 12, beim Rechner 710 des Dienstanbieters, wobei die Authentifizierungsdaten des Fahrzeugs beispielsweise die Daten des Fahrzeugs und/oder des Autoschlüssels und/oder einer SIM-Karte im Fahrzeug und/oder einer fahrzeugspezifischen Passworteingabe oder Passworterzeugung und/oder biometrische Nutzerdaten eines Fahrzeughalters etc. umfassen können;
• Schritt 5: Authentifizierung 1430 des Rechners 710 des Dienstanbieters beim Steuerrechner des Fahrzeugs, also beim übergeordneten Rechnersystem 12;
• Schritt 6: Authentifizierung 1430 der anfordernden Person 730 durch den Steuerrechner des Fahrzeugs, also durch das übergeordnete Rechnersystem 12, beim Rechner 710 des Dienstanbieters, wobei die Authentifizierungsdaten beispielsweise die Daten des Fahrzeugs und/oder des personalisierten Autoschlüssels, einer personalisierten SIM-Karte, einer personalisierten Passworteingabe, biometrische Nutzerdaten (z.B. Fingerprintsensordaten und/oder Retina-Scanner-Daten und/oder Gesichtserkennungsdaten und/oder Spracheingabedaten etc.) etc. umfassen können;
• Schritt 7: Erzeugen 1435 oder Bereitstellen eines Freischaltcodes insbesondere durch den Rechner 710 des Dienstanbieters. Vorzugsweise hängt der Freischaltcode von den übermittelten Konfigurationsdaten des Fahrzeugs und/oder den übermittelten Authentifizierungsdaten und/oder dem Ort, an dem sich das Fahrzeug befindet und/oder von der anfordernden Person 730 und/oder von dem Halter des Fahrzeugs und/oder von Betriebsdaten des Fahrzeugs etc. ab;
• Schritt 8: Vorzugsweise verschlüsseltes Übermitteln 1440 des Freischaltcodes durch den Rechner 710 des Dienstanbieters an den Steuerrechner des Fahrzeugs, also an das übergeordnete Rechnersystem 12;
• Schritt 9: Verifikation 1445 der Zulässigkeit und/oder syntaktischen Korrektheit und/oder der situativen Zulässigkeit des Freischaltcodes durch den Steuerrechner 12 des Fahrzeugs, also durch das übergeordnete Rechnersystem 12. Dies soll verhindern, dass ein anderes Rechnersystem als das Rechnersystem 710 eines zulässigen Dienstleisters einen Freischaltcode erfolgreich in das System des Fahrzeugs einspeist;
• Schritt 10: Ermöglichen 1450 der Energielieferung einer zugeordneten elektrischen Energiequelle 250, 251 mittels der entsprechenden, zugeordneten Sicherung 255, 260. Bei erfolgreicher Verifikation des Freischaltcodes in Schritt 10 schließt vorzugsweise der Rechnerkern 2 der Steuervorrichtung 4 der zugehörigen Sicherung 255, 260 den Leistungsschalter 17 dieser Sicherung 255, 260, sodass eine vorausgehende Energiequelle 250, 251 ein nachfolgendes Versorgungsteilnetz und/oder einen nachfolgenden Versorgungsleitungsabschnitt und/oder einen nachfolgenden elektrischen Verbraucher mit elektrischer Energie versorgen kann;
• Schritt 11: Vorzugsweise erfassen Messmittel und/oder Sicherungen in dem Versorgungsnetzwerk 200 Messwerte und Parameter, die der Rechnungsersteller für die Leistungsabrechnung benötigt. In diesem Schritt 11 erfolgt bevorzugt eine Übermittlung 1455 von Abrechnungsdaten durch das übergeordnete Rechnersystem 12 an einen oder den Rechner 710 eines oder des Dienstanbieters, insbesondere an ein oder das Rechnersystem des Automobilherstellers, wobei eine Speicherinformation im Rechner 710 des Dienstanbieters markiert, dass die Rechnung noch nicht bezahlt ist;
• Schritt 12: Erstellung 1460 einer Rechnung in Abhängigkeit von den übermittelten Abrechnungsdaten durch einem oder den Rechner 710 eines oder des Dienstanbieters, insbesondere an ein oder das Rechnersystem des Automobilherstellers;
• Schritt 13: Übermittlung 1465 der Rechnung, insbesondere durch einen oder den Rechner 710 eines oder des Dienstanbieters an einem oder den Rechner 750 eines oder des Dienstanbieters, insbesondere an ein oder das Rechnersystem der bestellenden Person, oder an die bestellende Person 730;
• Schritt 14: Begleichung 1470 der Rechnung durch einem oder den Rechner 750 eines oder des Dienstanbieters und/oder die anfordernde Person 730;
• Schritt 15: Markierung 1475 der Speicherinformation im Rechner 710 des Dienstanbieters, dass die Rechnung bezahlt ist;

14 also shows another simplified method 1400 for operating a vehicle by activating energy sources in the vehicle. The procedure includes the steps:

• Step 1: providing 1405 the vehicle;
• Step 2: Preventing 1410 the energy supply of an associated electrical energy source 250, 251 in which, for example, the higher-level computer system 12 signals the computer core 2 of the control device 4 of the corresponding fuse 255, 260 to open the circuit breaker 17 of this electronic fuse 255, 260, whereupon this computer core 2 of this control device 4 of this associated electronic fuse 255,260 opens the circuit breaker 17 of this fuse 255, 260;
• Step 3: Establishing 1415 an encrypted connection 720 between the control computer of the vehicle, ie the superordinate computer system 12, and a computer 710 of a service provider, in particular a computer system 710 of the automobile manufacturer. In this case, the higher-level computer system 12 and the computer system 710 of the service provider or of the automobile manufacturer preferably use PQC encryption;
• Step 4: Authentication 1420 of the vehicle by the vehicle's control computer, i.e. by the higher-level computer system 12, at the service provider's computer 710, with the vehicle's authentication data being, for example, the data of the vehicle and/or the car key and/or a SIM card in the vehicle and/or a vehicle-specific password input or password generation and/or biometric user data of a vehicle owner etc.;
• Step 5: Authentication 1430 of the service provider's computer 710 with the vehicle's control computer, ie with the superordinate computer system 12;
• Step 6: Authentication 1430 of the requesting person 730 by the vehicle's control computer, i.e. by the higher-level computer system 12, at the service provider's computer 710, the authentication data being, for example, the data of the vehicle and/or the personalized car key, a personalized SIM card, a personalized password entry, user biometric data (e.g., fingerprint sensor data and/or retina scanner data and/or facial recognition data and/or voice input data, etc.), etc.;
• Step 7: Generation 1435 or provision of an activation code, in particular by the computer 710 of the service provider. The activation code preferably depends on the transmitted configuration data of the vehicle and/or the transmitted authentication data and/or the location at which the vehicle is located and/or the requesting person 730 and/or the owner of the vehicle and/or operating data of the vehicle etc.;
• Step 8: preferably encrypted transmission 1440 of the activation code by the computer 710 of the service provider to the control computer of the vehicle, ie to the superordinate computer system 12;
• Step 9: Verification 1445 of the admissibility and/or syntactical correctness and/or the situational admissibility of the activation code by the control computer 12 of the vehicle, i.e. by the higher-level computer system 12. This is intended to prevent a computer system other than the computer system 710 of an authorized service provider from Successfully feeds the activation code into the vehicle's system;
• Step 10: Enabling 1450 the energy supply of an assigned electrical energy source 250, 251 by means of the corresponding, assigned fuse 255, 260. If the activation code is successfully verified in step 10, the computer core 2 of the control device 4 of the associated fuse 255, 260 preferably closes the circuit breaker 17 of this fuse 255, 260, so that a preceding energy source 250, 251 can supply electrical energy to a subsequent partial supply network and/or a subsequent supply line section and/or a subsequent electrical consumer;
• Step 11: Measuring devices and/or fuses in the supply network 200 preferably record measured values and parameters that the biller requires for the service billing. In this step 11, the higher-level computer system 12 preferably transmits billing data 1455 to a computer 710 of a service provider, in particular to a computer system of the automobile manufacturer, with storage information in the service provider's computer 710 marking that the bill has not yet been received is not paid;
• Step 12: Creation 1460 of an invoice as a function of the transmitted accounting data by a computer 710 of a service provider, in particular to a computer system of the automobile manufacturer;
• Step 13: Transmission 1465 of the invoice, in particular by a computer 710 of a service provider to a computer 750 of a service provider, in particular to a computer system of the ordering person, or to the ordering person 730;
• Step 14: settlement 1470 of the bill by a or the computer 750 of a or the service provider and/or the requesting person 730;
• Step 15: marking 1475 the storage information in the service provider's computer 710 that the bill is paid;

figure 15

15 largely corresponds to the 8th . Now, however, the supply network should be divided into a first supply sub-network and a second supply sub-network.

In the first partial supply network, a first energy source 250 supplies an output 485 of the fuse box 400 for supplying a consumer with electrical energy via the third supply line section 245 and a second additional fuse 810 . By way of example, we assume here that the first energy source 250 supplies an output voltage in a range from 45V to 80V.

In the second partial supply network, a second energy source 251 supplies electrical energy to a consumer 830 via the fourth supply line section 246 and an electronic fuse 825 and via a line section 1505 to be protected and a further fuse 805 . For example, we assume here that the second power source 251 supplies an output voltage in a range from 700V to 900V.

The output 485 of the fuse box 400 for supplying a consumer and the line section 1505 to be secured together form a cable harness 1515. In the line section 1505 to be secured, the electric current 1525 flows through the line section 1505 to be secured. The fuse 825 preferably has a current measuring device 1520, which is line section 1505 to be secured is inserted. Typically, the fuse 825 uses its power switch 17 as a current measuring device 1520. The computer core 2 of the control device 4 of the fuse 825 preferably uses the analog-to-digital converter 570 of the control device 4 of the fuse 825 in order to measure the potentials at the connections 26, 27, 28 of the circuit breaker 17 and/or to detect the voltage drop across the shunt resistor 24 and to conclude the current 29 through the circuit breaker 17 from this. So if we are talking here about the fact that the current measuring device 1520 is inserted into the line section 1505 to be protected, then such constructions of circuit breaker 17, auxiliary circuit breaker 23 and shunt resistor in combination with an analog-to-digital converter 570 are expressly included and are considered to be inserted in the line section 1505 to be secured. Such devices are therefore suitable for determining and thus detecting the value of the electric current 1525 through the line section 1505 to be protected.

In the example of 15 it is assumed that an arc 1510 is faulty between the output 485 of the fuse box 400 for supplying a load and the absi captive line section 1505 has formed. The proposed supply network 200 should detect this arc. In this regard, the document presented here refers to the following 16 .

figure 16

16 shows a schematically simplified and exemplary method 1600 for detecting non-extinguishing arcs 1510 in the wiring harness 1515 of a vehicle. The wiring harness 1515 includes various line sections 485.1505, which are intended to be at different electrical potentials, for example. The document presented here also refers to the previous one 15 .

In the wiring harness 1510, for example, voltages of more than 40V, for example 48V and/or 800V, should occur at least temporarily between the line sections 485, 1505. A non-extinguishing arc 1510 therefore represents a fire hazard that should not be underestimated. In line sections 245, 246,485,1505 of the cable harness 1515, electronic fuses 810, 825, 805 are inserted as an example, which prevent the current flow in individual or several line sections 245, 246,485,1505 of the Wiring harness 1515 can be interrupted by means of their circuit breakers 17. The exemplary wire harness 1515 of 16 is divided into line sections 485, 1505 to be secured. At least one electronic fuse 825 of the electronic fuses is assigned to a line section 1515 of these line sections 485, 1515—hereinafter referred to as line section 1505 to be protected—which can interrupt the flow of current in this line section 1505 of line sections 485, 1505 that is assigned to it. A control device 12 of the vehicle, for example the higher-level computer system 12, controls this fuse 825 of the electronic fuses 810, 825, 805 by means of data commands in bit-stream packets BP via the fuse data bus 9. The higher-level computer system 12 transmits commands to the computer core 2 of the Control device 4 of this fuse 825.

• In einem ersten Schritt 1606 erfasst der Rechnerkern 2 der Steuervorrichtung vorzugsweise mittels des Analog-zu-Digital-Wandlers 570 der Steuervorrichtung 4 der Sicherung 825 und des Shunt-Widerstands 24 oder mittels anderer Messmittel 1520 den zeitlichen Verlauf des elektrischen Stroms 1525 durch den abzusichernden Leitungsabschnitt 1505 für einen Zeitabschnitt. Der Rechnerkern 2 der Steuervorrichtung 4 der Sicherung 825 und/oder das übergeordnete Rechnersystem 12 erzeugen vorzugsweise einen zugehörigen Werteverlauf 1610 des erfassten Stromwerts des elektrischen Stroms 1525 durch den abzusichernden Leitungsabschnitt 1505 dieses Zeitabschnitts. Hierzu nutzt der Rechnerkern 2 der Steuervorrichtung 4 der Sicherung 825 insbesondere die besagte Strommessvorrichtung 1520, die in den Leitungsabschnitt 1505 eingefügt ist. Insbesondere kann die Strommessvorrichtung 1520, die dem abzusichernden Leitungsabschnitt 1505 zugeordnete Sicherung 825 oder eine Teilvorrichtung der dem abzusichernden Leitungsabschnitt 1505 zugeordneten Sicherung 825 sein. Beispielsweise kann es sich um den besagten Shunt-Widerstand 24 handeln. Insbesondere dieses Erfassen 1605 und/oder das Erzeugen des zugehörigen Werteverlaufs 1610 dieses Zeitabschnitts erfolgen bevorzugt mittels eines Rechnerkerns 2 einer Steuervorrichtung 4 einer elektronischen Sicherung, die von der elektronischen Sicherung 825 verschieden sein kann, und/oder mittels einer übergeordnete Steuervorrichtung 12 und/oder mittels eines übergeordneten Rechnersystems 12, die über einen Datenbus 9 mit dem Rechnerkern 2 der Steuervorrichtung 4 der Sicherung 825 kommunizieren.

For example, the procedure proposed in the document presented here includes the following steps:

• In a first step 1606, the computer core 2 of the control device preferably uses the analog-to-digital converter 570 of the control device 4, the fuse 825 and the shunt resistor 24 or other measuring means 1520 to record the time course of the electric current 1525 through the line section to be protected 1505 for a period of time. The computer core 2 of the control device 4 of the fuse 825 and/or the higher-level computer system 12 preferably generate an associated value profile 1610 of the detected current value of the electric current 1525 through the line section 1505 to be protected of this time segment. For this purpose, the computer core 2 of the control device 4 of the fuse 825 uses in particular the said current measuring device 1520, which is inserted in the line section 1505. In particular, the current measuring device 1520 can be the fuse 825 assigned to the line section 1505 to be protected or a partial device of the fuse 825 assigned to the line section 1505 to be protected. For example, it can be the said shunt resistor 24 . In particular, this detection 1605 and/or the generation of the associated value curve 1610 of this time segment is preferably carried out by means of a computer core 2 of a control device 4 of an electronic fuse, which can be different from electronic fuse 825, and/or by means of a higher-level control device 12 and/or by means of a higher-level computer system 12, which communicate with the computer core 2 of the control device 4 of the fuse 825 via a data bus 9.

The higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the electronic safety device, which can be identical to the electronic safety device 825, then preferably carry out a spectral analysis 1615 of the recorded value curve 1610 of this time segment as a function of the generated time profile 1610 of the time profile of the electric current 1525 through the line section 1505 to be protected. The higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the electronic fuse, which can be identical to the electronic fuse 825, thereby generate a spectral analysis result 1620. The higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core 2 of the control device 4 of the electronic fuse, which can be identical to the electronic fuse 825, via the data bus (9) among one another and/or with the computer core 2 of the control device 4 of the electronic fuse 828 communicate;

The higher-level computer system 12 and / or the higher-level control device 12 of the vehicle and / or the computer core of the control device 4 of the electronic fuse with the electronic National backup 825 can be identical, then use 1625 these values of the spectral analysis result 1620 of the recorded value profile 1610 of this time segment and/or values derived from it as a current feature vector 1630 for a pattern recognition method that the higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and /or the computer core of the control device 4 of the electronic fuse, which can be identical to the electronic fuse 825, then preferably execute.

To execute the pattern recognition method, the higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the electronic security device 1635, which can be identical to the electronic security device 825, form the current feature vector 1630 of the values of the spectral analysis result 1620 of the detected value curve 1610 of this time period to predefined feature vectors 1640 of spectral base structures from a stored set of predefined feature vectors of spectral base structures 1650 in a base structure database 1645. The higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the electronic safety device, which can be identical to the electronic safety device 825, manage this particularly preferably by means of a scalar product formation as follows: The higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the electronic fuse, which can be identical to electronic fuse 825, generate from the feature vector 1640 a spectral parameter set 1655. The spectral parameter set 1655 is composed of similarity values. Each similarity value of the parameter set 1655 reflects the similarity between the feature vector 1640 and between a predefined feature vector 1640 of a basic structure database 1635 and the current feature vector 1640. Each of the predefined feature vectors 1640 of the basic structure database 1635 is a feature vector 1640 which a basic time structure of a basic time profile of the measured values of the electric current 1525 would generate in the processing described above. Such a basic structure can be, for example, the time profile of a current spike in the value profile of the current 1525, as would occur with an arc. However, these can also be normal events as they occur in error-free normal operation. Each predefined feature vector 1640 thus preferably corresponds exactly to a spectral base structure of a set of predefined feature vectors 1640 spectral base structures 1625 of the base structure database 1635 stored in the base structure database 1635. The higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the Electronic fuse, which can be identical to the electronic fuse 825, now preferably calculate a similarity value for each pair of a feature vector 1640 of the basic structure database 1635 and the current feature vector 1640. Each of these similarity values is then a value of the spectral parameter set 1655. The higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the electronic fuse, which can be identical to the electronic fuse 825, preferably calculate a such a similarity value by forming a scalar product between a feature vector 1650 of the basic structure database 1635 on the one hand and the current feature vector on the other. The higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the electronic fuse, which can be identical to the electronic fuse 825, preferably calculate this scalar product for predefined, in particular all predefined, feature vectors of spectral base structures from the stored set of predefined feature vectors of spectral basic structures 1625 in the basic structure database 1635.

The higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the electronic safety device, which can be identical to the electronic safety device 825, then preferably evaluate 1660 the spectral parameter set 1655 thus obtained and generate an evaluation result from it 1665.

The higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the electronic safety device, which can be identical to the electronic safety device 825, preferably execute a neural network model for this purpose. The similarity values of the spectral parameter set 1655 and/or other values, such as the current feature vector, preferably form the input values of the neural network model. The output values of the neural network model preferably represent the evaluation result. The higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the electronic fuse, which can be identical to the electronic fuse 825, can also be derived from the Starting values of the neural network model the Bewer derive the result. The higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the electronic safety device, which can be identical to the electronic safety device 825, therefore carry out this assessment 1660, for example by using a neural network model. The evaluation result 1665 of the evaluation 1660 thus typically depends on the output values of the neural network model.

Depending on the evaluation result 1665, the higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the electronic fuse, which can be identical to the electronic fuse 825, interrupt 1670 the current flow 1525 through the line section to be protected 1505. The higher-level computer system 12 and/or the higher-level control device 12 of the vehicle and/or the computer core of the control device 4 of the electronic fuse, which can be identical to the electronic fuse 825, signal this via the data bus 9 to the computer core 2 of the control device 4 of the Electronic Fuse 825 that the computer core 2 of the control device 4 of the electronic fuse 825 should open the circuit breaker 17 of the electronic fuse 825 if the evaluation result 1665 of the spectral parameter set 1640 corresponds to or suggests the presence of a short circuit or a plasma discharge 1510, in particular an arc .

The computer core 2 of the control device 4 of the electronic fuse 825 then typically opens the circuit breaker 17 of the electronic fuse 825, which stops the supply of energy and extinguishes the arc.

figure 17

The 17 essentially corresponds to the 7 , the third supply line section 245 being separated into the third supply line section 245 and the fourth supply line section 246 here.

The first energy source 250 accordingly supplies the first device part 210 of the supply network 200 and the fifth device part 220 of the supply network 200 and the sixth device part 221 of the supply network 200 via the third supply line section 245 and the first device part 210 of the supply network 200 and the subsequent first supply line section 240 Energy. For example, the first energy source 250 can supply a first operating voltage.

The first energy source 250 accordingly supplies the second device part 211 of the supply network 200 and the seventh device part 222 of the supply network 200 and the eighth device part 223 of the supply network 200 via the third supply line section 245 and the second device part 211 of the supply network 200 and the subsequent fifth supply line section 242 Energy.

The second energy source 251 accordingly supplies the third device part 212 of the supply network 200 and the ninth device part 224 of the supply network 200 and the tenth device part 225 of the supply network 200 via the fourth supply line section 246 and the third device part 212 of the supply network 200 and the subsequent second supply line section 241 Energy.

For example, the second energy source 251 can supply a second operating voltage. The second operating voltage can deviate from the first operating voltage. In this context, the document presented here refers to the exemplary descriptions of the exemplary 15 and 16 for detecting an arc between a high-voltage supply network and a low-voltage supply network.

The second energy source 251 accordingly supplies the fourth device part 213 of the supply network 200 and the eleventh device part 226 of the supply network 200 and the twelfth device part 226 of the supply network 200 via the fourth supply line section 246 and the fourth device part 213 of the supply network 200 and the subsequent sixth supply line section 243 Energy.

The control devices 4 of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) are preferably each equipped with two data interfaces 10, 610 inserted into the data bus 9. In contrast to 7 the data bus 0 is now, for example, not closed in the form of a ring. The computer cores 2 of the control devices 4 of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) are in accordance with a daisy chain chain arranged one behind the other in the data bus 9. This has the advantage that the computer cores 2 of the control devices 4 of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) after the system start of the supply network 200 or at the command of the higher-level computer system 12, which typically acts as bus master, can carry out an auto-addressing method in order to generate a logical security address from their physical position within this data bus chain of the data bus 9.

To assign a backup address, the higher-level computer system 12 preferably sends to all computer cores 2 of the control devices 4 of the backups (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the subdevices (210 to 213 and 220 to 223 and 230 to 233). and 250 and 255) a data message in the form of a predefined bit stream packet BP, which preferably sends each of the computer cores 2 of the control devices 4 of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 through 213 and 220 through 223 and 230 through 233 and 250 and 255) to classify its own state as having no valid save address.

All computer cores 2 of the control devices 4 of all fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) preferably give such a command, which they receive via the data bus downstream, bus master-side data interface 10 of the control device 4 of their fuse via the second data bus upstream data bus interface 610 to the data bus upstream following computer core 2 of the control device of the data bus upstream immediately following fuse (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) so that all computer cores 2 of all control devices 4 of all fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) ultimately go to this initial state without a valid backup address. All circuit breakers 17 of all fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) are preferably opened after this initialization, so that no uncontrolled energy consumption and/or no uncontrolled energy consumption can take place. The fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the partial devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) particularly preferably have their own power supply via a separate supply voltage line 6 and a reference potential line 201, which can be identical to the body ground, or via a temporary energy supply via an energy reserve 8 per fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) so that the supply network 200 manages the addressing of the logical fuse addresses for the individual fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) without problems even with open circuit breakers 17 of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255).

At least, however, the backup of the backups (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) that the higher-level computer system 12 in Data bus 9 is closest, be supplied with electrical energy, so that the first step of address assignment of the fuse address to this fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255).

In the next step, the higher-level computer system 12 then assigns a special data message in the form of a special bit stream packet BP via the data bus 9 to the computer core 2 of the control device 4 of this fuse 256, which is closest to the higher-level computer system 12 in the data bus 9. a first backup address. The computer core 2 of the control device 4 of this fuse 256 then marks its fuse address as a valid fuse address. The computer core 2 of the control device 4 of the fuse 256 should then preferably close the circuit breaker 17 of this fuse 256 eat. The second energy source 251 then supplies the third device part 212 and the fourth device part 213 of the supply network with electrical energy via the fourth supply line section 246 .

The computer core 2 of the control device 4 of the fuse 256 then preferably registers with the higher-level computer system 12 with its new, valid fuse address. As a result, the higher-level computer system 12 then knows that the computer core 2 of the control device 4 of the nearest fuse 256 has received a valid fuse address.

In the next step, the higher-level computer system 12 assigns a fuse address to the computer core 2 of the control device 4 of the fuses of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) which is closest to the higher-level computer system 12 in the data bus 9 and whose computer core 2 of its control device 4 of this backup does not yet have a valid backup address. In the next step, the higher-level computer system 12 sends a new special data message in the form of a special bit stream packet BP via the data bus 9. The computer cores 2 of the control devices 4 of those fuses of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255), which have already received a valid security address from the higher-level computer system 12, receive this data message from the higher-level computer system 10 via their first data interface 10 and ignore the content of this data message from the higher-level computer system 12 and forward this data message preferably via their second data bus interface 610 upstream of the data bus to the subsequent computer core 2 of the control device 4 of the subsequent fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255).

If the computer core 2 of a control device 4 has a backup of the backups (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the subdevices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) such a receives a data message and does not yet have a valid backup address, the computer core 2 of the control device 4 generates this backup of the backups (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the subdevices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) using information content of the received data message a security address, which then the valid security address of the computer core 2 of the control device 4 of this backup of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255). The computer core 2 of the control device of this backup then stores information that its backup address is a valid backup address, which means that the computer core 4 of the control device 4 of this backup then has a valid backup address at its disposal. The computer core 2 of the control device 4 of this fuse 256 thus marks its fuse address as a valid fuse address. The computer core 2 of the control device 4 of this fuse 256 should then preferably close the circuit breaker 17 of this fuse 256 . The energy source preceding this fuse in the supply network then supplies the subsequent device parts of the subsequent supply sub-network of the supply network 200 with electrical energy via the subsequent supply sub-network. Preferably, the computer core 2 of the control device 4 of this backup that has just been addressed then registers with the higher-level computer system 12 with its new, valid backup address. As a result, the higher-level computer system 12 then knows that the computer core 2 of the control device 4 of this fuse just addressed has also received a valid fuse address. This newly addressed fuse then behaves like the other fuses whose computer cores 2 of these control devices of these fuses have already received a valid fuse address.

The higher-level computer system 12 continues this process until all computer cores 2 of all control devices 4 of all fuses of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) have received a valid backup address.

The computer cores 2 of the control devices 4 of the fuses can preferably provide information about the device parts 210 to 213 and 220 to 223 and 230 to 233 and 255 and 260). Such information is preferably located in the non-volatile memories of the control devices 4 of these fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255 ). The computer cores 2 of the control devices Gen 4 of these backups (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) can send this information together with their backup address to the higher-level computer system Make 12 in the data bus 9 available. The higher-level computer system 12 can then check whether the arrangement and configuration of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255 ) and the device parts (210 to 213 and 220 to 223 and 230 to 233 and 250 and 251) correspond to an expected arrangement and/or one determined by a server 710 of a service provider and/or automobile manufacturer. If this is not the case, the higher-level computer system 12 can, for example, first send a corresponding message via an encrypted data line 720 to the service provider's server 710, for example, and/or initiate a display on a user input device 740 and/or create a memory entry for later retrieval in a workshop in a non-volatile memory of the higher-level computer system 12 and/or individual power switches 17 of individual fuses of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 292 and 293) of the sub-devices (210 to 213 and 220 to 223 and 230 to 233 and 250 and 255) in the supply network 200 and/or change operating parameters before device parts in the supply network 200.

figure 18

18 provides a schematically simplified example of a method 1800 for operating a supply network 1700 of 17 represent.

In the two subsequent sections, the document presented here describes a first method in which the fuse 255 of an energy source 250 balances the supply network 1700 . In a second section, the document presented here describes a second possible method 1800 corresponding to the aforementioned method, in which the fuses 214, 215 of downstream device parts 210, 211 balance the supply network 1700 in the vehicle.

• Schritt 1: Das übergeordnete Rechnersystem 12 und/oder ein Rechnerkern 2 einer Steuervorrichtung 4 einer Sicherung der Sicherungen (214 bis 217 und 225 bis 228 und 235 bis 238 und 255 und 260) überwacht den Gesamtenergiebedarf von Vorrichtungsteilen (210, 211, 220, 221, 222, 223) der Vorrichtungsteile des Fahrzeugs.

The supply network 1700 has line sections 245 and energy-consuming device parts 210, 211 of the supply network 1700, which supplies the supply network 1700 with electrical energy via a line section 245. The supply network 1700 also includes energy-supplying device parts 250 of the vehicle, which feed energy into the supply network 1700 . Supply network 1700 supplies energy-consuming device parts 210, 211 of supply network 1700 of the vehicle with electrical energy from supply network 1700 via at least one line section 245. Energy-consuming device parts 210 can in turn supply electrical energy to another device part 220 of the vehicle via a further line section 240. The energy-consuming device parts 210 each preferably have an electronic fuse 214 . The electronic fuse 255 of a device part 250 can prevent the supply of this energy-consuming device part 210 and the other device parts 220, 221 supplied with electrical energy by this energy-consuming device part 210. This can be done in such a way that the computer core 2 of the control device 4 of this fuse 255 of this device part 250 opens the circuit breaker 17 of this fuse 255 in order to switch on the supply of this energy-consuming device part 210 and the other device parts 220, 221 supplied with electrical energy by this energy-consuming device part 210 stop. The procedure described here in the document presented here then comprises the steps:

• Step 1: The higher-level computer system 12 and/or a computer core 2 of a control device 4 of a backup of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) monitors the total energy requirement of device parts (210, 211, 220, 221 , 222, 223) of the device parts of the vehicle.

For this purpose, the higher-level computer system 12 and/or the computer core 2 of the control device 4 of that backup of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) records 1805 the respective expected current and/or future energy requirements of these device parts (210 , 211, 220, 221, 222, 223) by inquiries to computer cores 2 of the control devices 4 of the fuses of these device parts (210, 211, 220, 221, 222, 223) and/or other computer cores of these device parts (210, 211, 220 , 221, 222, 223) which are connected to the data bus 9. Preferably determined from the responses of the computer cores 2 of the control devices 4 of the fuses of these device parts (210, 211, 220, 221, 222, 223) and/or from the responses of the other computer cores of these device parts (210, 211, 220, 221, 222, 223), which are connected to the data bus 9, the higher-level computer system 12 and/or the computer core 2 of the control device 4 of that backup of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) the respective expected, current and/or future total energy requirement of these device parts (210, 211, 220 , 221, 222, 223).

The higher-level computer system 12 and/or the computer core 2 of the control device 4 preferably compares 1810 that backup of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) of the total energy requirement of these device parts (210, 211, 220, 221, 222, 223) of the vehicle with an upper energy consumption threshold.

The supply network 1700 react in two different ways when the upper energy consumption threshold value is exceeded. Firstly, the supply network 1700 can increase the energy provided and/or generated and/or secondly, it can reduce the energy demand of the consumers in the supply network 1700 .

If the determined total energy requirement is above the upper energy consumption threshold value, the higher-level computer system 12 and/or the computer core 2 of the control device 4 of that backup of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can supply a first energy-consuming device part 210 with electrical energy and/or the other device parts 220, 221 supplied with electrical energy by this first device part 210 1820. If the determined total energy requirement is above the upper energy consumption threshold value, the higher-level computer system 12 and/or the computer core 2 of the control device 4 can prevent that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) increase the energy supply capability of an energy source 250 if possible, for example by reparameterizing the energy source 250 1820.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 can take these measures for that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) if the determined total energy requirement of all device parts (210, 211, 220, 221, 222, 223) is or could be above the upper energy consumption threshold value or the operating state and/or the driving situation indicate this, in particular for the future.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can supply a first energy-consuming device part 210 with electrical energy and/or the prevent 1820 other device parts 220, 221 supplied with electrical energy from this first device part 210 by using a data message via the data bus to a computer core 2 of a control device 4 of a fuse 255 causing the computer core 2 of the control device 4 of this fuse 255 to switch the circuit breaker 17 of this fuse 255 of the relevant device part 250 to open.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can calculate the determined total energy requirement of these device parts (210, 211, 220, 221, 222 , 223) of the vehicle with a lower energy consumption threshold value 1830.

As before, the supply network can react to a drop below the lower energy consumption threshold in two different ways. Firstly, the supply network 1700 can reduce the energy provided and/or generated and/or secondly, the energy demand of the consumers in the supply network 1700 can be increased.

If the determined total energy requirement is below the lower energy consumption threshold value, the higher-level computer system 12 and/or the computer core 2 of the control device 4 of that protection of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can supply a first energy-consuming device part 210 with electrical energy and/or the other device parts 220, 221 supplied with electrical energy by this first device part 210 enable 1840. If the determined total energy requirement is below the lower energy consumption threshold value, the higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse can of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) reduce the energy supply capability of an energy source 250 if possible, for example by reparameterizing the energy source 250 1840.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 can take these measures for that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) if the determined total energy requirement of all device parts (210, 211, 220, 221, 222, 223) is or could be below the lower energy consumption threshold value or the operating state and/or the driving situation indicate this, in particular for the future.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can supply a first energy-consuming device part 210 with electrical energy and/or the further device parts 220, 221 supplied with electrical energy from this first device part 210 enable 1840 by using a data message via the data bus to a computer core 2 of a control device 4 of a fuse 255 to cause the computer core 2 of the control device 4 of this fuse 255 to switch the circuit breaker 17 of this fuse 255 of the relevant device part 250 to close.

Preferably, the energy supply of the device parts 220, 221 of the supply network 1700 of the vehicle, the energy supply of which may be suppressed, has a lower priority than the energy supply of the device parts 222, 223 of the supply network 1700 vehicle, the energy supply of which may not be suppressed.

Preferably, the energy supply of the device parts 222, 223 of the supply network 1700 of the vehicle, the energy supply of which may be improved, has a higher priority than the energy supply of the device parts 220, 221 of the supply network 1700 vehicle, the energy supply of which may not be improved.

In the previous section, the document presented here describes a method in which the fuse 255 of an energy source 250 performs the balancing of the supply network 1700 . A possible method 1800 corresponds to the above method, in which the fuses 214, 215 of downstream device parts 210, 211 balance the supply network 1700 in the vehicle.

• Das übergeordnete Rechnersystem 12 und/oder der Rechnerkern 2 der Steuervorrichtung 4 jener Sicherung der Sicherungen (214 bis 217 und 225 bis 228 und 235 bis 238 und 255 und 260) überwachen den Gesamtenergiebedarf von Vorrichtungsteilen (210, 211, 220, 221, 222, 223) der Vorrichtungsteile des Fahrzeugs. Hierzu erfassen 1805 das übergeordnete Rechnersystem 12 und/oder der Rechnerkern 2 der Steuervorrichtung 4 jener Sicherung der Sicherungen (214 bis 217 und 225 bis 228 und 235 bis 238 und 255 und 260) den Energiebedarf dieser Vorrichtungsteile (210, 211, 220, 221, 222, 223) durch Anfragen bei den Rechnerkernen 2 der Steuervorrichtungen 4 der Sicherungen (214 bis 217 und 225 bis 228 und 235 bis 238 und 255 und 260) dieser Vorrichtungsteile und/oder durch Anfragen bei anderen an den Datenbus 9 angeschlossenen Rechnerkernen über den Datenbus 9. Das übergeordnete Rechnersystem 12 und/oder der Rechnerkern 2 der Steuervorrichtung 4 jener Sicherung der Sicherungen (214 bis 217 und 225 bis 228 und 235 bis 238 und 255 und 260) ermitteln auf Basis der Antworten der Rechnerkerne 2 der Steuervorrichtungen 4 der Sicherungen (214 bis 217 und 225 bis 228 und 235 bis 238 und 255 und 260) dieser Vorrichtungsteile und/oder der Antworten der anderen an den Datenbus 9 angeschlossenen Rechnerkernen, die das übergeordnete Rechnersystem 12 und/oder die der Rechnerkern 2 der Steuervorrichtung 4 jener Sicherung der Sicherungen (214 bis 217 und 225 bis 228 und 235 bis 238 und 255 und 260) über den Datenbus 9 erhalten, den Gesamtenergiebedarf dieser Vorrichtungsteile (210, 211, 220, 221, 222, 223).

As before, this second method 1800 for balancing a supply network 1700 of a vehicle is again a method 1800 for operating a supply network 1700. For this second method 1800, the supply network 1700 again has line sections 245, 240, 241. The supply network 1700 again comprises energy-consuming device parts 210, 211 of the supply network 1700, which supply the supply network 1700 with electrical energy via a line section 245. The supply network 1700 also includes again energy-supplying device parts 250 of the vehicle, which feed energy into the supply network 1700 . The supply network 1700 supplies energy-consuming device parts 210, 211 of the vehicle with electrical energy from the supply network 1700 via at least one line section 245. As before, energy-consuming device parts 210, 211 can again supply a further device part 220, 221, 222, 223 via a further line section 240, 241 of the vehicle with electrical energy. These energy-consuming device parts 210, 211 each have an electronic fuse 214, 215, which is preferably connected to the data bus 9. The electronic fuse 255 of a device part 250 can now preferably prevent the supply of this energy-consuming device part 210, 211 and the other device parts 220, 221, 222, 223 supplied with electrical energy by this device part 210, 211. The proposed second method then comprises the following steps:

• The higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) monitor the total energy requirement of device parts (210, 211, 220, 221, 222, 223) of the device parts of the vehicle. For this purpose, the higher-level computer system 12 and/or the computer core 2 of the control device 4 record 1805 the energy requirements of these device parts (210, 211, 220, 221, 222, 223) by inquiries to the computer cores 2 of the control devices 4 of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) of these device parts and/or by inquiries to other computer cores connected to the data bus 9 via the data bus 9. The higher-level computer system 12 and/or the computer core 2 of the control device 4 determine that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) on the basis of the responses of the computer cores 2 of the control devices 4 of the fuses ( 214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) of these device parts and/or the responses of the other computer cores connected to the data bus 9, which the higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) via the data bus 9, the total energy requirement of these device parts (210, 211, 220, 221, 222, 223).

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can then use this determined total energy requirement of these device parts (210, 211, 220, 221, 222, 223) of the vehicle with an upper energy consumption threshold value 1810.

If the determined total energy requirement is above the upper energy consumption threshold value, the higher-level computer system 12 and/or the computer core 2 of the control device 4 of that protection of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can supply an energy-consuming device part of these device parts with electrical energy and the other device parts supplied with electrical energy by this device part prevent 1820. The higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) prevent 1820 this energy supply if the total energy requirement of all device parts is or could be above the upper energy transport threshold value for this line section or the operating state and/or the driving situation indicates this.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can, for example, by means of a suitable data message to the computer core 2 of the control device 4 of the fuse 214 of such a device part 210 signal that the computer core 2 of the control device 4 of this fuse 214 should stop the energy supply of the downstream supply part network 240, 220, 221 by opening the circuit breaker 17, so that the total energy requirement of the supply network 1700 falls by the energy requirement of the shed device parts 220, 221 .

If the determined total energy requirement is above the upper energy consumption threshold value, the higher-level computer system 12 and/or the computer core 2 of the control device 4 of that protection of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can switch the energy supply of an energy source into the affected sub-supply network of the supply network 1700 and in the other sub-supply networks supplied with electrical energy by this device part increase 1820. The higher-level computer system 12 and/or the computer core 2 of the control device 4 of that backup of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) increase 1820 this energy supply if the total energy requirement of all supplied device parts is or could be above the upper energy transport threshold value for this line section or the operating state and/or the driving situation indicates this.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can, for example, by means of a suitable data message to the computer core 2 of the control device 4 of the fuse 214 of such a device part 210 signal that the computer core 2 of the control device 4 of this fuse 214 should enable the power supply to the subsequent supply part network 240, 220, 221 by closing the circuit breaker 17, so that the energy source 250 can cover the total energy requirement of the subsequent supply part network 240, 220, 221 .

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can then use this determined total energy requirement of these device parts (210, 211, 220, 221, 222, 223) of the vehicle with a lower energy consumption threshold value 1810.

If the determined total energy requirement is below the lower energy consumption threshold, the higher-level computer system 12 and/or the computer core 2 of the control device 4 of that backup of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can supply an energy-consuming device part of these device parts with electrical energy and the other device parts supplied with electrical energy by this device part enable 1820. The superordinate computer system 12 and/or the computer core 2 of the control device 4 of those Securing the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) enable 1820 this energy supply if the total energy requirement of all device parts is or could be below the lower energy transport threshold value for this line section or the operating state and/or the driving situation so can be expected.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can, for example, by means of a suitable data message to the computer core 2 of the control device 4 of the fuse 214 of such a device part 210 signal that the computer core 2 of the control device 4 of this fuse 214 should enable the power supply to the subsequent supply part network 240, 220, 221 by closing the circuit breaker 17, so that the total energy requirement of the supply network 1700 increases by the energy requirement of the shed device parts 220, 221 .

If the determined total energy requirement is below the lower energy consumption threshold value, the higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can switch the energy supply of an energy source into the affected partial supply network of the supply network 1700 and into the other partial supply networks supplied with electrical energy by this device part lower 1820. The higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) reduce 1820 this energy feed if the total energy requirement of all supplied device parts is or could be below the lower energy transport threshold value for this line section or the operating state and/or the driving situation indicates this.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of that fuse of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 260) can, for example, by means of a suitable data message to the computer core 2 of the control device 4 of the fuse 214 of such a device part 210 signal that the computer core 2 of the control device 4 of this fuse 214 should prevent the additional energy supply of the subsequent supply part network 240, 220, 221 by opening the circuit breaker 17, so that the energy source 250 does not meet the total energy requirement of the subsequent supply part network 240, 220, 221 can cover more.

Preferably, the power supply of the device parts of the vehicle, the power supply of which is cut off, has a lower priority than the power supply of the device parts of the vehicle, the power supply of which is not cut off.

Preferably, the power supply of the device parts of the vehicle, the power supply of which is enabled, has a higher priority than the power supply of the device parts of the vehicle, the power supply of which is not enabled.

figure 19

The 19 corresponds to the essential parts 15 and the 10 .

While 10 shows a fuse box 1000, shows 19 two lines to be secured 1915 and 1505, which are parts of a cable harness 1515.

A first energy source 250 feeds energy into the third supply line section 245 .

A third electronic fuse 1975 connects via its circuit breaker 17, if necessary, the third supply line section 245 to the third line section 1915 to be protected. detect the preceding line section 1915 of the cable harness 1515 to be secured. The computer core 2 of the control device 4 of the third electronic fuse 1975 can use the third timer 1960 of the third electronic fuse 1975 to assign a time stamp value to each measured value of the third current flow 1910 in the third, preceding line section 1915 of the cable harness 1515 to be protected. The computer core 2 of the control device 4 of this third electronic fuse 1975 preferably transmits the recorded value pairs consisting of the time stamp value and the measured value of the third current flow 1920 in a third, preceding line section 1915 of the cable harness 1515 to be protected via the data bus 9 to a computer core 2 of a Control device 4 another backup in the supply network and / or to a higher-level computer system 12 for consolidation. At the other end of the third line section 1915 to be protected, the circuit breaker 17 of a fourth electronic fuse 1980 connects the third line section 1915 to be protected with a fourth line section 1925 to be protected Detect current flow 1925 in a fourth, subsequent line section 1925 to be secured. The computer core 2 of the control device 4 of the fourth electronic fuse 1980 can use the fourth timer 1965 of the fourth electronic fuse 1980 to assign a time stamp value to each measured value of the fourth current flow 1930 in the fourth, subsequent line section 1925 to be secured. The computer core 2 of the control device 4 of this fourth electronic fuse 1980 preferably transmits the detected pairs of values from the time stamp value and measured value of the fourth current flow 1930 in a fourth, subsequent line section 1925 to be protected via the data bus 9 to a computer core 2 of a control device 4 of another fuse in the supply network and/or to a higher-level computer system 12 for consolidation.

A second energy source 251 feeds energy into the fourth supply line section 246 .

An electronic fuse 825 connects via its circuit breaker 17, if necessary, the fourth supply line section 246 to the first line section 1505 to be protected. detect the preceding line section 1505 of the cable harness 1515 to be secured. The computer core 2 of the control device 4 of the first electronic fuse 825 can use the first timer 1950 of the first electronic fuse 825 to assign a time stamp value to each measured value of the first current flow 1525 in the first, preceding line section 1505 of the cable harness 1515 to be protected. The computer core 2 of the control device 4 of this first electronic fuse 825 preferably transmits the recorded value pairs consisting of the time stamp value and the measured value of the first current flow 1525 in a first, preceding line section 1505 of the cable harness 1515 to be protected via the data bus 9 to a computer core 2 of a control device 4 of another fuse in the supply network and/or to a higher-level computer system 12 for consolidation. At the other end of the first line section 1505 to be protected, the circuit breaker 17 of a second electronic fuse 805 connects the first line section 1505 to be protected with a second, subsequent line section 1905 to be protected Detect the value of the second current flow 1910 in a second, subsequent line section 1905 to be protected. The computer core 2 of the control device 4 of the second electronic fuse 805 can use the second timer 1955 of the second electronic fuse 805 to assign a time stamp value to each measured value of the second current flow 1910 in the second, subsequent line section 1905 to be protected. The computer core 2 of the control device 4 of this second electronic fuse 805 preferably transmits the detected value pairs consisting of the time stamp value and the measured value of the second current flow 1910 in a second, subsequent line section 1905 to be protected via the data bus 9 to a computer core 2 of a control device 4 of another fuse in the supply network and/or to a higher-level computer system 12 for consolidation.

The higher-level computer system 12 preferably has a timer 1970 of the higher-level computer system 12. The higher-level computer system 12 preferably synchronizes the timers 1950 by means of a special data message via the data bus 9 to all relevant computer cores 2 of the control devices 4 of the relevant fuses 805, 825, 1975, 1980 , 1955, 1960, 1965 of these fuses 805, 825, 1975, 1080 with the timer 1970 of the higher-level computer system 12. The data message preferably has the form of a bit stream packet BP again.

The higher-level computer system 12 can preferably be connected to a server 1985, 710 and/or a terminal 740 of a workshop and/or the server 710 of an automobile manufacturer and/or a service provider and/or or another user 730 of the supply network or a higher-level computer system ( 12) determined data. This data connection is preferably established by one or more wired and/or wireless data connections data connection 1990, 740 to a server 1985, 710 of a workshop and/or an automobile manufacturer and/or a service provider. These data connections are preferably encrypted. These data connections are preferably PQC encrypted.

figure 20

The document presented here refers to the description of the 19 .

• Vorzugsweise synchronisiert 2005 das übergeordnete Rechnersystem 12 oder ein anderes Rechnersystem und/oder ein Rechnerkern 2 einer Sicherung einen ersten Zeitgeber 1950 einer ersten elektronischen Sicherung 825 mit einem Zeitnormal, insbesondere einem Zeitgeber 1970 eines übergeordneten Rechnersystems 12. Auch der Zeitgeber 35 einer Steuerungsvorrichtung 4 einer Sicherung 1 des Versorgungsnetzwerks kann als Zeitnormal dienen. In gleicher Weise erfolgt bevorzugt ggf. die Synchronisation 2010 eines zweiten Zeitgebers 1955 einer zweiten elektronischen Sicherung 805 mit dem Zeitnormal, insbesondere dem Zeitgeber 1970 eines übergeordneten Rechnersystems 12.

20 describes, schematically and in simplified form, a distributed measurement method 2000 for detecting the state of a wiring harness 1515 of a vehicle based on the representation of FIG 19 . The proposed procedure takes place, for example, with the following steps:

• Preferably, in 2005, the higher-level computer system 12 or another computer system and/or a computer core 2 of a fuse synchronizes a first timer 1950 of a first electronic fuse 825 with a time standard, in particular a timer 1970 of a higher-level computer system 12. Also the timer 35 of a control device 4 of a fuse 1 of the supply network can serve as a time standard. The synchronization 2010 of a second timer 1955 of a second electronic fuse 805 with the time standard, in particular the timer 1970 of a higher-level computer system 12, preferably takes place in the same way.

In 2015, the higher-level computer system 12 and/or a computer core 2 of a control device 4 of one of the fuses 825, 805, 1975, 1980 preferably initiate the following two detection processes, preferably synchronized with the same time values of the first timer 1950 of the first electronic fuse 825 and of the second timer 1955 of the second electronic fuse 805. For this purpose, the higher-level computer system 12 and/or a computer core 2 of a control device 4 of one of the fuses 825, 805, 1975, 1980 signal this initiation 2015 via the data bus, preferably via the data bus to the computer core 2 of the control device 4 of the first fuse 825 and the computer core 2 of the control device 4 of the second fuse 825.

The next step is the detection 2020 of a first current value of the current flow 1525 into a first line section 1505 of the cable harness 1515 to be secured. The computer core 2 of the control device 4 of the first fuse 825 preferably carries out this detection 2020 by means of the first current measuring device 1520 of the first fuse 825 . The first current measuring device 1520 of the first fuse 825 preferably includes the analog-to-digital converter 570 and the auxiliary circuit breaker 23 of the first electronic fuse 825 and the shunt resistor 24 of the first fuse 825. The computer core 2 of the control device 4 preferably detects the first fuse 825 by means of these means (570, 20, 21, 22, 23, 24, 25) the first current value of the current flow 1525 into a first line section 1505 of the cable harness 1515 to be protected. Preferably, the computer core 2 of the control device 4 of the first fuse 825 simultaneously records the first time stamp value as the current time value of the first timer 1950 of the first fuse 825 at the time of the detection of the first current value of the current flow 1525 in a first line section 1505 of the cable harness 1515 to be protected.

The next step is the detection 2025 of a second current value of the current flow 1920 in a second line section 1905 to be secured. The second current measuring device 1935 of the second fuse 805 preferably includes the analog-to-digital converter 570 and the auxiliary circuit breaker 23 of the second electronic fuse 805 and the shunt resistor 24 of the second fuse 805. The computer core 2 of the control device 4 preferably detects the second fuse 805 by means of these means (570, 20, 21, 22, 23, 24, 25) the second current value of the current flow 1935 in a second line section 1905 to be secured Time value of the second timer 1955 of the second fuse 805 at the time of detection of the second current value of the current flow 1910 in a second line section 1905 to be protected.

The computer core 2 of the control device 4 of the first fuse 825 preferably determines 2030 the first time stamp value using the first timer 1950 of the first electronic fuse 825, for each measured value or for a group of measured values of the first current values of the current flow 1525.

The computer core 2 of the control device 4 of the second fuse 805 preferably determines 2035 the second time stamp value using the second timer 1955 of the second electronic fuse 805, for each measured value or for a group of measured values of the second current values of the current flow 1910.

The computer core 2 of the control device 4 of the second fuse 805 preferably transmits 2040 at least the detected second measured value for the second current value of the current flow 1910 in the second Line section 1905 together with the detected second time stamp value from the second fuse 805 via the data bus 9 to a higher-level computer system 12 and/or to the computer core 2 of the control device 4 of the first electronic fuse 825 and/or to a computer core 2 of a control device 4 of another fuse of the supply network.

The computer core 2 of the control device 4 of the first fuse 825 preferably transmits 2040 at least the recorded first measured value for the first current value of the current flow 1505 in the first line section 1505 together with the recorded first time stamp value from the first fuse 825 via the data bus 9 to a higher-level computer system 12 and/or to a computer core 2 of a control device 4 of another fuse of the supply network if the computer core 2 of the control device 4 of the second fuse 805 transmits at least the recorded second measured value for the second current value of the current flow 1910 in the second line section 1905 together with the recorded second time stamp value from the second fuse 805 to a higher-level computer system 12 and/or to a computer core 2 of a control device 4 of another fuse of the supply network 2040.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of the first electronic fuse 825 and/or the computer core 2 of a control device 4 of another fuse of the supply network compares 2045 the first measured value received via the data bus 9 with the second measured value.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of the first electronic fuse 825 and/or the computer core 2 of a control device 4 of another fuse of the supply network conclude 2050 an energy loss in line sections 1525 between the two electronic fuses 825, 805 if which places the difference between the first measured value and the second measured value outside of a permitted difference value interval and/or when a quotient of the first measured value and the second measured value lies outside of a permitted quotient interval.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of the first electronic fuse 825 and/or the computer core 2 of a control device 4 of another fuse of the supply network preferably signal such an incident via the data bus 9 to a terminal 740 of a User 730.

If necessary, the higher-level computer system 12 and/or the computer core 2 of the control device 4 of the first electronic fuse 825 and/or the computer core 2 of a control device 4 of another fuse of the supply network take countermeasures. Such a countermeasure can be, for example, a command via the data bus to the computer core 2 of the control device 4 of the first fuse 825 that the computer core 2 of the control device 4 of the first fuse 825 should open the circuit breaker 17 of the first fuse 825. The higher-level computer system 12 and/or the computer core 2 of the control device 4 of the first electronic fuse 825 and/or the computer core 2 of a control device 4 of another fuse of the supply network preferably transmit this command in encrypted form via the data bus 9. The computer core 2 of the control device 4 of the first Fuse 825 can then possibly open the first circuit breaker 17 . This de-energizes any existing short circuits of the first supply line section 1505 with other lines and/or device parts of the supply network 200 and thus brings them into a non-hazardous state.

A special step that is possible is therefore the taking 2055 of countermeasures, in particular by the higher-level computer system 12 or by the computer core 2 of the evaluating control device 4 of the evaluating electronic fuse 825, if the measured values or the ratio of the measured values to one another or a difference of such measured values or quantities derived from them do not correspond to one or more expected values and/or are not within an expected value interval.

The data communication between the computer cores 2 of the control devices 4 of the fuses of the supply network and/or with the higher-level computer system 12 preferably takes place via a fuse data bus 9 and/or a fuse data bus 9 and/or a Lin data bus 9 and/or a DSI3 data bus 9 and/or a PS15 data bus 9 and/or a CAN data bus 9 and/or a CAN FD data bus 9 and/or an Ethernet data bus 9 and/or a Flexray data bus 9 and/or an LVDS data bus 9 and / or an Ethernet data bus 9 and / or otherwise as wired or wireless data transmission route, for example via a Bluetooth or a WLAN data connection or an optical data connection 540, and/or another wired or wireless interface (610, 10, 551, 550).

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of the first electronic fuse 825 and/or the computer core 2 of a control device 4 of another fuse of the supply network preferably detect changes in the current values of the currents (1525, 1910, 1920, 1930) and/or or changes in the spectra of the voltage profile over time of the voltages between line sections 1505, 1905, 1915, 1920 of the wiring harness 1515 to be secured on the one hand and a reference potential on the other hand and/or changes in the spectra of the current profile of the current values of the currents 1525, 1910, 1920, 1930 or of the energy transport via the line sections 1505, 1905, 1915, 1920 of the cable harness 1515 to be secured. The higher-level computer system 12 and/or the computer core 2 of the control device 4 of the first electronic fuse 825 and/or the computer core 2 of a control device 4 of another fuse of the supply network preferably evaluate this Changes by comparing the changes with expected courses and/or expected values.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of the first electronic fuse 825 and/or the computer core 2 of a control device 4 of another fuse of the supply network preferably establishes 2060 a data connection 1990 to a server 1985 of a workshop and/or an automobile manufacturer and /or a service provider to make the recorded values and/or time stamps or data derived from them available there.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of the first electronic fuse 825 and/or the computer core 2 of a control device 4 of another fuse of the supply network preferably transmit 2065 vehicle data and/or operating data and/or measured values and/or damage data, if the comparison of the recorded changes with the expected courses and/or expected values revealed a deviation beyond a specified level.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of the first electronic fuse 825 and/or the computer core 2 of a control device 4 of another fuse of the supply network preferably transmit 2065 the vehicle data and/or operating data and/or measured values and/or damage data a server 1985 or a terminal of the workshop or another user of this data.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of the first electronic fuse 825 and/or the computer core 2 of a control device 4 of another fuse of the supply network and/or another computer 1985 preferably create a forecast 2070 of the probability of failure based on this data a device part of the vehicle using the vehicle data and/or operating data and/or measured values and/or damage data.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of the first electronic fuse 825 and/or the computer core 2 of a control device 4 of another fuse of the supply network and/or the other computer 1985 preferably transmit 2075 the prognosis result to a server 1985 and/or or a workshop terminal and/or a terminal 740 and/or a vehicle owner's computer 730 and/or a terminal 740 and/or a vehicle driver's computer 730 or a terminal and/or a server 710 of an automobile manufacturer and/or a terminal and /or server of a logistics company and/or a terminal and/or server of another user of this data.

One of the users of this data, in particular a fully or semi-automated logistics center, preferably provides 2080 a replacement part for the device part of the vehicle given a prognosis result that indicates that the device part will fail. A computer that uses the transmitted data identifies the part of the vehicle that is to be replaced. A computer in a semi-automated or fully automated warehouse locates the required spare part. A robot and/or a fully or semi-automatic shipping device provides the necessary spare part and creates the necessary shipping documents and, if necessary, packs the spare part for shipping. The robot and/or the fully or semi-automated shipping device preferably sends the spare part to an address predetermined by the vehicle owner 730 or the vehicle driver or an employee of the workshop. This address should typically be the Be the address of the workshop in which the preventive repair is typically to be carried out as part of regular maintenance.

The higher-level computer system 12 and/or the computer core 2 of the control device 4 of the first electronic fuse 825 and/or the computer core 2 of a control device 4 of another fuse of the supply network preferably infers 2085 the temperature of a line section 1915, 1925, 1505, 1905 and/or an excess temperature of a line section 1915, 1925, 1505, 1905 using the detected current values of the current flow 1920, 1925, 1525, 1910 in a plurality of line sections 1915, 1925, 1505, 1905 of the cable harness 1515 to be protected.

figure 21

21 shows in a schematically simplified manner a proposed battery 2100 with diagnostic function for a vehicle using supply networks 200 as already described above in the document presented here. The proposed battery 2100 preferably comprises one or more battery cell modules 2105, 2155 and one or more electronic shears 825, 805. At least one connection 2197 of the battery 2100 is preferably connected to the first connection 26 of the circuit breaker 17 of a first electronic fuse 825. The battery 2100 preferably comprises a supply tree and/or supply network having one or more supply branches (2198, 2196, 2120, 2135, 2140, 2190, 2160, 2175, 2180, 2196). Several electronic fuses 825, 805 are preferably connected in series in a supply branch (2198, 2196, 2120, 2135, 2140, 2190, 2160, 2175, 2180, 2196) of the supply tree or supply network. Such a supply tree or such a supply network can also include only one supply branch with a plurality of electronic fuses that are inserted in the supply branch. One or more battery cell modules 2105, 2155 of the battery 2100 are electrically connected in series, for example. One or more electronic fuses 805 are connected between battery cell modules 2105, 2155 of battery 2100.

Exactly one electronic fuse 805 is preferably connected between two battery cell modules 2105, 2155, which are connected to one another in series.

Each battery cell module 2105, 2155 is preferably provided with a respective electronic fuse 825, 805 assigned to this battery cell module. An electronic fuse 825, 805 is preferably assigned to each battery cell module 2105, 2155 or to one or more groups, in particular battery cell modules 2105, 2155 connected in series.

One or more or all of these electronic fuses 825, 805 preferably have a first circuit breaker 17 which is suitable for preventing the current flow 2121, 2161 through one or more battery cell modules 2105, 2155 and/or the relevant group of battery cell modules, i.e. the electrical connection 2140, 2190, 2160, 2175 between a first battery cell module 2105 and a second battery cell module 2155 or a first group of battery cell modules and a second group of battery cell modules that are connected in series to separate when the first circuit breaker 17 is open. One or more or all of these electronic fuses 825, 805 has a first circuit breaker 17 which is suitable for enabling the flow of current 2121, 2161 through one or more battery cell modules 2105, 2155 and/or the relevant group of battery cell modules, i.e. the electrical Connection (2140, 2190, 2160, 2175) between a first battery cell module 2105 and a second battery cell module 2155 or a first group of battery cell modules and a second group of battery cell modules that are connected in series to produce when the first circuit breaker 17 is closed.

The 21 12 shows a battery 2100 with diagnostic function for a vehicle. The battery includes a first battery cell module 2105 and a second battery cell module 2155. The first battery cell module 2105 includes a first electrochemical cell 2145, the first battery cell, of the first battery cell module (2105). The second battery cell module 2155 includes a second electrochemical cell 2185, the second battery cell, of the second battery cell module (2155). The connection 2198 of the first connection 2197 of the battery 2100 connects the first connection 2125 of the first battery cell module 2105 to the first connection 2197 of the battery 2100. The connection 2120 connects the first connection 2125 to the first connection 18 of the circuit breaker 17 of the first fuse 825 of the battery 2100. The connector 410 connects the first fuse 825 to the first battery cell module 2105. The first fuse 825 includes a computer core 2 and a control device 4 and a timer 1950 and a Measuring device 1520 for detecting the electric current in the first electrochemical cell 2145 of the first battery cell module 2105 or out of it. This current essentially corresponds to the electric current 2121 in the connection 2120 between the first terminal 2125 and the first terminal 18 of the circuit breaker 17 of the first fuse 825 of the battery 2100. The first terminal 2135 of the first electrochemical cell, the first battery cell 2145, the first Battery cell module 2105 is preferably connected to second terminal 19 of first fuse 825 . The second connection 2130 of the first battery cell module 2105 is preferably connected to the second connection 2140 of the first electrochemical cell, the first battery cell 2145, of the first battery cell module 2105.

The connection 2190 connects the second connection 2130 of the first battery cell module 2105 to the first connection 2165 of the second battery cell module 2155. The connection 2160 connects the first connection 2165 to the first connection 18 of the circuit breaker 17 of the second fuse 805 of the battery 2100. In the connection 2160 the electric current 2161 flows in the connection 2160 between the first connection 2165 and the first connection 18 of the circuit breaker 17 of the second fuse 805 of the battery 2100.

The connection 2196 connects the second terminal 2195 of the battery 2100 to the second terminal 2170 of the second battery cell module 2155. The second terminal 19 of the second fuse 805 is preferably connected to the first terminal 2175 of the second electrochemical cell, the second battery cell 2184, the second battery cell module 2155 tied together. The second connection 2180 of the second electrochemical cell, the second battery cell 2185, the second battery cell module 2155 is preferably connected to the second connection 2170 of the second battery cell module 2155.

The entire battery 2100 includes a battery case 2199.

The data bus 9 is connected to the first electronic fuse 825 via a first plug connector 410 . The data bus 9 is connected to the second electronic fuse 805 via a second plug connector 410 . The battery housing 2199 preferably has a connection for the data bus 9 . This connection for the data bus 9 is preferably connected to the data bus 9 within the battery 210 .

The supply voltage line 6 for the supply of the first electronic fuse 825 and the supply of the second electronic fuse 805 within the battery 2100 is preferably connected to the first electronic fuse 825 via a first connector 410 and to the second electronic fuse 805 via a second connector 410 , in order to supply the respective control devices 4 with electrical energy there.

Preferably shows that

The reference potential line 201 for the supply of the first electronic fuse 825 and the supply of the second electronic fuse 805 within the battery 2100 is preferably connected to the first electronic fuse 825 via a first connector 410 and to the second electronic fuse 805 via a second connector 410 , in order to supply the respective control devices 4 with electrical energy and a reference potential there.

figure 22

22 equals to 21 with the difference that the first electronic fuse 825 has an additional contact 2210 in order to conduct this current past the electrochemical battery cell 2145 in the event of an incorrect sign of the current 2121 through the first fuse 825 .

For this purpose, the first fuse 825 in the example of FIG 22 a second circuit breaker 17', which is also controlled by the computer core 2 of the control device 4 of the first fuse 825.

One or more or all of these electronic fuses 825 of the battery 2200 preferably have a second circuit breaker 17′ that is suitable for bridging the battery cell module 2105 and/or the group of battery cell modules when the second circuit breaker 17′ is closed.

The computer core 2 of the respective control device 4 of the respective electronic fuse 825 preferably detects the switching state of the first circuit breaker 17 and whether the first circuit breaker 17 is open before the second circuit breaker 17′ is closed. The computer core 2 of the control device 4 of the electronic fuse 825 only closes the second circuit breaker 17' when the first circuit breaker 17 is open.

The computer core 2 of the control devices 4 of the respective electronic fuse causes a test current 515 to be fed into the first circuit breaker 17 at a connection point 26 before the first circuit breaker 17 and causes this test current 915 to be drawn off at a second connection point 28 behind the first circuit breaker 17. The computer core 2 of the control device 4 of the respective electronic fuse evaluates whether this feeding and removal were successful.

In the 22 thus shows a battery 2200 in which an electronic fuse 825 of the battery 2200 has a second circuit breaker 17' which is suitable for bridging the battery cell module 2105 associated with the fuse when the second circuit breaker 17' is closed. The battery 2200 is preferably accommodated in a housing 2220 of the battery 2200 or of the battery cell module. The housing 2220 of the battery 2200 preferably has a connection 2225 of the battery 2220 of the battery cell module for the operating voltage 6 of the electronic fuses 825, 805 within the battery 2200. The housing 2220 of the battery 2200 preferably has a connection 2230 of the battery 2200 of the battery cell module for the reference potential node 201 of the electronic fuses 825, 805. The housing 2220 of the battery 2200 preferably has a connection 2235 of the battery 2200 of the battery cell module for the external data bus 9 of the electronic fuses 825, 805.

figure 23

23 shows a battery cell module 2300, which has at least one battery cell 2145 and/or an interconnection of battery cells, a first circuit breaker 17, a second circuit breaker 17', a first electrical node 2120, a second electrical node 2135, a third electrical node 2140, a first battery cell connection 2305 and a second battery cell connection 2310 includes. The first battery cell terminal 2305 is connected to the second node 2135, for example. The second battery cell terminal 2310 is connected to the third node 2140, for example. The first circuit breaker 17 has a first connection 26 and a second connection 28 and a control connection 27 . The second circuit breaker 17' has a first connection 26' and a second connection 28' and a control connection 27'. The battery cell 2105 and/or the interconnection of battery cells comprises a first connection 2125 and a second connection 2130. The first circuit breaker 17 is preferably connected to the first node 2120 with its first connection 26 of the first circuit breaker 17. The first power switch 17 is preferably connected to the second node 2135 with its second connection 28 of the first power switch 17 . The second power switch 17' is preferably connected to the first node 2120 with its first connection 26' of the second power switch 17'. The second circuit breaker 17' is preferably connected to the third node 2140 with its second terminal 28' of the second circuit breaker 17'. A first connection 2305 of the battery cell 2145 or of the group of battery cells is preferably connected to the second node 2135 . A second connection 2310 of the battery cell 2145 or of the group of battery cells is preferably connected to the third node 2140 . When the term "connected" is used here, it means that there is a direct or indirect electrical connection via other electrical components that is essentially functionally equivalent to a direct connection.

The battery cell module 2105 preferably includes a control device 4 of a fuse or is connected to such a control device 4 . This control device 4 preferably controls the control connection 27 of the first circuit breaker 17. A computer core 2 of the control device 4 preferably controls the control connection 27 of the first circuit breaker 17. The control device 4 also preferably controls the control connection 27' of the second circuit breaker 17'. The computer core 2 of the control device 4 preferably controls the control connection 27' of the second circuit breaker 17'. The control device 4 or the computer core 2 of the control device 4 preferably interlock the control connection 27 of the first circuit breaker 17 with respect to the control connection 27' of the second circuit breaker 17' in such a way that it is impossible for the first circuit breaker 17 to be conductive, i.e. closed , is when the second circuit breaker 17' is conductive, ie closed.

The control device preferably comprises 4 means (16, 525, 520, 920, 530, 21, 22, 28, 26, 27, 915, 515, 510, 910, 905 and 16', 525', 520', 920', 530 ', 21', 22', 28', 26', 27', 915', 515', 510', 910', 905') for acquisition sen the switching state of the circuit breakers 17, 17 '. The control device 4 and/or the computer core 2 of the control device preferably use these means (16, 525, 520, 920, 530, 21, 22, 28, 26, 27, 915, 515, 510, 910, 905 and 16', 525', 520', 920', 530', 21', 22', 28', 26', 27', 915', 515', 510', 910', 905') the switching state of at least one of the circuit breakers 17, 17', in particular as "on" or "off" or as "closed" or "open".

The control device 4 and/or the computer core 2 of the control device 4 are preferably set up to bypass the battery cell module 2105 . For this purpose, the control device 4 and/or the computer core 2 of the control device 4 are preferably set up to first open the first circuit breaker 17 and thus to prevent a current flow 2121 through the battery cell 2145 and then in particular by means of the means (16, 525, 520 , 920, 530, 21, 22, 28, 26, 27, 915, 515, 510, 910, 905) for detecting the switching state of the first circuit breaker 17 to check and determine whether the first circuit breaker 17 is open, and then if the second circuit breaker 17' is open, close the second circuit breaker 17' and then by means of the means (16', 525', 520', 920', 530', 21', 22', 28', 26', 27', 915', 515', 510', 910', 905') for detecting the switching state of the second circuit breaker 17' to check whether the second circuit breaker 17' is closed.

The battery cell module 2200 can optionally itself include at least one first battery cell module 2105 as described above and itself again include at least one second battery cell module 2155, as described above. The second connection 2130 of the first battery cell module 2105 is preferably connected to the first connection 2165 of the second battery cell module 2155.

The power switch 17 and the control device 4 of the fuse 825 and the fuse 825 are preferably housed in a housing 2605 with the actual battery cell module 2105 .

The control device 4 of the fuse 825 can have an optical data interface 550, 551.

In that case, the housing 2605 preferably has an optical window 545 that allows access of electromagnetic radiation 540 for the optical transport of data away from the optical data interface 550, 551 of the control device 4 and to the optical data interface 550, 551 of the control device 4.

The computer core 2 of the control device 4 can communicate via the optical interface 550, 551 of the control device 4 inside the housing 2605, for example with an optical interface 555 of another device, for example a higher-level computer system 12 outside the housing 2665.

The document presented here thus also describes, among other things, a battery cell module 2300 with a battery cell 2145, a first battery cell connection 2305, a second battery cell connection 2310, a connection 2320 of the battery cell module 2105 for the operating voltage 6 of the electronic fuse 825, a connection 2325 of the battery cell module 2105 for the reference potential node 201 of the electronic fuse 825 and a connection 2330 of the battery cell module 2105 for the external data bus 9 of the electronic fuse 825.

figure 24

24 equals to 6 , where fuse 1 is the 24 a second circuit breaker 17'.

In the 24 For the sake of clarity, not all useful and possibly usual device components are shown. Next device components that the reader as possibly in the 1 can accept present, can be found, for example, in the 1 , 5 , 6 , 9 , 41 , 42 , 52 , 53 , 54 , 55 . The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

Dabei soll T die Periode des ersten Modulationssignals {505} oder des zweiten Modulationssignals {505'} darstellen, die bevorzugt gleich sind oder ein ganzzahliges Vielfaches voneinander. Bevorzugt ist die Periode T des ersten Modulationssignals {505} gleich der Periode T des zweiten Modulationssignals {505'}. Dies ermöglicht die Trennung der beiden Modulationssignale ({505}, {505'}). Bevorzugt gilt also beispielsweise $$\langle \left\{505\right\}|\left\{505\text{'}\right\}\rangle ={\displaystyle {\int }_0^T\left\{505\right\}\times \left\{505\right\}dt=\mathrm{0,}}$$

was Orthogonalität bedeutet.The control circuit 4 of the fuse 1 preferably also has a second gate drive circuit 16' for driving and monitoring the second circuit breaker 17'. The first connection 26 ′ of the second circuit breaker 17 ′ is preferably connected to the first connection 18 of the fuse 1 . The second gate drive circuit 16' for driving and monitoring the second power switch 17' controls the second line switch 17' via the control line 20' to control the second power switch 17'. Using the monitoring line 21' to detect the voltage between the second connection 19' of the second circuit breaker 17' and the control line 20' of the second circuit breaker 17' and by means of the monitoring line 22' to detect the voltage between the first connection 18' of the second circuit breaker 17 ' and the control line 20' of the second power switch 17' and by means of the measuring line 25' for detecting the voltage drop across the second shunt resistor 24', the second gate drive circuit 16' monitors the second power switch for driving and monitoring the second power switch 17'17'. Fuse 1 of 24 further comprises a second auxiliary circuit breaker 23' for sensing a current proportional or otherwise equal to the current 29' through the second circuit breaker 17'. Fuse 1 of 24 preferably also includes a shunt resistor 24' for detecting the current through the second auxiliary circuit breaker 23' of the second circuit breaker 17'. A third test current source 505' is modulated by the second control signal 510' with a second modulation signal {505'} of a second signal generator 520'. The curly brackets are intended to signal that {505′} is the second modulation signal with which the second current 515′ of the third test current source 505′ is modulated. Preferably, the second modulation signal {505'} is orthogonal to the first modulation signal {505} in terms of dot product $〈\left\{505\right\}|\left\{505\text{'}\right\}〉={\displaystyle {\int }_0^T\left\{505\right\}\times \left\{505\right\}\mathrm{i.e}t.}$

In this case, T is intended to represent the period of the first modulation signal {505} or of the second modulation signal {505'}, which are preferably the same or an integral multiple of one another. The period T of the first modulation signal {505} is preferably equal to the period T of the second modulation signal {505'}. This enables the two modulation signals ({505}, {505'}) to be separated. For example, the following preferably applies $$〈\left\{505\right\}|\left\{505\text{'}\right\}〉={\displaystyle {\int }_0^T\left\{505\right\}\times \left\{505\right\}\mathrm{i.e}t=\mathrm{0,}}$$

which means orthogonality.

The second current 515' of the third test current source 505' is preferably modulated with the second modulation signal {505'} by means of the third control signal 510' of the third electronic test current source 505'. The third test current source 505′ feeds the second additional current 515′ into the second circuit breaker 17 . A second signal generator 520' generates the second modulation signal {505'}. A second correlator 525′ preferably includes one or more input amplifiers that detect, filter and condition the voltages between the second measurement contacts (21′, 25′, 27′, 28′, 22′). The second correlator 525′ preferably includes a second synchronous demodulator, for example, which examines one of the measurable voltages for second components of the second modulation signal {505′} of the second current 515′ of the third test current source 505′. In this case, the second synchronous demodulator of the second correlator 525′ preferably uses a correlation in the form of a scalar product, for example according to the form $$A\text{'}=〈\left\{505\text{'}\right\}|V{\text{'}}_{xy}\left(t\right)〉={\displaystyle {\int }_0^T\left\{505\text{'}\right\}\times V_{xy}}\left(t\text{'}\right)\mathrm{i.e}t$$

Here, A' stands for the value of the second portion and V' _xy for a voltage between the second measuring contacts (21', 25', 27', 28', 22). Preferably, the second correlator 525' uses a voltage V _xy between the second terminal 28' of the second power switch 17' and the second control terminal 27' of the second power switch 17'.

A second gate drive 530' of the control contact 27' of the second power switch 17' and second control signal generation for the control signal of the control line 20' of the second power switch 17' controls the second power switch 17'.

A first test current source 505' feeds a test current 515' into the first connection 26' of the second power switch 17', which is provided with a modulation signal {505'} of a first signal generator 520' by means of the control signal 510'.

A second test current source 905' draws a test current 915' from the second connection 28' of the second power switch 17', which is provided with a modulation signal {505'} of a second signal generator 920' by means of the control signal 910'.

A third control signal 510' controls the third electronic test current source 505'.

A fourth control signal 910' controls the fourth electronic test current source 905'.

The first test current 515' preferably corresponds to the second test current 915'.

The fourth signal generator 920' preferably generates the modulation signal {505'}.

In the example of 24 some modules are also possible modules of the control device 4 that are not shown in the figures for the sake of clarity. The reader is to assume that these modules may be present in the figures and are hereby disclosed.

24 shows a diagram of an example of an electronic fuse with a safe control device 4 and a safe computer core 2. The safe control device 4 contains memory elements, for example, which are connected to the internal data bus 11. The memory elements can include, for example, one or more read/write memories RAM 14 and/or one or more writable non-volatile memories such as EEPROM memory 15 and/or flash memory 15 and/or OTP memory 15 . Furthermore, the safe control device 4 preferably includes one or more non-volatile, read-only memories 14, such as a ROM. In addition, the secure control device 4 preferably includes one or more non-volatile, writable and/or non-writable manufacturer memories. This can be, for example, a manufacturer memory 72 for data from the vehicle manufacturer and/or a supplier/manufacturer memory 74 for data from the automotive supplier and/or a semiconductor manufacturer/manufacturer memory 76 for data from the semiconductor manufacturer. Each of these data memories is preferably protected by a respective password. The manufacturer memory 72 is preferably protected by a manufacturer password. The supplier-manufacturer memory 74 is preferably protected by a supplier password. The semiconductor manufacturer's memory 76 is preferably protected by a semiconductor manufacturer's password.

The supplier can gain access to the manufacturer store 72 using a supplier analysis password. When the supplier accesses the manufacturer's memory 72 in this way, the content of the manufacturer's memory 72 is preferably deleted, so that the supplier cannot obtain any knowledge of the content of the manufacturer's memory 72 . The manufacturer's passwords are preferably also deleted in the process.

The semiconductor manufacturer can gain access to the manufacturer memory 72 and/or the supplier memory 74 using a semiconductor manufacturer analysis password. When the semiconductor manufacturer accesses the manufacturer's memory 72 in this way, the content of the manufacturer's memory 72 is preferably deleted, so that the semiconductor manufacturer cannot obtain any knowledge of the content of the manufacturer's memory 72 . When the semiconductor manufacturer accesses the supplier memory 74 in this way, the content of the supplier memory 74 is preferably deleted, so that the semiconductor manufacturer cannot obtain any knowledge of the content of the supplier memory 72 . In this case, the passwords of the manufacturer or the supplier are preferably also deleted.

In the case of a non-writable manufacturer memory 72 or a non-writable supplier memory or a non-writable semiconductor manufacturer memory 76, these memories can each be a respective manufacturer ROM. Access to the manufacturer's memory 72 is preferably via one or more manufacturer's memory firewalls 71, preferably implemented in hardware. For access, the computer core 2 stores the manufacturer's password via the internal data bus 11 in a register of the manufacturer's memory firewall 71. The manufacturer's memory firewall 71 checks the content of the register and releases access to the registers of the manufacturer memory firewall 71 and access to the manufacturer memory 72 for the computer core 2 if the manufacturer password corresponds to the content in a manufacturer password default register of the manufacturer memory firewall 71 in a predetermined manner. The computer core 2 can then access the manufacturer's memory 72 and the manufacturer's default password register of the manufacturer's memory firewall 71 .

Access to the supplier memory 74 is preferably via one or more supplier memory firewalls 73, preferably implemented in hardware. For access, the computer core 2 stores the supplier password via the internal data bus 11 in a register of the supplier memory firewall 73. The supplier memory firewall 73 checks the content of the register and enables access to the registers of the supplier memory firewall 73 and access to the supplier memory 74 for the computer core 2 if the supplier password corresponds to the content in a supplier password default register of the supplier memory firewall 73 in a predetermined manner. The computer core 2 can then access the supplier memory 74 and the supplier password default register of the supplier memory firewall 73 .

Access to the semiconductor manufacturer's memory 76 is preferably via one or more semiconductor manufacturer's memory firewalls 75, preferably implemented in hardware. The computer core 2 stores the semiconductor manufacturer's password via the internal data bus 11 in a register of the semiconductor manufacturer's memory firewall 75 for access. The semiconductor manufacturer's memory firewall 75 checks the content of the register and enables access to the registers of the semiconductor manufacturer's memory firewall 75 and access to the semiconductor manufacturer's memory 76 for the computer core 2 if the semiconductor manufacturer's password corresponds to the content in a semiconductor manufacturer's password default register of the semiconductor manufacturer's memory firewall 75 in a predetermined manner. The computer core 2 can then access the semiconductor manufacturer's memory 76 and the semiconductor manufacturer's default password register of the semiconductor manufacturer's memory firewall 75 .

The manufacturer memory firewall 71 preferably encrypts the data in the computer core 2 before it is stored in the manufacturer memory 72 using a PQC-enabled encryption method and/or using a quantum random number from the quantum random number generator 60.

The supplier memory firewall 73 preferably encrypts the data in the computer core 2 before it is stored in the supplier memory 74 using a PQC-enabled encryption method and/or using a quantum random number from the quantum random number generator 60.

The semiconductor manufacturer memory firewall 75 preferably encrypts the data in the computer core 2 before it is stored in the semiconductor manufacturer memory 76 using a PQC-enabled encryption method and/or using a quantum random number from the quantum random number generator 60.

A manufacturer ROM 72, 74, 76 preferably includes the respective boot software. The secure control device 4 comprises, for example, one or more cryptography accelerators 70, for example a DES accelerator and/or an AES accelerator 70, which is connected to the internal data bus 11. For example, one or more manufacturer memory firewalls 71, 73, 75 are preferably provided between the respective manufacturer memory 72, 74, 76 and the internal data bus 11. The computer core 2 accesses these memories 72, 74, 76 via the data bus 11. The safe control device 4 includes, for example, processing modules that communicate with the computer core 2 via the internal data bus 11 . The processing modules of the control device 4 of the fuse 1 preferably comprise one or more of the following modules: a CRC (Cyclic Redundancy Check) module 77, an oscillator and clock generator module 30, one or more timer modules 78, a safety monitoring circuit and safety control circuit 79, a or several quantum process-based generators for real random numbers (English: Quantum Random Number Generator: QRNG) 60, an 8/16/32/15-bit microcontroller core as the computer core 2 and one or more data interfaces 82, in particular one or more universal asynchronous receivers -Transmitter (UART) to support high-speed serial data and/or one or more so-called General Purpose IOs (GPIO). The other circuit parts of the safe control device 4 include, for example, one or more basic clock generators 30 (CLK) and/or one or more clock generator modules 30, a reset circuit 80, a power supply or Vcc circuit 5 with voltage regulators that provide the operating voltage, a ground circuit 81 which compensates for noise on the ground line; and an input/output circuit 82.

The secure control device 4 is preferably configured in such a way that it enables secure authentication. First of all, this relates to the authentication of the control device 4 with other computers. These other computers can be, for example, the higher-level control device 12 as well as servers 710 from service providers and/or servers 710 from automobile manufacturers and/or terminals 740, for example smartphones. First of all, this concerns the authentication of such other computers with the control device 4 of the backup 1. These other computers can, for example, be the higher-level control device 12 as well as servers 710 from service providers and/or servers 710 from automobile manufacturers and/or terminals 740, for example smartphones, be. However, this also applies to the authentication of a user 730 with the control device 4 of the security device 1, for example by means of data input at an authenticated terminal and/or by recording biometric data of the user 730 by means of biometric sensors of the terminal 740. In this way, the secure control device 4 stores additional codes in addition to the authentication code data, e.g. B. one or more lifetime and usage data and/or e.g. logistical data and/or e.g. commercial data and/or website and email addresses and/or image data, a set of instructions for control devices of the vehicle and/or the higher-level computer system 12 with which the computer core 2 of the control device 4 communicates via a data interface 10 . In addition, the safe control device 4 can store additional application data.

The control device 4 of 24 includes, for example, one or more cryptography accelerators 70, for example a DES accelerator and/or an AES accelerator 70.

Preferably, a monolithic integrated circuit comprises, for example, the secure controller 4, which is preferably configured to facilitate secure authentication and verification of a product, a user, and/or other computing and usage situations. Preferably, the integrated circuit also includes shunt resistors 24 and 24'. The integrated circuit is preferably manufactured on or in a first semiconductor substrate, preferably using CMOS technology.

The first auxiliary circuit breaker 23 is preferably manufactured monolithically on or in a common second substrate with the first circuit breaker 17 .

The second auxiliary circuit breaker 23' is preferably manufactured monolithically on or in a common third substrate with the second circuit breaker 17'.

The second substrate and the third substrate preferably form a common second substrate.

The first substrate and the second substrate and—if not part of the second substrate—the third substrate are preferably accommodated in a common housing 535 .

The housing 535 preferably has a second metal mounting surface, a so-called die-island, for mounting the second substrate by means of adhesive or solder on the surface of this second mounting surface and optionally a third metal mounting surface, a so-called die-island for the Mounting of the third substrate by means of glue or solder on the surface of this third mounting area. The underside of the second mounting surface is preferably not covered by the material of the housing 535 . The underside of the second mounting surface is therefore preferably part of the surface of the underside of the housing 535. Is the solder or the adhesive with which the underside of the second substrate is connected to the first circuit breaker 17 and, if applicable, to the second circuit breaker 17' on the surface of the top of the is attached to the second mounting surface is electrically conductive, the second substrate can be electrically and thermally contacted via the underside of this second mounting surface as a so-called exposed die pad, so that the first circuit breaker 17 and, if applicable, the second circuit breaker 17' are cooled particularly well and can be made smaller and shift faster. This is therefore an important prerequisite for being able to switch off particularly quickly in the event of a short circuit, as mentioned elsewhere in this document.

The housing 535 preferably has a third metal mounting surface, a so-called die island, for mounting the third substrate that may be present by means of adhesive or solder on the surface of this third mounting surface. The underside of the third mounting surface is preferably not covered by the material of the housing 535 . The underside of the third mounting surface is thus preferably part of the surface of the underside of the housing 535. If the solder or the adhesive with which the underside of the third substrate, if present, is attached to the second circuit breaker 17' is attached to the surface of the top of the third mounting surface, electrically conductive, the third substrate can be electrically and thermally contacted via the underside of this third mounting area as a so-called exposed die pad, so that the second circuit breaker 17' is particularly well cooled and can be made smaller and switches faster. This is therefore an important prerequisite for being able to switch off particularly quickly in the event of a short circuit, as mentioned elsewhere in this document.

figure 25

The 25 corresponds to the battery of 22 , where the 25 a battery cell module 2500 with a plurality of battery cells 2145, 2185 shows. The battery cell module 2500 corresponds to the battery cell module 2105 of FIG 21 .

An exemplary connector 2505 has a first contact 6 for the operating voltage connection 6 of the electronic fuses 825, 805. The connector 2505 also has a second contact 201 for the reference potential connection 201 of the electronic fuses 805, 815. The plug connector has a third contact 9 for the external data bus 9 of the electronic fuses 805, 815.

figure 26

26 shows a housed battery cell module 2600 with a common housing 2605 of the battery cell module 2600 for an electronic fuse 825 and an inner battery cell module 2105. By means of an optical connector system 2640 for the pluggable optical connection between the external optical fiber 580 outside the housing 2605 and the optical fiber 2635 inside the Housing 2605, the optical data interface 550 of the electronic fuse 825 can exchange data and commands via an optical window 545 with an optical interface 555 of a higher-level computer system 12. The fuse housing 425 preferably also has an optical window 545 .

The proposed battery cell module 2600 includes an exemplary optical fiber 2635 within the housing 2605 of the battery cell module 2600.

The first connector 2610 of the battery cell module 2600 is preferably connected to the first connector 2125 of the inner battery cell module 2105 within the housing 2605 of the battery cell module 2600 .

The second connection 2615 of the battery cell module 2600 is preferably connected to the second connection 2130 of the inner battery cell module 2105 within the housing 2605 of the battery cell module 2600 .

The battery cell module 2600 preferably includes a connection 2620 of the battery cell module 2600 for the operating voltage 6 of the electronic fuse 825 of the inner battery cell module 2105.

The battery cell module 2600 preferably includes a connection 2625 of the battery cell module 2600 for the reference potential node 201 of the electronic fuse 825 of the inner battery cell module 2105.

The battery cell module 2600 preferably includes a connection 2630 of the battery cell module 2600 for the external data bus 9 of the electronic fuse 825 of the inner battery cell module 2105.

figure 27

27 shows a battery 2700, in which an electronic fuse 825 of the battery 2200 has a second circuit breaker 17', which is suitable for bridging the battery cell module 2105 assigned to the fuse when the second circuit breaker 17' is closed, and in which the control device consists of the battery cell 2145 is supplied, but only when the circuit breaker 17 is closed. Otherwise the battery 2700 essentially corresponds to the battery 2022 of FIG 22 .

figure 28

28 shows a battery 2800, in which an electronic fuse 825 of the battery 2200 has a second circuit breaker 17', which is suitable for bridging the battery cell module 2105 assigned to the fuse when the second circuit breaker 17' is closed, and in which the control device 4 consists of the battery cell 2145 continues to be supplied, even if the circuit breaker 17 is open.

figure 29

29 shows a supply network 2900, one or more supply branches of the supply network 2900 for supplying electrical consumers 2930 to 2933 with electrical energy as a ring of a supply line 2910 to 2915, in particular when a body is used as a return ground line, and/or as two rings of two supply lines are. One or more supply branches of supply network 2900 for supplying electrical energy from electrical energy sources 2940, 2941 can also be designed as a ring of a supply line 2910 to 2915, in particular when a body is used as a return ground line, and/or as two rings of two supply lines.

Two fuses 2960 to 2967 are preferably inserted into the supply line 2910 to 2915 at the respective energy extraction point 2920 to 2923 for this consumer of the consumers 2930 to 2933 in the supply line 2910 to 2915 and/or in the supply network 2900 for some consumers of the consumers 2930 to 2933 for energy sources 2940, 2941 two fuses 2950 to 2953 are inserted into the supply line 2910 to 2915 at the energy feed point 2924 to 2925 of the electrical energy for these energy sources 2940, 2941 in the supply line 2910 to 2915.

Preferably, precisely those two electronic fuses of fuses 2950 to 2953 and 2960 to 2967 that are assigned to a faulty line section of line sections 2910 to 2915 are set up to open their circuit breakers 17 in the event of a fault in the line section, so that precisely these two electronic fuses of Fuses 2950 to 2953 and 2960 to 2967 open this faulty line section of the line sections 2910 to 2915. Preferably, in the event of a fault in a consumer of the consumers 2930 to 2933, the two electronic fuses of the fuses 2960 to 2967 assigned to this faulty consumer open their circuit breakers 17, so that these two electronic Fuses thereby isolate the faulty consumer and/or open their circuit breakers in the event of a fault in one of the energy sources of the energy sources 2940, 2941, the two electronic fuses of the fuses 2950 to 2953 assigned to this faulty energy source, so that these two electronic fuses thereby isolate the faulty energy source. This is preferably the case in particular when the above errors impair the energy supply of other consumers of consumers 2930 to 2933 and/or consumers of consumers 2930 to 2933 with high priority.

The document presented here also describes, among other things, a supply network 2900 in which the computer core 2 of the control device 4 of an electronic fuse for the fuses 2950 to 2953 and 2960 to 2967 sends data such as configuration data (write /read), switching commands (write/read), diagnostic data (write/read), measured values (read), comparison value settings (write/read) receives or sends.

The data bus 9 is preferably partially or entirely a two-wire data bus and/or a differential data bus 9 and/or a differential bidirectional data bus 9.

For example, the data bus 9 can be a CAN data bus or a data bus 9 with a physical interface of a CAN data bus, a CAN FD data bus or a Flexray data bus or an LVDS data bus or the like.

Electronic fuses 2950 to 2953 and 2960 to 2967 of the supply network 2900 can each include two data interfaces 10, 610, 550, 551 for the data bus 9, these being inserted into the data bus 9 and a linear chain of fuses 2950 to 2953 and 2960 to 2967 form along at least part of the data bus 9.

A higher-level computer system 12, which is connected to the beginning of this part of the data bus 9, can use auto-addressing in cooperation with the control devices 4 of the electronic fuses for each of the control devices 4 of the electronic fuses (2950 to 2953 and 2960 to 2967) to assign a fuse address to control the Determine the computer cores 2 of the control devices 4 of the fuses and, if necessary, transmit them to the computer cores 2 of the control devices 4 of the electronic fuses (2950 to 2953 and 2960 to 2967).

The supply network 2900 preferably comprises a supply line 2910 to 2915. For example, the supply network 2900 can be ring-shaped in parts. The consumers 2920 to 2923 can draw electrical energy from the supply line 2910 to 2915 of the supply network 2900 at various energy extraction points 2920 to 2923 of the ring-shaped supply network 2900 . The energy sources 2940 to 2941 can feed electrical energy into the supply line 2910 to 2915 of the supply network 2900 at various feed points 2924 to 2925 of the ring-shaped supply network 2900 . The supply lines 2910 to 2915 of the ring-shaped supply network 2900 to the left or right of the respective removal points of electrical energy or left or right of the respective feed-in points of electrical energy are interrupted at least on one side by a respective electronic fuse of the fuses 2950 to 2953 and 2960 to 2967. The respective electronic fuse of the fuses 2950 to 2953 and 2960 to 2967 is with its respective circuit breaker 17 in the supply line 2910 to 2915 of the supply line section between two respective extraction points of the extraction points 2920 to 2923 for electrical consumer energy of the associated consumption cher of consumers 2930 to 2933 or between two respective feed points of feed points 2924 to 2924 for electrical energy of the associated energy sources of energy sources 2940 to 2941 or between a respective feed point of feed points 2924 to 2924 for electrical energy of the associated energy source of energy sources 2940 to 2941 and a respective extraction point of the extraction points 2920 to 2923 for electrical consumer energy of the associated consumer of consumers 2930 to 2933 inserted.

The supply line of the ring-shaped supply network 2900 is interrupted to the left and right of the respective tapping points 2920 to 2923 of electrical energy on each side of each tapping point of the tapping points 2920 to 2923 by a respective electronic fuse of the fuses 2960 to 2967 and/or to the left and right of the respective feed-in points 2924 to 2925 electrical energy on each side of each feed point of the feed points 2924 to 2925 each interrupted by a respective electronic fuse of the fuses 2950 to 2953.

Preferably, the two electronic fuses that are closest to a feed point of the feed points 2924 to 2925 or an extraction point of the extraction points 2920 to 2923 or a supply line section of the supply sections 2910 to 2915 isolate this feed point or this extraction point or this supply line section by opening their circuit breakers 17 if a failure of a consumer of consumers 2930 to 2933 at this withdrawal point in this supply line section of supply sections 2910 to 2915 and/or if a failure of an energy source of energy sources 2940 to 2941 occurs at this feed point in this supply line section of supply sections 2910 to 2915.

For example, a higher-level computer system 12 can determine the status of the electronic fuses 2960 to 2967 and 2950 to 2953 by addressing the computer cores 2 of the control devices 4 of the electronic fuses 2960 to 2967 and 2950 to 2953 via the data bus 9 . The higher-level computer system 12 can determine the position of the fault or the fault in the supply network 2900 if there is a fault or a fault. The higher-level computer system 9 can then localize the disruption or error at the determined position by intervening in the supply network 2900, in which the higher-level computer system 12 controls the computer cores 2 of the control devices 4 of the two electronic fuses of the fuses 2960 to 2967 and 2950 to 2953 of the supply network 2900, which are closest to the position of the fault, to open their circuit breakers 17.

The intervention by the higher-level computer system 12 is preferably faster than twice the longest time constant of the energy withdrawals of the consumers 2920 to 2923, which draw energy from the supply network 2900 at the time of the intervention. The intervention by the higher-level computer system 12 is also preferably faster than twice the longest time constant of the energy feeds from the energy sources 2940 to 2941 that feed energy into the supply network 2900 .

The computer core 2 of the control device 4 of an electronic backup of the backups 2950 to 2953 and 2960 to 2967 preferably records the faults and/or errors in the form of a log table 2970, which can also only contain a few bits, or a log file 2970 or in another form of storage in a preferably non-volatile memory of the control device 4 of the fuse. Similarly, a higher-level computer system 12 can display the disruptions and/or errors in the supply network 2900 and/or the disruptions and/or errors in the fuses 2950 to 2953 and 2960 to 2967 in the form of a log table 2970, which also only has a few bits may include, or a log file 2970 or another form of storage, preferably in a non-volatile memory of the higher-level computer system 12.

The computer core 2 of the control device 4 of the electronic security preferably provides the entries in the log table 2970 or the log file 2970 with a time stamp of a timer unit 35 of the control device 4 of the electronic security. The higher-level computer system 12 can also provide the entries in the log table 2970 or the log file 2970 with a time stamp of a timer unit 1970 of the higher-level computer system 12 in an analogous manner.

The computer core 2 of the control device 4 of the electronic fuse preferably also records in the log table 2970 or the log file 2970 with a time stamp when the fault no longer existed. In an analogous manner, the superordinate computer system 12 can also record in the log table 2970 or the log file 2970 with a time stamp when the fault no longer existed.

The higher-level computer system 12 reads the log table 2970 or the log file 2970 of the computer core 2 of the control device 4 of a backup of the fuses 2950 to 2953 and 2960 to 2963 via the data bus (9) preferably regularly or in the event of a malfunction or an error. from the memory of the control device 4 of this electronic fuse and/or from the memory of the computer core 2 of the control device 4 of this fuse.

The higher-level computer system 12 identifies one or more computer cores using one or more of its log tables 2970 or one or more of its log files 2970 and/or using one or more log tables 2970 or one or more log files 2970 2 one or more control devices 4 one or more electronic fuses of the fuses (2950 to 2953 and 2960 to 2967) potentially affected sensors and measuring systems that the supply network 2900 supplies with electrical energy. The higher-level computer system 12 then preferably marks the measured values acquired by these sensors and measuring systems in the relevant period of time as potentially incorrect or immediately discards the measured values acquired by these sensors and measuring systems in the relevant period of time.

The 29 12 thus shows a supply network 2900 in a schematically simplified manner. One or more supply branches of the supply network 2900 for supplying electrical consumers 2930 to 2933 with electrical energy are designed as a ring of a supply line 2910 to 2915. In particular, in the case of a ring, for example, a car body can serve as a return conductor ground line. If the body ground is not available as a return line in all parts of the supply network 2900, the supply network 2900 can be implemented in these areas in the form of two rings of two supply lines. One or more supply branches of supply network 2900 then serve to supply electrical energy from electrical energy sources 2940 to 2941 as a ring of a supply line 2910 to 2915 if, for example, a body is used as a return conductor ground line, and/or as two rings of two supply lines if, for example, none body serves as a return conductor ground line.

The supply network 2900 comprises in the example of 29 a first line section 2910 of the supply line ring, the first line section 2910 connecting the energy feed point 2924 of the first energy source 2940 to the first energy extraction point 2920 of the first consumer 2930 in the example of 29 electrically connects and wherein the return line can be, for example, the vehicle body.

The supply network 2900 comprises in the example of 29 a second line section 2911 of the supply line ring, the second line section 2911 connecting the first energy extraction point 2920 of the first consumer 2930 to the second energy extraction point 2921 of the second consumer 2931 in the example of 29 electrically connects and wherein the return line can be, for example, the vehicle body.

The supply network 2900 comprises in the example of 29 a third line section 2912 of the supply line ring, the third line section 2912 connecting the second energy extraction point 2921 of the second consumer 2931 to the third energy extraction point 2922 of the third consumer 2932 in the example of 29 electrically connects and wherein the return line can be, for example, the vehicle body.

The supply network 2900 comprises in the example of 29 a fourth line section 2913 of the supply line ring, the fourth line section 2913 connecting the third energy extraction point 2922 of the third consumer 2932 to the third energy extraction point 2922 of the third consumer 2933 in the example of 29 electrically connects and wherein the return line can be, for example, the vehicle body.

The supply network 2900 comprises in the example of 29 a fifth line section 2914 of the supply line ring, the fifth line section 2914 connecting the fourth energy extraction point 2923 of the fourth consumer 2933 to the second energy feed point 2925 of the second energy source 2941 in the example of 29 electrically connects and wherein the return line can be, for example, the vehicle body.

The supply network 2900 comprises in the example of 29 a sixth line section 2915 of the supply line ring, the sixth line section 2915 connecting the second energy feed point 2925 of the second energy source 2941 to the first energy feed point 2924 of the first Energy source 2940 in the example of 29 electrically connects and wherein the return line can be, for example, the vehicle body.

The supply network 2900 comprises in the example of 29 a first energy extraction point 2920 for supplying the first consumer 2930 with electrical energy from the supply line ring 2910 to 2915, the return line being able to be the vehicle body, for example.

The supply network 2900 comprises in the example of 29 a second energy extraction point 2921 for supplying the second consumer 2931 with electrical energy from the supply line ring 2910 to 2915, the return line being able to be the vehicle body, for example.

The supply network 2900 comprises in the example of 29 a third energy extraction point 2922 for supplying the third consumer 2932 with electrical energy from the supply line ring 2910 to 2915, the return line being able to be the vehicle body, for example.

The supply network 2900 comprises in the example of 29 a fourth energy extraction point 2923 for supplying the fourth consumer 2933 with electrical energy from the supply line ring 2910 to 2915, the return line being able to be the vehicle body, for example.

The supply network 2900 comprises in the example of 29 a first energy feed point 2924 for feeding the energy from the first energy source 2940 into the supply line ring 2910 to 2915, the return line being able to be the vehicle body, for example.

The supply network 2900 comprises in the example of 29 a second energy feed point 2925 for feeding the energy from the second energy source 2941 into the supply line ring 2910 to 2915, the return line being able to be the vehicle body, for example.

The supply network 2900 comprises in the example of 29 a first fuse 2950 of the first energy source 2940. The first fuse 2950 can use its circuit breaker 17 to separate the first energy feed point 2924 from the first line section 2910 of the supply line ring 2910 to 2915 or to connect the first energy feed point 2924 to the first line section 2910 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electric current through the first fuse 2950 and/or the electric voltage of the supply line ring 2910 to 2915 in the area of the first fuse 2950 relative to a reference potential and/or on a data command via the fuse data bus 9 .

The supply network 2900 comprises in the example of 29 a second fuse 2951 of the first energy source 2940. The second fuse 2951 can use its circuit breaker 17 to separate the first energy feed point 2924 from the sixth line section 2915 of the supply line ring 2910 to 2915 or to connect the first energy feed point 2924 to the sixth line section 2915 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electrical current through the second fuse 2951 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the second fuse 2951 relative to a reference potential and/or on a data command via the fuse data bus 9.

The supply network 2900 comprises in the example of 29 a third fuse 2952 of the second energy source 2941. The third fuse 2952 can use its circuit breaker 17 to separate the second energy feed point 2925 from the sixth line section 2915 of the supply line ring 2910 to 2915 or to connect the second energy feed point 2925 to the sixth line section 2915 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electrical current through the third fuse 2952 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the third fuse 2952 relative to a reference potential and/or on a data command via the fuse data bus 9.

The supply network 2900 comprises in the example of 29 a fourth fuse 2953 of the second energy source 2941. The fourth fuse 2953 can use its circuit breaker 17 to separate the second energy feed point 2925 from the fifth line section 2914 of the supply line ring 2910 to 2915 or to connect the second energy feed point 2925 to the fifth line section 2914 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electrical current through the fourth fuse 2953 and/or the electrical voltage of the supply führungsleitungsrings 2910 to 2915 in the fourth fuse 2953 relative to a reference potential and / or a data command via the fuse data bus 9 from.

The supply network 2900 comprises in the example of 29 a thirteenth fuse 2950 of the first energy source 2940. The thirteenth fuse 2950 can use its circuit breaker 17 to separate the first energy feed point 2924 from the first line section 2910 of the supply line ring 2910 to 2915 or to connect the first energy feed point 2924 to the first line section 2910 of the supply line ring 2910 to 2915 . This disconnection or connection typically depends on the electrical current through the thirteenth fuse 2950 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the thirteenth fuse 2950 relative to a reference potential and/or a data command via the fuse data bus 9. The thirteenth fuse 2950 and the fourteenth fuse 2951 can have a common control device 4 .

The supply network 2900 comprises in the example of 29 a fourteenth fuse 2951 of the first energy source 2940. The fourteenth fuse 2951 can use its circuit breaker 17 to separate the first energy feed point 2924 from the sixth line section 2915 of the supply line ring 2910 to 2915 or to connect the first energy feed point 2924 to the sixth line section 2915 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electrical current through the fourteenth fuse 2951 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the fourteenth fuse 2951 relative to a reference potential and/or on a data command via the fuse data bus 9. The thirteenth fuse 2950 and the fourteenth fuse 2951 can have a common control device 4 .

The supply network 2900 comprises in the example of 29 a fifteenth fuse 2952 of the second energy source 2941. The fifteenth fuse 2952 can use its circuit breaker 17 to separate the second energy feed point 2925 from the sixth line section 2915 of the supply line ring 2910 to 2915 or to connect the second energy feed point 2925 to the sixth line section 2915 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electrical current through the fifteenth fuse and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the fifteenth fuse 2952 relative to a reference potential and/or a data command via the fuse data bus 9. The fifteenth fuse 2952 and the sixteenth fuse 2953 can have a common control device 4 .

The supply network 2900 comprises in the example of 29 a sixteenth fuse 2953 of the second energy source 2941. The sixteenth fuse 2953 can use its circuit breaker 17 to separate the second energy feed point 2925 from the fifth line section 2914 of the supply line ring 2910 to 2915 or to connect the second energy feed point 2925 to the fifth line section 2914 of the supply line ring 2910 to 2915 . This disconnection or connection typically depends on the electrical current through the sixteenth fuse 2953 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the sixteenth fuse 2953 relative to a reference potential and/or a data command via the fuse data bus 9. The fifteenth fuse 2952 and the sixteenth fuse 2953 can have a common control device 4 .

The supply network 2900 comprises in the example of 29 a fifth fuse 2960 of the first consumer 2930. The fifth fuse 2960 can use its circuit breaker 17 to separate the first energy extraction point 2920 from the first line section 2910 of the supply line ring 2910 to 2915 or to connect the first energy extraction point 2930 to the first line section 2910 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electrical current through the fifth fuse 2960 and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the fifth fuse 2960 relative to a reference potential and/or a data command via the fuse data bus 9 . The fifth fuse 2960 and the sixth fuse 2961 can have a common control device 4 .

The supply network 2900 comprises in the example of 29 a sixth fuse 2961 of the first consumer 2930. The sixth fuse 2961 can, by means of its circuit breaker 17, the first energy extraction point 2920 from the second line section 2911 of the supply line ring 2910 to 2915 separate or connect the first energy extraction point 2930 to the second line section 2911 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electric current through the sixth fuse 2961 and/or the electric voltage of the supply line ring 2910 to 2915 in the area of the sixth fuse 2961 relative to a reference potential and/or on a data command via the fuse data bus 9. The fifth fuse 2960 and the sixth fuse 2961 can have a common control device 4 .

The supply network 2900 comprises in the example of 29 a seventh fuse 2962 of the second consumer 2931. The seventh fuse 2962 can use its circuit breaker 17 to separate the second energy extraction point 2921 from the second line section 2911 of the supply line ring 2910 to 2915 or to connect the second energy extraction point 2921 to the second line section 2911 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electrical current through the seventh fuse 2962 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the seventh fuse 2962 relative to a reference potential and/or on a data command via the fuse data bus 9. The seventh fuse 2962 and the eighth fuse 2963 can have a common control device 4 .

The supply network 2900 comprises in the example of 29 an eighth fuse 2963 of the second consumer 2931. The eighth fuse 2963 can use its circuit breaker 17 to separate the second energy extraction point 2921 from the third line section 2912 of the supply line ring 2910 to 2915 or to connect the second energy extraction point 2921 to the third line section 2912 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electric current through the eighth fuse 2963 and/or the electric voltage of the supply line ring 2910 to 2915 in the area of the eighth fuse 2963 relative to a reference potential and/or on a data command via the fuse data bus 9 . The seventh fuse 2962 and the eighth fuse 2963 can have a common control device 4 .

The supply network 2900 comprises in the example of 29 a ninth fuse 2964 of the third consumer 2932. The ninth fuse 2964 can use its circuit breaker 17 to separate the third energy extraction point 2922 from the third line section 2912 of the supply line ring 2910 to 2915 or to connect the third energy extraction point 2922 to the third line section 2912 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electrical current through the ninth fuse 2964 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the ninth fuse 2964 relative to a reference potential and/or on a data command via the fuse data bus 9 . The ninth fuse 2964 and the tenth fuse 2965 can have a common control device 4 .

The supply network 2900 comprises in the example of 29 a tenth fuse 2965 of the third consumer 2932. The tenth fuse 2965 can use its circuit breaker 17 to separate the third energy extraction point 2922 from the fourth line section 2913 of the supply line ring 2910 to 2915 or to connect the third energy extraction point 2922 to the fourth line section 2913 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electrical current through the tenth fuse 2965 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the tenth fuse 2965 relative to a reference potential and/or a data command via the fuse data bus 9 . The ninth fuse 2964 and the tenth fuse 2965 can have a common control device 4 .

The supply network 2900 comprises in the example of 29 an eleventh fuse 2966 of the fourth consumer 2933. The eleventh fuse 2966 can use its circuit breaker 17 to separate the fourth energy extraction point 2923 from the fourth line section 2913 of the supply line ring 2910 to 2915 or to connect the fourth energy extraction point 2923 to the fourth line section 2913 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electric current through the eleventh fuse 2966 and/or the electric voltage of the supply line ring 2910 to 2915 in the area of the eleventh fuse 2966 relative to a reference potential and/or on a data command via the fuse data bus 9 . The eleventh fuse 2966 and the twelfth fuse 2967 can have a common control device 4 .

The supply network 2900 comprises in the example of 29 a twelfth fuse 2967 of the fourth consumer 2933. The twelfth fuse 2967 can use its circuit breaker 17 to disconnect the fourth energy extraction point 2923 from the fifth line section 2914 of the supply line ring 2910 separate to 2915 or connect the fourth energy extraction point 2923 to the fifth line section 2914 of the supply line ring 2910 to 2915. This disconnection or connection typically depends on the electric current through the twelfth fuse 2967 and/or the electric voltage of the supply line ring 2910 to 2915 in the area of the twelfth fuse 2967 relative to a reference potential and/or on a data command via the fuse data bus 9 . The eleventh fuse 2966 and the twelfth fuse 2967 can have a common control device 4 .

The supply network 2900 comprises in the example of 29 a log table 2970 or log file for the errors and faults and, if necessary, other operating parameters. The log table 2970 or log file for the errors and malfunctions and possibly other operating parameters is preferably a log table 2970 or a log file for the errors and malfunctions and possibly other operating parameters of the higher-level computer system 12.

The higher-level computer system 12 preferably includes a timer 2971 of the higher-level computer system 12 for synchronizing the other timers of the supply network 2900 and in particular for synchronizing the timers 35 of the control devices 4 of the electronic fuses in the supply network 2900.

figure 30

The 30 equals to 29 with the difference that energy sources and consumers are pluggable.

The supply network 3000 of the 30 additionally has a first fuse slot 3010 for the first consumer 2930 with two fuses 2960, 2961 and a first connector 3020.

The supply network 3000 of the 30 also has a second fuse slot 3011 for the second consumer 2931 with two fuses 2962, 2963 and a second connector 3021.

The supply network 3000 of the 30 also has a third fuse slot 3012 for the third consumer 2932 with two fuses 2964, 2965 and a third connector 3022.

The supply network 3000 of the 30 also has a fourth fuse slot 3013 for the fourth consumer 2933 with two fuses 2966, 2967 and a fourth connector 3023.

The supply network 3000 of the 30 additionally has a fifth fuse slot 3014 for the first energy source 2940 with two fuses 2950, 2951 and a fifth connector 3024.

The supply network 3000 of the 30 additionally has a sixth fuse slot 3015 for the second energy source 2941 with two fuses 2952, 2953 and a sixth plug connection 3025.

The supply network 3000 of the 30 additionally has a first plug-in connection 3020 with a first plug and first socket for connecting and supplying the first load 2930.

The supply network 3000 of the 30 additionally has a second plug-in connection 3021 with a second plug and second socket for connecting and supplying the second load 2931.

The supply network 3000 of the 30 additionally has a third plug-in connection 3022 with a third plug and a third socket for connecting and supplying the third load 2932.

The supply network 3000 of the 30 additionally has a fourth plug-in connection 3023 with a fourth plug and a fourth socket for connecting and supplying the fourth consumer 2933.

The supply network 3000 of the 30 additionally has a fifth plug-in connection 3024 with a fifth plug and fifth socket for connecting and feeding in the first energy source 2940.

The supply network 3000 of the 30 additionally has a sixth plug-in connection 3025 with a sixth plug and sixth socket for connecting and feeding in the second energy source 2941 .

figure 31

The supply network 3100 shown schematically and in simplified form 31 essentially corresponds to the supply network 3000 of 30 , whereby the plug connections are now secured with their own fuses.

According to the proposal, a supply line (2910 to 2015 and 2920 to 2923) of the supply network 3100 can have a plug connection of the plug connections 3020 to 2023, a plug or a socket for connecting and supplying a load of the loads 2930 to 2033. A supply line (2910 to 2015 and 2924 to 2925) of the supply network 3100 can have a plug-in connection of the plug-in connections 3024 to 2025, a plug or a socket for connecting and supplying energy to an energy source from the energy sources 2940 to 2041. According to the proposal, an electronic fuse of the fuses 3110 to 3113 is inserted near the plug connection of the plug connections 3020 to 3023 for drawing energy from the relevant supply line (2910 to 2915 and 2920 to 2925) by the electrical consumer of the electrical consumers 2930 to 2933 or an electronic one Fuse of the fuses 3110 to 3113 inserted in the vicinity of the plug connection of the plug connections 3020 to 3023 for feeding energy from the energy source of the energy sources 2940 to 2941 in the relevant supply line (2910 to 2915 and 2920 to 2925).

This electronic fuse recognizes a hot-plug event relating to this plug connection of the plug connections (3020 to 3023) in that the computer core 2 of the control device 4 of the electronic fuse, for example by means of the analog-to-digital converter 570 of the control device 4 of the fuse, detects the transient Time curve of the voltage of the potential of a node of the circuit breaker 17 of this fuse against the potential of a reference node 201, in particular compared to a ground potential, is monitored. The computer core 2 of the control device 4 of the fuse can also monitor the transient course of the current 29 through the circuit breaker 17 of this electronic fuse, for example by means of the analog-to-digital converter 570 . The computer core 2 of the control device 4 of this electronic fuse preferably monitors these transient profiles.

The document presented here understands a hot-plug event as a removal or insertion of an energy source and/or a consumer in the live state of one side of the plug connection and/or in the live state of the plug connection. Hot plug describes the possibility of inserting or removing from the supply network operating and/or loaded device parts without a previously executed shutdown procedure for the device part and/or without a previously executed conditioning procedure for the device part in preparation for the plugging process.

The computer core 2 of the control device 4 of this electronic fuse, which detects a hot-plug event at one of its connections 18, 19, preferably switches off the circuit breaker (17) in the event of a hot-plug event. This possibly prevents further damage to the device part.

The computer core 2 preferably reports such a hot-plug event to the control device 4 of this electronic fuse via the data bus 9 to the higher-level computer system 12. If necessary, the higher-level computer system 12 displays the reported hot-plug event on a display or a similar or functionally equivalent device Instrument, for example a terminal 740 for display.

One or more electronic fuses are preferably set up to make this normal operation visually recognizable to a person during normal operation, in particular by means of a light source and/or an LED and/or an indicator and/or a display of a data output means 740 of the fuse or of the higher-level computer system 12 and /or as data information via the data bus 9, at least temporarily and/or upon request, in particular upon request of the higher-level computer system 12 or an operator 730 by means of the data input and data output means 740 to sig nalize. It is conceivable, for example, that each fuse has an LED that lights up green when it is operating properly and lights up red when it is defective. Preferably, such LEDs only light up when requested by an operator 730 to conserve power.

Preferably, one or more electronic fuses are set up so that, in the event of an error and/or a fault and/or a hot-plug event, this error or this fault or this hot-plug event can be visually recognized by a person, in particular by means of an illuminant and/or an LED and/or an indicator and/or a display of data output means 740 of the fuse or of the higher-level computer system 12 and/or as data information via the data bus 9, at least temporarily and/or upon request, in particular at the request of the higher-level Computer system 12 or an operator 730 by means of the data input and data output means 740 to signal.

In the event of a hot-plug event in the supply network 3100, the computer core 2 of the control device 4 of the electronic fuse preferably transmits a message to a computer 710, 750 of a service provider and/or to a higher-level computer system 12. The computer core 2 of the control device 5 of the electronic fuse In the event of a hot-plug event in the supply network 3100 of a vehicle, a message can be sent to a computer 710 of a vehicle manufacturer or a service provider, either immediately or with a time delay.

Control devices 4 of electronic fuses of the supply network 3100 preferably include clocks or timers 35, in particular for creating time stamps for LOG tables and/or log files. The higher-level computer system 12 of the supply network can also have one or more clocks or one or more timers 1970, in particular for creating time stamps for LOG tables and/or log files. The higher-level computer system 12 then preferably synchronizes clocks and/or timers 35, 1970 in the supply network 3100, preferably regularly by means of a synchronization signal, in particular via the data bus 9.

This preferably includes the synchronization of clocks and/or timers 35, 1970 in the supply network 3100 and a reset to a common starting value for these clocks and/or timers 35, 1970.

The synchronization of clocks and/or timers 35, 1970 in the supply network 3100 preferably includes a correction of the frequency and/or the phase of the oscillators 30 of the control devices 4 of the electronic fuses (2950 to 2953 and 2960 to 2967 and 3110 to 3113 and 3120 to 3121 ). The oscillators 30 of the control devices 4 of the electronic fuses (2950 to 2953 and 2960 to 2967 and 3110 to 3113 and 3120 to 3121) are preferably synchronized by means of a respective PLL of the respective control device 4 of the respective fuse.

A higher-level computer system 12 preferably initiates computer cores 2 of control devices 4 electronic fuses (2950 to 2953 and 2960 to 2967 and 3110 to 3113 and 3120 to 3121) in the supply network by means of a command via the data bus 9 in broadcasting mode to several and/or all of them fuses (2950 to 2953 and 2960 to 2967 and 3110 to 3113 and 3120 to 3121) at the same points in time, preferably the same measurements, preferably at the same times using the measuring means of the control devices 4 of the fuses and/or the analog-to-digital converter 570 of the control devices 4 of the fuses. The term “same times” here refers to the equality of the clock readings of the respective clocks and/or timers 35 of the various control devices 4 of the various electronic fuses (2950 to 2953 and 2960 to 2967 and 3110 to 3113 and 3120 to 3121). .

The document presented here proposes that at least two electronic fuses (2950 to 2953 and 2960 to 2967 and 3110 to 3113 and 3120 to 3121) of the supply network 3100 carry out a distributed measurement method with synchronous measurement using two synchronized local clocks 35, each located within the respective control device 4 of the at least two electronic fuses are located. This means that the first computer core 2 of a first control device 4 of a first electronic fuse and the second computer core 2 of a second control device 4 of a second electronic fuse of these fuses (2950 to 2953 and 2960 to 2967 and 3110 to 3113 and 3120 to 3121) have a distributed Perform measurement method with synchronous measurement of predetermined parameters by means of a first timer 35 of the control device 4 of the first fuse and by means of a second timer 35 of the control device 4 of the second fuse. The supply network uses the two timers as two synchronized local clocks 35. The parameters recorded can be, for example, the respective current 29 through the respective circuit breaker 17 and the respective voltage of the second connection 19 of the respective fuse against a reference potential 201 and the respective voltage of the first connection 18 of the respective fuse be against a reference potential 201.

If necessary, the computer cores 2 of the control devices 4 of the fuses preferably transmit the measured values recorded in this way to a higher-level computer system 12 and/or to an evaluating computer core 2 of the control device 4 of a fuse via the data bus 9.

The computer core 2 of a control device 4 of a first of the electronic fuses can work as the higher-level computer system 12 . In this case, the first fuse and the second fuse are preferably connected to one another via one or more supply line sections. From the transmitted data, the higher-level computer system 12 deduces a parameter of the supply line section between the first electronic fuse and the second electronic fuse. This parameter can be, for example, the electrical resistance and/or the temperature of the supply line section between the first electronic fuse and the second electronic fuse.

Accordingly, the higher-level computer system 12 can infer the temperature and/or the electrical resistance of one or more supply line sections between the first electronic fuse and the second electronic fuse from the data transmitted via the data bus 9 .

The 31 11 thus shows a supply network 3100 with the ability to isolate line sections 2910 to 2915 and consumers 2930 to 2933 and the ability to isolate energy sources 2940 to 2941, with proposed fuses producing this ability to be isolated by means of their circuit breakers 17.

The supply network 3100 of the 1 includes a seventeenth fuse 3110 of the first consumer 2930. The seventeenth fuse 3110 can, by means of its circuit breaker 17, the first energy extraction point 2920 on the one hand from the first consumer 2930 or from the first plug connection 3020 with the first plug and the first socket for the connection and the supply of the first consumer 2930 on the other hand, or connect the first energy extraction point 2920 on the one hand to the first consumer 2930 or to the first plug connection 3020 with the first plug and the first socket for connecting and supplying the first consumer 2930 on the other hand. This disconnection or connection typically depends on the electrical current 29 through the seventeenth fuse 3110 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the seventeenth fuse 3110 or in the area of the first plug connection 3020 relative to a reference potential 201 and/or depends on a data command over the backup data bus 9. The seventeenth fuse 3110 and the fifth fuse 2960 and the sixth fuse 2961 may have a common controller 4;

The supply network 3100 of the 1 includes an eighteenth fuse 3111 of the second consumer 2931. The eighteenth fuse can, by means of its circuit breaker 17, the second energy extraction point 2921 on the one hand from the second consumer 2931 or from the second plug connection 3021 with the second plug and the second socket for the connection and supply of the second Disconnect consumer 2931 on the other hand or connect the second energy extraction point 2921 on the one hand to the second consumer 2931 or to the second plug-in connection 3021 with the second plug and the second socket for connecting and supplying the second consumer 2931 on the other. This disconnection or connection typically depends on the electrical current 29 through the eighteenth fuse 3111 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the eighteenth fuse 3111 or in the area of the second plug connection 3021 relative to a reference potential 201 and/or depends on a data command over the backup data bus 9. The eighteenth fuse 3111 and the seventh fuse 2962 and the eighth fuse 2963 can have a common control device 4 .

The supply network 3100 of the 1 includes a nineteenth fuse 3112 of the third consumer 2932. The nineteenth fuse 3112 can use its circuit breaker 17 to separate the third energy extraction point 2922 from the third consumer 2932 or from the third plug-in connection 3022 with the third plug and the third socket for the connection and the supply of the third ver On the other hand, separate the consumer 2932 or connect the third energy extraction point 2922 on the one hand to the third consumer 2932 or to the third plug-in connection 3022 with the third plug and the third socket for connecting and supplying the third consumer 2932. This disconnection or connection typically depends on the electrical current 29 through the nineteenth fuse 3112 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the nineteenth fuse 3112 or in the area of the third plug connection 3022 relative to a reference potential 201 and/or from a data command via the backup data bus 9. The nineteenth fuse 3112 and the ninth fuse 2964 and the tenth fuse 2965 can have a common control device 4 .

The supply network 3100 of the 1 includes a twentieth fuse 3113 of the fourth consumer 2933. The twentieth fuse 3113 can use its circuit breaker 17 to separate the fourth energy extraction point 2923 from the fourth consumer 2933 or from the fourth plug-in connection 3023 with the fourth plug and the fourth socket for connection and supply of the fourth consumer 2933 on the other hand, or connect the fourth energy extraction point 2923 on the one hand to the fourth consumer 2933 or to the fourth plug-in connection 3023 with the fourth plug and the fourth socket for connecting and supplying the fourth consumer 2933 on the other hand. This disconnection or connection typically depends on the electrical current 29 through the twentieth fuse 3113 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the twentieth fuse 3113 or in the area of the fourth plug connection 3023 relative to a reference potential 201 and/or from a data command via the backup data bus 9. The twentieth fuse 3113 and the eleventh fuse 2966 and the twelfth fuse 2966 may have a common control device 4;

The supply network 3100 of the 1 includes a twenty-first fuse 3120 of the first energy source 2940. The twenty-first fuse 3120 can, by means of its circuit breaker 17, connect the first energy feed point 2924 to the first energy source 2940 or to the fifth plug-in connection 3024 with the fifth plug and the fifth socket for connection and supply the first energy source 2940 on the other hand, or connect the fifth energy extraction point 2924 on the one hand to the first energy source 2940 or to the fifth plug connection 3024 with the fifth plug and the fifth socket for connecting and supplying the first energy source 2940 on the other hand. This disconnection or connection typically depends on the electrical current 29 through the twenty-first fuse 3120 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the twenty-first fuse 3120 or in the area of the fifth plug-in connection 3024 relative to a reference potential 201 and/or from a data command via the backup data bus 9. The twenty-first fuse 3120 and the thirteenth fuse 2950 and the fourteenth fuse 2951 may have a common control device 4;

The supply network 3100 of the 1 includes a twenty-second fuse 3121 of the second energy source 2941. The twenty-second fuse 3121 can, by means of its circuit breaker 17, connect the second energy feed point 2925 to the second energy source 2941 or to the sixth plug-in connection 3025 with the sixth plug and the sixth socket for connection and supply the second energy source 2941 on the other hand, or connect the sixth energy extraction point 2925 to the second energy source 2941 on the one hand or to the sixth plug-in connection 3025 with the sixth plug and the sixth socket for connecting and supplying the second energy source 2941 on the other hand. This disconnection or connection typically depends on the electrical current 29 through the twenty-second fuse 3121 and/or the electrical voltage of the supply line ring 2910 to 2915 in the area of the twenty-second fuse 3121 or in the area of the sixth plug-in connection 3025 relative to a reference potential 201 and/or from a data command via the backup data bus 9. The twenty-second fuse 3121 and the fifteenth fuse 2952 and the sixteenth fuse 2953 may have a common controller 4;

figure 32

32 corresponds to a large extent to 11 , where the supply network 3200 of 32 a first sub-supply network 3201 and a second sub-supply network 3202. In the example of 32 If the first sub-supply network 3201 is to have high voltage values greater than 50V, the voltage between supply line sections 3260 to 3265 of the first sub-supply network 3201 on the one hand and a reference potential 20 and/or the supply line sections 3260 to 3265 of the second sub-supply network 3202 on the other hand. In the example of 32 should the second Sub-supply network 3202, in contrast, have low voltage values of less than 50V, for example, of the voltage between supply line sections 3266 to 3278 of the second sub-supply network 3202 on the one hand and reference potential 201.

The supply network 3200 of the 31 includes a first sub-supply network 3201 of the supply network 3200. The first sub-supply network 3201 has in the example of 32 for example high voltage values greater than 50V of the voltage between supply line sections 3260 to 3265 of the first partial supply network 3201 on the one hand and a reference potential 201 or the supply line sections 3260 to 3265 of the second partial supply network 3202 on the other;

The supply network 3200 of the 31 includes a second sub-supply network 3202 of the supply network 3200. The second sub-supply network 3202 has in the example of 32 for example low voltage values of less than 50V of the voltage between supply line sections 3266 to 3278 of the second partial supply network 3202 on the one hand and a reference potential 201;

The supply network 3200 of the 31 includes an operating voltage 3206 for the fuses in the HV supply sub-grid 3201.

The supply network 3200 of the 31 includes a first cross fuse 3210 in the first supply sub-network 3201 for voltages greater than 50V.

The supply network 3200 of the 31 includes a second cross fuse 3211 in the first partial supply network 3201 for voltages greater than 50V.

The supply network 3200 of the 31 includes a third cross fuse 3212 in the first supply subsystem 3201 for voltages greater than 50V.

The supply network 3200 of the 31 includes a fourth cross fuse 3213 in the second supply subsystem 3202 for voltages of less than 50V.

The supply network 3200 of the 31 includes a fifth cross fuse 3214 in the second supply subsystem 3202 for voltages less than 50V.

The supply network 3200 of the 31 includes a sixth cross fuse 3215 in the second supply subsystem 3202 for voltages of less than 50V.

The supply network 3200 of the 31 includes a seventh cross fuse 3216 in the second supply subsystem 3202 for voltages of less than 50V.

The supply network 3200 of the 31 includes an eighth cross fuse 3217 in the second supply subsystem 3202 for voltages of less than 50V.

The supply network 3200 of the 31 includes a ninth cross fuse 3218 in the second supply subsystem 3202 for voltages of less than 50V.

The supply network 3200 of the 31 comprises a first energy source 3250 in the first partial supply network 3201 for voltages greater than 50V.

The supply network 3200 of the 31 comprises a second energy source 3251 in the first partial supply network 3201 for voltages greater than 50V.

The supply network 3200 of the 31 comprises a third energy source 3252 in the second partial supply network 3202 for voltages of less than 50V.

The supply network 3200 of the 31 comprises a fourth energy source 3253 in the second partial supply network 3202 for voltages of less than 50V.

The supply network 3200 of the 31 comprises a fifth energy source 3254 in the second partial supply network 3202 for voltages of less than 50V.

The supply network 3200 of the 31 comprises a sixth energy source 3255 in the second partial supply network 3202 for voltages of less than 50V.

The supply network 3200 of the 31 comprises supply line sections 3260 to 3265 in the first partial supply network 3201 for voltages greater than 50V.

The supply network 3200 of the 31 comprises supply line sections 3266 to 3278 in the second partial supply network 3202 for voltages of less than 50V.

The supply network 3200 of the 31 includes an operating voltage source 3280 for the operation of the control devices 4 of the electronic fuses 405 in the first HV supply sub-grid 3201.

The supply network 3200 of the 31 includes an optical data bus 3290 for electrical isolation.

The 32 thus shows a schematic example of a supply network 3200, the supply network 3200 having supply sub-grids 3202 with voltages of less than 50V (LV grids) and supply sub-grids 3201 with voltages greater than 50V (HV grids). The supply network 3200 comprises a data bus 9, which is preferably embodied as an optical data bus 3290 in the area of the voltage domain boundaries between supply sub-networks 3202 with voltages of less than 50V on the one hand and supply sub-networks 3201 with voltages greater than 50V.

The supply network 3200 should at least include a data bus 9, which is designed as a data bus with electrical isolation 3290 in the area of the voltage domain boundaries between supply sub-networks 3202 with voltages of less than 50V on the one hand and supply sub-networks 3201 with voltages greater than 50V.

At least two electronic fuses (3210, 3211, 3212) are preferably cascaded within one or more supply lines of the supply lines (3260, 3262, 3263, 3264), which fuses the supply line (3260, 3262, 3263, 3264) in different supply line sections (3260, 3262 , 3263, 3264).

Figure 33

33 shows a supply network 3300 similarly 31 to explain the prioritization of consumers and energy sources and a favorable topology of the supply network 3300 to support this prioritization. Firstly, the electrical connection point 2920 of a more important consumer 2930 to a supply line 2910 of the supply network 3300 is arranged in the part of the supply line 2910, 2911 closer to the energy source 2940, while the electrical connection point 2921 of a less important consumer 2931 to the supply line 2911 in the further part of the supply line 2910, 2911 lying from the energy source 2940 is arranged. As a result, the energy supply can be prioritized by interrupting the supply line between an important consumer 2930 and a less important consumer 2931 without endangering the energy supply of the important consumer 2930 . For this purpose, there is preferably an electronic fuse 2961, 2962 between the electrical connection point 2920 of the more important consumer 2930 to the supply line 2910, 2911 and the electrical connection point 2921 of the less important consumer 2931 to the supply line 2915, 2910, 2911. This respective electronic fuse 2961, 2962 can then use their respective circuit breakers 17 to stop the energy supply to the less important consumer 2931 by interrupting the supply line 2915, 2910, 2911. In the example of 33 the cross fuse 3011 includes a further fuse 3111, which can also prevent the power supply of the less important consumer 2931 with its circuit breaker 17.

The computer core 2 of the control device 4 of an electronic fuse (2961, 2962) in the supply network 2915, 2910, 2911 and/or the computer core 2 of the control device 4 of the fuse 3111 in the branch line 3021 to the less important consumer 2931 preferably disconnect the less important consumer 2931 and/or the supply line section 2911 of the less important load 2931 and/or the stub 3021 for supplying the less important load 2931 in the event of a fault or malfunction of the less important load 2931 or in the event of a fault or a fault in the supply line section 2911 of the less important consumer 2931 and/or in the event of a fault or a fault in the branch line 3021 of the less important consumer 2931 from the supply network 2915, 2910, 2911.

The advantage is that the supply network then continues to supply electrical energy to the more important consumer 2930 in the event of such a fault or such a fault.

In an analogous manner, the supply network 3300 can also configure the energy sources in a prioritized manner. Secondly, the electrical connection point 2924 of a more important energy source 2940 to a supply line 2915, 2910, 2911 of the supply network 3300 is therefore preferably arranged in the part of the supply line 2915, 2910, 2911 that is closer to one or more consumers 2930, 2931, while the electrical connection point 2925 of a less important energy source 2925 to the supply line 2915, 2910, 2911 in that part of the supply line 2915, 2910, 2911 that is further from the one or more consumers 2930, 2931. This ensures that the energy sources can be prioritized. Between the electrical connection point 2924 of the more important energy source 2940 to the supply line 2915, 2910, 2911 and the electrical connection point 2925 of the less important energy source 2941 to the supply line 2915, 2910, 2911 there is preferably an electronic fuse 2951, 2952. In the example of 33 there is another fuse 3121 in the branch line between the connection point 2925 of the less important energy source 2941 and the less important energy source 2941.

This electronic fuse 2951, 2952 can protect the less important energy source 2941 in the event of a fault and/or malfunction of the less important energy source 2941 or the supply line section 2915 of the less important energy source 2941 or the stub line 3025 of the less important energy source 2941 from the supply line 2915, 2910 , 2911 of the supply network 3300 disconnect. In such an event of such a disturbance, the utility grid 3300 can continue to draw electrical energy from the more important energy source 2940 .

The document presented here also describes, by way of example, a supply network 3300, the supply network 3300 comprising at least one supply line 2915, 2910, 2911, a first electrical consumer 2930, a second electrical consumer 2931 and an energy source 2940. The first electrical consumer 2930 is connected to the supply line 2915, 2910, 2911 at a first connection point 2920 via a seventeenth electronic fuse 3110 by means of a first spur line 3020. The second electrical load 2931 is connected to the supply line 2915, 2910, 2911 by means of a second spur line 3021 at a second connection point 2921 via an eighteenth electronic fuse 3111. The first connection point 2920 is spaced from the second connection point 2921 . The first connection point 2920 is closer to the energy source 2940 than the second connection point 2921.

If both consumers 2930 and 2931 are equally sensitive to damage, the supply network 3300 should switch off the first consumer last, since it is more important. The computer core 2 of the control device 4 of the seventeenth electronic fuse 3110 therefore then switches off the circuit breaker 17 of the seventeenth electronic fuse 3110 with a temporally longer first delay time than the delay time with which the computer core 2 of the control device 4 of the eighteenth electronic fuse 3111 in relation to a switch-off event from the circuit breaker 17 of the eighteenth electronic fuse 3111.

Unless both consumers 2930 and 2931 are equally sensitive to damage and the first consumer 2930 is more sensitive, the supply network 3300 should switch off the first consumer first, since it is more important, for improved protection. The computer core 2 of the control device 4 of the seventeenth electronic fuse 3110 in relation to a switch-off event therefore then switches off the circuit breaker 17 of the seventeenth electronic fuse 3110 with a shorter first delay time than the delay time with which the computer core 2 of the control device 4 of the eighteenth electronic fuse 3111 in relation to a switch-off event from the circuit breaker 17 of the eighteenth electronic fuse 3111

The document presented here also describes a supply network 3300, the supply network 3300 comprising at least one supply line 2915, 2910, 2911, a first electrical energy source 2940, a second electrical energy source 2941 and one or more electrical consumers 2930, 2931. The first electrical energy source 2940 is at a first connection point 2924 connected to the supply line 2915, 2910, 2911 via a twenty-first fuse 3120. The second electrical energy source 2941 is connected to the supply line 2915, 2910, 2911 at a second connection point 2925 via a twenty-second fuse 3121. The first connection point 2924 is spaced from the second connection point 2925 . The first connection point 2924 is closer to the one or more electrical consumers 2930, 2931 than the second connection point 2925. The computer core 2 of the control device 4 of the twenty-first electronic fuse 3120 also switches the power switch 17 of the twenty-first electronic fuse 3120 in relation to a switch-off event a longer delay time than the delay time with which the computer core 2 of the control device 4 of the twenty-second electronic fuse 3121 switches off the circuit breaker 17 of the twenty-second electronic fuse 3121 in relation to a switch-off event.

figure 34

• In einem ersten Schritt erfassen 3410 und/oder ermitteln die Rechnerkerne 2 der Steuervorrichtungen 4 der elektronischen Sicherungen die jeweiligen Wert der jeweiligen elektrischen Ströme 29 durch einen oder mehrere ihrer jeweiligen Leistungsschalter 17 einer oder mehrerer jeweiliger elektronischer Sicherungen der Sicherungen 1110 bis 1118 des Versorgungsnetzwerks 1100. Das Erfassen 3410 kann dabei auch die Ermittlung eines jeweiligen Stromwerts eines jeweiligen Hilfsstroms 36 durch einen jeweiligen Shunt-Widerstand 24 der jeweiligen Sicherung bedeuten, wenn der jeweilige Hilfsstrom im Wesentlichen proportional zum jeweiligen Strom 29 durch den jeweiligen Leistungsschalter 17 der jeweiligen Sicherung und/oder wenn der Rechnerkern 2 der Steuervorrichtung 4 der jeweiligen elektronischen Sicherung und/oder ein übergeordnetes Rechnersystem 12 von dem Wert des jeweilige Hilfsstroms mittels eines vorbekannten mathematischen Zusammenhangs auf den jeweiligen Wert des jeweiligen Stroms 29 durch den jeweiligen Leistungsschalter 17 der jeweiligen Sicherung schließen können.

34 exemplifies and simplifies a method 3400 for active power management in a supply network 1100 (see 11 ) with electrical fuses 1110 to 1118 for supplying electrical consumers 1121 to 1125 in this supply network 1100 with electrical energy from one or more electrical energy sources 1150 to 1155. The in the 11 Cross fuses 1110 to 1118 shown generally include four electronic fuses. The document presented here nevertheless references these fuses here with the reference numbers 1110 to 1118 to simplify the illustration. The proposed method 3400 includes the following steps, among others:

• In a first step, the computer cores 2 of the control devices 4 of the electronic fuses record 3410 and/or determine the respective value of the respective electric currents 29 through one or more of their respective circuit breakers 17 of one or more respective electronic fuses of the fuses 1110 to 1118 of the supply network 1100. The detection 3410 can also mean the determination of a respective current value of a respective auxiliary current 36 through a respective shunt resistor 24 of the respective fuse if the respective auxiliary current is essentially proportional to the respective current 29 through the respective circuit breaker 17 of the respective fuse and/or if the computer core 2 of the control device 4 of the respective electronic fuse and/or a higher-level computer system 12 can infer the respective value of the respective current 29 through the respective circuit breaker 17 of the respective fuse from the value of the respective auxiliary current by means of a previously known mathematical relationship.

In a second step, the respective computer cores 2 of the control devices 4 of the respective fuses record 3420 and/or determine the respective values of the voltage difference between one or more connections ( 26, 27, 28) of the respective circuit breaker 17 of the respective fuse against a reference potential (201) of a reference potential contact.

In a third step, the respective computer cores 2 of the control devices 4 of the respective fuses preferably calculate 3430 the respective theoretical ground offset of the respective local reference potential 201 at the control device 4 of the respective fuse as a result of the respective local energization of the respective circuit breakers 17 of the respective fuse. For this purpose, the respective computer cores 2 of the respective control device 4 of the respective fuses preferably use a model with a preferably respective fuse-specific parameterization.

In a fifth step, the computer cores 2 of the control devices 4 of the respective fuses preferably correct 3440 the respective measured voltage values of the respective recorded voltage values by the calculated value of the respective theoretical ground offset to the respective corrected voltage values.

The computer cores 2 of the control devices 4 of the fuses preferably transmit their respective corrected voltage values to a higher-level computer system 12.

The computer cores 2 of the control devices 4 of the fuses preferably transmit their respective measured current values for the respective current 29 through the respective circuit breaker 17 to a higher-level computer system 12.

The computer cores 2 of the control devices 4 of the fuses preferably transmit these calculated values of the respective theoretical mass offsets to a higher-level computer system 12.

Preferably, the computer cores 2 of the control devices 4 of the fuses also transmit the uncorrected measured voltage values of the respective recorded voltage values to a higher-level computer system 12.

As a result, the higher-level computer system 12 can detect errors that occur in the overall system.

A computer core 2 of a control device 4 of a fuse and/or the higher-level computer system 12 preferably infers 3450 status parameters of supply line sections of the supply line sections (3260 to 3278) of the supply network with the aid of the parameters recorded in this way, such as current values and voltage values.

For example, such state parameters of a supply line section of the supply line sections 3260 to 3278, which a computer core 2 of a control device 4 of an electronic fuse and/or the higher-level computer system 12 determine, a resistance per unit length of a supply line section of the supply line sections 3260 to 3278 and/or the temperature of a supply line section of the supply line sections ( 3260 to 3278).

For example, a computer core 2 of a control device 4 of a fuse and/or the higher-level computer system 12 can calculate an estimated temperature of a supply line section using a known temperature coefficient of the line material of the relevant supply line section of the supply line sections 3260 to 3278 and the known design data such as the length and cross section of the supply line section determine 3460.

figure 35

35 illustrates in a simplified and schematic manner a method 3500 for operating a vehicle with equipment variants, the activation and deactivation of the equipment variants of the vehicle taking place at least in part preferably by means of the supply network and by means of the electronic fuses and their circuit breakers 17 .

The first step of the presented method includes providing 3505 a vehicle with a supply network 3300 (see, for example, 33 ) for supplying electrical consumers 2930, 2931 of the vehicle with electrical energy. The vehicle preferably includes one or more energy sources 2940, 2941, one or more consumers 2930, 2931 and several electronic fuses 2960 to 2963 and 2959 to 2953. The supply lines 2915, 2910, 2911 connect the consumers 2930, 2931 to one or more energy sources Energy sources 2940, 2941. The consumers 2930, 2931 and the energy sources 2940, 2941 are preferably connected to one another together with the supply lines 2915, 2910, 2911 in a tree structure 3300 or a supply network. The tree structure includes subtrees and the supply network includes subnetworks ([2915, 3015, 3025, 2941]; [2940, 3024, 3014, 2910, 3010, 3020, 2930]; [2911, 3011, 2931]). First, electronic fuses (2960 to 2963 and 2959 to 2953) are preferably inserted in supply lines of the supply network, so that the computer cores 2 of the control devices 4 of these electronic fuses (2960 to 2963 and 2959 to 2953) use their respective circuit breakers 17 to form respective subtrees of the tree structure of of the rest of the tree structure or connect to this rest of the tree structure.

Secondly, electronic fuses (2916, 2962, 2951, 2952) are preferably inserted into supply lines in the supply network, so that the computer cores 2 of the control devices 4 of these electronic fuses (2960 to 2963 and 2959 to 2953) connect these respective sub-networks by means of their respective circuit breakers 17 ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) of the supply network 3300 can be separated from the rest of the supply network 3300 or connected to this rest of the supply network 3300-. As a result, these respective sub-networks ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) and/or respective sub-trees essentially no longer have any energy supply and/or no energy consumption after a respective separation.

By means of commands from a user 730 via a terminal 740 and/or by commands from a server 710 of a service provider and/or a vehicle manufacturer or by other access to the higher-level computer system 12 and/or the computer cores 2 of the control devices 4 of fuses of the supply network, a programming 3510 of specific equipment variants can now take place.

Here, for example, a first equipment variant of these equipment variants of the vehicle should differ from a second equipment variant of these equipment variants of the vehicle.

For example, at least the computer core 2 of the control device 4 of an electronic fuse of these electronic fuses (2916, 2962, 2951, 2952) can have a subtree of the tree structure or a subnetwork ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) of the supply network 3300 in the first equipment variant using the circuit breaker 17 to separate this electronic fuse from the rest of the tree structure or the rest of the supply network 3300 and in the second equipment variant to the rest of the tree structure or the rest of the supply network 3300. As a result, the supply network 3300 supplies this sub-tree or sub-network ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) of the supply network 3300 with electrical energy from the energy sources of the supply network 3300 only in the second equipment variant Only in the second equipment variant can one or more electrical consumers 2931 of the sub-network in question ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) have an electrical energy consumption that the supply network 3300 only uses in this second equipment variant supplied with electrical energy via a closed circuit breaker 17 of the relevant electronic fuse.

The programming 3510 of certain equipment variants is preferably carried out by transmitting programming data to the computer cores 2 of the control devices 4 of electronic fuses of the supply network 3300 via a data bus 9 of the supply network 3300.

This communication and/or programming 3510 preferably takes place by means of encrypted communication via the control data bus 9 of the supply network 3300 for programming the equipment variants and/or for communication via the control data bus 9. This communication and/or programming 3510 preferably takes place by means of encrypted communication via the control data bus 9 of the supply network 3300 for programming the equipment variants and/or for communication via the control data bus 9 for programming the equipment variants only after transmission of a password to the computer core 2 of the control device 4 of the corresponding electronic fuse.

The higher-level computer system 12 preferably communicates and/or programs 3510 the higher-level computer system 12 by means of encrypted communication via the control data bus 9 of the supply network 3300 for programming the equipment variants and/or for communication via the control data bus 9. The higher-level computer system 12 preferably communicates and/or programs 3510 the higher-level computer system 12 by means of encrypted communication via the control data bus 9 of the supply network 3300 for programming the equipment variants and/or for communication via the control data bus 9 for programming the equipment variants only after transmission of a password from the higher-level computer system 12 to the computer core 2 of the control device 4 of the corresponding electronic fuse.

The communication between a computer core 2 of a control device 4 of an electronic fuse and its environment preferably takes place via such data connections via the data bus 9 in a cryptographic manner using a PQC method. (PQC=post quantum cryptography);

A server 710 of a service provider and/or a vehicle manufacturer preferably communicates with the higher-level computer system 12 via an encrypted data line 720. The server 710 and the higher-level computer system preferably use a PQC-encrypted communication protocol. The higher-level computer system 12 preferably uses a PQC-encrypted communication protocol for data communication via the data bus 9 of the supply network with computer cores 2 of control devices 4 of fuses of the supply network. The computer cores 2 of the control devices 4 of the electronic fuses of the supply network preferably use a PQC encrypted communication protocol for data communication via the data bus 9 of the supply network with the computer cores 2 of control devices 4 of fuses of the supply network.

• ‚BIKE1-L1-CPA‘, ‚BIKE1-L3-CPA‘, ‚BIKE1-L1-FO‘, ‚BIKE1-L3-FO‘, ‚Kyber512‘, ‚Kyber768‘, ‚Kyber1024‘, ‚Kyber512-90s‘, ‚Kyber768-90s‘, ‚Kyber1024-90s‘, ‚LEDAcryptKEM-LT12‘, ‚LEDAcrypt-KEM-LT32‘, ‚LEDAcryptKEM-LT52‘, ‚NewHope-512-CCA‘, ‚NewHope-1024-CCA‘, ‚NTRU-HPS-2048-509‘, ‚NTRU-HPS-2048-677‘, ‚NTRU-HPS-4096-821‘, ‚NTRU-HRSS-701‘, ‚LightSaber-KEM‘, ‚Saber-KEM‘, ‚FireSaber-KEM‘, ‚BabyBear‘, ‚BabyBearEphem‘, ‚Mama-Bear‘, ‚MamaBearEphem‘, ‚PapaBear‘, ‚PapaBearEphem‘, ,FrodoKEM-640-AES', ‚FrodoKEM-640-SHAKE‘, ‚FrodoKEM-976-AES‘, ‚FrodoKEM-976-SHAKE‘, ‚FrodoKEM-1344-AES‘, ‚FrodoKEM-1344-SHAKE‘, ‚SIDH-p434‘, ‚SIDH-p503‘, ‚SIDH-p610‘, ,SIDH-p751', ‚SIDH-p434-compressed‘, ‚SIDH-p503-compressed‘, ‚SIDH-p610-compressed‘, ‚SIDH-p751-compressed‘, ‚SIKE-p434‘, ‚SIKE-p503‘, ‚SIKE-p610‘, ‚SIKE-p751‘, ‚SIKE-p434-compressed‘, ‚SIKE-p503-compressed‘, ‚SIKE-p610-compressed‘, ‚SIKE-p751-compressed‘.

These computer cores 2 and/or the higher-level computer system 12 and/or the servers 710, 750 and/or the terminal 740 particularly preferably use one or more of the following methods for PQC encryption:

• 'BIKE1-L1-CPA', 'BIKE1-L3-CPA', 'BIKE1-L1-FO', 'BIKE1-L3-FO', 'Kyber512', 'Kyber768', 'Kyber1024', 'Kyber512-90s', 'Kyber768-90s', 'Kyber1024-90s', 'LEDAcryptKEM-LT12', 'LEDAcrypt-KEM-LT32', 'LEDAcryptKEM-LT52', 'NewHope-512-CCA', 'NewHope-1024-CCA', 'NTRU -HPS-2048-509', 'NTRU-HPS-2048-677', 'NTRU-HPS-4096-821', 'NTRU-HRSS-701', 'LightSaber-KEM', 'Saber-KEM', 'FireSaber -KEM', 'BabyBear', 'BabyBearEphem', 'Mama-Bear', 'MamaBearEphem', 'PapaBear', 'PapaBearEphem', 'FrodoKEM-640-AES', 'FrodoKEM-640-SHAKE', 'FrodoKEM-976 -AES', 'FrodoKEM-976-SHAKE', 'FrodoKEM-1344-AES', 'FrodoKEM-1344-SHAKE', 'SIDH-p434', 'SIDH-p503', 'SIDH-p610', ,SIDH-p751 ', 'SIDH-p434-compressed', 'SIDH-p503-compressed', 'SIDH-p610-compressed', 'SIDH-p751-compressed', 'SIKE-p434', 'SIKE-p503', 'SIKE-p610 ', 'SIKE-p751', 'SIKE-p434-compressed', 'SIKE-p503-compressed', 'SIKE-p610-compressed', 'SIKE-p751-compressed'.

• ‚DILITHIUM_2‘, ‚DILITHIUM_3‘, ‚DILITHIUM_4‘, ‚MQDSS-31-48‘, MQDSS-31-64', SPHINCS+-Haraka-128f-robust', SPHINCS+-Haraka-128f-simple', ‚SPHINCS+-Haraka-128s-robust‘, ‚SPHINCS+-Haraka-128s-simple‘, ‚SPHINCS+-Haraka-192f-robust‘, ‚SPHINCS+-Haraka-192f-simple‘, ‚SPHINCS+-Haraka-192s-robust‘, ‚SPHINCS+-Haraka-192s-simple‘, ‚SPHINCS+-Haraka-256f-robust‘, ‚SPHINCS+-Haraka-256f-simple‘, ‚SPHINCS+-Haraka-256s-robust‘, ‚SPHINCS+-Haraka-256s-simple‘, ‚SPHINCS+-SHA256-128f-robust‘, ,SPHINCS+-SHA256-128f-simple', ‚SPHINCS+-SHA256-128s-robust‘, ‚SPHINCS+-SHA256-128s-simple‘, ‚SPHINCS+-SHA256-192f-robust‘, ‚SPHINCS+-SHA256-192f-simple‘, ‚SPHINCS+-SHA256-192s-robust‘, ‚SPHINCS+-SHA256-192s-simple‘, ‘SPHINCS+-SHA256-256f-robust‘, ‚SPHINCS+-SHA256-256f-simple‘, ‘SPHINCS+-SHA256-256s-robust‘, ‘SPHINCS+-SHA256-256ssimple‘, ‘SPHINCS+-SHAKE256-128f-robust‘, ‚SPHINCS+-SHAKE256-128f-simple‘, ‚SPHINCS+-SHAKE256-128s-robust‘, ‚SPHINCS+-SHAKE256-128s-simple‘, 'SPHINCS+-SHAKE256-192f-robust', 'SPHINCS+-SHAKE256-192fsimple', ‚SPHINCS+-SHAKE256-192s-robust‘, ‚SPHINCS+-SHAKE256-192s-simple‘, ‚SPHINCS+-SHAKE256-256f-robust‘, ‚SPHINCS+-SHAKE256-256fsimple‘, ‚SPHINCS+-SHAKE256-256s-robust‘, ‚SPHINCS+-SHAKE256-256s-simple‘,m'picnic_L1_FS', ‚picnic_L1_UR‘, ‚picnic_L3_FS‘, ‚picnic_L3_UR‘, ‚picnic_L5_FS‘, ‚picnic_L5_UR‘, ‚picnic2_L1_FS‘, ‚picnic2_L3_FS‘, ‚picnic2_L5_FS‘, ‚qTesla-p-I‘, ‚qTesla-p-III‘.

These computer cores 2 and/or the higher-level computer system 12 and/or the servers 710, 750 and/or the terminal 740 particularly preferably use one or more of the following PQC signature methods for signing data messages:

• 'DILITHIUM_2', 'DILITHIUM_3', 'DILITHIUM_4', 'MQDSS-31-48', MQDSS-31-64', SPHINCS+-Haraka-128f-robust', SPHINCS+-Haraka-128f-simple', 'SPHINCS+-Haraka- 128s-robust', 'SPHINCS+-Haraka-128s-simple', 'SPHINCS+-Haraka-192f-robust', 'SPHINCS+-Haraka-192f-simple', 'SPHINCS+-Haraka-192s-robust', 'SPHINCS+-Haraka- 192s-simple', 'SPHINCS+-Haraka-256f-robust', 'SPHINCS+-Haraka-256f-simple', 'SPHINCS+-Haraka-256s-robust', 'SPHINCS+-Haraka-256s-simple', 'SPHINCS+-SHA256- 128f-robust', ,SPHINCS+-SHA256-128f-simple', 'SPHINCS+-SHA256-128s-robust', 'SPHINCS+-SHA256-128s-simple', 'SPHINCS+-SHA256-192f-robust', 'SPHINCS+-SHA256- 192f-simple', 'SPHINCS+-SHA256-192s-robust', 'SPHINCS+-SHA256-192s-simple', 'SPHINCS+-SHA256-256f-robust', 'SPHINCS+-SHA256-256f-simple', 'SPHINCS+-SHA256- 256s-robust', 'SPHINCS+-SHA256-256ssimple', 'SPHINCS+-SHAKE256-128f-robust', 'SPHINCS+-SHAKE256-128f-simple', 'SPHINCS+-SHAKE256-128s-robust', 'SPHINCS+-SHAKE256-128s- simple', 'SPHINCS+-SHAKE256-192f-robust', 'SPHINCS+-SHAKE256-192fsimple', 'SPHINCS+-SHAKE256-192s-robust', 'SPHINCS+-SHAKE256-192s-simple', 'SPHINCS+-SHAKE256-256f-robust' . 'picnic_L5_UR', 'picnic2_L1_FS', 'picnic2_L3_FS', 'picnic2_L5_FS', 'qTesla-pI', 'qTesla-p-III'.

The activation and/or deactivation of an electronic fuse, i.e. switching on or off the power switch 17 of the electronic fuse, preferably requires the transmission of a digital password from the computer core 2 of the control device 4 of another electronic fuse and/or from the computer 12 of a control device , ie for example from the superordinate computer system 12 and/or from a server 710 of a service provider and/or automobile manufacturer via a data bus 9 to the computer core 2 of the control device 4 of the electronic fuse. The computer core 2 of the control device 4 of the electronic security device preferably verifies the passwords and commands received before they are executed. He preferably checks for correctness of the content, for example whether the passwords match the commands and/or whether the commands are admissible, for example whether the correct participants in the supply network are also authorized to give these commands and/or whether the participants in the supply network also have the participants are who they claim to be and/or whether the commands are permitted and/or useful in the current usage situation and/or the current state of the vehicle and/or the supply network. If this check by the computer core 2 of the control device 4 of the fuse is successful, then the computer core 2 of the control device 4 of the fuse executes the command.

It is part of the proposal presented in this document to use the supply lines of the supply network themselves as lines of the data bus 9 of the supply network. In particular, the vehicle and/or the supply network and/or device parts thereof can use data communication via the supply lines of the supply network as emergency communication when the normal data bus 9 is disrupted. The document proposed here also proposes using a supply voltage line 6 for supplying the electronic fuses with electrical energy for such a power-line communication as emergency operation of the fuse data bus. In this case, such a supply voltage line 6 is part of a backup data bus 9. In this case, the communication takes place via this data bus 9 using power-line communication. This emergency communication via the supply voltage line 6 can be communication between at least two computer cores 2 of at least two control devices 4 of two electronic fuses and/or between a computer core 2 of a control device 4 of an electronic fuse on the one hand and a higher-level computer system 12 on the other via this data bus 9.

In order to minimize switching and inrush currents, it makes sense if, after changing an equipment variant by programming a new equipment variant, the fuses that have to change their switching state for this equipment variant change, i.e. at least two electronic fuses, better all affected electronic fuses change their switching state with a time delay and essentially do not change their switching state at the same time. For example, the higher-level computer system 12 can signal to the computer cores 2 of the control devices 4 of these affected fuses of the supply network at which time value of the respective timer 35 of the respective control device 4 of the respective fuse which computer core 2 of which control device 4 of which fuse should change the switching state of which of its circuit breakers 17 and how.

Since the higher-level computer system 12 can inform the computer cores 2 of the control devices 4 of the fuses at which point in time, i.e. the time value of their respective timers 35, they should bring their respective circuit breaker 17 into which switching state (closed vs. open), it is conceivable that this higher-level computer system 12 of the vehicle programmed a predefined sequence of equipment variants at certain time intervals in predetermined operating states. For the individual computer core 2 of a control device 4 of a fuse, this then meant that the higher-level computer system specified a sequence of switching states of the circuit breaker 17 of this fuse to this computer core 2 of the control device 4 of a fuse, with the higher-level computer system preferably specifying a switching state of the circuit breaker to be assumed for each equipment variant to be assumed circuit breaker 17 of the fuse to the computer core 2 of the control device 4 of the fuse together with the point in time, i.e. the timer value of the timer 35, at which the computer core 2 of the control device 4 of the fuse is to bring the circuit breaker 17 of the fuse into this state. The higher-level computer system 12 preferably transmits to the computer core 2 of the control device 4 of the fuse 1 only the changes in the switching state of the circuit breaker 17 of the relevant fuse and the planned time of the switching state change.

Preferably, after the vehicle is switched on, the higher-level computer system 12 transfers the vehicle from the parked state to the driving state by programming at least two equipment variants at two different programming times at a time interval between the programming times that differs from 0s. For the purpose of the present document, the parking state of the vehicle's supply network and the driving state of the vehicle's supply network are trim levels.

Since the programming of a sequence of equipment variants may require a certain amount of time, the higher-level computer system preferably determines a time reference point to which the programmed switching times for the equipment variant changes relate. For this purpose, the higher-level computer system 12 preferably sends the computer cores 2 of the control devices 4 of the relevant electronic fuses a start signal, preferably at the same time, via the data bus 9, whereupon they generate the sequence of the equipment variants for the respective electronic fuse and preferably set them in a timely manner.

Prior to the transmission of the start signal, the higher-level computer system 12 preferably programs the values of waiting times that the computer cores 2 control devices 4 of the electronic fuses are to wait between the arrival of the start signal from the higher-level computer system 12 and the closing or opening of their respective circuit breakers 17 in the Storage of the computer cores 2 of the control devices 4 of the fuses and/or the storage of the control devices of the fuses.

The higher-level computer system 12 or another computer 710, 2, preferably programs these values of the waiting times into a non-volatile memory 14 of the control devices 4 of the relevant electronic fuses.

• Das hier vorgelegte Dokument beschreibt u.a. auch ein Verfahren 3500, das zusätzlich vorsieht, das das übergeordnete Rechnersystem 12 und/oder ein Rechnerkern 2 einer Steuervorrichtung 4 einer Sicherung und/oder ein Terminal 740 eines Nutzers 730 (mit Nutzereingabe) und/oder ein anderer Rechner des Fahrzeugs Authentifizierungsdaten an einen Server 710 eines Freischaltcodeanbieters übermitteln 3520.

At least parts of this programming are preferably carried out at the factory and/or by the higher-level computer system 12 and/or another computer in the vehicle, and thus also by the control device (4) of another electronic fuse:

• The document presented here also describes, among other things, a method 3500 that additionally provides for the higher-level computer system 12 and/or a computer core 2 of a control device 4 of a fuse and/or a terminal 740 of a user 730 (with user input) and/or another computer of the vehicle transmit authentication data to a server 710 of an activation code provider 3520.

Preferably, the server 710 of an unlock code provider or another computer verifies 3525 the authentication data transmitted to the server 710 of an unlock code provider.

The server 710 of an activation code provider and/or a computer of a vicarious agent of the activation code provider generate 3530 an activation code using this or other authentication data according to a fixed procedure and/or provide the generated or a ready made activation code.

If the activation code provider requests payment for the activation, an activation code is then purchased (3535) via a data connection from the terminal 740 of the user 730 and/or from the higher-level computer system 12 and/or from a computer core 2 of a control device 4 of a backup to the server 710 the unlock code provider.

Preferably, the terminal 740 of the user 730 and/or the higher-level computer system 12 and/or the computer core 2 of the control device 4 of the security system transmits to the server 710 of the activation code provider the necessary data to carry out the billing and the data to prove the declaration of intent of the paying person or Institution for the conclusion of the contract and the processing of the contract.

If the data for the contract processing is correct and complete and possibly also successfully verified, the server 710 of the activation code provider transmits 3540 the activation code(s) to the higher-level computer system 12 of the vehicle and/or one or more computer cores 2 of one or more control devices 4 of one or several fuses of the vehicle and thus to the vehicle. If necessary, a program in the terminal 740 of the user 730 logs this successful transmission of one or more activation codes.

Such a transmission can result in the transmission (3545) of one or more activation codes for one or more equipment variants based on the activation codes received to the computer cores 2 of the control devices 4 of the affected electronic fuses by the higher-level computer system 12 .

The higher-level computer system 12 and/or the computer cores 2 of the control devices 4 of the fuses preferably program 3510 the activated equipment variants if the verification of these activation codes is successful.

The document presented here also describes, among other things, a method 3500, which additionally provides that the computer cores 2 of the control devices 4 of fuses of the energy an electronic fuse in a supply branch ([2915, 3015, 3025, 2941]; [2911, 3011, 3021 , 2931]) of the supply tree 3300 as a measured value of the amount of energy and/or the underlying measured values in the electronic fuse record 3550 and determine.

The higher-level computer system 12 or another computer in the supply network or in the vehicle preferably reads 3555 the measured value of the determined amount of energy and/or the underlying measured values from the computer core 2 of the control device of the relevant electronic fuse via the data bus 9.

The higher-level computer system 12 preferably transmits 3560 the measured value of the determined amount of energy and/or the underlying measured values via a data transmission path 720, which is preferably encrypted, from the higher-level computer system 12 to a computer 750 of a service provider, for example an energy supplier or its vicarious agents.

The service provider and/or one of his vicarious agents preferably create 3565 an invoice based on the transmitted measured value or the transmitted measured values of the determined amount of energy and/or the underlying measured values.

The document presented here proposes to check the structural and functional integrity of the supply network during and/or at the beginning and/or at the end of a driving operation of the vehicle.

For this purpose, the higher-level computer system 12 determines 3570 the topology of the supply network using the electronic fuses of the supply network. Here, the higher-level computer system 12 can, for example, cause energy sources in the supply network to feed in test currents in a targeted manner and cause consumers in the supply network to absorb these test currents in a targeted manner. The computer cores 2 of the control devices 4 of the fuses through which these test currents flow can detect them and signal the detected measured current values to the superordinate computer system 12 .

The higher-level computer system 12 determines a topology of the supply network on the basis of the measured values received from the computer cores 2 of the control devices 4 of the fuses.

The higher-level computer system 12 preferably compares 3575 the topology of the supply network determined in this way with the equipment variant that is valid or to be set in order to check the plausibility of the present equipment variant or the admissibility of the determined topology of the supply network.

If the determined topology does not match a permissible topology, the higher-level computer system 12 can transmit this to the server 710 of an automobile manufacturer and/or service provider. Another possible measure in such a case is for the superordinate computer system 12 to switch off supply subnetworks of the supply network by means of appropriate commands to the computer cores 2 of the control devices 4 of corresponding fuses or otherwise restrict their function.

A further variant of the method presented can include the detection of current values for currents 29 through power switches 17 of electronic fuses by the control devices 4 of these fuses in the supply network and the calculation or provision of expected value intervals for these currents 29 through these power switches 17 of electronic fuses in the supply network.

The higher-level computer system 12 preferably checks the supply network with the supply lines and the consumers and the energy sources and the electronic fuses for plausibility by comparing the current values recorded by the control devices 4 of the fuses in the supply network with calculated or provided expected value intervals.

Typically, the higher-level computer system 12 concludes that the supply network has been tampered with and/or that an electrical consumer in the supply network has been tampered with and/or that an electrical energy source in the supply network has been tampered with and/or that a supply line in the supply network has been tampered with and/or that a Equipment variant if the above-described plausibility check has failed.

The document presented here also proposes a method for reducing the starting current (in-rush current). The computer cores 2 of the control devices 4 of the fuses preferably record the current values of the starting currents in the supply network using the measuring means of these fuses. The higher-level computer system 12 preferably collects these current values via the data bus 8 from the computer cores 2 of the control devices 4 of the fuses in the supply network. The higher-level computer system 12 preferably initiates a change in the equipment variant to one with an equipment variant with increased power consumption by other consumers if the amount of the starting current is below a threshold value after a waiting time has elapsed.

The higher-level computer system 12 preferably begins with an equipment variant in which the supply network preferably supplies the consumer that causes the in-rush current with electrical energy. The supply network then preferably does not supply consumers with low priority, or supplies them to a lesser extent, with electrical energy at the beginning.

figure 36

36 is intended to represent possible levels of a data protocol on the data bus 9 of the supply network 200. In the example of 36 let the data bus 9 be a bidirectional and differential data bus 9, which comprises a first single-wire data bus and a second single-wire data bus. The information is preferably transmitted by means of the voltage difference between the electrical potential of the first single-wire data bus minus the second electrical single-wire data bus. This has the advantage that a mass offset that may have an effect as a common-mode interference does not affect the transmitted data. In its preferred role as bus master, the higher-level computer system 12 has a first driver with which it can bring the first single-wire data bus of the differential data bus 9 into a first state Z1 or a second state Z2 or a third state Z3. As a CAN driver, a first driver can preferably assume two of three permitted states: In a first state, it applies a first logic level Z1 to the first single-wire data bus of the differential, bidirectional data bus 9. In a second state, it applies a third logic level Z3 the first single-wire data bus of the differential, bidirectional data bus 9. The first driver of the higher-level computer system 12 also works in the addressing state of the data bus system and the computer cores 2 of the control devices 4 of the electronic fuses of the supply network 200, preferably as the first current sink for the first addressing currents of the first addressing current sources of the data interfaces 10 of the control devices 4 of the electronic fuses. (In the 2 and 3 these would be the electronic fuses 214 to 217 and 225 to 225 and 235 to 238 and 255 and 256). The first driver of the data interface 10 of the control device 4 of an electronic fuse or of the higher-level computer system 12 preferably assumes the first state Z1 when the second driver of the relevant data interface 10 of the relevant control device 4 of the relevant fuse assumes the second state Z2. As a result, the signal is impressed differentially on the differential and bidirectional data bus 9 with a first differential level z1. The first driver of a data interface 10 of a control device 4 of a fuse of the supply network 200 or of the higher-level computer unit 12 preferably assumes the third state Z3 when the second driver of the relevant data interface 10 of the relevant control device 4 of the relevant electronic fuse of the supply network 200 has the third state Z3 accepts. As a result, the signal is impressed differentially with a third differential level z3.

As an RS485 driver, the first driver can preferably assume two of two permitted states: In a first state, it applies a first logic level Z1 to the first single-wire data bus. In a second state, it applies a second logic level Z2 to the first single-wire data bus. The first driver of the higher-level computer system 12 also works in the addressing state of the data bus system and the fuses as a first current sink for the first addressing currents of the addressing current sources of the data interfaces 10 of the control devices 4 of the fuses of the supply network 200 and their quiescent currents. The first driver of a data interface 10 of a control device 4 of a backup of the supply network 200 or of the higher-level computer system 12 preferably assumes the first state Z1 when the second driver of the relevant data interface 10 assumes the second state Z2. As a result, the signal is impressed differentially on the differential, bidirectional data bus 9 with a first differential level z1. The first driver of a data interface 10 or of the higher-level computer system 12 preferably assumes the second state Z2 when the second driver of the relevant data interface 10 or of the higher-level computer system 12 assumes the first state Z1. As a result, the signal is impressed differentially with a second differential level z2. In addition, the first driver typically has a sub-device for detecting and avoiding a bus collision in the event of simultaneous access to the first single-wire data bus by a first driver of another data bus interface 10 of another fuse or the higher-level computer system 12.

A second driver as a CAN driver as a driver of a data interface 10 or the higher-level computer system 12 can preferably assume two of three permitted states: In a first state, it applies a second logic level Z2 to the second single-wire data bus. In a second state, it applies a third logic level Z3 to the second single-wire data bus. The second driver of the higher-level computer system 12 also works in the addressing state of the data bus system and the data interfaces 10 of the fuses as a second current sink for the second addressing currents of the second addressing current sources of the data interfaces of the fuses and their second quiescent currents. The second driver of a data interface 10 of a control device 4 of a fuse or of the higher-level computer system 12 preferably assumes the second state Z2 when the first driver of the relevant data interface 10 of the relevant control device 4 of the relevant fuse the first assumes state Z1. As a result, the signal is impressed differentially with a first differential level z1. The second driver of a data interface 10 of a fuse or of the higher-level computer system 12 preferably assumes the third state Z3 when the first driver of the relevant data interface 10 of the relevant control device 4 of the relevant fuse assumes the third state Z3. As a result, the signal is impressed differentially with a third differential level z3.

As an RS485 driver, the second driver can preferably assume two of two permitted states: In a first state, it places a second logic level Z2 on the first single-wire data bus. In a second state, it applies a first logic level Z1 to the second single-wire data bus. The second driver of the higher-level computer system 12 also works in the addressing state of the data bus system and the data interfaces 10 of the control devices 4 of the fuses of the supply network 200 as a second current sink for the second addressing currents of the second addressing current sources of the data bus interfaces 10 of the control devices 4 of the fuses and their second quiescent currents. The second driver of a data bus interface 10 of a control device 4 of a fuse or of the higher-level computer system 12 preferably assumes the second state Z2 when the first driver of the relevant data bus interface 10 of the relevant control device 4 of the relevant fuse assumes the first state Z1. As a result, the signal is impressed differentially on the data bus 9 with a first differential level z1. The second driver of a data interface 10 of a control device 4 of a fuse or of the higher-level computer system 12 preferably assumes the first state Z1 when the first driver of the relevant data interface 10 of the relevant control device 4 of the relevant fuse assumes the second state Z2. As a result, the signal is impressed differentially on the data bus 9 with a second differential level z2.

In addition, the second driver typically has a sub-device for detecting and avoiding a bus collision in the event of simultaneous access to the first single-wire data bus by a second driver of another data bus interface 10 of another control device 4 of another fuse or the higher-level computer system 12.

figure 37

37 shows today's protection of the cable of a supply line section.

figure 38

38 shows the advantages of securing a supply line section with an electronic fuse;

figure 39

39 shows the combination of two proposed SPAD diodes in cross section.

The semiconductor crystal of the control device 4 of the fuse 1 preferably has at least one first SPAD diode 5394 and at least one second SPAD diode 3955 and at least one optical waveguide 3944. The quantum random number generator 4100, 60 is preferably a quantum process-based true random number generator (QRNG) 60. The quantum process-based true random number generator (QRNG) 60 preferably comprises a first SPAD diode 3954 as a light source for a quantum optical signal and a second SPAD diode 3955 as a Photodetector for the optical quantum signal. Furthermore, the quantum process-based true random number generator (QRNG) 60 preferably comprises at least the processing circuitry and the optical fiber 3944. Preferably, the at least one optical fiber 3944 optically couples the at least one first SPAD diode 3954 to the at least one second SPAD diode 3955. An operating circuit provides electrical energy to the first SPAD diode 3954 such that the first SPAD diode 3954 emits light. In this case, the emission of light requires that the operating voltage provide a sufficient electrical bias voltage of the first SPAD diode 354 (4104.1). A processing circuit (4102, 4103, 4104) detects the signal from the second SPAD diode 3955 (4104.3) and forms the random number from it. The processing circuit then preferably makes the random number formed in this way available to one or more of the one or more processors, in particular the computer core 2 of the control device 4 of the fuse 1, via a data bus 11.

The semiconductor crystal of the control device 4 of the fuse 1 preferably has a surface 3956 . Typically, the semiconductor crystal has a semiconducting material below its surface 3956 on. In particular when using conventional semiconductor circuit manufacturing processes, such as CMOS processes, bipolar processes and BiCMOS processes, the surface 3956 of the semiconductor crystal typically has a metallization stack as structured metal layers and electrical insulation layers. The structured metal layers typically form the conductor tracks, which are electrically isolated from one another by the insulating layers. Thus, the metallization stack has a typically structured and optically transparent and electrically insulating layer 3944 . At least part of this typically structured, transparent and electrically insulating layer 3944 of the surface 3956 preferably forms the optical waveguide 3944. The first SPAD diode 3954 typically radiates light 3957 from the semiconducting material of the semiconductor substrate into this optical waveguide 3944. i.e. As a rule, in contrast to the prior art, the first SPAD diode 3954 radiates essentially upwards perpendicular to the surface 3956 and not to the side into the semiconductor substrate of the semiconductor crystal, which has a high attenuation. Despite this, the emission of the photons 3957 from the first SPAD diode 5394 in the optical waveguide 3944 is not directed. In particular, the emission via the substrate 3948, 3949 is very attenuated since visible light has a very high absorption. This allows the device to couple more photons from the first SPAD diode 3954 to the second SPAD diode 5395 directly. The optical light waveguide 3944 transports these photons 3957, 3958, 3959 of the first SPAD diode 3954 in the light waveguide 3944 to the second SPAD diode 3955 with practically no loss compared to the prior art. The light waveguide 4394 irradiates with these photons 3957, 5398, 3959 of the first SPAD diode 5394 the second SPAD diode 3955 in such a way that the light 5399 from within the optical waveguide 3944 again penetrates into the semiconducting material of the semiconductor substrate from the surface 3956 and there device parts of the second SPAD diode 3955 hits. The second SPAD diode 3955 then generates a received signal as a function of the irradiation with these photons 59 .

Typically, at least one operating circuit supplies the at least one first SPAD diode 3954 with electrical energy at least at times. The at least one first SPAD diode 3954 then feeds photons 3957 into the at least one optical waveguide 3944 when it is supplied with sufficient electrical energy. The optical fiber 3944 then transports these photons 3957, 3958, 3959 further. The at least one optical waveguide 3944 then radiates the transported photons 3958 into the second SPAD diode 3955 as photons 3959 moving essentially vertically. Since this transport of photons from the first SPAD diode 3954 to the second SPAD diode 3955 loses significantly fewer photons than in the prior art design using the highly absorptive semiconductor substrate 3949, 3948 due to the low attenuation in the optical fiber 3944 the quantum efficiency is massively higher. This increases the bit rate at which the device can generate random numbers. A pair of a single first SPAD diode 3954 and a single second SPAD diode 3955 is therefore sufficient in the construction presented here. The prior art always uses multiple SPAD diodes.

figure 40

40 shows the combination of two proposed SPAD diodes in cross section, with several insulation layers now forming the optical waveguide 3944.

40 essentially corresponds to the 39 . In contrast to 39 the semiconductor crystal 3948 and the epitaxial layer 3949 are now covered with a first optically transparent insulating layer, for example an oxide layer 4043. The vias 4040 are filled with metal in an electrically conductive manner. The metallization level 1 with the electrical lines of the first wiring level 4041 contact these vias 4040. On this first insulation layer 4042 and the first metallization layer with the first wiring level 4041, a second optically transparent insulation layer 4044, preferably also in the form of an oxide layer, is applied. This can also be done by vias that are in the 7 are not shown, be plated through, so lines of the first metallization level can be connected to lines of the second metallization level. The boundary surface 4045 drawn in as a dashed line between the first optically transparent insulation layer 4043 and the second optically transparent insulation layer 4044 is essentially also optically transparent and preferably does not essentially reflect and/or absorb the light of the first SPAD diode 3955 . The first optically transparent insulation layer 4043 and the second optically transparent insulation layer 4044 essentially form the optical waveguide (optical waveguide) in the area of the first SPAD diode 3954 and the second SPAD diode 3955. In the optical path between the first SPAD diode 3954 and the The second SPAD diode 3955 is preferably free of vias 4040 and metal lines 4041, so that the light from the first SPAD diode 3954 can reach the second SPAD diode 3955 unhindered. A metal cover 4042 prevents photons from escaping upwards and preferably reflects them back into the optical waveguide 3944 . The vias 4040 and the Metal lines of the first metallization level 4041 similarly prevent light from being lost from the optical fiber in the horizontal.

Figure41

41 FIG. 12 schematically shows the simplified block diagram of a quantum-based random number generator 4100 as proposed in this document.

In the 41 For the sake of clarity, not all of the useful and possibly customary components of the control device 4 are shown. Next device components that the reader as possibly in the 1 can accept present, can be found, for example, in the 1 , 5 , 6 , 9 , 24 , 42 , 52 , 53 , 54 , 55 . The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

A preferred common clock preferably clocks the digital circuits in the example in the 41 device shown. The quantum random number generator 60, 4100 der 41 is preferably part of the control device 4 of the fuse 1. The structure includes an entropy source 4101, preferably a broadband 40 dB high-frequency amplifier 4102 or the like, an analog-to-digital converter 4103, which may also be identical to the analog-to-digital converter 570 or just an inverter or the like. An analog-to-digital converter 4103 with a resolution of 14 bits and a sampling rate of 125 MS/s and with an evaluation device 4104, which essentially comprises sub-devices of the control device 4 of the fuse 1, has proven itself in experiments.

The entropy source 4101 of the quantum random number generator 4100, 60 typically comprises an array of single photon avalanche diodes (SPAD). The quantum random number generator 4100 preferably operates the SPADs in the so-called Geiger mode with a supply voltage above the breakdown voltage. In addition, a quenching resistor 4101.4 is preferably connected in series for each SPAD diode 4101.1, 4101.3. The quenching resistor 4101.4 prevents thermal destruction of the respective SPAD diode 4101.1, 4101.3 when a charge carrier avalanche is triggered. The current signal of the second single photon avalanche diode 4101.3 is measured via a shunt resistor 4101.4 for this second SPAD diode 4101.3. An example of the 41 the series resistor for limiting the current strength (quenching resistor 4101.4) through the respective SPAD diodes 4101.1 and 4101.3 forms the shunt resistor 4101.4. However, the shunt resistor 4101.4 can be inserted into the supply line of the respective SPAD diode 4101.1, 4101.3 independently of the quenching resistor 4101.4. An example array of SPAD diodes includes in the example of FIG 41 for example four active first SPAD diodes 4101.1 and twelve passive second SPAD diodes 4101.3. The exemplary four active, first SPAD diodes 4101.1 and twelve passive, second SPAD diodes 4101.3 are preferably coupled via an optical waveguide 4101.2. The active first SPAD diodes 4101.1 spontaneously and randomly emit individual light pulses. They correspond to the first SPAD diode 3954 of 39 and 40 . The active first SPAD diodes 4101.1, 3954 are preferably located inside the array of first and second SPAD diodes 4101.1 and 4101.3. The proposed device supplies the active, first SPAD diodes 4101.1 with an increased supply voltage, therefore operates the active, first SPAD diodes 4101.1 preferably far above the breakdown voltage of the first SPAD diodes 4101.1, 3954. This increases the dark count rate, which leads to a higher number of spontaneously emitted photons 3957 leads. The optical waveguide 4101.2, 3944 forwards some photons 3958 of the emitted photons 3957 to the passive, second SPAD diodes 4101.3, 3955. The optical waveguide 4101.2, 3944 corresponds to the optical waveguide 3944 of 39 and 40 . The passive, second SPAD diodes 4101.3 correspond to the second SPAD diode 3955 of 39 and 40 . The proposed device supplies the passive, second SPAD diodes 4101.3, 3955 with an increased supply voltage. The proposed device therefore operates the passive, second SPAD diodes 4101.3, 3955 just above the breakdown voltage. The passive, second SPAD diodes 4101.3, 3955 are preferably arranged as a ring around the active, first SPAD diodes 4101.2, 3954. The passive, second SPAD diodes 4101.3, 3955 detect at least part of the photons 3959 arriving via the optical waveguide 4101.2, 3944 , which is assigned to the second SPAD diodes 4101.3, 3955. The entropy source 4101 preferably includes the shunt resistors, the operating device for the SPAD diodes, the SPAD diodes 4101.1 and 4101.3 and the optical waveguide 4101.2. A voltage signal 4105 from the entropy source 4101 preferably connects the entropy source 4101 to a preferred exemplary broadband 40 dB radio frequency amplifier 4102. The voltage signal preferably corresponds to the voltage drop across the quenching resistor 4101.4, which acts as a shunt resistor 4101.4 in the example in the figure. The proposed exemplary radio frequency amplifier 4102 preferably and exemplary has a bandwidth of 30 to 4000 MHz and preferably a 1 dB compression point of 20 dBm. The voltage swing of the voltage signal 4105 of the entropy source 4101 is typically in the sub-millivolt range. The high-frequency amplifier 4102 proposed as an example amplifies the voltage swing of this voltage signal 4105 of the entropy source 4101 to 50 to 150 mV, for example.

An amplifier output signal 4106 of the high-frequency amplifier 4102 connects, for example, the exemplary high-frequency amplifier 4102 to an exemplary evaluation device 4104, which essentially comprises sub-devices of the control device 4 of the fuse 1. The evaluation device 4104 of 41 is just one of many different implementation options for the technical teaching presented in this document. The evaluation device 404 has a microcontroller. The microcontroller is preferably the computer core 2 of the fuse 1. The evaluation circuit 4101 has in the examples of 41 and 42 via an exemplary 14-bit analog-to-digital converter (ADC) 4103, 570 with an exemplary sampling rate of 125 megasamples/s and an exemplary bandwidth of 50 MHz. It has been shown during development that smaller bit widths and lower sampling rates are possible. If necessary, analog pre-processing prior to digitization by the analog-to-digital converter 4103, 570 using circuits for pulse broadening is expedient. The amplified voltage signal of the example radio frequency amplifier 4102 is the amplifier output signal 4106 of the radio frequency amplifier 4102. The analog-to-digital converter 4103, 570 samples the amplifier output signal 4106 of the radio frequency amplifier 4102 at a sampling rate of the analog-to-digital converter 4103, 570 from. The analog-to-digital converter 4103, 570 forwards, for example, the determined samples of the amplifier output signal 4106 of the high-frequency amplifier 4102 digitally with a bus width of, for example, 14 bits to the evaluation device 4104, for example.

The simplified as a block diagram of in 41 The device shown includes, for example, a comparator 4104.2, a time-to-digital converter (TDC=time to digital converter) 4104.3, an entropy extraction device 4104.4 and a finite state machine (finite automaton) 4104.8.

The comparator 4104.2 compares in the example of the 41 the exemplary digital 14-bit value 4107 of the analog-to-digital converter 4103, 570 with a constant 4104.1, which represents a threshold value, and generates a two-clock long 1-bit output pulse on its output signal 4109 of the comparator 4104.2 if the value of the analog -to-digital converter 4103 is greater than the constant 4104.1. The output signal 4109 of the comparator 4104.2 connects the comparator 4104.2 to the time-to-digital converter 4104.3. The time-to-digital converter 4104.3 preferably consists of a 32-bit counter, for example, which counts up in time with the evaluation device 4104. The oscillator 30 and the clock system of the control device 4 typically provide this clock. The bit width of this counter can vary depending on the application. This clock can have a frequency of 125 MHz, for example. The 1-bit output signal of the comparator 4104.2 preferably resets the count of this counter. The time-to-digital converter 4104.3 applies the counter reading present at this point in time immediately before the reset to the output 4110 of the time-to-digital converter (TDC) 4104.3. With an exemplary 125MHz clock, the counting result has a resolution of 1/(125MHz)=8 ns. The output 4110 of the time-to-digital converter (TDC) 4104.3 forwards the exemplary 32-bit count result, also referred to as raw data, of the time-to-digital converter 4104.3 to the entropy extraction 4104.4 that follows in the signal path. The entropy extraction 4104.4 converts the random raw data RD of the time-to-digital converter (TDC) 4104.3 on the signal of the output 4110 of the time-to-digital converter (TDC) 4104.3 into a 1-bit random number 4111 RN. The output 4111 of the entropy extraction 4104.4 is connected to the input of the finite state machine FSM 4104.8.

The finite state machine 4104.8 typically has the task of receiving data in the form of a serial stream of random bits 4111 from the entropy extraction 4104.4, converting the serial stream of random data bits into random data words and storing them in the block RAM 4104.9 of the evaluation device 4104, which is typically the volatile Memory 15 of the control device 4 of the fuse 1 is to store. The finite state machine 4104.8 preferably communicates with the microcontroller 4104.11, which can be identical to the computer core 2 of the control device 4 of a fuse, via an internal data bus 4119, which can be identical to the internal data bus 11 of the control device 4 of the fuse 1. After a successful writing process, the finite state machine 4104.8 sets a finish flag 4104.10. The microcontroller 4104.11 can preferably write and/or read the finish flag 4104.10 via the internal data bus 4119. The finish flag 4104.10 may be part of the RAM 4104.9 or a register of the microcontroller 4104.11. The microcontroller 4104.11 preferably controls and monitors the finite state machine 4104.8 via the internal data bus 4119. The finish flag 4104.10 is preferably not at system start set. The computer core 2, 4104.11 of the control device 4 of the fuse can then access the block RAM 4104.9, 15, for example by means of a C program, and read the random number from the RAM 4104.9, 15. The microcontroller 404.11 is preferably identical to the first processor 10-1 of 1 . The computer core 2 of the control device 4 of the fuse, which operates here as a microcontroller 4104.11, can be a dual-core Arm Cortex-A9 MPCore, for example. The computer core can also execute some of the functions of the sub-devices of the evaluation device 4104 using a suitable program and thus replace these device parts if necessary.

The microcontroller 4105.11 preferably controls a watchdog 4104.5. In the sense of the document presented here, the watchdog 4104.5 is not just a watchdog timer that includes a timer that is clocked with the system clock of the quantum random number generator 4100, 60 or the clock of the control device 4 of the fuse 1 and at regular time intervals must be reset to a starting value by the microcontroller 4104.11 in order to avoid interrupting the program execution of the microcontroller 4104.11 when the count of the timer of the watchdog 4105.5 reaches and/or crosses a watchdog count threshold value. The watchdog 4105.5 also carries out further monitoring tasks within the quantum random number generator 4100. For example, the watchdog 4104.5 preferably monitors the entropy of the random bits 4111. In particular, the watchdog 4104.5 ensures that the random bits 4111 preferably have no more than k consecutive random bits of the same logical value. If this is the case, the watchdog 4104.5 preferably inserts other bits instead of the random bits 4111 into this serial bit data stream from the entropy extraction 4104.5 to the finite state machine 4107.8. For this in the following 42 more. In this case, the watchdog 4104.5 preferably adds random bits from another real random number generator and/or another quantum random number generator and/or pseudo-random bits from a pseudo-random number generator, the starting value of which is determined by valid random bits from a quantum random number generator (QRNG) or a real random number generator (TRNG). The watchdog 4104.5 is preferably also a watchdog 13 of the control device 4 of the fuse 1. In addition, the watchdog 4104.5 monitors other variables within the meaning of the document presented here, such as the agreement of voltage values within the quantum random number generator 4100, 60 and/or within the control device 4 of the fuse 1 by means of one or more analog-to-digital converters 570, 4113 etc.

Figure 42

42 shows the extended exemplary evaluation device 4104, which now includes monitoring of the random number 4111 RN and has an additional backup system in the event of an error, in order to secure the security (security) of the supply network 200 by means of an emergency operation method even if the quantum random number generator fails. For a better overview, the components microcontroller 4104.11 (computer core 2), RAM 4104.9, 15 and finish flag 4104.10 have been left out. The reader should use these device parts or functions in the 42 continue to be considered as existing. However, the person skilled in the art can easily connect to the finite state machine 4104.8 from the 41 in the 42 copy and then comes to the revealed technical teaching. The watchdog 4104.5, a linearly feedback shift register 4104.6 as a pseudo-random number generator PRNG and a signal multiplexer 4104.7 expand the device 41 to the device 42 .

In the 42 For the sake of clarity, not all of the useful and possibly customary components of the control device 4 are shown. Next device components that the reader as possibly in the 1 can accept present, can be found, for example, in the 1 , 5 , 6 , 9 , 24 , 41 , 52 , 53 , 54 , 55 . The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

The output 4111 of the entropy extraction 4104.4 is now connected to the watchdog 4104.5 and the signal multiplexer 4104.7, for example. The watchdog 4104.5 monitors the random number RN at the output 4111 of the entropy extraction 4104.4. According to the proposal, the watchdog 4104.5 records at least three defined error cases. For this purpose, the watchdog 4104.5 gives, for example, the last valid random numbers as seed S 4112 to the linear feedback shift register 4104.6. If an error occurs, the watchdog 4104.5 sets error bits in an undrawn error register ER of the microcontroller 4104.11, 2 (computer core 2) Which error bit the watchdog 4104.5 sets in the error register of the microcontroller 4104.11, 2 (computer core 2) is preferably dependent depending on the error detected by watchdog 4104.5. In addition, the watchdog 4104.5 is connected to a voltage monitor 4113 via one or more, preferably digital, input/output signal lines 4114. The watchdog switch preferably monitors circle the voltage values determined by the 4113 voltage monitor. It has proven useful if the voltage monitor 4113 determines and monitors not only the voltages in the quantum random number generator 4100, 60, but also other voltages within the control device 4 of the fuse 1. The voltage monitor 4113 can be the analog-to-digital converter 570 act.

The voltage monitor 4113 monitors, for example, the operating voltages of the entropy source 4101 and/or the voltages within the control device 4 and/or the voltages of the energy reserve 8 and/or the internal supply voltages that the voltage supply 5 of the fuse 1 generates. If one of the operating voltages of one of the SPAD diode connections 4101.1 or 4101.3 is too low, i.e. the voltage value is below a lower SPAD operating voltage threshold value, or too high, i.e. the voltage value is above an upper SPAD operating voltage threshold value, then the operating voltage monitor 4113 detects this voltage deviation. The computer core 2 can preferably read out the values of the voltage monitor 4113 via the internal data bus 11 of the control device 4 of the fuse. In the event of such a voltage deviation, the voltage monitor 4133 signals such a deviation to the watchdog 4104.5 or directly to the microcontroller 4104.11 (computer core 2). In the case of a signal to watchdog 4104.5, watchdog 4104.5 can, for example, generate an interrupt signal 4120 for microcontroller 4104.11 (computer core 2). The watchdog 4104.5 can, for example, trigger such an interrupt 4120 of the microcontroller 4104.11 (computer core 2) or another sub-device of an application system/the fuse 1 if the supply voltage of the entropy source 4101 or the high-frequency amplifier 4102 or another device part of the quantum random number generator QRNG 4100 and/or the Control device 4 and / or fuse 1 is faulty. If the watchdog 4104.5 has detected an error in the quantum random number generator 4100, then the quantum random number generator 4100 switches to an emergency mode. For this purpose, the watchdog 4104.5 sets the selection signal 4116 of the signal multiplexer 4104.7, so that the signal multiplexer 4104.7, instead of the output 4111 of the entropy extraction 4104.4, uses the pseudo-random number PRN of the linear feedback shift register 4104.6 in the form of a stream of pseudo-random bits via a pseudo-random signal line 4117 as a replacement for the at least potentially faulty one Random number RN of the output 4111 of the entropy extraction 4104.4 to the input of the finite state machine 4104.8.

The shift register 4104.6 with linear feedback is connected to the output Seed S 4112 of the watchdog 4104.5. In the event of an error, the watchdog 4104.5 activates the linear feedback shift register 4104.6. The linear feedback shift register 4104.6 then generates pseudo-random numbers PRN as pseudo-random number generator PRNG. The seed S 4112 preferably has the last 16 random numbers (e.g. 1 bit each) that are just about valid. The watchdog 4104.5 preferably places these last valid random numbers at the input of the linear feedback shift register 4104.6. The seed S thus serves as a random PQC secure start value for the generator polynomial of the feedback of the linear feedback shift register 4104.6 for the generation of the pseudo-random number PRN and its signaling via the pseudo-random signal line 4117. The generator polynomial and the degree of the generator polynomial are preferably freely selectable.

The signal of the output 4111 of the entropy extraction 4104.4 with the 1-bit random number RN of the entropy extraction 4104.4 or the signal of the pseudo-random signal line 4117.with the pseudo-random number PRN of the linear feedback shift register 4104.6 are connected to the inputs of the signal multiplexer 4104.7. Depending on the value of the selection signal 4116 SEL, the signal multiplexer 4104.7 forwards one of the two inputs to the finite state machine 4104.8. Of course it is conceivable to use a multiplexer with more than two inputs and a more complex control signal if the application requires it. The number of inputs of the signal multiplexer 4104.7 is therefore typically greater than or equal to two.

Here, too, the finite state machine 4104.8 has the task of receiving the random data RN or the pseudo-random number PRN at the output of the signal multiplexer 4104.7 and writing them to the block RAM 4104.9, 15 of the evaluation device 4104 within the control device 4 of the fuse 1. If the writing process is successful, the finite state machine 4104.8 sets the finish flag 4104.10 again. The microcontroller 4104.11 (computer core 2) can then use a C program, which preferably runs on the embedded microcontroller 4104.11, to access the block RAM 4104.9, 15 and read out the random number and use it for encryption, for example.

Figure 43

FIG. 4 shows the flow diagram 4300 of the entropy extraction method, which, for example, carries out the entropy extraction 4104.4. The method initially provides two values in a first step 4301 of the output 4110 of the time-to-digital converter 4104.3 and to store it in a shift register of the entropy extraction 4104.4. If two values are stored in the entropy extraction shift register 4104.4, the entropy extraction 4104.4 compares these two values in a second step 4302. The two values in the entropy extraction shift register 4104.4 therefore include a first value and a second value, both of which correspond to the time to-digital converter 4104 by means of two different measurements of the respective time period between two signal pulses above the value of the constant 4104.1. In a third step 4303, the entropy extraction 4104.4 evaluates the two values. If the first value is smaller than the second value and the difference between value 1 and value 2 is greater than a minimum difference ∈, then the entropy extraction 4014.4 sets the value of its output 4111 to a first logical value.

If the first value is greater than the second value and the difference between the first value and the second value 2 is greater than the minimum difference ∈, the entropy extraction 4104.4 sets its output to a second logical value that differs from the first logical value. If the difference between the first value and the second value is smaller than the minimum difference ∈, then the entropy extraction discards the first value and the second value. In such a case, the entropy extraction preferably causes the watchdog 4104.5 to increase an error counter by a first error counter increment. The first error counter increment can be negative. Conversely, the entropy extraction 4104.4 can decrease the error counter of the watchdog 4104.5 by a second error counter increment if the difference between the first value and the second value is greater than the minimum difference ∈. The second error counter increment may be equal to the first error counter increment. Typically, the signs of the first error counter increment and the second error counter increment are the same. The microcontroller 4104.11 (computer core 2) can preferably set the error counter increments and the start value of the error counter and an error counter threshold value. If the counter reading of the error counter crosses the error counter threshold value, the watchdog 4104.5 preferably uses an interrupt 4120 or other signaling to signal the microcontroller 404.11 (computer core 2) that a critical error state is present. The microcontroller 4104.11 (computing core 2) then typically starts a self-test program in order to test the various parts of the quantum random number generator 4100. For this purpose, the microcontroller 4104.11 (computing core 2) can, for example, put the analog-to-digital converter 4103, 570 into a state in which the microcontroller 4104.11 (computing core 2) writes test values to an output register of the analog-to-digital converter 4103 which the subsequent signal chain then processes like real samples. Since the test values are already known, the microcontroller 4104.11 (computer core 2) can observe and evaluate the correct reaction of the rest of the system, for example the incrementing of the error counter in the watchdog 4104.5. The microcontroller 4104.11 (computer core 2) can therefore preferably monitor all storage nodes of the evaluation circuit 4104 or the control circuit 4 and read their logical state.

If a time value at the output 4110 of the time-to-digital converter 4104.3 is less than a minimum value, this is a value that lies within the dead time of the SPAD diodes 4101.1, 4101.3. The evaluation device 4104 preferably discards such a value and preferably increases the error counter by the first error increment, which can also be negative. In that case, the entropy extraction 4104.4 waits for the determination of the next time value by the time-to-digital converter 4104.3. With the random bit extracted in this way, the quantum random number generator 4100 starts the process over.

If the error counter crosses or reaches the error counter threshold value, an error may be present, for example, in which the time-to-digital converter 41^03 supplies constant numerical values due to an error.

This device is thus able to detect a failure of the voltage supply 5 of the entropy source 4101 or other parts of the device 4, 4100. The microcontroller 4104.11 (computing core 2) can also use the analog-to-digital converter 4103 to record voltages and currents in the quantum random number generator 4100 and/or within the control device 4 of the fuse and/or within the fuse 1 for test purposes and to use the values determined in this way Compare expected value ranges in which these values must lie. The microcontroller 4104.11 (the computer core 2) can also acquire digital values within the quantum random number generator 4100 and/or the control device 4. For example, the microcontroller 4104.11 (the computer core 2) can set the constant Const 4104.1 so low for test purposes that the noise background essentially controls the time-to-digital converter 4104.3. The values of the time-to-digital converter 4104.3 should then satisfy an expected statistic within a tolerance band. If this is not the case, then there is an error. The microcontroller 4104.11 (computer core 2) can create this statistic and, if necessary, deduce this error if the determined statistical values are not in an expected value interval.

The watchdog 4104.5 can monitor the entropy of the random numbers 4111 supplied. If the average entropy of the bits 4111 over an entropy measurement period deviates significantly more than a permitted entropy deviation value from the expected random mean value of 50%, the watchdog 4104.5 preferably concludes that there is an error in the quantum random number generator 4100, 60, and preferably increments the error counter by the said error counter increment. The watchdog 4104.5 then preferably stops using these random bits of the output 4111 of the entropy extraction in order to prevent the transmission of plain text via the data bus by the fuse 1. Clear text, as used in the document presented here, means that the data sent and/or stored is in a form that allows a third party to gain unauthorized access to the content of a data message and/or from stored data and/or program code. It is namely conceivable that a virtual permanent one or a virtual permanent zero is also randomly generated in the case of functioning sub-devices. Chance also includes the permanent zero and the permanent one. It is therefore useful if the maximum length of a bit sequence without changing the logic state at the output 411 of the entropy extraction 4104.4 is limited to a value that can be programmed by the microcontroller 4104.11 (computer core 2) by the watchdog 4195.5.

• • Störung von Versorgungsspannungen
• • Fehlerhafte Signalerzeugung der SPAD-Dioden 4101.1 und 4101.3,
• • Störung des Lichtwellenleiters 4101.2 und/oder der Ankoppelungen der SPAD-Dioden 4101.1 und 4101.3 an den Lichtwellenleiter 4101.2,
• • Schaltungsausfälle im Digitalteil 4104 des Quantenzufallszahlengenerators 4100
• • Fehlerhafte Entropie der gelieferten Zufallszahlen 4111.

Essentially, the above-described quantum random number generator 4100 can thus detect the following errors and catch them with a lower security level by means of an emergency operation using a pseudo-random number generator 4104.6, i.e. for example using a linear feedback shift register 4104.6:

• • Disturbance of supply voltages
• • Faulty signal generation of the SPAD diodes 4101.1 and 4101.3,
• • Malfunction of the optical fiber 4101.2 and/or the coupling of the SPAD diodes 4101.1 and 4101.3 to the optical fiber 4101.2,
• • Circuit failures in the digital part 4104 of the quantum random number generator 4100
• • Incorrect entropy of the supplied random numbers 4111.

It is conceivable to use a second complete quantum random number generator 4100 instead of the linear feedback shift register 4104.6 or the pseudo-random number generator 4104.6, the output 4111 of which the entropy extraction is then used by the multiplexer 4104.7 instead of the signal on the pseudo-random signal line 4117 for the emergency operation of the quantum random number generator 4100, 60. In the event that the output of the pseudo-random number generator 4104.6 depends on one or more genuine random bits 4112 as a seed, it is again a quantum random number as long as the number of inserted bits is limited. The watchdog 4105.5 preferably determines the number k of the permitted maximum consecutive quantum bits 4111 from a quantum random number. If this quantum random number 4111, which the watchdog 4104.5 uses to determine k, comprises only bits with a single logical value, then there is a possibility that an error has occurred. The number k should then not be a maximum in order to avoid sending or storing plain text. Rather, the watchdog 4104.5 should then choose the number k to be very small, preferably minimal.

figure 44

44 shows an exemplary oscillogram of the voltage signal 4104 of the entropy source 4101. As can easily be seen, first spikes 4401 occur with a first height and second spikes 4402 with a second height. The scattering of the first height of the first spikes 4401 and the scattering of the second height of the second spikes 4402 are each so small that a clear separation of these events 4401, 4402 is possible using an exemplary cutting level 4403 via the selection of the constant 4104.1. The cutting level 4403 corresponds to the value that the microcontroller 4104.11 (computer core 2) sets by means of the constant 4104.1, which is preferably implemented as a register of the microcontroller 4104.11 (computer core 2).

figure 45

• Zu Beginn erzeugt sich der Rechnerkern 2 der Steuervorrichtung 4 der Sicherung 1 (Server) einen Socket-Descriptor in Schritt 4500. Ein Socket-Descriptor im Sinne des hier vorgelegten Dokuments ist ein Integer ähnlicher File-Handle, den beispielsweise die Standard C Library-Funktion socket() der socket.h Library erzeugt. Der Rechnerkern 2 der Steuervorrichtung 4 der Sicherung 1 (Server) kann diesen Socket-Descriptor in späteren Funktionsaufrufen, die Sockets verwenden, nutzen.

45 shows the schematic sequence of a server-client communication using a proposed quantum random number generator. In this case, a first device, such as the electronic fuse 1 of 1 , As a server via a data bus 9 with a second device, such as For example, another, second backup of the 1 and/or a higher-level computer system 12, communicate in encrypted form as a client. In a first example, both the first device and the second device should preferably each comprise a quantum random number generator 60, which the respective computer uses for the encryption. The quantum random number generator 60, 4100 preferably corresponds in whole or in part to a construction corresponding to one of 41 until 42 . Very particularly preferably, the quantum random number generators of the first device and the second device each comprise a quantum random number generator 4100, 60, each of which has at least one first SPAD diode 4101.1 and at least one optical waveguide 4101.2, preferably in the form of the oxide stack 3944 on the semiconductor surface and preferably at least one second SPAD diode 4101.3 as receiver. This increases the data rate of the generated random bits and enables the computer of the respective device to generate and exchange the keys very quickly. The respective computers of the respective devices encrypt their mutual communication, preferably using an RSA encryption method. The exemplary RSA encryption method is, for example, from RL Rivest, A. Shamir, and L. Adleman, "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems" Communications of the ACM, February 1978, Vol. 21, No. 2, pages 120 to 126 known. The prime numbers, which the respective computer of the respective device preferably uses to generate the public and private key, are preferably generated randomly by the quantum random number generator 4100, 60 QRNG. The communication of the computer core 2 of the control device 4 of the backup (server) with the respective computer core 2 of the control device 4 of the other backup 1 (client) or the higher-level computer system (client) preferably firstly includes the process "Server Process", which is based on the Computer core 2 of the control device 4 of the backup (server), i.e. the first device, is started, and secondly the process "Client Process", which is running on the respective computer core 2 of the control device 4 of the other backup (client) or the higher-level computer system 12 , ie the second device, is started. The respective computer core 2 of the control device 4 of the other backup (client) or the superordinate computer system 12 typically communicate with the computer core 2 of the control device 4 of the backup (server) via so-called sockets. These are communication points provided by the respective operating system of the respective computer. The functions required to set up communication preferably come from the standard C library socket.h, for example. The following explains the communication according to an example 45 :

• At the beginning, the computer core 2 of the control device 4 of the fuse 1 (server) generates a socket descriptor in step 4500. A socket descriptor in the sense of the document presented here is an integer similar to a file handle, for example the standard C library function socket() of the socket.h library is generated. The computer core 2 of the control device 4 of the fuse 1 (server) can use this socket descriptor in later function calls that use sockets.

In step 4510, the computer core 2 of the control device 4 of the fuse 1 (server) preferably binds the socket descriptor to a port and an IP address. For the purposes of this document, binding means that the computer core 2 of the control device 4 of the fuse 1 (server) uses the standard C function bind() from the standard C library socket.h to logically connect the port and the IP address to the socket descriptor generated in step 4500. In the sense of this document, a port is a part of the network address that enables data packets to be assigned between server and client programs. For the purposes of this document, an IP address is a network address that makes a participant in a network clearly identifiable.

In the next step 4520, the computer core 2 of the control device 4 of the fuse 1 (server) goes into a passive wait state 4520 and waits for connection requests from a computer core 2 of the control device 4 of the other fuse 1 (client). In terms of the document presented here, the computer core 2 of the control device 4 of the fuse 1 (server) preferably calls the standard C function listen() of the socker.h library for this purpose. The function indicates that the computer core 2 of the control device 4 of the backup 1 (server) is ready, that the computer core 2 of the control device 4 of the backup 1 (server) can accept connection requests from clients. The computer core 2 of the control device 4 of the backup 1 (server) creates a queue for incoming connection requests from the computer core 2 of the control device 4 of the other backup 1 (client) in one of the memories 15 of the computer core 2 of the control device 4 of the backup 1 (server) or one other device part of the control device 4 of the fuse 1 (server). If computer core 2 of control device 4 of backup 1 (server) detects a connection request from a computer core 2 of control device 4 of the other backup 1 (client), then computer core 2 of control device 4 of backup 1 (server) accepts this connection request from computer core 2 of the Control device 4 of the other backup 1 (clients).

In a following step 4530, the computer core 2 of the control device 4 of the backup 1 (server) then establishes a connection 4530 to the computer core 2 of the control device 4 of the other backup 1 (client). The computer core 2 of the control device 4 of the backup 1 (server) establishes a connection request from the computer core 2 of the control device 4 of the other fuse 1 (client) in that the computer core 2 of the control device 4 of the fuse 1 (server) exits the listen() function. The computer core 2 of the control device 4 of the fuse 1 (server) preferably accepts the connection request by calling the standard C function accept() of the socket.h standard C library. The computer core 2 of the control device 4 of the backup 1 (server) preferably extracts the first connection request from the queue of open connection requests for the server and then uses it to establish the connection to the computer core 2 of the control device 4 of the other backup 1 (client). If successful, the accept() function returns a socket descriptor of the client to the computer core 2 of the control device 4 of the fuse 1 (server). A socket descriptor as used in this document is an integer similar to the file handle of the standard C library socket.h. This then creates the connection between the computer core 2 of the control device 4 of the fuse 1 (server) and the computer core 2 of the control device 4 of the other fuse 1 (client).

If said connection exists, the computer core 2 of the control device 4 of the fuse 1 (server) preferably starts a keyExchangeServer() function in a following step 4540 . The computer core 2 of the control device 4 of the backup 1 (server) then executes this keyExchange() function in this step 4540 in order to send its public key to the computer core 2 of the control device 4 of the other backup 1 (client). However, this keyExchangeServer() function is not a standard C function. In this function, in this step 4540 the computer core 2 of the control device 4 of the fuse 1 (server) uses a quantum random number generator 4100, 60 QRNG to generate random numbers from random bits 4111. The random number preferably has a bit width n. Here n is a positive integer including zero . In the example presented in this document, these random numbers of the quantum random number generator 4100, 60 of the control device 1 of the fuse 1 (server) serve as indices for a look-up table of the first 2n prime numbers. This look-up table is preferably located in one of the memories 15, 14 of the control device 4 of the fuse 1 (server). The computer core 2 of the control device 4 of backup 1 (server) then reads the prime number corresponding to this index of the quantum random number of the quantum random number generator 4100, 60 of the control device 4 of backup 1 (server) from the memory 14, 15 of the computer core 2 of the control device 4 of backup 1 (Server). The computer core 2 of the control device 4 of the fuse 1 (server) uses these prime numbers to generate both a public key and the private key in accordance with the RSA encryption method mentioned.

The computer core 2 of the control device 4 of the fuse 1 (server) then transmits via the data interface 64 of the computer core 2 of the control device 4 of the fuse 1 (server) and the data bus 9 and the data interfaces 10, 610, 550, 551 of the computer core 2 of the control device 4 the other backup 1 (client) a public key to the computer core 2 of the control device 4 of the other backup 1 (client).

The computer core 2 of the control device 4 of the backup 1 (server) then waits for a message from the computer core 2 of the control device 4 of the other backup 1 (client) via the data interface 10, 610, 550, 551 of the computer core 2 of the control device 4 of the other backup 1 (Client) and the data bus 9 and the data interfaces 10, 610, 550, 551 of the computer core 2 of the control device 4 of the fuse 1 (server). This message from the computer core 2 of the control device 4 of the other backup 1 (client) preferably includes a public key of the computer core 2 of the control device 4 of the other backup 1 (client). The computer core 2 of the control device 4 of the other backup 1 (client) typically transmits the private key of the computer core 2 of the control device 4 of the other backup 1 (client) via the data interface 64 of the computer core 2 of the control device 4 of the other backup 1 (client) and the data bus 9 and the data interface 10, 610, 550, 551 of the computer core 2 of the control device 4 of the fuse 1 (server) to the computer core 2 of the control device 4 of the fuse 1 (server). If computer core 2 of control device 4 of backup 1 (server) has received the public key of computer core 2 of control device 4 of the other backup 1 (client), computer core 2 of control device 4 of backup 1 (server) stores this public key in a Memory 14, 15 of the computer core 2 of the control device 4 of the fuse 1 (server).

Computer core 2 of control device 4 of backup 1 (server) then sends its public key, for example, via its data bus interface 10, 610, 550, 551 and data bus 9 and data bus interface 10, 610, 550, 551 of computer core 2 of control device 4 to the other Backup 1 (client) to the computer core 2 of the control device 4 of the other backup 1 (client).

The computer core 2 of the control device 4 of the backup 1 (server) is thus typically prepared for the exchange of encrypted data between the computer core 2 of the control device 4 of the other backup 1 (client) and the computer core 2 of the control device 4 of the backup 1 (server).

After the keys have now been exchanged, the computer core 2 of the control device 4 of the backup device 1 (server) preferably executes the recv() 4550 function and waits for an encrypted message from the computer core 2 of the control device 4 of the other backup device 1 (client). . If the computer core 2 of the control device 4 of the backup 1 (server) receives a message, the computer core 2 of the control device 4 of the backup 1 (server) stores this encrypted message, preferably initially in a temporary buffer memory 15 of the computer core 2 of the control device 4 of the backup 1 ( Server). In terms of the present document, the recv() function is preferably a standard C function of the standard C library socket.h. The recv() function typically reads incoming data from a socket descriptor, in this case the socket descriptor of the computer core 2 of the control device 4 of the other backup 1 (client) from step 4530 of the method. The recv() function, which the computer core 2 of the control device 4 of the backup 1 (server) typically executes, typically stores the received data in the temporary buffer memory 15 of the computer core 2 of the control device 4 of the backup 1 (server).

If the computer core 2 of the control device 4 of the backup 1 (server) has received an encrypted message in this way, the computer core 2 of the control device 4 of the backup 1 (server) preferably executes the function Decrypt() 4560 in a further step 4560. This Decrypt() function is not a standard C function. In this step 4560, the Decrypt() function decrypts the message of the private key of the computer core 2 of the control device 4 of the fuse 1 (server) that is temporarily stored in the memory 15 of the computer core 2 of the control device 4 of the fuse 1 in the sense of the document presented here (server) from step 4540 according to the RSA method. As a result, the computer core 2 of the control device 4 of the backup 1 (server) decrypts the received encrypted message from the client using the private key from step 4540 temporarily stored in the memory 15 of the computer core 2 of the control device 4 of the backup 1 (server) according to the RSA method . The computer core 2 of the control device 4 of the backup 1 (server) preferably stores the then decrypted message in a temporary buffer store 15 of the computer core 2 of the control device 4 of the backup 1 (server).

If the computer core 2 of the control device 4 of backup 1 (server) does not receive a message from the computer core 2 of the control device 4 of the other backup 1 (client) within a specified period of time, the computer core 2 of the control device 4 of backup 1 (server) jumps to the one now described Step. The computer core 2 of the control device 4 of the backup 1 (server) checks whether it should send a message to the computer core 2 of the control device 4 of the other backup 1 (client). Typically, such a message is stored in a memory 15 of the computer core 2 of the control device 4 of the fuse 1 (server) in such a case for sending. If necessary, the computer core 2 of the control device 4 of the fuse 1 (server) can also fetch or receive such a message from another memory or system before it is sent. The computer core 2 of the control device 4 of the backup 1 (server) then preferably stores such a message temporarily in a buffer memory 15 of the computer core 2 of the control device 4 of the backup 1 (server). If such a message to be sent is waiting to be sent in a memory 15 or buffer of the computer core 2 of the control device 4 of the backup 1 (server), the computer core 2 of the control device 4 of the backup 1 (server) preferably executes the Encrypt() function in another Step 4570 off. In this step 4570, the computer core 2 of the control device 4 of the security device 1 (server) encrypts its own message in this case using the public key of the client from 4540 according to the RSA method. This function Encrypt() is not a standard C function. The server stores its now encrypted message in a temporary buffer 15 of the computer core 2 of the control device 4 of the fuse 1 (server).

The computer core 2 of the control device 4 of the fuse 1 (server) now executes the send() function in a step 4580 . In step 4580, the computer core 2 of the control device 4 of the fuse 1 (server) sends its encrypted message stored in the buffer 15 of the computer core 2 of the control device 4 of the fuse 1 (server) to the computer core 2 of the control device 4 of the other fuse 1 ( Client) via the data bus interface 10, 610, 550, 551 of the computer core 2 of the control device 4 of the fuse 1 (server) and via the data bus 9 and via the data interface 10, 610, 550, 551 of the computer core 2 of the control device 4 of the other fuse 1 (Client). For the purposes of this document, the send() function is a Stan standard C function dard C-Library socket.h. The send() function sends data over a socket descriptor, in this case the client's socket descriptor from step 4530. At the end of the transfer, the typical cycle is complete.

The encrypted communication for the computer core 2 of the control device 4 of the fuse 1 (server) then starts again at step 4540.

If the communication is terminated by the computer core 2 of the control device 4 of the backup 1 (server) or the computer core 2 of the control device 4 of the other backup 1 (client), the computer core 2 of the control device 4 of the backup 1 (server) executes the close() function. 4590 out. The function close() is a standard C function of the standard C library socket.h. By executing the close() function, the computer core 2 of the control device 4 of the fuse 1 (server) closes the open connection to a socket, here the socket of the client, and thus ends the communication.

In an analogous manner, the computer core 2 of the control device 4 of the other backup 1 (client) executes a client process.

At the beginning of the "client process", the computer core 2 of the control device 4 of the other fuse 1 (client) generates a socket descriptor in a step 4600. A socket descriptor within the meaning of this document is again an integer similar to the file handle, for example the Standard C library function socket() of the socket.h library, which the computer core 2 of the control device 4 of the other backup 1 (client) can use in later function calls that use sockets. the processor core 2 of the controller 4 of the other backup 1 (client) makes a connection request to the processor core 2 of the controller 4 of the backup 1 (server) using the port and the IP address specified in step 4510.

For this purpose, the computer core 2 of the control device 4 of the other fuse 1 (client) preferably executes the standard C function connect() of the standard C library socket.h. This function establishes a connection between the server socket of step 4510 and the client socket of step 4600.

If the connection was accepted by the computer core 2 of the control device 4 of the fuse 1 (server) according to step 4530, the computer core 2 of the control device 4 of the other fuse 1 (client) executes the KeyExchangeClient() function in a step 4620. This function is not a standard C function. By executing this function, the computer core 2 of the control device 4 of the other fuse 1 (client) uses the quantum random number generator 4100, 60 to generate one or more QRNG random numbers from random bits 4111. This random number has a bit width n. Here n is a positive integer including zero. These random numbers of the quantum random number generator 4100, 60 of the computer core 2 of the control device 4 of the other fuse 1 (client) are preferably used as indices for a look-up table of the first 2 ⁿ prime numbers. Using these prime numbers or other prime numbers, the computer core 2 of the control device 4 of the other security device 1 (client) generates both a public key and a private key according to RSA encryption. The computer core 2 of the control device 4 of the other backup 1 (client) preferably stores its public key thus generated and its private key thus generated in a memory 15 of the computer core 2 of the control device 4 of the other backup 1 (client). Then the computer core 2 of the control device 4 of the other backup 1 (client) sends its public key to the computer core 2 of the control device 4 of the backup 1 (server) via the data interface 10, 610, 550 551 of the computer core 2 of the control device 4 of the other backup 1 (client ) and via the data bus 9 and via the data interface 10, 610, 550, 551 of the computer core 2 of the control device 4 of the fuse 1 (server). The computer core 2 of the control device 4 of the other fuse 1 (client) then waits for a message from the computer core 2 of the control device 4 of the fuse 1 (server). This message from the first processor 10-1 of the computer core 2 of the control device 4 of the fuse 1 (server) typically contains the public key of the computer core 2 of the control device 4 of the fuse 1 (server).

The computer core 2 of the control device 4 of the other backup 1 (client) then executes the Encrypt() 4630 function. By executing the Encrypt() function in step 4630, the computer core 2 of the control device 4 of the other backup 1 (client) encrypts its own message using the public key of the computer core 2 of the control device 4 of the backup 1 (server) from step 4540 using the RSA -Procedure. This function is not a standard C function. The client stores the encrypted message in a temporary buffer 15.

The computer core 2 of the control device 4 of the other backup 1 (client) now executes the send() function in step 4640 and sends its encrypted message to the computer core 2 of the control device 4 of the backup 1 (server). For the purposes of this document, the send() function is a standard C function of the standard C library socket.h. By executing the send() function, the computer core 2 sends the control device 4 to the other fuse 1 (client) data via a socket descriptor, in this case the socket descriptor of the client from 4600.

The computer core 2 of the control device 4 of the other backup 1 (client) then executes the recv() 4650 function. In this case, the computer core 2 of the control device 4 of the other backup 1 (client) waits in step 4650 for an encrypted message from the computer core 2 of the control device 4 of the backup 1 (server). If the computer core 2 of the control device 4 of the other backup 1 (client) receives a message, the computer core 2 of the control device 4 of the other backup 1 (client) stores this received and typically encrypted message in a temporary buffer store 15. In the sense of the present document the recv() function is preferably a standard C function of the standard C library socket.h. The computer core 2 of the control device 4 of the other backup 1 (client) reads incoming data from a socket descriptor by executing the recv() function, in this case from the socket descriptor of the computer core 2 of the control device 4 of the other backup 1 (client ) from step 4600. The computer core 2 of the control device 4 of the other backup 1 (client) preferably stores the read data in a temporary buffer memory 15 of the computer core 2 of the control device 4 of the other backup 1 (client).

If the computer core 2 of the control device 4 of the other backup 1 (client) has received an encrypted message in this way, the computer core 2 of the control device 4 of the other backup 1 (client) preferably executes the Decrypt() function in a step 4660. This Decrypt() function is not a standard C function. By executing the Decrypt() function, the computer core 2 of the control device 4 of the other backup 1 (client) decrypts an encrypted message received by the computer core 2 of the control device 4 of the other backup 1 (client) from the computer core 2 of the control device 4 of the backup 1 (server ) using the private key of the computer core 2 of the control device 4 of the other backup 1 (client) from step 4620 using the RSA method. The computer core 2 of the control device 4 of the other backup 1 (client) then stores the message decrypted in this way in a temporary buffer store 15 of the computer core 2 of the control device 4 of the other backup 1 (client).

Then the communication between the computer core 2 of the control device 4 of the backup 1 (server) and the computer core 2 of the control device 4 of the other backup 1 (client) starts again at step 4620.

If the communication is terminated by the computer core 2 of the control device 4 of the other backup 1 (client) or the computer core 2 of the control device 4 of the backup 1 (server), the computer core 2 of the control device 4 of the other backup 1 (client) executes the close( ) in step 4670. The function close() is a standard C function of the standard C library socket.h. Because the computer core 2 of the control device 4 of the other fuse 1 (client) executes the close() function, the computer core 2 of the control device 4 of the other fuse 1 (client) closes the open connection to a socket and thus terminates communication with the Computer core 2 of the control device 4 of the fuse 1 (server).

Figure 46

46 shows the schematic sequence of the KeyExchangeServer() and KeyExchangeClient() functions.

When the KeyExchangeServer() function is started, the computer core 2 of the control device 4 of the fuse 1 (server) first calls the setPrimes() function in step 4700. This KeyExchangeServer() function is not a standard C function. The computer core 2 of the control device 4 of the fuse 1 (server) uses the KeyExchangeServer() function to generate two different prime numbers p and q, the product n=p*q and Euler's phi function phi=(p-1)(q-1 ) in step 3200.

Then the computer core 2 of the control device 4 of the fuse 1 (server) calls the function setE() in step 4710 . This setE() function in step 4710 is not a standard C function. When the setE() function is called in step 4710, the computer core 2 of the control device 4 of the fuse 1 (server) a number e relatively prime to phi, where the number phi is that from step 4700. For the purposes of this document, coprime means that there is no natural number other than the number one that divides the number e and phi at the same time.

The computer core 2 of the control device 4 of the fuse 1 (server) then executes the findD() function in step 4720 . This findD() function is not a standard C function. The computer core 2 of the control device 4 of the fuse 1 (server) uses the findD() function to calculate the multiplicative inverse of e, so that (e*d)mod phi=1 applies.

The computer core 2 of the control device 4 of the fuse 1 (server) now calls the recv() function in step 4730 . The computer core 2 of the control device 4 of the backup 1 (server) now waits for an incoming message from the computer core 2 of the control device 4 of the other backup 1 (client), which should typically include the public key of the client. For the purposes of this document, the recv() function is a standard C function of the standard C library socket.h. By calling the recv() function, the computer core 2 of the control device 4 of the fuse 1 (server) reads the incoming data from a socket descriptor, in this case the socket descriptor of the client. The computer core 2 of the control device 4 of the backup 1 (server) preferably stores the read data in a temporary buffer memory 15 of the computer core 2 of the control device 4 of the backup 1 (server).

The computer core 2 of the control device 4 of the fuse 1 (server) now calls the send() function in step 4740 . In this step 4740, the computer core 2 of the control device 4 of the backup 1 (server) sends its public key (d, n) from steps 4700 and 4720 to the computer core 2 of the control device 4 of the other backup 1 (client). For the purposes of this document, the send() function is a standard C function of the standard C library socket.h. The computer core 2 of the control device 4 of the fuse 1 (server) uses the send() function to send data via a socket descriptor, in this case the socket descriptor of the client from step 4530.

The computer core 2 of the control device 4 of the fuse 1 (server) then exits the KeyExchangeServer() function in step 4745.

When starting the KeyExchangeClient() function, the computer core 2 of the control device 4 of the other fuse 1 (client) first calls the setPrimes() function in step 4750. This function is not a standard C function. The computer core 2 of the control device 4 of the other fuse 1 (client) uses the KeyExchangeClient() function to generate the prime number p and the prime number q, which differs from q. The computer core 2 of the control device 4 of the other fuse 1 (client) generates the product n=p*q using the KeyExchangeClient() function. The computer core 2 of the control device 4 of the other fuse 1 (client) uses the KeyExchangeClient() function to generate Euler's phi function phi=(p-1)(q-1).

Then the computer core 2 of the control device 4 of the other backup 1 (client) calls the setE() function in step 4760 . This function is not a standard C function. The computer core 2 of the control device 4 of the other fuse 1 (client) uses the setE() function to generate an integer e which is relatively prime to the number phi from step 4750. Coprime in the sense of the present document means that there is no natural number apart from the number one that simultaneously divides the number e and phi without remainder.

The computer core 2 of the control device 4 of the other backup 1 (client) then calls the findD() 4770 function. This function is not a standard C function. The computer core 2 of the control device 4 of the other fuse 1 (client) uses the findD() function to calculate the multiplicative inverse of the number e, so that (e*d)mod phi=1 applies.

The computer core 2 of the control device 4 of the other backup 1 (client) now calls the function send() 4780 and sends its public key (d, n) from steps 4750 and 4770 to the computer core 2 of the control device 4 of the backup 1 (server ). For the purposes of this document, the send() function is a standard C function of the standard C library socket.h. The computer core 2 of the control device 4 of the other fuse 1 (client) uses the send() function to send data via a socket descriptor, in this case the socket descriptor of the client from step 4600.

The computer core 2 of the control device 4 of the other backup 1 (client) now calls the recv() function in step 4790. The computer core 2 of the control device 4 of the other backup 1 (client) now waits for an incoming message from the computer core 2 of the control device 4 of the backup 1 (server) with the public key of the computer core 2 of the control device 4 of the fuse 1 (server). For the purposes of this document, the recv() function is a standard C function of the standard C library socket.h. The computer core 2 of the control device 4 of the other backup 1 (client) uses the recv() function to read incoming data from the computer core 2 of the control device 4 of the s backup 1 (server) from a socket descriptor, in this case from the socket descriptor of the Clients from step 4600, and stores the data in a temporary buffer 15 of the computer core 2 of the control device 4 of the other backup 1 (client).

The computer core 2 of the control device 4 of the other fuse 1 (client) then exits the KeyExchangeClient() function in step 4795.

figure 47

47 shows the schematic sequence of the setPrimes() function.

The computer core 2 of the control device 4 of the other backup 1 (client) and the computer core 2 of the control device 4 of the backup 1 (server) each call up this function at the appropriate time. If one of these computers calls the setPrimes() function, the calling computer, in the case of the present document the computer core 2 of the control device 4 of the backup 1 (server) or the computer core 2 of the control device 4 of the other backup 1 (client), a random number using a Quantum Random Number Generator QRNG in step 4800. This random number has a bit width n. Here n is a positive integer including zero. In the technical teaching of the document presented here, these random numbers serve as indices for a look-up table of the first 2 ⁿ prime numbers. The calling computer stores the prime number indexed by the random number as a variable p.

The calling computer then generates another random number in step 4810 with the preferred bit width n using the quantum random number generator 4100, 60 QRNG. The calling computer preferably uses these random numbers again as indices for a look-up table of the first 2 ⁿ prime numbers. The calling computer stores the prime number, which is indexed by the random number, as a variable q in a buffer memory 15 of the calling computer, part of which the computer is preferred.

The calling computer now checks in step 4820 whether the logical statement q ==p applies. If this statement is true, step 4810 is repeated.

The calling computer then calculates the product n = p * q in step 4830.

Then the calling machine calculates Euler's phi function phi = (q-1) * (p-1) in step 4840.

The calling computer then exits the setPrimes() function in step 4850.

figure 48

The 48 shows the schematic sequence of the setE() function 4900. When the setE() function is called in step 4900, the calling computer generates, in the case of the present document the computer core 2 of the control device 4 of the other backup 1 (client) or the computer core 2 of the control device 4 of fuse 1 (server), a random number e such that e is prime to the number phi. For the purposes of this document, coprime means that there is no natural number other than the number one that divides the number e and phi at the same time. The calling computer can generate the number e either using a random number from the quantum random number generator 4100, 60 QRNG or using a pseudo-random number generator PRNG or by up-integrating an integer number starting with 2. However, generation by means of the quantum random number generator 4100, 60 QRNG is preferred.

The calling computer then checks in step 4910 whether the logical statement gcd(e,phi) != 1 is fulfilled.

If the logical statement is fulfilled, the calling computer repeats step 4900.

If the logical statement is not fulfilled, the calling computer exits the setE() function and returns the current value of e to the calling computer as a return value. For the function gcd(a,b) it is not a standard C function. The calling computer uses this function gcd(a,b) to calculate the greatest common divisor of the transfer parameters a, b and returns the result to the calling computer.

figure 49

49 shows the schematic flow of the findD() function. When the calling computer calls the findD() function in step 5000, the calling computer initializes a variable d with 0 in step 5000.

In the subsequent step 5010, the calling computer adds the number 1 to the number d.

In step 5020, the calling computer now checks whether the logical statement (e*d) (mod phi)==1 is fulfilled. If the logical statement (e*d) (mod phi) == 1 is not fulfilled, the calling computer repeats the steps from step 5010.

If the logical statement (e*d) (mod phi) == 1 is fulfilled, then in step 5030 the calling computer exits the findD() function and the calling computer returns the current value of d to the calling computer, in In the case of the present document, the computer core 2 of the control device 4 of the other fuse 1 (client) or the computer core 2 of the control device 4 of the fuse 1 (server).

figure 50

50 shows the schematic sequence of a secure transmission of quantum-based random numbers between a computer core 2 of the control device 4 of fuse 1 (server) 5100 and a computer core 2 of the control device 4 of the other fuse 1 (client) 5110.

In the case of the present document, the server 5100 is a computer core 2 of the control device 4 of the fuse 1 (server), the computer core 2 of the control device 4 of the fuse 1 (server) 5100 having a quantum random number generator 4100, 60 QRNG. In the case of the present document, the client 5110 is another computer core 2 of the control device 4 of the other fuse 1 (client), with this computer core 2 of the control device 4 of the other fuse 1 (client) 5110 now expressly NOT having a quantum random number generator 4100.60 QRNG.

At the beginning, the computer core 2 of the control device 4 of the fuse 1 (server) generates 5100 quantum random numbers QZ1. The quantum random numbers QZ1 are used by the computer core 2 of the control device 4 of the backup 1 (server) 5100 as a basis for generating a private key and a public key of the server 5100 according to an asymmetric encryption method.

The asymmetric encryption method can be the RSA method, for example.

In a step 5120, computer core 2 of control device 4 of backup 1 (server) 5100 sends the public key of server 5100 via a non-tap-proof channel to computer core 2 of control device 4 of the other backup 1 (client) 5110.

The computer core 2 of the control device 4 of the other fuse 1 (client) 5110 then generates a pseudo-random number PZ or a random number generated in a different way. The computer core 2 of the control device 4 of the other backup 1 (client) 5110 stores the pseudo-random number PZ or the random number generated in a different way in a memory 15 of the computer core 2 of the control device 4 of the other backup 1 (client) 5110 . The computer core 2 of the control device 4 of the other fuse 1 (client) 5110 generates a first private key of the client 5110 and a first public key of the client 5110 using this pseudo-random number PZ or this random number generated differently.

The computer core 2 of the control device 4 of the other backup 1 (client) 5110 encrypts the first public key of the client 5110 using the public key of the server 5100.

The computer core 2 of the control device 4 of the other backup 1 (client) 5110 then sends the encrypted first public key of the client 5110 to the computer core 2 of the control device 4 of the backup 1 (server) 5100.

The computer core 2 of the control device 4 of the fuse 1 (server) 5100 now decrypts this message with its first private key. As a result, the computer core 2 of the control device 4 of the backup 1 (client) 3600 now has the first public key of the client 5110 without this third party being able to know it.

The computer core 2 of the control device 4 of the fuse 1 (server) 5100 then generates a further, second quantum random number QZ2 by means of the quantum random number generator 4100, 60. The bit width of this second quantum random number is preferably equal to the bit width of the random number PZ of the client 5110.

The computer core 2 of the control device 4 of the fuse 1 (server) 5100 now encrypts the second quantum random number QZ2 with the first public key of the client 5110. For example, the first public key of the client 5110 can have the same length in number of bits as this new quantum random number QZ2 . In this case, the computer core 2 of the control device 4 of the fuse 1 (server) 5100 can encrypt the second quantum random number QZ2, for example by bitwise XORing the second quantum random number QZ2 with PZ to form an encrypted second quantum random number QZ2′. The computer core 2 of the control device 4 of the backup 1 (server) 5100 then preferably sends the encrypted second quantum random number QZ2' to the computer core 2 of the control device 4 of the other backup 1 (client) 5110 in a step 5140.

The computer core 2 of the control device 4 of the other security device 1 (client) 5110 decrypts the encrypted second quantum random number QZ2′ using its first private key to form the second quantum random number QZ2. If the computer core 2 of the control device 4 of the other backup 1 (client) 5110 has determined the second encrypted quantum random number QZ2' by bitwise XORing the random number PZ with the second quantum random number QZ2, then the computer core 2 of the control device 4 of the other backup 1 (client ) 5110, for example, by bitwise XORing the encrypted second quantum random number QZ2' with the random number PZ known to it to form the second quantum random number QZ2.

The computer core 2 of the control device 4 of the other security device 1 (client) 5110 preferably uses the second quantum random number QZ2 now available to it as the basis for generating a second private key and a second public key according to an asymmetric encryption method. The asymmetric encryption method can be the RSA method, for example. The computer core 2 of the control device 4 of the other backup 1 (client) 5110 now sends its second public key to the server 5100 via the non-tap-proof channel Server 5100 decrypts the encrypted second public key of the client 5110 and then uses this second public key of the client to encrypt further messages to the computer core 2 of the control device 4 of the other backup 1 (client) 5110. The computer core 2 of the control device preferably generates and sends 4 of backup 1 (server) 5100 after a predetermined time or after sending a predetermined amount of data to the computer core 2 of the control device 4 of the other backup 1 (client) 5110 a new public key based on a new quantum random number of its quantum random number generator 4100, 60 QRNG encrypted with the second public key of the client 5110. The computer core 2 of the control device 4 of the backup 1 (server) 5100 and the computer core 2 of the control device 4 of the other backup 1 (client) 5110 then preferably carry out the previously described method again, so that the keep changing keys. This also makes it impossible for a quantum computer to break the keys.

As a result, the computers involved can carry out the communication on the basis of the selected asymmetric encryption method after these keys have been exchanged.

figure 51

51 shows schematically the proposed method 5200 for generating a quantum random number. The method 5200 begins by generating 5210 a random stream of single photons (3957, 3958, 3959, 4101.2) using one or more first SPAD diodes (4101.1, 3954). The method 5200 continues with the transmission 5220 of the random single photon stream (3957, 3958, 3959, 4101.2) with by means of an optical waveguide (3944, 4101.2) which is different from the semiconductor substrate (3949, 3948) to one or more second SPAD diodes (4101.3, 3955). This is followed by the conversion 5230 of the random single photon stream (3957, 3958, 3959, 4101.2) into a detection signal in the form of a voltage signal 4105 from the entropy source 4101, which preferably includes the first SPAD diodes 4101.1 and the optical waveguide 4101.2 and the second SPAD diodes 4101.3 . This is followed by the processing 5240, in particular amplification and/or filtering and/or analog-to-digital conversion, of the detection signal into a processed detection signal, in particular a digital 14-bit value 4107 of the analog-to-digital converter 4103 Then the separation 5250 of the pulses of the processed detection signal, which are caused by coupling the emissions of a first SPAD diode 4101.1 and a second SPAD diode 4101.3, from the pulses of the processed detection signal, which are caused by spontaneous emission, takes place by comparing the processed detection signal with a threshold value 4104.1, in particular in a comparator 4104.2 and the generation of a corresponding output signal 4109, in particular of the comparator 4104.2. This is followed by the determination 5260 of a first time interval between the first pulse and the second pulse of a first pulse pair made up of two consecutive pulses of the processed detection signal that are produced by coupling the emissions of a first SPAD diode 4101.1 and a second SPAD diode 4101.3, and the determination a second time interval between a third pulse and a fourth pulse of a second pair of pulses consisting of two consecutive pulses of the processed detection signal that were produced by coupling the emissions of a first SPAD diode 4101.1 and a second SPAD diode 4101.3 and, in particular, for determining the first value the output 4110 of the time-to-digital converter 4104.3 and the second value of the output 4110 of the time-to-digital converter 4104.3. On this basis, the bit value of a random bit is then determined 5270 by comparing the value of the first time interval and the value of the second time interval. In a final check 5280, the computer core 2 of the control device 4 of the fuse 1 checks whether the number n of determined random bits is still smaller than the desired number m of random bits of the desired quantum random number. If this is not the case, the computer core 2 of the control device 4 of the fuse 1 repeats the above steps. Otherwise the computer core 2 of the control device 4 of the fuse 1 ends the process for generating a quantum random number.

Figure 52

52 shows a general quadruple fuse with only one control device 4. The common control device 4 of the multiple fuse 1 has a respective gate drive circuit (16, 16', 16'', 16''') for the drive and monitoring of the respective line for each protected line circuit breaker (17, 17', 17'', 17'''). Each of the respective power switches (17, 17', 17'', 17''') has a respective first connection (18, 18', 18'', 18''') and a respective second connection (19, 19' , 19'', 19''') of the respective circuit breaker (17, 17', 17'', 17'''). Each circuit breaker (17, 17', 17'', 17''') is again analogous to 1 a respective auxiliary circuit breaker (23, 23', 23'', 23'''), preferably associated with a respective shunt resistor (24, 24', 24'', 24''') and connected to the respective circuit breaker (17 , 17', 17'', 17''') analogous to 1 assigned. The electronic multiple backup of the 52 thus comprises a first backup channel (16, 18, 17, 19, 26, 27, 28, 20, 21, 22, 23, 24, 25) and a second backup channel (16', 18', 17', 19', 26 ', 27', 28', 20', 21', 22', 23', 24', 25') and a third backup channel (16'', 18'', 17'', 19'', 26'' , 27'', 28'', 20'', 21'', 22'', 23'', 24'', 25'') and a fourth backup channel (16''', 18''', 17''',19''',26''',27''',28''',20''',21''',22''',23''',24''',25'''). The computer core (2) of the control device (4) controls and monitors the respective circuit breaker (17, 17', 17'', 17''') of the respective backup channel. This control and monitoring by means of a single gate drive circuit (16, 16', 16'', 16''') has already been described in FIG 1 described.

In the 52 For the sake of clarity, not all of the useful and possibly customary components of the control device 4 are shown. Next device components that the reader as possibly in the 1 can accept present, can be found, for example, in the 1 , 5 , 6 , 9 , 24 , 41 , 42 , 53 , 54 , 55 . The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

The functions of the respective control lines (20, 20', 20'', 20''') for controlling the respective circuit breaker (17, 17', 17'', 17''') can be read there.

The functions of the respective monitoring line (20, 20', 20'', 20''') for detecting the voltage between the respective second connection (19, 19', 19'', 19''') of the respective circuit breaker (17, 17', 17'', 17''') and the respective control line (20, 20', 20'', 20''') of the respective circuit breaker (17, 17', 17'', 17''') can be read there .

The functions of the respective monitoring line (22, 22', 22'', 22''') for detecting the voltage between the respective first connection (18, 18', 18'', 18''') of the respective circuit breaker (17, 17', 17'', 17''') and the respective control line (20, 20', 20'', 20''') of the respective circuit breaker (17, 17', 17'', 17'''). read up there.

The functions of the respective measuring line (25, 25, 25'', 25''') for detecting the voltage drop across the respective shunt resistor (24, 24', 24'', 24''') can be read there.

Preferably, the multiple backup of 52 monolithic or as a module with a microelectronic circuit, which preferably includes the control device 4 and preferably also the shunt resistors (24, 24', 24'', 24''') and is preferably manufactured in CMOS technology. Such a multiple fuse can be used as a cross fuse 1000 or as a triple fuse 3010 or as a three-phase fuse with neutral point protection via the fourth fuse channel without having to change the hardware.

For example, it makes sense to electrically connect the second terminals (19, 19', 19'', 19''') and the first security channel (16, 18, 17, 19, 26, 27, 28, 20, 21, 22 , 23, 24, 25) to protect the ground derivation of a first half-bridge for the first three-phase phase R (L1) and the second fuse channel (16', 18', 17', 19', 26', 27', 28' , 20', 21', 22', 23', 24', 25') to protect the ground derivation of a first half bridge for the second three-phase phase S (L2) and the third fuse channel (16'', 18'', 17'', 19'', 26'', 27'', 28'', 20'', 21'', 22'', 23'', 24'', 25'') to protect the ground lead of a to use the first half-bridge for the third three-phase phase T (L3). The second connections (19, 19', 19'', 19''') then form the star point. The fourth backup channel (16''', 18''', 17''', 19''', 26''', 27''', 28''', 20''', 21''', 22 ''', 23''', 24''', 25''') can then secure the star point against the reference ground, typically earth, via its first connection (18''').

Figure 53

53 shows the general quadruple backup of the 52 as a general triple fuse, the three circuit breakers 17, 17 'and 17''are interconnected in the star, so that they z. B. as a triple fuse 3010 'of 31 can be used.

In the 53 For the sake of clarity, not all of the useful and possibly customary components of the control device 4 are shown. Next device components that the reader as possibly in the 1 can accept present, can be found, for example, in the 1 , 5 , 6 , 9 , 24 , 41 , 42 , 52 , 54 , 55 . The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

figure 54

54 shows the general quadruple backup of the 52 the four circuit breakers 17, 17', 17'' and 17''' being connected to form a cross fuse 1000.

In the 54 For the sake of clarity, not all of the useful and possibly customary components of the control device 4 are shown. Next device components that the reader as possibly in the 1 can accept present, can be found, for example, in the 1 , 5 , 6 , 9 , 24 , 41 , 42 , 52 , 53 , 55 . The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

Figure 55a

55a shows a block diagram of a system 55100 for providing SW programs in a supply network 200. The system 55100 includes a first HW platform 55110 (e.g. a higher-level computer system 12 or a server 710 of a service provider, etc.) on which different SW programs 55111, 55112, 55113, in particular a SW program 55113 from an external provider, can be executed. The SW programs 55111, 55112, 55113 can be executed using an operating system 55130. Furthermore, the SW programs 55111, 55112, 55113 can access one or more HW drivers 55131, e.g. to enable data communication via a communication unit 55141, 55142, 55143, 555 (e.g. via a communication unit 55141 for a cellular network (GSM, UMTS, LTE), via a communication unit 55142 for WLAN and/or via a communication unit 55143 for Bluetooth).

In the 55a For the sake of clarity, not all of the useful and possibly customary components of the control device 4 are shown. Next device components that the reader as possibly in the 1 can accept present, can be found, for example, in the 1 , 5 , 6 , 9 , 24 , 41 , 42 , 52 , 53 , 54 . The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

The system 55100 further includes a control device 55120, 4 of a fuse 1 with a computer core 2 for executing one or more safety-related SW modules 55121, 55122 of the SW programs 55111, 55112, 55113 implemented on the first HW platform 55110. A safety-related SW module 55121, 55122 can, for example, contain safety-relevant data and/or safety-relevant program code and/or SW modules 55121, 55122 that change the switching state of circuit breaker 17 of fuse 1 and/or SW modules 55121, 55122 that allow access to memory 14,15 of the control device 55120, 4 of the electronic fuse 1, and/or SW modules 55121, 55122, which allow the download and/or execution of SW in the memory 14, 15 of the control device 55120, 4 of the fuse 1, and /or SW modules 55121, 55122, which enable the reading of measured values and/or data from the memory of the control device 55120, 4 of fuse 1, and/or SW modules 55121, 55122, which enable the configuration of parameters and/or threshold values and similar in the controller 55120, 4 enable the fuse 1 include. Alternatively or additionally, a safety-relevant SW module 55121, 55122 can access a safety-relevant internal function of the supply network 200 and/or a safety-relevant internal function of the electronic fuses 1 of the supply network 200 and/or a safety-relevant internal function of the supply network 200 allow external function and / or on a safety-related, internal functions of the electronic fuses 1 of the supply network 200 external function.

The control device 55120, 4 of the fuse 1 can be subject to one or more special security measures. In particular, the manufacturer of a vehicle can carry out a detailed analysis and check of the one or more software modules 55121, 55122 that are installed on the control device 55120, 4 of fuse 1. Furthermore, measures can be provided which prevent unauthorized access to software modules 55121, 55122 and/or data on control device 55120, 4 of fuse 1. The fuse 1 controller 55120, 4 may include a security measure that provides the fuse 1 controller 55120, 4 with extra protection against side channel attacks. Furthermore, a physical reading of a memory of the control device 55120, 4 of the fuse 1 can be prevented by a security measure. In other words, the control device 55120, 4 of fuse 1 can be protected by one or more security measures in such a way that the one or more memories 14, 15 of the control device 55120, 4 of fuse 1 cannot be read (from the outside). The control device 55120, 4 of the fuse 1 can in particular be designed to be “tamper-resistant” or tamper-proof.

A trustworthy application environment of a control device 55120, 4 of fuse 1 is thus provided for an automobile manufacturer and a provider of third-party software for use in a proposed supply network. The security hardware platform control device 55120, 4 of security 1 provides an abstraction layer between the control unit operating system 55130 - typically in the higher-level computer system 12 -, one or more high-security modules 55121, 55122 and all other SW programs 55111, 55112 , 113. A high-security module 55121, 55122 is typically very small, so that the program source code of such a module 55121, 55122 can be checked. In addition, the Security Hardware Platform 55120 provides strong isolation for a High Security Module 55121, 55122. This prevents access to arithmetic operations and/or data of a high-security module 55121, 55122 by another high-security module 55121, 55122 or by another software program 55111, 55112, 55113. The one or more interfaces for high-security modules 55121, 55122 can be uniform and/or standardized.

55a 15150 further shows a communication network (eg the Internet 720) with which communication can take place directly (eg via a communication unit 55141 for a cellular network) or indirectly via a smartphone 55160, 740 with one or more SW applications 55161.

Figure 55b

55b illustrates an exemplary sequence 55200 of a SW program 55111, 55112, 55113. A SW program 55111, 55112, 55113 can include one or more basic modules 55210, which are installed on the first HW platform 55110, for example the higher-level computer unit 12 could be. Furthermore, a SW program 55111, 55112, 55113 can include one or more safety-relevant modules 55121, 55122, which are preferably installed on the control device 55120, 4 of the fuse 1. When executing a SW program 55111, 55112 55113, a basic module 55210 can be executed first, which calls up a safety-relevant module 55121, 555122 if necessary. With the call, input data 55211 can be transferred to a safety-relevant module 55121, 55122. Furthermore, output data 55221 can be transferred back to a base module 55210 after or during the execution of the safety-relevant module 55121, 55122. By dividing a SW program 55111, 55112, 55113 into one or more basic modules 55210 and one or more safety-related modules 55121, 55122, complex applications can be provided, which, however, only include relatively small safety-related modules 55121, 55122, which are more efficient and can be checked reliably.

Access to a safety-relevant supply network-internal function 55201 and/or to a safety-relevant supply network-external function 55202 can preferably only be made possible by a safety-relevant module 55121, 55122. In this way, the security of functions 55201 of the supply network 200 and/or of functions 55202 external to the supply network can be ensured in an efficient manner.

In an example of automatic equipment variant billing, an external provider uses its server 710 to provide a payment application 55113 . This application 55113 is divided, for example, into two parts 55121, 55210, a safety-critical part 55121 and a safety-uncritical part 55210. The safety-critical part 55121 runs on a safety hardware platform 55120, for example the control device 4 of a fuse 1 and the safety-uncritical part 55210 is executed within the usual control unit operating system 55130 or on the first HW platform 55110, for example the superordinate computer system 12 itself. The cryptographic operations required for the payment process and/or the access to the switching states of the circuit breakers 17 of the electronic fuses 1 of the supply network can be regarded as a security-critical part 55121, for example. The user interface and communication, e.g. with the Internet 55150 , can be viewed as a non-security-critical part 55210 . All critical operations (in particular encryption and in particular post-quantum encryption) can be performed on the security hardware platform 55120, so that e.g. all data to and from the Internet 55150 e.g. running on the first HW platform 55110 (e.g. Server 710) are processed, encrypted and integrity protected. The security hardware platform preferably includes a genuine random number generator 60 and/or a quantum random number generator 60. The security hardware platform 55120, for example a control device 55120, 4 of the security device 1, preferably uses a quantum random number generator 60 for the encryption.

A user 730 changes the capabilities of their vehicle by changing the trim level. For this purpose, the user 730 makes contact with the higher-level computer system 12 of the supply network 200 of the vehicle via a terminal 740 of the vehicle, e.g. via WLAN, Bluetooth or the Internet. Using a security-critical part 55121 of the payment application 55113, the user or the vehicle is registered as using this equipment variant and a confirmation can be issued via the user interface (by means of a security-uncritical part 55210). When the use of the equipment variant ends, a security-critical part 55121 of the payment application 55113 takes over the calculation of the costs and in doing so clearly identifies the vehicle with the supply network 200 by means of cryptographic operations, which preferably use PQC-firm signatures and encryptions and random numbers the true random number generator 60 and/or the quantum random number generator 60.

Using the system 55100 described in this document, a trim level application 55113 can be split into two parts 55210, 55121, a safety-critical part 55121 and a safety-uncritical part 55210. The safety-critical part 55121 runs on the safety HW platform 55120 (control device 55120, 4 of backup 1) and the safety-uncritical part 55210 can be within the higher-level computer system 12 and/or run together with a non-critical user application on a 55160 smartphone, for example.

As a safety-critical part 55121, e.g. those for changing the switching states of the circuit breakers 17 of the fuses 1 and/or changing the switching thresholds for switching the circuit breakers 17 and/or all other changes in the behavior of the circuit breakers 17 of the fuses 1 and those for the cryptographic operations required for the billing process and the parameters for the operation of the quantum random number generators and the other cryptographic devices and security-related devices. The user interface and the communication, e.g. with the Internet, can be viewed as a non-security-critical part 55210 . Since all critical operations are already performed on the security HW platform 55120 (controller 55120, 4 of fuse 1), e.g. all data to and from the internet is already encrypted (preferably PQC encrypted) and integrity protected.

A user 730 installs an application for changing the equipment variant (which supports supply network-specific interfaces) on a smartphone 55160, which is intended to serve as a terminal 740 here. The user 730 registers with a server 730 of a provider for the equipment variants, which in turn registers the user 730 in a backend. The user 730 books an available equipment variant of the supply network via the equipment variant application, which corresponds to an equipment variant of the vehicle, and receives a "token" on his smartphone 55160 (740) with which he can use a specific equipment variant, i.e. a specific configuration and topology of the supply network 200 with certain properties of the fuses 1 of the supply network 200 with certain partial supply networks of the supply network and certain energy sources and consumers of the supply network with certain parameter ranges of these energy sources and consumers and with certain functions of these energy sources and consumers, for example in a certain period of time and for example in a certain geographical area . With his smartphone 55160 (740) and/or via another terminal 740 of the vehicle, the user can then use the now supplied and approved device parts of the vehicle and the supply network 200 and parameterize them within the framework of the licensed one.

The security critical part 55121 of the trim level configuration application 55113 verifies the "token" and upon confirmation of the "token" the use of the relevant trim level is granted. In this case, it is impossible for a user 730 to generate a token himself or to import an old token again. Furthermore, due to the structure described in this document, it is irrelevant whether the smartphone 55160 or the equipment variant configuration application is insecure, since only the safety-critical part 55121 of the equipment variant configuration application 55113 critical components 55201 of the supply network 200 and/or critical supply network external components 55202 affected (e.g. on/off of circuit breakers 17 of fuses 1).

A further adaptation of the underlying hardware (in particular the processor environment of e.g. the head unit) can enable further isolation of SW programs 55113 from an external provider. In this case, applications can be completely isolated from the rest of the software environment of the higher-level computer system 12 . In this way, security can be further increased.

Figure 56

56 shows a flowchart of an exemplary method 55300 for executing a SW program 55113 in a supply network 200. The SW program 55113 can be provided by an external provider for an application. The external provider can neither be the manufacturer of the vehicle nor a supplier for a component of the vehicle of which the supply network is a part. The external provider can be a service provider, for example, who wants to provide a service, such as a billing service, an equipment variant service, etc., in connection with the supply network 200 using the SW program 55113 .

The method 55300 includes the execution 55301 of a base module 55210 of the SW program 55113 on a first HW platform 55110 of the vehicle (eg on the higher-level computer system 12 of the supply network 200). The base module 55210 can, for example, have relatively uncritical functions, such as a user interface and/or communication with a network 55150 and/or with a provider Allow transmission network-external device 55160 (eg a smartphone or a car key or the like).

A safety-relevant module (55121) of the SW program (55113) can then be called from the base module 55210 when the SW program 55113 is executed (step 55302). The safety-relevant module 55121 accesses safety-relevant data (e.g. cryptographic keys and/or billing data) and/or a safety-relevant function (e.g. one or more gate controls 16 of one or more circuit breakers 17 of one or more fuses 1 in the supply network 200 of the vehicle) too.

The method 55300 also includes the execution 55303 of the safety-relevant module 55121 on a control device 55120, 4 of the supply network 200. The control device 55120, 4 of the fuse 1 is subject to one or more safety measures, which the first HW platform 55110, ie for example the higher-level computer system 12 and/or the 740 terminal. For example, for SW modules 55121 that are to be executed on the control device 55120, 4 of fuse 1, the SW code is checked by the manufacturer of the vehicle and/or the manufacturer of the supply network 200 and/or the manufacturer of fuse 1, to prevent undesired effects on a vehicle function 55201 and/or a function of the supply network 200 and/or a function of the fuse 1. Alternatively or in addition, data 55201, 55202 can be restricted, which can be transferred to a SW module 55121 or from a SW module 55121 that runs on control device 55120, 4 of fuse 1. Incidentally, in the sense of the document presented here, the superordinate computer system 12 can also be regarded as a fuse without circuit breaker 17 in some applications. The first hardware platform would then be, for example, the service provider's server 710 and/or the terminal 740 for user 730 inputs.

A standardized software and hardware environment for SW programs 55113 from external providers is thus described in this document. The system 55100 described is preferably designed in such a way that no special knowledge of embedded hardware/software is required and that all software interfaces are clearly defined. By abstracting the hardware, an external provider of software programs 55113 does not have to worry about hardware interfaces. Furthermore, a vehicle manufacturer or a manufacturer of a supply network does not have to make any software or hardware changes for the connection of a new SW program 55113 .

A secure and reliable execution environment for SW programs 55113 from external providers within a supply network 200 is thus provided. SW programs 55113 can be subsequently delivered during the operating time of a supply network 200 (after verification and signature by the automobile manufacturer or the manufacturer of the supply network), so that functional expansion and/or changes to the equipment variant of the vehicle are made possible by changing the equipment variant of the supply network 200 become. In addition, an automobile manufacturer or the manufacturer of the supply network 200 can outsource safety-critical parts 55121 of a SW program 55111 to the safety HW platform 55120 (control device 5120, 4 of fuse 1) in order to increase the safety level of a higher-level computer system 12 of the supply network 200 to increase.

Features of the proposal

The characteristics of the proposal reflect various characteristics of possible forms. The characteristics have sub-characteristics. The features are organized in feature groups. A new feature group begins with a new feature number 1. Reworkers can combine features and/or sub-features as desired, as far as this makes sense. These combinations are expressly part of the disclosure presented here. The claim results in each case from the claims. However, we expressly reserve the right to change the claim in the further patenting process. The claim is limited to functional combinations than to meaningful combinations. If no values and/or value ranges for parameters are specified, the document presented here recommends carrying out a DoE (English for Design of Experiment), i.e. carrying out a series of experiments with a suitable statistical experimental design.

Features control device

• - die System Basis Chip Funktionalität umfasst
  • - die Spannungsversorgung (5) durch Aufbereitung einer extern bereit gestellten Betriebsspannung (6) einer oder mehrerer Energiequellen und
  • - eine Notenergieversorgung (7) insbesondere durch Laden einer externen und/oder internen Energiereserve (8) aus einer oder mehreren der Energiequellen und durch Spannungsversorgung mittels Aufbereitung der Energie dieser Energiereserve (8) und
  • - die Bereitstellung eines Bus-Transceivers (10) für die Kommunikation des Mikrokontrollers (2) mit übergeordneten Vorrichtungsteilen des Fahrzeugs, beispielsweise einem übergeordneten Rechnersystem (12) und
  • - ein Watch-Dog-Timer (13) für die Überwachung des Mikrokontrollers (2).

Feature 1: control device (4) for a vehicle for operating an electronic fuse with system basis chip functionality
this system based chip functionality providing all the functions to be able to operate a microcontroller (2) in the control system (3) of the electronic fuse and

• - includes the System Basis Chip functionality
  • - The power supply (5) by processing an externally provided operating voltage (6) of one or more energy sources and
  • - An emergency energy supply (7), in particular by charging an external and/or internal energy reserve (8) from one or more of the energy sources and by supplying power by processing the energy of this energy reserve (8) and
  • - The provision of a bus transceiver (10) for the communication of the microcontroller (2) with higher-level device parts of the vehicle, for example a higher-level computer system (12) and
  • - a watchdog timer (13) for monitoring the microcontroller (2).

Advantage of this feature: The control device 4 can detect safety-related incidents using the watchdog 13 and, if necessary, switch off the circuit breaker and/or signal the incident to a higher-level computer system 12 .

Feature 1b: control device (4) of an electronic fuse (1) of a vehicle,
wherein the control device (4) is monolithic and
wherein the control device (4) comprises a circuit breaker (17) and
wherein the control device (4) comprises an oscillator (30) and/or a clock system and
wherein the control device (4) comprises a voltage supply (5) and
wherein the control device (4) comprises an externally provided operating voltage (6) and
wherein the control device (4) is set up for at least a first state of normal operation of the control device (4) when the externally provided operating voltage (6) is available and a second state of emergency operation of the control device (4) when the externally provided operating voltage ( 6) accept, and
wherein the voltage supply (5) is set up to supply internal supply voltages of the control device (4) required by device parts of the control device (4) during normal operation of the control device (4) and/or by conditioning an externally provided operating voltage (6) of the control device (4). to provide internal supply voltages of the electronic fuse (1) required by other device parts of the electronic fuse (1), and
wherein the voltage supply (5) is set up to supply an external and/or internal energy reserve (8) with the energy of an externally provided operating voltage (6) of the control device (4) and/or the externally provided operating voltage during normal operation of the control device (4). To load operating voltage (6) of the control device (4), and
wherein the power supply (5) is set up to, in emergency operation of the control device (4), supply the energy for providing these internal supply voltages and/or the energy for providing some of these internal supply voltages instead of from the externally provided operating voltage (6) of the control device ( 4) taken from the energy reserve (8), and
wherein the voltage supply (5) is set up to supply the oscillator (30) and/or the clock system with electrical energy from the energy reserve (8) in the emergency operation of the control device (4) if the operating voltage (6) fails, and
wherein the control device (4) sets the state of the circuit breaker (17) in normal operation and in emergency operation of the control device (4) if the operating voltage (6) fails and

Advantage of this feature: Proper operation of the fuse is also ensured if the operating voltage fails.

Feature 1c: control device according to feature 1b,
wherein the control device (4) comprises a computer core (2) and
wherein the control device (4) comprises a non-volatile memory (14) and
wherein the power supply (5) is set up to supply the computer core (2) with electrical energy from the energy reserve (8) in the emergency operation of the control device (4) if the operating voltage (6) fails provide, and
wherein the voltage supply (5) is set up to supply the non-volatile memory (14) with electrical energy from the energy reserve (8) in the emergency operation of the control device (4) if the operating voltage (6) fails and

Advantage of this feature: Proper operation of the fuse is also ensured if the operating voltage fails.

Feature 1d: control device according to feature 1c,
wherein the control device (4) comprises a data bus interface (10) and
wherein the voltage supply (5) is set up to supply the data bus interface (10) with electrical energy from the energy reserve (8) in the emergency operation of the control device (4) if the operating voltage (6) fails, and
wherein the computer core (2) of the control device (4) is connected to a higher-level computer system (12) of the vehicle via the data bus interface (10) and via a data bus (9) and
wherein the computer core (2) is set up to signal this emergency operation and/or the failure of the operating voltage (6) of the control device (4) to the higher-level computer system (12) in an emergency operation of the control device (4) if the operating voltage (6) fails .

Advantage of this feature: Proper operation of the fuse is also ensured if the operating voltage fails and the higher-level computer system 12 can still bring the vehicle to a safe state in good time.

Feature 1e: control device according to feature 1c or 1d,
wherein the control device (4) comprises a watchdog timer (13) and
wherein the control device (4) is set up to supply the watchdog timer (13) with electrical energy from the energy reserve (8) in an emergency operation of the control device (4) if the operating voltage (6) fails.

Advantage of this feature: Proper operation of the fuse and monitoring of this operation are also ensured if the operating voltage fails.

Features security system

Feature 2: Backup System
with an electronic fuse (1) and
with a control device (4) and
with a current measuring device (570, 24),
wherein the security system is intended and suitable as a device component of a device for carrying out a method according to feature 3.
characterized in that the current measuring device has an increased sampling rate.

Device features supply network (Figure 2)

• - wobei das Versorgungsnetzwerk (200) einen oder mehrere erste Versorgungsleitungsabschnitte (245) aufweist, die dazu eingerichtet sind, jeweils einen oder mehrere erste Vorrichtungsteile (210 bis 213) der Vorrichtungsteile (210 bis 215 und 220 bis 224 und 230 bis 234) des Fahrzeugs mit elektrischer Energie zu versorgen, und
• - wobei diese ersten Vorrichtungsteile (210 bis 213) dazu eingerichtet sind, andere, zweite Vorrichtungsteile (220 bis 224 und 230 bis 234) der Vorrichtungsteile (210 bis 215 und 220 bis 224 und 230 bis 234) des Fahrzeugs über einen oder mehrere andere, zweite Leitungsabschnitte (240, 241) mit elektrischer Energie zu versorgen, und
• - wobei einige oder alle Vorrichtungsteile dieser Vorrichtungsteile (210 bis 213 und 220 bis 224 und 230 bis 234) zumindest eine jeweilige elektronische Sicherung (214 bis 217 und 225 bis 228 und 235 bis 238), im Folgenden als elektronische Sicherung (214 bis 217 und 225 bis 228 und 235 bis 238) des Vorrichtungsteils bezeichnet, aufweisen und
• - wobei die jeweilige elektrische Sicherung (214 bis 217 und 225 bis 228 und 235 bis 238) des jeweiligen Vorrichtungsteils jeweils dazu eingerichtet ist, die Energieentnahme dieses jeweiligen Vorrichtungsteils aus dem Versorgungsleitungsabschnitt (245), der dazu eingerichtet ist, diesen jeweiligen Vorrichtungsteil mit elektrischer Energie zu versorgen, zu unterbinden oder zuzulassen.

Feature 3. Supply network (200) for a vehicle for supplying device parts (210 to 215 and 220 to 224 and 230 to 234) of the vehicle with electrical energy from energy sources (250, 251)

• - wherein the supply network (200) has one or more first supply line sections (245) which are set up to each have one or more first device parts (210 to 213) of the device parts (210 to 215 and 220 to 224 and 230 to 234) of the vehicle to supply with electrical energy, and
• - wherein these first device parts (210 to 213) are set up to other, second device parts (220 to 224 and 230 to 234) of the device parts (210 to 215 and 220 to 224 and 230 to 234) of the vehicle via one or more others, to supply second line sections (240, 241) with electrical energy, and
• - wherein some or all device parts of these device parts (210 to 213 and 220 to 224 and 230 to 234) have at least one respective electronic fuse (214 to 217 and 225 to 228 and 235 to 238), hereinafter referred to as electronic fuse (214 to 217 and 225 to 228 and 235 to 238) of the device part, and
• - wherein the respective electrical fuse (214 to 217 and 225 to 228 and 235 to 238) of the respective device part is set up in each case to ensure that the energy withdrawal of this respective device part from the supply line section (245) is set up to supply this respective device part with electrical energy to provide, prevent or allow.

Advantage of this feature: This feature allows for the reconfiguration of the supply network topology during operation and the optimization of the energy production, the energy distribution and the energy consumption in the supply network of the vehicle.

Feature 4: supply network according to feature 3,
wherein the topology of the supply network (200) or a supply sub-network of the supply network (200) has a tree structure with a tree starting point (270) and
wherein the line sections (241 to 245) represent the branches of the supply network (200) or of the partial supply network of the supply network (200) and
wherein an energy source (250) and/or a central energy feed point is located at the tree starting point (270) and
device parts (210 to 213 or 220 to 224 or 230 to 234) which have the electronic fuse (214 to 217 and 225 to 228 and 235 to 238) are located at the ends of line sections (240 to 245).

Advantage of this feature: This feature enables a clear hierarchy of consumers in the supply network. Important consumers can be placed closer to the energy source than less important ones. This is not possible without a tree structure and/or a central energy feed point as the central energy source.

Feature 4b: supply network according to feature 3,
wherein the topology of the supply network (200) or a supply sub-network of the supply network (200) has a tree structure with a tree starting point (270) and
wherein the line sections (241 to 245) represent the branches of the supply network (200) or of the partial supply network of the supply network (200) and
a consumer (250) and/or a central energy supply point being located at the tree starting point (270) and
energy sources having the electronic fuse being located at the ends of line sections (240 to 245).

Advantage of this feature: This feature enables a clear hierarchy of the energy sources of the supply network. Important consumers can be placed closer to the energy source than less important ones. This is not possible without a tree structure and/or a central energy feed point as the central consumer.

Feature 5: supply network according to one of features 3 to 4 or 4b,
wherein in at least one resulting energy supply path (250, 255, 245, 216, 212, 241, 235, 230) a plurality of electronically controllable fuses (eg 255, 216, 235 etc.) are connected in series in series.

Advantage of this feature: This allows isolation of a faulty section of supply line.

Feature 6: supply network (200) according to feature 5,
wherein at least two line sections (241, 243) are set up to supply at least one device part (230, 232) of the vehicle with electrical energy at least at times with different priorities, and
a higher-level computer system (12) of the vehicle being set up for this purpose, in particular via a data bus (9), by means of electronic fuses (255, 214 to 217 and 225 to 228 and 235 to 238) in the supply network (200), depending on the operating state of the vehicle and/or due to environmental influences and/or due to the state of the surroundings of the vehicle and/or due to the vehicle occupants and/or due to vehicle parameters such as speed or acceleration or location, one or more device parts of the device parts (210 to 213 and 220 to 224 and separating 230 to 234) of the supply network (200) from the energy supply (250).

Advantage of this feature: In the event of an accident, such as driving off the road, this allows a preventive reduction of the power supply to harmless and/or absolutely necessary vehicle components, such as the automatic emergency call and/or airbags.

Feature 7: supply network (200) according to feature 6,
wherein the supply network (200) is set up to supply at least a first device part (212) with higher priority electrical energy via a first supply line section (245), and
wherein the supply network (200) is set up to supply at least one second device part (231) with electrical energy with a lower priority via a second supply line section (241).

Advantage of this feature: This ensures that less important consumers cannot interfere with the functioning of the core devices of the vehicle.

Feature 8: supply network (200) according to feature 7,
wherein the vehicle comprises a higher-level computer system (12) and
the higher-level computer system (12) of the vehicle being set up to send the device part ( 231) with the lower priority within the supply network (200) from the energy supply (250) if otherwise the security of supply of other device parts of the supply network (200) with higher priority regarding the supply of electrical energy would be endangered.

Advantage of this feature: This ensures a vehicle-wide optimization of the energy supply.

Feature 9: supply network (200) according to one of features 3 to 8,
one or more, preferably all, device parts (250, 210 to 213 and 220 to 224 and 230 to 234) of the vehicle, which are supplied with energy by a supply line section (245, 240, 241) and/or the electrical energy is fed into a supply line section (245 , 240. 241) are set up to
to detect electrical parameters of the current flow in the relevant supply line section of the supply line sections (245, 240, 241) and/or
to detect electrical parameters of the potential of the supply line section of the supply line sections (245, 240. 241) on the supply line side of the device part against a reference potential (280).

Advantage of this feature: This enables compliance with the specification values of the relevant supply line section.

Feature 10: supply network (200) according to feature 9,
wherein the device parts (250, 210 to 213 and 220 to 224 and 230 to 234) of the vehicle, which the relevant supply line section (245, 240. 241) supplies with energy and/or the electrical energy into the relevant supply line section (245, 240. 241), are set up to feed the recorded parameters and/or the values derived from these recorded parameters to control devices (281 to 292) of other device parts of the vehicle and/or to control devices (281 to 292) of other electronic fuses of the supply network (200) and/or to a higher-level computer system (12) via a data bus (9).

Advantage of this feature: This enables the vehicle-wide optimization of the energy supply to the consumers of the supply network and a good overview of the state of the supply network.

Feature 11: supply network (200) according to feature 10,
wherein the data bus (9) is a backup data bus (9) or another data bus, for example a Lin data bus or a DSI3 data bus or a PSI5 data bus or a CAN data bus or a CAN FD data bus or an Ethernet data bus or a Flexray data bus or an LVDS data bus or
an otherwise wired or wireless data communication device, for example a Bluetooth or WLAN data communication device, or the like.

Advantage of this feature: It enables the integration of the supply network into existing data networks in automobiles.

Feature 12: supply network (200) according to one of features 3 to 11,
wherein an energy source (250) is set up to supply a device part (213) of the device parts (250, 210 to 213 and 220 to 224 and 230 to 234) of the vehicle), hereinafter referred to as the energy-supplying device part (213), via a supply line section ( 245) to supply electrical energy, and
wherein the energy-supplying device part (213) is set up to supply a further device part (232) of the vehicle with electrical energy via a further supply line section (243).

Advantage of this feature: This enables a hierarchy of the supply network and the control of voltage converters as special consumers in the supply network.

Feature 13: supply network (200) according to one or more of features 3 to 12,
wherein a first supply line section (241) of the supply network (200) and a second supply line section (243) of the supply network (200) at least temporarily have a voltage of more than 40V between themselves or with respect to a reference potential (201).

Advantage of this feature: This enables the operation of different voltage domains for drive and data processing.

Feature 14: supply network (200) according to one or more of features 3 to 13,
wherein the supply network (200) comprises a first supply sub-network, which is a supply network according to one or more of claims 1 to 11, and
wherein the supply network (200) comprises a second supply sub-network, which is a supply network according to one or more of claims 1 to 11, and
wherein the first supply sub-network is different from the second supply sub-network and
wherein the potential difference between the potential of the supply line sections of the first partial supply network and a reference potential is at least temporarily at a voltage of 0V to 1500V, typically 800V, and
wherein the potential difference between the potential of the supply line sections of the second supply part network and a reference potential is at least temporarily at a voltage of 0V to 50V, typically 48V, ie less than 50V.

Advantage of this feature: This enables the operation of different voltage domains for drive and data processing.

Feature 15: device part for a vehicle with a supply network according to one of features 3 to 14,
the respective device part (212) having a plug-in option (262) for the respective electronic fuse (216).

Advantage of this feature: This makes it easier to replace faulty fuses. Downward compatibility with fuses is possible.

Feature 16: supply network (200) of a vehicle
wherein the supply network (200) has supply line sections and
wherein the supply network (200) comprises energy-consuming device parts (250, 210 to 213 and 220 to 224 and 230 to 234) of the supply network (200) and
wherein the supply network (200) comprises energy-supplying device parts (250, 251) of the vehicle which are set up to feed energy into the supply network (200), and
wherein energy-consuming device parts (250, 210 to 213 and 220 to 224 and 230 to 234) of the vehicle are set up such that at least one supply line section (240 to 245) supplies them with electrical energy from the supply network, and
wherein energy-consuming device parts (210 to 213) are set up to be able to supply electrical energy to a further device part (220 to 223 and 230 to 233) of the vehicle via a further line section (240, 241), and
wherein the power consuming device parts (210 to 213 and 220 to 223 and 230 to 233) a have electronic fuse (280 to 291) and
wherein the respective electronic fuse (280 to 291) of a respective energy-consuming device part (210 to 213 and 220 to 223 and 230 to 233) is set up in each case to ensure the supply of this respective energy-consuming device part (210 to 213 and 220 to 223 and 230 to 233 ) and any further energy-consuming device parts (220 to 223 and 230 to 233) supplied with electrical energy by this respective energy-consuming device part (210 to 213 and 220 to 223 and 230 to 233).

Advantage of this feature: This makes it possible to drop larger sub-networks.

Feature 17: supply network (200) of a vehicle according to feature 16,
wherein energy-supplying device parts (250 to 251) have a respective electronic fuse (292 to 293) and
wherein the respective electronic fuse (280 to 291) of a respective energy-supplying device part (250 to 251) is set up to prevent the feeding of electrical energy through the respective energy-supplying device part (250 to 251) into the supply network (200) and/or a respective supply line section (245 ) to be able to prevent, and
wherein energy-consuming device parts (210 to 213), which are set up to supply other energy-consuming device parts (220 to 223 and 230 to 233) with electrical energy via sub-supply networks of the supply network (200), have a respective further electronic fuse, in order to be able to throw off the partial supply networks of the supply network (200) supplied by them, if necessary by means of a respective circuit breaker (17) of this respective further electronic fuse.

Advantage of this feature: This makes it possible to drop larger sub-networks.

Device features Fuse box

Feature 18: fuse box (400) for a supply network (200) of a vehicle
wherein the fuse box (400) comprises electronic fuses (405) and/or slots (410) for electronic fuses (405) and
wherein the fuse box comprises fuses (415) and/or slots (420) for fuses (415) and
wherein at least one electronic fuse (405) of the electronic fuses has a first connection (18) and a second connection (19) and
wherein said at least one electronic fuse (405) is set up to emulate the behavior of a fuse (415), and
wherein said electronic fuse (405) is set up to detect the current value of the magnitude of the electric current (29) flowing through said electronic fuse (405) from the first terminal (18) to the second terminal (19) or vice versa, and
wherein this electronic fuse (405) is set up to determine an intermediate value from this detected current value by means of a polynomial of at least the second degree and to integrate it over time to form an integrated intermediate value, and
wherein the electronic fuse (405) is set up to prevent the flow of current between the first connection (18) and the second connection (19) if the integrated intermediate value exceeds a maximum value, and
wherein the electronic fuse (405) is arranged in a fuse body (425) with connectors that mechanically fits into one of the slots (410) for electronic fuses (405).

Advantage of this feature: This makes it easier to replace faulty fuses. Downward compatibility with fuses is possible.

Feature 19: fuse box (400) according to feature 18,
wherein the fuse box (400) comprises a data bus (9).

Advantage of this feature: This makes data collection and data processing possible in the car and beyond.

Feature 20: fuse box (400) according to feature 19,
wherein a slot (410) for an electronic fuse (405) has a first contact (430) of the slot zes (410) and
wherein this slot (410) for an electronic fuse (405) has a second contact (445) of the slot (410) and
wherein the first contact (430) of the slot (410) is arranged to establish an electrical connection between this first contact (410) of the slot (410) and a first contact (450) of a plug connector of a fuse body (425) to form the first to electrically connect the connection (18, 450) of the fuse (405) of the fuse body (425) to the first contact (430) of the slot (410), and
wherein the second contact (445) of the slot (410) is set up to establish an electrical connection between this second contact (445) of the slot (410) and a second contact (470) of the plug connector (410) of the fuse body (425), to electrically connect the second terminal (19, 470) of the fuse (405) of the fuse body (425) to the second contact (445) of the slot (405).

Advantage of this feature: This makes it easier to replace faulty fuses. Downward compatibility with fuses is possible.

Feature 21: fuse box (400) according to feature 20,
wherein a slot (410) for an electronic fuse (405) has a third contact (440) of the slot (410) and
wherein the third contact (440) of the slot (405) is set up to establish an electrical connection between this third contact (440) of the slot (405) and a third contact (465) of the plug connector (410) of the fuse body (425), to electrically connect a data line (9) of a data interface (10) of a control circuit (4) of the electronic fuse (405) of the fuse body (425) to the third contact (440) of the slot (405).

Advantage of this feature: This makes it easier to replace faulty fuses. Downward compatibility with fuses is possible. At the same time, data can be collected and the backup can be controlled externally via the data bus.

Feature 22: fuse box (400) according to feature 20 or 21,
wherein a slot (410) for an electronic fuse (405) has a fourth contact (435) of the slot (410) and
wherein the fourth contact (435) of the slot (410) is set up to establish an electrical connection between this fourth contact (435) of the slot (410) and a fourth contact (455) of the plug connector of the fuse body (425) in order to provide a power supply to electrically connect the control device (4) of the electronic fuse (405) to the fourth contact (455) of the slot (410).

Advantage of this feature: This makes it easier to replace faulty fuses. Downward compatibility with fuses is possible. At the same time, the fuses can be supplied via specially secured supply lines.

Feature 23: fuse body (425) of an electronic fuse (405) for a fuse box (400) according to one or more of features 18 to 22,
wherein the connector of the fuse body (425) has a first contact (450) for the first terminal (18) of the electronic fuse (405) and
wherein the connector of the fuse body (425) has a second contact (470) for the second terminal (19) of the electronic fuse (405) and
wherein the connector mechanically fits into at least one of the slots (410) for electronic fuses (405) of the fuse box (400).

Advantage of this feature: This makes it easier to replace faulty fuses. Downward compatibility with fuses is possible.

Feature 24: fuse body (425) according to feature 23,
wherein the plug connector of the fuse body (425) has a third contact (465) for a fuse data bus (9) and
wherein the third contact (465) is electrically connected to a data line (9) of a data interface (10) of a control device (4) of the electronic fuse (405) of the fuse body (425).

Advantage of this feature: This makes it easier to replace faulty fuses. Downward compatibility with fuses is possible.

Feature 25: fuse body (425) according to feature 23 or feature 24,
wherein the connector of the fuse body (425) has at least a fourth contact (455) for a voltage supply (6) of the control device (4) of the electronic fuse (405).

Advantage of this feature: This makes it easier to replace faulty fuses. Downward compatibility with fuses is possible.

Feature 26: Fuse (415) for a fuse box (400) according to one or more of Claims 18 to 22
wherein the fuse (415) has a fuse body (425) and
wherein the fuse body (425) has a plug connector (410) and
wherein the connector (410) of the fuse body (425) has a first contact (455) for the first terminal (18) of the fuse (415) and
wherein the connector (410) of the fuse body (425) has a second contact (470) for the second terminal (19) of the fuse (415) and
wherein the connector of the fuse (415) is adapted to mechanically fit into at least one of the slots (410) for electronic fuses (405).

Advantage of this feature: If necessary, faulty fuses can be replaced with fuses in the workshop.

Feature 27: fuse (415) according to feature 26,
wherein the connector of the fuse (415) is adapted to mechanically fit into at least one of the sockets (420) for fuses (415).

Advantage of this feature: This means that fuses can be used both as a replacement for electronic fuses and in slots for fuses.

Device features electronic fuse

Feature 28: Electronic fuse (1),
wherein the electronic fuse (1) has a first connection (18) and
wherein the electronic fuse (1) has a second connection (19) and
wherein the electronic fuse (1) has a circuit breaker (17) and
wherein the electronic fuse (1) has a control device (4) and
wherein the circuit breaker (17) has a first connection (26), a control connection (27) and a second connection (28) and
wherein the first terminal (26) of the circuit breaker (17) is electrically connected to the first terminal (18) of the fuse (1) and
wherein the second terminal (28) of the circuit breaker (17) is electrically connected to the second terminal (19) of the fuse (1) and
wherein the control terminal (27) of the circuit breaker (17) is electrically connected to the control device (4) and
wherein the control device (4) of the electronic fuse (1) is set up to detect voltages between the terminals (26, 27, 28) of the circuit breaker and/or functionally equivalent values of physical parameters and from this to derive a value for an electric current (29). to determine the circuit breaker (17) between the first connection (26) of the circuit breaker (17) and the second connection (28) of the circuit breaker (28).

Advantage of this feature: This enables the backup to record relevant operating data.

Feature 29: electronic security (1), in particular according to feature 28,
wherein the electronic fuse (1) has a first connection (18) and
wherein the electronic fuse (1) has a second connection (19) and
wherein the electronic fuse (1) has a circuit breaker (17) and
wherein the electronic fuse (1) has an auxiliary circuit breaker (23) and
wherein the electronic fuse (1) has a shunt resistor (24) and
wherein the electronic fuse (1) has a control device (4) and
wherein the circuit breaker (17) has a first connection (26), a control connection (27) and a second connection (28) and
wherein the auxiliary circuit breaker (23) has a first connection (26), a control connection (27) and a second connection (28) and
wherein the first terminal (26) of the circuit breaker (17) is electrically connected to the first terminal (18) of the fuse (1) and
wherein the second terminal (28) of the circuit breaker (17) is electrically connected to the second terminal (19) of the fuse (1) and
wherein the control terminal (27) of the circuit breaker (17) is electrically connected to the control device (4) and
wherein the first terminal (26) of the auxiliary circuit breaker (23) is electrically connected to the first terminal (18) of the fuse (1) and
wherein the control terminal (27) of the auxiliary circuit breaker (23) is electrically connected to the control device (4) and
wherein the second terminal (28) of the auxiliary circuit breaker (23) is connected to a first terminal (25) of the shunt resistor (24) and
wherein the second terminal of the shunt resistor is electrically connected to the second terminal (19) of the fuse (1) and
wherein the control device (4) of the electronic fuse (1) is set up to measure the voltage between the first terminal (25) of the shunt resistor (24) and the second terminal (21) of the shunt resistor (24) and/or functionally equivalent Detect values of physical parameters and use them to determine a value for an electric current (29) through the circuit breaker (17) between the first connection (26) of the circuit breaker (17) and the second connection (28) of the circuit breaker (28).

Advantage of this feature: This enables the fuse to detect the fuse current without significant loss of energy.

Feature 30. Electronic security (1), in particular according to feature 28 or 29,
wherein the electronic fuse (1) has a first connection (18) and
wherein the electronic fuse (1) has a second connection (19) and
wherein the electronic fuse (1) has a circuit breaker (17) and
wherein the electronic fuse (1) has a control device (4) and
wherein the circuit breaker (17) has a first connection (26), a control connection (27) and a second connection (28) and
wherein the first terminal (26) of the circuit breaker (17) is electrically connected to the first terminal (18) of the fuse (1) and
wherein the second terminal (28) of the circuit breaker (17) is electrically connected to the second terminal (19) of the fuse (1) and
wherein the control terminal (27) of the circuit breaker (17) is electrically connected to the control device (4) and
wherein the electronic fuse (1) has an electronic test current source (505) and
wherein the electronic test current source (505) is set up to inject an additional test current (515) into the circuit breaker (17) between the first connection (26) of the circuit breaker (17) and the second connection (28) of the circuit breaker (17) and/or to be able to feed into the first terminal (26) of the circuit breaker (17) as a function of a first control signal (510) from the control device (4), and
wherein the control device (4) is set up to modulate the control signal (510) with a first modulation signal ({505}) and thus the additional test current (515), and
wherein the control device (4) is set up to detect or determine the time profile of the electric current (29) through the circuit breaker (17), and
wherein the control device (4) is set up to check whether the time profile of the electric current (29) includes signal components whose modulation correlates with the modulation of the modulation signal ({505}).

This allows the fuse controller to detect when the circuit breaker is faulty.

Feature 31: electronic fuse (1) according to feature 30,
wherein the fuse (1) comprises a synchronous demodulator (525) and
wherein the synchronous demodulator (525) is set up to determine the correlation between the value profile of the electric current (29) on the one hand and the modulation signal ({505}) on the other.

Advantage of this feature: This makes it possible to quantify the conductivity of the circuit breaker during operation without disturbing the consumer current.

Feature 32. Electronic fuse (1) according to feature 31,
wherein the synchronous demodulator (525) is set up to decode the modulation signal ({505}) or a signal derived therefrom or a signal that has a fixed temporal relationship with the modulation signal ({505}), on the one hand with the temporal value profile of the electrical to multiply the current (29) or a signal derived therefrom on the other hand, and
wherein the synchronous demodulator (525) is set up to subsequently filter, preferably low-pass filter, the signal resulting from the multiplication to form a correlation signal (C _29m (t)).

Advantage of this feature: This makes it possible to quantify the conductivity of the circuit breaker during operation without disturbing the consumer current.

Feature 33. Electronic fuse (1) according to feature 31 or 32,
wherein the synchronous demodulator (525) or the control device (4) comprises a matched filter optimized for the modulation signal ({505}) and/or an optimum filter and/or a Kalman filter or another estimation filter which is set up to to convert the time profile of the electric current (29) to a correlation signal (C _29m (t)).

Advantage of this feature: This makes it possible to quantify the conductivity of the circuit breaker during operation without disturbing the consumer current.

Feature 34. Electronic fuse (1) according to any one of features 28 to 33,
wherein the control device (4) is set up to detect the electrical voltage between the first connection (18) of the fuse (1) and the second connection (19) of the fuse (1), and
wherein the control device (4) switches the circuit breaker (17) non-conductive if the sign of the electrical voltage between the first connection (18) of the fuse (1) and the second connection (19) of the fuse (1) does not correspond to a preset value and/or corresponds to a default value interval.

Advantage of this feature: This is an additional function where the fuse operates as a voltage monitoring device and prevents over and/or under voltages.

Feature 35: Electronic fuse (1) according to one of features 28 to 34,
wherein the control device (4) is set up to detect the electrical voltage between the first connection (18) of the fuse (1) and the second connection (19) of the fuse (1), and
wherein the control device (4) switches the circuit breaker (17) off when the electrical voltage between the first connection (18) of the fuse (1) and the second connection (19) of the fuse (1) falls below a first preset value, and/or
wherein the control device (4) switches the circuit breaker (17) off when the electrical voltage between the first terminal (18) of the fuse (1) and the second terminal (19) of the fuse (1) exceeds a second preset value.

Advantage of this feature: This is an additional function where the fuse operates as a voltage monitoring device and prevents over and/or under voltages.

Feature 36: Electronic fuse (1) according to one of features 28 to 35,
wherein the control device (4) is set up to detect the electrical voltage between the first connection (26) of the circuit breaker (17) of the fuse (1) and the second connection (28) of the circuit breaker (17) of the fuse (1), and
wherein the control device (4) switches the circuit breaker (17) off when the sign of the electrical voltage between the first connection (26) of the circuit breaker (17) of the fuse (1) and the second connection (28) of the circuit breaker (17) of the Backup (1) does not meet a default value and/or default value interval.

Advantage of this feature: This is an additional function where the fuse operates as a voltage monitoring device and prevents over and/or under voltages.

Feature 37: Electronic fuse (1) according to one of features 28 to 36,
wherein the control device (4) is set up to detect the electrical voltage between the first connection (26) of the circuit breaker (17) of the fuse (1) and the second connection (28) of the circuit breaker (17) of the fuse (1), and
wherein the control device (4) switches the circuit breaker (17) non-conductive when the electrical voltage between the first terminal (26) of the circuit breaker (17) of the fuse (1) and the second terminal (28) of the circuit breaker (17) of the fuse ( 1) falls below a third preset value, and/or
wherein the control device (4) switches the circuit breaker (17) non-conductive when the electrical voltage between the first terminal (26) of the circuit breaker (17) of the fuse (1) and the second terminal (28) of the circuit breaker (17) of the fuse ( 1) exceeds a fourth preset value.

Advantage of this feature: This is an additional function where the fuse operates as a voltage monitoring device and prevents over and/or under voltages.

Feature 38: Electronic fuse (1) according to one of features 28 to 37,
wherein the electronic fuse (1) has a reference potential connection (201) and
wherein the control device (4) is set up to detect the electrical voltage between the first connection (18) of the fuse (1) and the reference potential connection (201) of the fuse (1) and to switch the circuit breaker (17) non-conductive, if the electrical voltage between the first terminal (18) of the fuse (1) and the reference potential terminal (201) of the fuse (1) falls below a fifth preset value and/or if the electrical voltage between the first terminal (18) of the fuse (1) and the reference potential terminal (201) of the fuse (1) exceeds a sixth default value, and/or
wherein the control device (4) is set up to detect the electrical voltage between the second terminal (19) of the fuse (1) and the reference potential terminal (201) of the fuse (1) and to switch the circuit breaker (17) non-conductive, if the electrical voltage between the second terminal (19) of the fuse (1) and the reference potential terminal (201) of the fuse (1) falls below a seventh preset value and/or if the electrical voltage between the second terminal (19) of the fuse (1) and the reference potential connection (201) of the fuse (1) exceeds an eighth preset value.

Advantage of this feature: This is an additional function where the fuse operates as a voltage monitoring device and prevents over and/or under voltages.

Feature 39: Electronic fuse (1) according to one of features 28 to 38,
wherein the electronic fuse (1) has a reference potential connection (201) and
wherein the control device (4) is set up to detect the electrical voltage between the first connection (26) of the circuit breaker (17) of the fuse (1) and the reference potential connection (201) of the fuse (1) and the circuit breaker (17) not - to switch on when the electrical voltage between the first connection (26) of the circuit breaker (17) of the fuse (1) and the reference potential connection (201) of the fuse (1) falls below a ninth preset value and/or if the electrical voltage between the first connection (26) of the circuit breaker (17) of the fuse (1) and the reference potential connection (201) of the fuse (1) exceeds a tenth preset value, and/or
wherein the control device (4) is set up to detect the electrical voltage between the second connection (28) of the circuit breaker (17) of the fuse (1) and the reference potential connection (201) of the fuse (1) and the circuit breaker (17) not - to switch on when the electrical voltage between the second terminal (19) of the fuse (1) and the reference potential terminal (201) of the fuse (1) falls below an eleventh preset value and/or when the electrical voltage between the second terminal (28) of the circuit breaker (17) of the fuse (1) and the reference potential connection (201) of the fuse (1) exceeds a twelfth preset value.

Advantage of this feature: This is an additional function where the fuse operates as a voltage monitoring device and prevents over and/or under voltages.

Feature 40: Electronic fuse (1) according to one of features 28 to 39,
wherein the circuit breaker (17) and the control device (4) are accommodated in a housing (535).

Advantage of this feature: This improves the manual handling of the fuse and the galvanic isolation of the fuse components against contact etc.

Feature 41: Electronic fuse (1) according to one of features 28 to 40, wherein the control device (4) has an optical data interface (550).

Advantage of this feature: This enables an improvement in the galvanic isolation.

Feature 42: electronic fuse (1) according to feature 40 and feature 41,
wherein the housing (535) has an optical window (545).

Advantage of this feature: This is a prerequisite for optical signaling to humans and/or optical data interfaces.

Feature 43: electronic fuse (1) according to feature 42,
wherein the optical window (545) is part of one or more optical data interfaces (550) of the control device (4) of the relevant electronic fuse (1).

Advantage of this feature: This enables said optical signaling to people and/or optical data interfaces.

Feature 44: electronic fuse (1) according to feature 43,
wherein the optical window (545) is set up to allow electromagnetic radiation to enter and/or exit for the transport of data to the control device (4), and
wherein the control device (4) is located within the housing (535) and
wherein the optical data interface (550) of the control device (4) is set up to communicate through the optical window (545) with an optical interface (555) of another device (12), for example a higher-level computer system (12), outside the housing (535 ) to communicate by means of electromagnetic radiation.

Advantage of this feature: This enables improved galvanic isolation in HV supply sub-networks with increased voltages.

Feature 45: electronic fuse (1) according to feature 44,
wherein the electromagnetic radiation for the transport of data is laser radiation from a laser (560) or radiation from an LED (560).

Advantage of this feature: Lasers are particularly suitable for data communication.

Feature 46: Electronic fuse (1) according to one of features 28 to 45,
wherein the electronic fuse (1) comprises a laser or an LED (560), in particular as a transmitter of data from the optical data interface (550).

Advantage of this feature: Lasers are particularly suitable for data communication.

Feature 47: electronic fuse (1) according to feature 46,
wherein the electronic fuse (1) has a silicon-based LED (560) as the LED.

Advantage of this feature: Lasers are particularly suitable for data communication. Integration in a CMOS IC is particularly advantageous.

Feature 48: electronic fuse (1) according to feature 47,
wherein the silicon-based LED (560) is a silicon avalanche LED (560), in particular a SPAD diode (560) operated as an LED.

Advantage of this feature: LEDs are suitable for data communication. Integration in a CMOS IC is particularly advantageous. SPAD diodes are particularly easy to manufacture.

Feature 49: Electronic security (1) according to feature 47 and/or 48,
wherein the electronic fuse (1) comprises a control device (565) and
wherein the control device (565) generates an operating voltage for the silicon-based LED (560) from the operating voltage of the electronic fuse (1) by means of a voltage converter of a voltage supply (5).

Advantage of this feature: LEDs are suitable for data communication. Integration in a CMOS IC is particularly advantageous. SPAD diodes are particularly easy to manufacture.

Feature 50: Electronic fuse (1) according to one of features 47 to 49,
wherein the electronic fuse (1) is set up to operate the silicon-based LED (560) at least temporarily as a receiver.

Advantage of this feature: PN diodes are suitable as receivers for data communication. Integration in a CMOS IC is particularly advantageous. SPAD diodes are particularly easy to manufacture.

Feature 51: Electronic fuse (1) according to feature 50,
wherein the computer core (2) of the control device (4) of the electronic fuse (4) is set up to disconnect the silicon-based LED (560) from the electrical supply of the voltage converter of the voltage supply (5) by means of a disconnector of the control device of the electronic fuse, and
wherein the computer core (2) is set up to send the voltage signal (575) and/or the photocurrent of the silicon-based LED (560) to the control device (4) of the electronic fuse (1) by means of an analog-to-digital converter (570). capture.

Advantage of this feature: This feature allows time-division multiplexing between receiver operation and transmission operation of the LEDs and lasers.

Feature 52: Electronic fuse (1) according to one of features 44 to 51,
wherein the computer core (2) is set up to detect the voltage signal (575) and/or the photocurrent of a photodetector (560) by means of an analog-to-digital converter (570) of the electronic fuse (1).

Advantage of this feature: This allows the LEDs to be operated as receivers.

Feature 53: Electronic fuse (1) according to feature 51 or 52,
wherein the computer core (2) and/or the control device (4) are set up to use the recorded value as an input data signal of an optical data interface (550).

Advantage of this feature: This allows the LEDs to be operated as receivers.

Feature 54: Electronic fuse (1) according to one of features 44 to 53,
wherein the electronic fuse (1) comprises a photodetector, for example a photodiode (560), and evaluation electronics of the photodetector (560).

Advantage of this feature: This allows the LEDs to be operated as receivers.

Feature 55: electronic fuse (1) according to one or more of features 44 to 54,
wherein the fuse (1) is set up so that an optical fiber (580) connects it to one or more other electronic fuses (1, 214 to 217, 225 to 223, 230 to 235, 225 to 256) via the respective optical data interface (550 , 551) of the control devices (4) of these electronic fuses (1, 214 to 217, 225 to 223, 230 to 235, 225 to 256).

Advantage of this feature: By means of a fiber optic cable, fuses can be coupled with each other in terms of data technology across different voltage domains without problems with the galvanic isolation.

Feature 56: Electronic fuse (1) according to feature 55,
wherein the electronic fuse (1) is set up in such a way that its optical interface (550) and an optical waveguide (580) connect it to an optical interface (555) of a higher-level control device (12), for example a higher-level computer system (12), and optionally with one or more other electronic fuses (214 to 217, 225 to 223, 230 to 235, 225 to 256).

Advantage of this feature: By means of a fiber optic cable, fuses can be coupled with each other in terms of data technology across different voltage domains without problems with the galvanic isolation.

feature 57; Electronic fuse (1) according to one or more of features 28 to 56,
wherein the fuse (1) is connected via another data interface (10, 610, 551) to a higher-level computer system (12) and possibly to one or more further electronic fuses (1, 214 to 217, 225 to 223, 230 to 235, 225 to 256) is connected.

Advantage of this feature: Using a fiber optic cable, fuses can be coupled with each other in terms of data technology across different voltage domains without problems with the galvanic isolation. The present feature enables gateways between optical and wired data buses 9.

Feature 58: Electronic fuse (1) according to one of features 28 to 57,
wherein the electronic fuse controller comprises one or more temperature sensor evaluators (585).

Advantage of this feature: The fuses can detect and, if necessary, combat overheating of their circuit breakers and other parts of the device.

Feature 59: Electronic fuse (1) according to one of features 28 to 58,
wherein the electronic fuse includes a temperature sensor (586).

Advantage of this feature: The fuses can detect and, if necessary, combat overheating of their circuit breakers and other parts of the device.

Feature 60: electronic fuse (1) according to feature 57 and claim 59,
wherein the control device (4) is set up to evaluate measured temperature values of the one or more temperature sensor evaluation devices (585), which these use temperature sensors external to the electronic control device (4) and/or use temperature sensors (586) of the electronic fuse (1st ) capture.

Advantage of this feature: The fuses can detect and, if necessary, combat overheating of their circuit breakers and other parts of the device.

Feature 61: Electronic fuse (1) according to one of features 28 to 60,
wherein the electronic fuse (1) and/or the control device (4) of the electronic fuse (1) has means (20, 21, 22, 23, 24, 25, 525, 570) for recording and detecting a reverse current (29) include.

Advantage of this feature: Current injection into other device parts in the supply network through uncontrolled currents, in particular inductive loads, is prevented.

Feature 62: electronic fuse (1) according to feature 61,
wherein the control device (1) comprises a computer core (2) and,
wherein the computer core (2) of the control device (4) of the electronic fuse (1) is set up to evaluate the measured values recorded in this way, and
wherein the computer core (2) is set up to transmit the measured values and/or measured values derived therefrom to other computer cores of other electronic fuses via a fuse data bus (9, 540) or the like or to a higher-level control unit (12), for example to a higher-level computer system ( 12) to pass on.

Advantage of this feature: This enables the consolidation of the data across the entire supply network.

Feature 63: Electronic fuse (1) according to one of features 28 to 62,
wherein the electronic fuse (1) and/or the control device (4) of the electronic fuse (1) comprise two data interfaces (10, 610), which can each be optical data interfaces (550, 551).

Advantage of this feature: This enables daisy-chain topologies of the optical data bus and redundancy in the event of a transmission line failure.

Feature 64: System of several electronic fuses according to features 28 to 63,
the system comprising an optical fiber (580) and
wherein the optical waveguide (580) is set up to connect the electronic fuse to another device (12), for example to a higher-level computer system (12), or to another electronic fuse via an optical data interface (551, 550). connect.

Advantage of this feature: This enables the data to be compared for measuring supply line sections.

Feature 65: Electronic security (1), in particular according to features 28 to 64,
wherein the electronic fuse (1) has a control device (4) and
wherein the electronic fuse (1) has a circuit breaker (17) and
wherein the control device (4) of the electronic fuse (1) has a data interface (10) for a fuse data bus (9) and
wherein the control device (4) is arranged to control whether the circuit breaker (17) is conducting, and thus operates as a closed circuit breaker, or whether the circuit breaker (17) does not conduct, and therefore operates as an open circuit breaker, and
wherein the control device (4) is set up to receive data messages via the security data bus (9), and
Whether the control device (1) closes or opens the circuit breaker (17) depends at least partially and at least temporarily on the content of these data messages.

Advantage of this feature: This allows the fuses to be controlled remotely, in particular for setting equipment variants.

Feature 66: Electronic fuse (1) according to feature 65,
wherein the control device (4) of the electronic fuse (1) is set up to only change the switching state of the circuit breaker (17) on the basis of the data message,
if the data message includes a password and
if this password has one or more predetermined properties, in particular is a predetermined password.

Advantage of this feature: This prevents the unauthorized use of consumers and/or energy sources and the unauthorized switching off, in particular safety-related fuses, which could lead to safety-related incidents.

Feature 67: Electronic security (1), in particular according to features 28 to 66,
wherein the electronic fuse (1) comprises a circuit breaker (17) and
wherein the electronic fuse (1) is set up to detect the voltage between this connection (26) and a reference node (201) in the form of a voltage value at the connection (26) of its circuit breaker (17), which is on the energy source side, and
wherein the electronic fuse (1) is set up to check this voltage value, and
wherein the electronic fuse (1) is set up to switch off the electrical supply of a partial supply network of a supply network (200) by switching off its circuit breaker (17),
when the magnitude of the detected voltage value falls below a minimum voltage value.

Advantage of this feature: An undervoltage can be an indication of a short circuit. Turning it off is a possible countermeasure. If the voltage at the power source connection of the fuse is OK again after switching off, then there was a short circuit or an overload.

Feature 68: Electronic security (1), in particular according to features 28 to 67,
wherein the electronic fuse (1) comprises a circuit breaker (17) and
wherein the electronic fuse (1) is set up to detect and/or determine the current value of the current (29) through the circuit breaker (17), and
wherein the electronic fuse (1) is set up to check the determined current value, and
wherein the electronic fuse (1) is set up to switch off the electrical supply of a partial supply network of a supply network (200) by switching off its circuit breaker (17),
when the magnitude of the sensed current value exceeds a predetermined maximum current value.

Advantage of this feature: An overcurrent undervoltage can be an indication of a short circuit. Turning it off is a possible countermeasure.

Feature 69: Electronic security (1), in particular according to features 28 to 68,
wherein the electronic fuse (1) comprises a circuit breaker (17) and
wherein the electronic fuse (1) is set up to detect the voltage between this connection (26) and a reference node (201) in the form of a voltage value at the connection (26) of its circuit breaker (17), which is on the energy source side, and
wherein the electronic fuse (1) is set up to check this voltage value, and
wherein the electronic fuse (1) is set up to detect and/or determine the current value of the current (29) through the circuit breaker (17), and
wherein the electronic fuse (1) is set up to check the determined current value, and
wherein the electronic fuse (1) is set up to switch off the electrical supply of a partial supply network of a supply network (200) by switching off its circuit breaker (17),
if the absolute value of the detected voltage value falls below a minimum voltage value and
if at the same time the absolute value of the detected current value exceeds a predetermined maximum current value.

Advantage of this feature: A combination of undervoltage and overcurrent can indicate a short circuit. Turning it off is a possible countermeasure. If the voltage at the power source connection of the fuse is OK again after switching off, then there was a short circuit or an overload.

Feature 70: electronic fuse (1) according to feature 69,
wherein the control device (4) of the electronic fuse (1) is set up to carry out one or more attempts to switch on the circuit breaker (17) after the electrical supply of the partial supply network of the supply network (200) has been switched off by switching off its circuit breaker (17).

Advantage of this feature: One-off current pulses, as they occur in vehicle supply networks, no longer lead to permanent failure.

Feature 71: electronic fuse (1) according to feature 70,
wherein the control device (4) of the electronic fuse (1) is set up to count a switch-on attempt counter of the control device ( 4), in particular a register value of a computer core (2) of the control device (4) of the electronic fuse (1), in order to increase a switch-on attempt count step size, which can also be negative and is different from 0.

Advantage of this feature: In the event of a real fault, the damage caused by attempts to switch on again increases only slightly or not at all.

Feature 72: electronic fuse (1) according to feature 71,
wherein the control device (4) of the electronic fuse (1) is set up to send an error message to the computer core (2) of the control device (4) of another electronic fuse and/or to a control device (4) of another electronic fuse or to a higher-level Computer system (12) to be transmitted when the number of unsuccessful switch-on attempts and/or the counter reading of the switch-on attempt counter of the control device (4) and/or the computer core (2) cross or reach a predetermined number.

Advantage: The number of switch-on attempts is limited.

Feature 73: Electronic fuse (1) according to one of features 28 to 72,
wherein the control device (4) of the electronic fuse (1) and/or the computer core (2) of the control device (4) of the electronic fuse (1) are set up to communicate via a data interface (10, 550) of the control device (4) and via a security data bus (9, 540) data such as configuration data and/or switching commands and/or diagnostic data and/or measured values and/or comparison value settings and/or threshold values and/or authentication data and/or program code and/or passwords and/or encryption information and/or random numbers in particular for writing to a memory in the control device (4) or the computer core (2) and/or for reading from a memory in the control device (4) or from a memory in the computer core (2).

Advantage of this feature: This feature ensures safe and reliable full remote controllability.

Feature 74: Electronic fuse (1) according to one of features 28 to 73,
the data bus (9) being a two-wire data bus in part or in its entirety.

Advantage of this feature: A two-wire data bus is more robust with regard to EMC radiation from outside and emits less electromagnetic radiation itself. Data rates are typically higher.

Feature 75: electronic fuse (1) according to feature 74,
wherein the data bus (9) is a differential data bus.

Advantages of this feature: A differential signal is more robust with regard to EMC radiation from outside and emits less electromagnetic radiation itself. Data rates are typically higher.

Feature 76: Electronic fuse (1) according to feature 75,
wherein the data bus (9) is a differential bidirectional data bus.

Benefits of this feature: A bi-directional data bus allows simultaneous control of the fuse and centralized analysis of the data collected by the fuses.

Feature 77: electronic fuse (1) according to feature 76,
wherein the data bus (9) is a CAN data bus or a CAN FD data bus or a Flexray data bus or an LVDS data bus or a PS15 data bus or a data bus (9) which has a data interface (10) of the control device (4 ) with a physical interface (physical interface) of a CAN data bus and/or a CAN FD data bus or a Flexray data bus or a PSI-5 data bus or an LVDS data bus or the like.

Feature 78: Electronic fuse (1) according to one of features 28 to 73,
the data bus (9) being a single-wire data bus in part or in its entirety.

Feature 79: electronic fuse (1) according to feature 78,
wherein the data bus (9) is a LIN data bus or a DSL3 data bus or a UART data bus or an SPI data bus.

Feature 80: Electronic fuse (1) according to one of features 28 to 79,
wherein the control device (4) of the electronic security comprises two data interfaces (610, 10) for the security data bus (9).

Feature 81: Electronic fuse (1) according to one of features 28 to 80,
wherein the control device (4) of the electronic fuse (1) comprises one or more data interfaces (10, 610) and
data interfaces (10, 610) of the control device (4) of the electronic safety device (1) thereto are directed to carry out an auto-addressing method for determining a security address of the control device (4) and/or the computer core (2) of the control device (4) or to participate in this auto-addressing method.

Feature 82: Electronic fuse (1, 825) according to one of features 28 to 81 ( 8th )
wherein the electronic fuse (1, 825) is set up to parameters of the supply part trees (815) connected to the electronic fuse (1, 825) and/or individual nodes of the connected supply part trees (815) and/or individually connected supply line sections of the supply tree of the supply lines of the vehicle to another electronic fuse (805) and/or one or more control units of the vehicle and/or a higher-level computer system (12).

Feature 83: Electronic fuse (1, 825) according to feature 82,
such a parameter being a directly accessible parameter, such as the temperature value of a temperature sensor and/or the voltage value of a voltage of a node (26, 27, 28) within the fuse (1) against a reference potential (201) and/or the voltage value of a Voltage of a node of the supply network (200) against a reference potential (201) and/or the current value of an electrical current (29) in a supply line section of the connected supply network (820).

• - die die Steuervorrichtung (4) der elektronischen Sicherung (mittels Messvorrichtungen dieser elektronischen Sicherung (1, 825) ermittelt hat und/oder
• - die die Steuervorrichtung (4) dieser elektronischen Sicherung (1, 825) von den Steuervorrichtungen (4) anderer elektronischer Sicherungen (805) oder von übergeordneten Steuergeräten (12), beispielsweise einem übergeordneten Rechnersystem (12), erhalten hat,

abgeleitete Parameter, wie beispielsweise Leckströme gegen andere elektrische Knoten im Fahrzeug oder elektrische Widerstände von Versorgungsspannungsleitungsabschnitten, zu erfassen und/oder zu ermitteln.Feature 84: electronic fuse (1, 825) according to feature 82 or feature 83,
wherein the computer core (2) of the control device (4) of the electronic fuse (1) is set up to
in particular by applying Kirchhoff's equations to data,

• - which the control device (4) of the electronic fuse has determined (by means of measuring devices of this electronic fuse (1, 825) and/or
• - which the control device (4) of this electronic fuse (1, 825) has received from the control devices (4) of other electronic fuses (805) or from higher-level control devices (12), for example a higher-level computer system (12),

to detect and/or determine derived parameters, such as leakage currents to other electrical nodes in the vehicle or electrical resistances of supply voltage line sections.

• - wenn dessen ohmscher Widerstand und dessen Wärmekapazität und dessen thermische Ableitwiderstände und die Umgebungstemperatur im Bereich des Versorgungsleitungsabschnitts näherungsweise, z.B. durch Schätzung der Steuervorrichtung (4) der elektronischen Sicherung (1, 825) der Steuervorrichtung (4) der elektronischen Sicherung (1, 825) und/oder dem Rechnerkern (2) der Steuervorrichtung (4) der elektronischen Sicherung (1, 825) bekannt sind.

Feature 85: Electronic fuse (1, 805) according to feature 83 or 84,
that the control device (4) of the electronic fuse (1, 825) and/or the computer core (2) of the control device (4) of the electronic fuse (1, 825) are set up to estimate the temperature value of the temperature of a subsequent supply line section,

• - if its ohmic resistance and its heat capacity and its thermal discharge resistances and the ambient temperature in the area of the supply line section approximately, e.g. by estimating the control device (4) of the electronic fuse (1, 825) the control device (4) of the electronic fuse (1, 825) and/or the computer core (2) of the control device (4) of the electronic fuse (1, 825) are known.

Feature 86: Electronic fuse (1, 825) according to one or more of Features 28 to 85,
wherein the control device (4) of the electronic fuse (1, 825) is set up to use a voltage measuring device (16) to measure the voltage value of the voltage of a node (22, 25, 21) on the circuit breaker (17) of the electronic fuse (1, 825) and/or to determine a node (25) connected thereto with respect to a reference potential (201) and
wherein the control device (4) of the electronic fuse (1, 825) is set up to determine the current value of the current (29) through the circuit breaker (17) of the electronic fuse (1, 825), and
wherein the control device (4) of the electronic fuse or a higher-level computer system (12) are set up to calculate the power value of the electrical power flowing into the consumer or into a subsequent supply tree (815, 820) or into a subsequent supply line section from the current value and the voltage value to identify, and
wherein the control device (4) of the electronic fuse (825) and/or the higher-level computer system (12), in cooperation with the control device (4), are set up to open the circuit breaker (17) of the electronic fuse (825) if the amount this fed-in power exceeds a power feed-in threshold value.

Feature 87: electronic fuse (1, 825) according to one or more of features 28 to 86,
wherein the control device (4) of the electronic fuse (1, 825) is set up to use a voltage measuring device to measure the voltage value of the voltage of a node (22, 25, 21) on the circuit breaker (17) of the electronic fuse (1, 805) or one therewith to determine the related node with respect to a reference potential (201), and
wherein the control device (4) of the electronic fuse (1, 825) is set up to determine the current value of the current (29) through the circuit breaker (17) of the electronic fuse (1, 825), and
wherein the control device (4) of the electronic fuse (1, 825) or a higher-level computer system (12) are set up to calculate the power value of the electrical power flowing from the energy source or from a preceding supply tree or from a preceding supply line section from the current value and the voltage value to identify, and
wherein the control device (4) of the electronic fuse (825) and/or the higher-level computer system (12), in cooperation with the control device (4), are set up to open the circuit breaker (17) of the electronic fuse (825) if the amount this power drawn exceeds a power consumption threshold value.

Feature 88: Electronic fuse (1, 805) according to feature 86 or feature 87,
wherein the control device (4) of the electronic fuse (1, 805) is set up to transmit this power value via the fuse data bus (9) to the control device (4) of another electronic fuse (825) and/or the higher-level computer system (12). .

Feature 89: electronic fuse (1) according to feature 88,
wherein the higher-level computer system (12) is a server (750) of an energy provider or one of its vicarious agents and/or the server (710) of a service provider or an automobile manufacturer.

Feature 90: Electronic fuse (1) according to one of features 28 to 89
wherein the control device (4) of the electronic security device (1, 825) has a clock or a timer (35), in particular for generating time stamps in a log table.

Feature 91: Electronic fuse (1, 825) according to feature 90,
the clock or timer (35) of the control device (4) of the electronic fuse (1, 825) being able to be synchronized with the clocks and timers (35) of the control devices (4) of other electronic fuses (805, 810) and/or with the clocks and timers (1970) of a higher-level computer system (12).

Feature 92: electronic fuse (1, 825) according to one of features 28 to 91,
wherein the control device (4) of the electronic fuse (1) is set up to switch off the circuit breaker (17) of the fuse (1) after receiving a switch-off signal via a fuse data bus (9) only after a switch-off delay time has elapsed.

• - von dem Betrag des Stromwerts des elektrischen Stroms (29) durch den Leistungsschalter (17) und/oder
• - von dem der Betrag der Leistungseinspeisung in das nachfolgende Versorgungsteilnetzwerk und/oder in den nachfolgenden Versorgungsleitungsabschnitt oder in einen nachfolgenden Verbraucher und/oder
• - von dem Betrag der Leistungsentnahme aus dem vorausgehenden Versorgungsteilnetzwerk und/oder in dem vorausgehenden

Versorgungsleitungsabschnitt oder aus einer vorausgehenden Energiequelle abhängt.Feature 93: Electronic fuse (1, 825) according to feature 92,
where the turn-off delay time

• - From the magnitude of the current value of the electric current (29) through the circuit breaker (17) and/or
• - From which the amount of power feed into the subsequent partial supply network and / or in the subsequent supply line section or in a subsequent consumer and / or
• - the amount of power drawn from and/or in the preceding sub-network

Supply line section or from a preceding energy source depends.

Feature 94: electronic fuse (1, 825) according to feature 93,
wherein the switch-off delay time depends on the magnitude of the current value of the electrical current (29) through the circuit breaker (17) falling parabolically as the magnitude of the value of the electrical current (29) through the circuit breaker (17) increases.

• - wenn der Betrag des Werts des elektrischen Stromes (29) durch den Leistungsschalter (17) der elektronischen Sicherung (1, 825) einen Stromschwellwert überschreitet und/oder
• - wenn der Betrag der Leistungseinspeisung in das nachfolgende Versorgungsteilnetzwerk und/oder in den nachfolgenden Versorgungsleitungsabschnitt und/oder in einen nachfolgenden Verbraucher einen Leistungseinspeisungsschwellwert überschreitet und/oder
• - wenn der Betrag der Leistungsentnahme aus dem vorausgehenden Versorgungsteilnetzwerk und/oder aus dem vorausgehenden Versorgungsleitungsabschnitt oder aus einer vorausgehenden Energiequelle einen Leistungsentnahmeschwellwert überschreitet.

Feature 95: electronic fuse (1, 825) according to one of features 28 to 94,
wherein the control device (4) of the electronic fuse (1) is set up to switch off the circuit breaker (17) of the fuse (1) immediately,

• - if the amount of the value of the electric current (29) through the circuit breaker (17) of the electronic fuse (1, 825) exceeds a current threshold value and/or
• - if the amount of power feed into the subsequent partial supply network and/or in the subsequent supply line section and/or in a subsequent consumer exceeds a power feed threshold value and/or
• - if the amount of power drawn from the preceding utility sub-network and/or from the preceding utility line section or from a preceding energy source exceeds a power drawing threshold.

Feature 96: Electronic fuse (1, 825) according to one of features 28 to 95,
wherein the control device (4) of the electronic fuse (1, 825) is set up to emulate the behavior of a safety fuse in cooperation with the circuit breaker (17).

Feature 97: Electronic fuse (1, 825) according to feature 96,
wherein the control device (4) of the electronic fuse (1, 825) is set up to detect and/or determine the magnitude of the current value of the electrical current (29) through the circuit breaker (17), and
wherein the control device (4) of the electronic fuse (1, 825) is set up to square the detected magnitude of the current value of the electric current (29) through the circuit breaker (17), and
wherein the control device (4) of the electronic fuse (1, 825) is set up to integrate the detected and squared magnitude of the current value of the electric current (29) through the circuit breaker (17) over time, and
wherein the control device (4) of the electronic fuse (1, 825) is set up to filter, in particular to low-pass filter, the amount of the current value of the electric current (29) that is detected and squared and integrated over time, and
wherein the control device (4) of the electronic fuse (1, 825) is set up to compare the detected and squared and filtered magnitude of the current value of the electrical current (29) with a threshold value, and
wherein the control device (4) is set up to set the switching state of the circuit breaker (17) of the electronic fuse (1, 825) at least temporarily as a function of the result of this comparison.

Feature 98: electronic security (1, 825) according to feature 96 and/or feature 97,
wherein the control device (4) of the electronic fuse (1, 825) is set up to detect and/or determine the magnitude of the current value of the electrical current (29) through the circuit breaker (17) and
wherein the control device (4) of the electronic fuse (1, 825) is set up to convert the detected amount of the current value of the electric current (29) through the circuit breaker (17) into a mapped value by means of a polynomial with an order of the polynomial greater than one convert, and
the control device (4) of the electronic fuse (1, 825) being set up to integrate this mapped value of the electric current (29) through the circuit breaker (17) over time, and
wherein the control device (4) of the electronic fuse (1, 825) is set up to filter, in particular low-pass filter, the mapped and time-integrated value of the electric current (29), and
the control device (4) of the electronic fuse (1, 825) being set up to compare the mapped and filtered value of the electrical current (29) with a threshold value, and
wherein the control device (4) of the electronic fuse (1, 825) is set up to set the switching state of the circuit breaker (17) of the electronic fuse (1, 825) at least temporarily depending on the result of this comparison.

Feature 99: electronic fuse (1, 825) one or more of features 28 to 98,
wherein the electronic fuse (1, 825) and/or the control device (4) of the electronic fuse (1, 825) and/or the computer core (2) of the control device (4) of the fuse (1, 825) and/or the fuse (1) are set up in cooperation with a higher-level computer system (12) to permit the transport of electrical energy from one or more energy sources (250) to the consumer (835, 830) at least temporarily, and
wherein the electronic fuse (1, 825) and/or the control device (4) of the electronic fuse (1, 825) and/or the computer core (2) of the control device (4) of the fuse (1, 825) and/or the fuse (1) are set up in cooperation with a higher-level computer system (12) to prevent the transport of electrical energy from the consumer (835, 830) to one or more or all energy sources (250).

Feature 100: electronic fuse (1, 825) according to feature 99,
the electronic fuse (1, 825) comprising means (24, 23) for detecting the direction of the electric current (29) through the circuit breaker (17) and
the control device (4) of the electronic fuse (1, 825) being set up to detect the direction of the electric current (29) flowing with the aid of these means (24, 23).

Feature 101: electronic fuse (1, 805) according to feature 100,
wherein the electronic fuse (1, 825) and/or the control device (4) of the electronic fuse (1, 825) and/or the computer core (2) of the control device (4) of the fuse (1, 825) and/or the fuse (1) are set up in cooperation with a higher-level computer system (12) to open the circuit breaker (17) of the fuse (1, 825) when the electrical current (29) from the consumer (830) to one or more energy sources (250 ) flows through the circuit breaker (17) of the electronic fuse (1, 825).

Feature 102: electronic fuse (1, 825) according to feature 101,
the control device (4) of the electronic fuse (1, 825) and/or the fuse (1, 825) comprising a third power switch (615) distinct from the power switch (17) of the electronic fuse (1, 825), and
wherein the electronic fuse (1, 825) and/or the control device (4) of the electronic fuse (1, 825) and/or the computer core (2) of the control device (4) of the fuse (1, 825) and/or the fuse (1) are set up in cooperation with a higher-level computer system (12) to close this third circuit breaker (615) when the electrical current (29) from the consumer (835) to one or more energy sources (250) flows through the circuit breaker (17 ) of the electronic fuse (1, 825) flows, and
that this third circuit breaker (615) is set up to derive the electric current (29) from the load (835) into a current sink, in particular a reference potential line (201) when the third circuit breaker (615) is closed.

Feature 103: Electronic fuse (1) according to one of features 28 to 102,
wherein the electronic fuse (1) comprises means for detecting the switchability of the circuit breaker (17) of the electronic fuse (1).

Feature 104: Electronic fuse (1) according to feature 103, ( 9 )
wherein the control device (4) of the electronic fuse (1) and/or the electronic fuse (1) comprises a first test current source (505) and
wherein the control device (4) of the electronic fuse (1) and/or the electronic fuse (1) comprise a second test current source (905) and
wherein the control device (4) of the electronic fuse (1) is set up to control the first test current source (505) and the second test current source (905), and
wherein the first test current source (505) is set up to feed a test current (515) into the first connection (26) of the circuit breaker (17) at the instigation of the control device (4), and
wherein the second test current source (905) is set up to then draw the test current (915) from the second terminal (28) of the circuit breaker (17), and
wherein the second test current source (905) comprises means for detecting the current value of the test current (915) drawn, and
wherein the control device (4) is set up to conclude that there is a fault in the circuit breaker (17) of the electronic fuse (1) if the second current source (905), contrary to the respective expectation, does not have a current value of the test current (915) and/or time profile of the current value of the test current (915) corresponding to an expected value interval for the current value of this test current (915) and/or the expected time profile of the expected value interval for the time profile of the current value of the test current (915).

105. Electronic fuse (1) according to feature 104,
the control device (4) of the electronic fuse (1) being set up for this purpose - in particular for testing purposes - to change the switching state of the circuit breaker (17) one or more times and to check the switching state of the circuit breaker (17).

• - an ein übergeordnetes Rechnersystem (12) und/oder
• - an einen Rechnerkern (2) einer anderen Steuervorrichtung (4) einer anderen elektronischen Sicherung (805) ist.

Feature 106: Electronic fuse (1) according to one of features 28 to 105,
wherein the computer core (2) of the control device (4) of the electronic fuse (1) is set up to transmit measured values - in particular physical parameters and/or currents and/or voltages within the fuse (1) - to the electronic fuse (1) by means of measuring means identify, and
wherein the computer core (2) of the control device (4) is set up to execute a neural network model, and
wherein the computer core (2) of the control device (4) is set up to use the measured values determined as input values for this neural network model, and
wherein the switching state of the circuit breaker (17) of the electronic fuse (1) and/or at least one data message and/or the content of a data message of the computer core (2) of the control device (4) of the electronic fuse (1) depends on an output signal of the neural network model and
the data message (9) sending a data message (9) via the data bus (9)

• - To a higher-level computer system (12) and/or
• - To a computer core (2) of another control device (4) of another electronic fuse (805).

Feature 107: electronic fuse (1) according to feature 106,
wherein the neural network model is trained with suitable training data from the development time of the electronic fuse (1).

Feature 108: electronic fuse (1, 825) according to one of features 105 to 107,
wherein the control device (4) of the electronic fuse (1, 825) is set up to use an output signal from the neural network model to indicate a failure of one or more consumers (835) or a failure of one or more energy sources (250) or another defect in the system of the overall device of the supply network 200 recognizes.

Feature 109: electronic fuse (1, 825) according to one of features 28 to 108,
wherein the control device (4) of the electronic fuse (1, 825) is set up to communicate with another computer system (12) and/or the control device (4) of another electronic fuse (805) via a supply voltage line (6, 241, 242, 245) Exchange data.

Feature 110: electronic fuse (1, 825) according to feature 109,
wherein the control device (4) of the electronic fuse (1) is set up to use the power switch (17) of the electronic fuse (1, 825) as a transmission transistor for data communication via the supply network (200).

Feature 111: Electronic fuse (1, 825) according to feature 110,
wherein the control device (4) of the electronic fuse (1) is set up to open the circuit breaker (17) of the electronic fuse (1, 825) in order to transmit a bit with a first logical value via the supply network (200).

Feature 112: Electronic fuse (1, 825) according to feature 110 or 111,
wherein the control device (4) of the electronic fuse (1) is set up to transmit a bit with a second logical value, which is different from the first logical value, via the supply network (200) to the circuit breaker (17) of the electronic fuse (1 , 825) to close.

Feature 113: electronic fuse (1, 825) according to one of features 110 to 112,
wherein the fuse comprises a second energy reserve and
wherein the second energy reserve is set up to feed a current into the second connection (19) of the fuse (1) at the second connection (19) of the fuse for the duration of the transmission of a bit of a first logical value via the supply network (200), which, instead of the current (29) through the circuit breaker (17), supplies subsequent partial supply networks and/or consumers of the supply network (200) with electrical energy.

Feature 114: electronic fuse (1, 825) according to one of features 110 to 113,
wherein the control device (4) of the fuse (1) is set up to detect and/or determine current values of the current (29) through the circuit breaker (17) and
wherein the control device (4) of the fuse (1) is set up to extract data from the time profile of the current values of the current (29) through the circuit breaker (17), which the control device (4) of another fuse (1) in particular by means of of the circuit breaker (17) via the supply network (200).

Feature 115: electronic fuse (1, 825) according to one of features 28 to 114,
wherein the electronic fuse (1, 825) comprises means for detecting the time profile of the electric current (29) through the circuit breaker (17) of the electronic fuse (1) and
wherein these means are set up to at least temporarily detect the time course of the electric current (29) through the circuit breaker (17) of the electronic fuse (1.825) and
these means being able to comprise an analog-to-digital converter (570) of the control device (4) of the electronic fuse (1, 825) and/or a memory of the computer core (2) of the control device (4) of the electronic fuse (1, 825). .

Feature 116: Electronic fuse (1, 825) according to one of features 28 to 115,
wherein the electronic fuse (1, 825) comprises means for detecting the time profile of the voltage between a terminal (26, 27, 28) of the circuit breaker (17) of the electronic fuse (1, 825) and a reference potential (201) and
these means being set up to at least temporarily detect the time profile of the voltage between a connection (26, 27, 28) of the circuit breaker (17) of the electronic fuse (1, 825) and a reference potential (201).

Feature 117: Electronic fuse (1, 825) according to one of features 28 to 116,
wherein the electronic fuse (1, 825) comprises means for detecting the time profile of the voltage between a terminal (26, 27, 25) of the auxiliary circuit breaker (23) of the electronic fuse (1, 825) and a reference potential (201) and
these means being set up to at least temporarily detect the time profile of the voltage between a terminal (26, 27, 25) of the auxiliary circuit breaker (23) of the electronic fuse (1, 825) and a reference potential (201).

Feature 118: electronic fuse (1, 825) according to one of features 28 to 117,
wherein the electronic fuse (1, 825) has means for detecting the time profile of the voltage between a first terminal (25) of a shunt resistor (24) of the electronic fuse (1, 825) and a second terminal (21) of the shunt resistor (24) of the electronic fuse (1, 825) and
these means being set up to at least temporarily monitor the voltage curve over time between a first terminal (25) of a shunt resistor (24) of the electronic fuse (1, 825) and a second terminal (21) of the shunt resistor (24) of the electronic fuse (1, 825).

Feature 119: electronic fuse (1, 825) according to one of features 114 to 118,
wherein the control device (4) of the electronic fuse (1) is set up to carry out a spectral analysis of the data of the time curves, for example by Fourier or Laplace transformation or wavelet transformation, and thus to determine values of the spectrum and
wherein the control device (4) of the electronic fuse (1) is set up to conclude that preventive maintenance is necessary in the event of significant deviations in the values of this spectrum of expected value intervals and/or to send a signal to a higher-level computer system (12).

• - bei einem Spannungsabfall in den gemessenen Spannungswerten und
• - bei einem gleichzeitigen Stromanstieg

den Leistungsschalter (17) der elektronischen Sicherung (1, 825) auszuschalten,
wenn a) der gemessene Spannungswert einen Spannungsschwellwert unterschreitet und wenn gleichzeitig der gemessene Strommesswert einen Stromschwellwert überschreitet und/oder
wenn b) der der Betrag der zeitlichen Änderungsgeschwindigkeit des gemessenen Spannungswertabfalls zwischen einem Anschluss (26, 27, 28) des Leistungsschalters 17 der Sicherung (1, 825) und einem Bezugspotenzial (201) eine Spannungsabfalländerungsgeschwindigkeitsschwelle überschreitet und gleichzeitig der Betrag der Änderungsgeschwindigkeit der Änderung des Betrags des elektrischen Stromes 29 durch den Leistungsschalter 17 eine Stromanstiegsgeschwindigkeitsschwelle überschreitet.Feature 120: electronic fuse (1, 825) according to one of features 28 to 119,
the electronic fuse (1, 925) having means for detecting the value of the electric current (29) through the circuit breaker (17) of the electronic fuse (1, 825) and for detecting a voltage at a terminal (26, 27, 28) of the Circuit breaker (17) of the electronic fuse (1, 825) against a reference potential (201) and
wherein the control device (4) of the electronic fuse (1, 825) is set up to

• - with a voltage drop in the measured voltage values and
• - with a simultaneous increase in current

turn off the circuit breaker (17) of the electronic fuse (1, 825),
if a) the measured voltage value falls below a voltage threshold value and if at the same time the measured current value exceeds a current threshold value and/or
if b) the amount of the rate of change over time of the measured voltage drop between a terminal (26, 27, 28) of the circuit breaker 17 of the fuse (1, 825) and a reference potential (201) exceeds a voltage drop rate of change threshold and at the same time the amount of the rate of change of the change in the Amount of the electric current 29 through the circuit breaker 17 exceeds a current rate of rise threshold.

Feature 121: Electronic fuse (1, 825) according to feature 120,
wherein the control device (4) of the electronic fuse (1, 825) is set up to switch off the circuit breaker (17) of the electronic fuse (1, 825) faster than within 1 µs under such switch-off conditions.

Feature 122: electronic fuse (1, 825) according to one of features 28 to 121,
wherein the electronic fuse (1, 825) comprises an emergency operation control (925) and
wherein the emergency control (925) is set up to send data via a data bus (540, 9) and to receive this data bus (9, 540), and
wherein the electronic fuse (1, 825) is set up such that the control device (4) of the electronic fuse (1, 825) is and/or can be under certain conditions a further control device (4) of another electronic fuse (805), and
wherein the further control device (4) of the other electronic fuse (805) is set up to control the electronic fuse (825) by means of data communication via the data bus (9, 540) and by means of the emergency operation control (925) of the electronic fuse (825). .

Feature 123: Electronic fuse (1, 825) according to feature 122,
wherein the emergency control (925) of the fuse (825) is set up to monitor the data communication between the control device (4) of the fuse (825) and the emergency control (925) of the other fuse (805), and

Feature 124: electronic fuse (1, 825) according to feature 122 or 123,
wherein the emergency control (925) of the fuse (1, 825) is set up to emulate simple functions of the control device (4) of the fuse (1, 825) in the event of a data communication failure of the fuse (1, 825) and preferably at least one ensure basic protection of the connected supply line (19, 815, 820) by taking over control of the circuit breaker (17) of the fuse (1, 825) in this case.

• - dass a) die entsprechende elektronische Sicherung (1, 825) noch vorhanden ist und/oder
• - dass b) die entsprechende elektronische Sicherung (1, 825) betriebsbereit ist und/oder
• - welche Sicherungsidentifikationsinformation die Sicherung (1,825) aufweist und/oder
• - welche gültige Sicherungsadresse die Sicherung (1,825) aufweist und/oder
• - ob die Sicherung (1,825) eine gültige Sicherungsadresse der Sicherung (1,825) aufweist und/oder
• - welche Schwellwerte die Sicherung (1,825) verwendet und/oder
• - welchen Strommesswert für den Strom (29) durch den Leistungstransistor (17) die Steuervorrichtung (4) der Sicherung (1, 825) ermittelt hat und/oder
• - welchen Strommesswert für den Strom (36) durch den Shunt-Widerstand (24) die Steuervorrichtung (4) der Sicherung (1, 825) ermittelt hat und/oder
• - welche Spannungswerte welcher Spannungen bezogen auf das Bezugspotenzial (201) und/oder andere Knoten innerhalb der Sicherung (1, 825) die Steuervorrichtung (4) der Sicherung (1, 825) ermittelt hat und/oder
• - welche Leistungsabgabe über den zweiten Anschluss (19) die Steuervorrichtung (4) der Sicherung (1, 825) ermittelt hat und/oder
• - welchen Temperaturwert die Steuervorrichtung (4) der Sicherung (1, 825) ermittelt hat und/oder
• - welchen Zeitstempelwert ein ebenfalls übermittelter Wert die Steuervorrichtung (4) der Sicherung (1, 825) gespeichert hat und/oder
• - welche sonstigen Betriebsparameter die elektronische Sicherung (1, 825) aufweist.

Feature 125: electronic fuse (1, 825) according to one of features 28 to 124,
the computer core (2) of the control device (4) of the electronic security device (1,825) being set up to send a signal to a higher-level computer system (12) via the security data bus (9, 540), which signals

• - that a) the corresponding electronic fuse (1, 825) is still present and/or
• - that b) the corresponding electronic fuse (1, 825) is operational and/or
• - which fuse identification information the fuse (1.825) has and/or
• - which valid fuse address the fuse (1,825) has and/or
• - whether the fuse (1,825) has a valid fuse address of the fuse (1,825) and/or
• - what thresholds the fuse (1.825) uses and/or
• - which measured current value for the current (29) through the power transistor (17) the control device (4) of the fuse (1, 825) has determined and/or
• - which measured current value for the current (36) through the shunt resistor (24) the control device (4) of the fuse (1, 825) has determined and/or
• - which voltage values of which voltages related to the reference potential (201) and/or other nodes within the fuse (1, 825) the control device (4) of the fuse (1, 825) has determined and/or
• - which power output via the second connection (19) the control device (4) of the fuse (1, 825) has determined and / or
• - which temperature value the control device (4) of the fuse (1, 825) has determined and/or
• - what time stamp value a likewise transmitted value the control device (4) of the fuse (1, 825) has stored and/or
• - Which other operating parameters the electronic fuse (1, 825) has.

Feature 126: Electronic fuse (1, 825) according to one of features 28 to 125,
wherein the fuse (1) and/or the control device (4) of the fuse (1) comprises a random number generator (60).

• wobei der Zufallszahlengenerator (60) ein echter Zufallszahlengenerator (TRNG) ist.

Feature 127: Electronic fuse (1, 825) according to feature 126:

• wherein the random number generator (60) is a true random number generator (TRNG).

Feature 128: electronic fuse (1, 825) according to feature 127,
wherein the random number generator (60) is a quantum random number generator (QRNG).

Feature 129: Electronic fuse (1, 825) according to feature 128,
wherein the quantum random number generator (QRNG) (60) comprises a first SPAD diode (3954, 4101.1), which in turn may comprise a plurality of first SPAD diodes (3954, 4101.1), and
wherein the quantum random number generator (QRNG) (60) comprises a second SPAD diode (3955, 4101.3), which in turn may comprise a plurality of second SPAD diodes (3955, 4101.3), and
wherein the quantum random number generator (QRNG) (60) comprises an optical fiber (3944, 4101.2) and
wherein the voltage supply (5) of the control device (4) of the fuse (1, 825) is set up to reverse-bias the first SPAD diode (3954, 4101.1) with a diode bias, and
wherein the voltage supply (5) of the control device (4) of the fuse (1, 825) is set up to reverse-bias the second SPAD diode (3955, 4101.3) with a diode bias, and
wherein the first SPAD diode (3954, 4101.1) has the property, when biased with the diode reverse bias, to inject random light pulses into the optical fiber (3944, 4101.2), and
wherein the optical waveguide is set up to irradiate the second SPAD diode (3955, 4104.3) with light from these light pulses, and
wherein the second SPAD diode (5955, 4104.3) has the property, when biased with the diode bias in the reverse direction, to generate a diode current of the second SPAD diode in the form of signals of the current pulses (4105), which firstly include random current pulses of a first current pulse height and which comprise second current pulses of a second current pulse height based on the reception of photons of the light pulses of the second SPAD diode (3955, 4101.3), and
wherein the second current pulse height is higher in absolute value than the first current pulse height and
wherein further device parts (4102, 4103, 4104.2, 4104.1) of the quantum random number generator (QRNG) (60) are set up to separate the signals of the current pulses (4105) with the second current pulse height from the signals of the current pulses (4105) with the first current pulse height and a generate adjusted pulse signal (4109) and
wherein further device parts (4104.3) of the quantum random number generator (QRNG) (60) detect the time interval between pulse pairs of two consecutive pulses of the cleaned pulse signal and generate time interval values (4110) therefrom and
wherein further device parts (4101.1) of the quantum random number generator (QRNG) (60) compare two different time interval values of two different pulse pairs, a first time interval value and a second time interval value, and generate a random bit (4111) with a first logical value if the first time interval value is less than is the second lag value, and generating the random bit (4111) with a second logical value when the first lag value is greater than the second lag value, and
wherein further device parts (4104.8) of the quantum random number generator (QRNG) (60) generate a random number (4117) from a plurality of these random bits (4111).

Feature 130: electronic fuse (1, 825) according to feature 129,
wherein device parts (4104.4) of the quantum random number generator (QRNG) (60) are set up to discard and no longer use time interval values that are smaller than a minimum time interval value.

Feature 131: Electronic fuse (1, 825) according to feature 129,
wherein the first SPAD diode (3954, 4101.1) and the second SPAD diode (3955, 4101.3) are manufactured in a common silicon crystal as part of a microelectronic circuit in CMOS technology and
wherein the optical waveguide (3944, 4101.2) in the metallization stack (4042, 3944, 4041, 4040, 3953, 3942, 3943, 3952) microelectronic circuit of optically transparent insulation layers (3944, 3952) on the surface (3956) of the silicon crystal (3948 , 3949).

Feature 132: Electronic fuse (1, 825) according to one of features 126 to 131,
wherein the control device (4) of the fuse (1,825) and/or the computer core (2) of the control device (4) of the fuse (1,825) are set up to use a random number of the random number generator (60) to generate data for data communication via the data bus ( 9), in particular by executing a PQC encryption process.

Feature 133: Electronic fuse (1, 825) according to feature 132,
wherein the control device (4) of the backup (1.825) and/or the computer core (2) of the control device (4) of the backup (1.825) are set up to use a random number from the random number generator (60) to generate a key pair consisting of a private key and a generate public key.

Feature 134: electronic fuse (1, 825) according to feature 133,
wherein the control device (4) of the security (1.825) and/or the computer core (2) of the control device (4) of the security (1.825) are set up to transmit the public key to a control device (4) of another security (805) and/or or to a computer core (2) of a control device (4) of another fuse (805) and/or to a higher-level computer system (12).

Feature 135: electronic fuse (1, 825) according to feature 134,
wherein the control device (4) of the fuse (1.825) and/or the computer core (2) of the control device (4) of the fuse (1.825) are set up to receive data messages from a control device (4) of another fuse (805) and/or a computer core (2) a control device (4) of another fuse (805) and/or a higher-level computer system (12), which the control device (4) of the fuse (1.825) and/or the computer core (2) of the control device (4) of the fuse (1.825) received via the data bus (9) to be decrypted using the private key.

Feature 136: Electronic fuse (1, 825) according to one of features 28 to 135,
wherein the control device (4) of the fuse (1.825) and/or the computer core (2) of the control device (4) of the fuse (1.825) are set up to transmit a public key of a control device (4) of another fuse (805) and/or a computer core (2), a control device (4), another fuse (805) and/or a higher-level computer system (12).

Feature 137: Electronic fuse (1, 825) according to one of features 28 to 136,
wherein the control device (4) of the backup (1,825) and/or the computer core (2) of the control device (4) of the backup (1,825) are set up to exchange public keys with another backup (805) by means of a Diffie-Hellman key exchange method and /or with a computer core (2), a control device (4), another fuse (805) and/or with a higher-level computer system (12).

Feature 138: Electronic fuse (1, 825) according to feature 137,
wherein the control device (4) of the fuse (1.825) and/or the computer core (2) of the control device (4) of the fuse (1.825) are set up to receive data messages from a control device (4) of another fuse (805) and/or a computer core (2) a control device (4) of another fuse (805) and/or a higher-level computer system (12), which the control device (4) of the fuse (1.825) and/or the computer core (2) of the control device (4) of the fuse (1.825) received via the data bus (9) to be decrypted using the private key of the Diffie-Hellman key exchange method.

Feature 139: electronic fuse (1, 825) according to one of features 136 to 138,
wherein the control device (4) of the backup (1.825) and/or the computer core (2) of the control device (4) of the backup (1.825) are set up to encrypt data messages using a received public key to form encrypted data messages.

Feature 140: electronic fuse (1, 825) according to feature 139,
wherein the control device (4) of the backup (1,825) and/or the computer core (2) of the control device (4) of the backup (1,825) are set up to encrypt data messages using a PQC encryption method and/or using an RSA method to encrypt.

Feature 141: Electronic fuse (1, 825) according to feature 140,
wherein the control device (4) of the backup (1, 825) and/or the computer core (2) of the control device (4) of the backup (1, 825) are set up to transmit such encrypted data messages to a control device (4) of another backup ( 805) and/or to a computer core (2) of a control device (4) of another fuse (805) and/or to a higher-level computer system (12) via the data bus (9).

• eine erste SPAD-Diode (4104.1)
• eine zweite SPAD-Diode (4104.3),
• einen Lichtwellenleiter (4104.2), der die erste SPAD-Diode (4104.1) und die zweite SPAD-Diode (4104.3) optisch miteinander koppelt,
• einen Verstärker (4103) und/oder Filter,
• einen Analog-zu-Digital-Wandler (4103),
• einen Komparator (4104.2),
• einen Zeit-zu-Digital-Wandler (4104.3),
• eine Entropie-Extraktionsvorrichtung (4104.4), die Ausgangswerte des Zeit-zu-Digital-Wandlers (4103) in erste und zweite Werte wandelt und daraus Zufallsbits (4111) erzeugt.

Feature 142: Electronic fuse (1, 825) according to one of features 28 to 141,
wherein the electronic fuse (1) has a first connection (18) and
wherein the electronic fuse (1) has a second connection (19) and
wherein the electronic fuse (1) has a circuit breaker (17) and
wherein the electronic fuse (1) has a control device (4) and
wherein the circuit breaker (17) has a first connection (26), a control connection (27) and a second connection (28) and
wherein the first terminal (26) of the circuit breaker (17) is electrically connected to the first terminal (18) of the fuse (1) and
wherein the second terminal (28) of the circuit breaker (17) is electrically connected to the second terminal (19) of the fuse (1) and
wherein the control terminal (27) of the circuit breaker (17) is electrically connected to the control device (4) and
wherein the control device (4) of the electronic fuse (1) is set up to detect voltages between the terminals (26, 27, 28) of the circuit breaker and/or functionally equivalent values of physical parameters and from this to derive a value for an electric current (29). to determine the circuit breaker (17) between the first connection (26) of the circuit breaker (17) and the second connection (28) of the circuit breaker (28) and
wherein the electronic fuse (1, 825) comprises a quantum random number generator (60, 4100) and
wherein the quantum random number generator (60, 4100) comprises the following device parts:

• a first SPAD diode (4104.1)
• a second SPAD diode (4104.3),
• an optical waveguide (4104.2) which optically couples the first SPAD diode (4104.1) and the second SPAD diode (4104.3) to one another,
• an amplifier (4103) and/or filter,
• an analog to digital converter (4103),
• a comparator (4104.2),
• a time-to-digital converter (4104.3),
• an entropy extractor (4104.4) converting output values of the time-to-digital converter (4103) into first and second values and generating random bits (4111) therefrom.

Feature 143: Electronic fuse (1, 825) according to feature 142,
wherein the electronic safeguard (1, 825) comprises a watchdog (4104.5) which is set up to monitor device parts of the quantum random number generator (60, 4100).

Feature 144: Electronic fuse (1, 825) according to one of Claims 142 to 143,
wherein the electronic fuse (1, 825) has a voltage monitor (4113) which is set up to record and monitor analog values of analog signals.

Feature 145: Electronic fuse (1, 825) according to one of Claims 142 to 144,
wherein the device comprises a pseudo-random number generator (4104.6), in particular in the form of a linear feedback shift register (4104.6).

Feature 146: Electronic fuse (1, 825) according to one of Claims 142 to 145,
the electronic fuse (1, 825) having a signal multiplexer (4104.7) which, in the event of an error, converts the signal from the output (4111) of the entropy extraction device (4104.4) to a signal from a substitute random number generator (60) or a signal ( 4117) of a substitute pseudo-random number generator (4104.6).

Feature 147: Electronic fuse (1, 825) according to one of Claims 142 to 146,
wherein the start value of the pseudo-random number generator (4104.6) in the event of an error depends on previously correctly generated random bits (4111) of the quantum random number generator (4100, 60).

• Erzeugen einer Pulsfolge (4106) mit zufälligen zeitlichen Abständen mittels zumindest zweier SPAD-Dioden (3954, 3955, 4101.1, 4101.3),
• wobei die Pulsfolge (4106) Pulse einer ersten Höhenkasse (4401) und einer zweiten Höhenklasse (4402) umfasst;
• Trennen der Pulse der ersten Höhenklasse (4401) von den Pulsen der zweiten Höhenklasse (4402) mittels eines Schneidepegels (4403, 4104.1);
• Erfassen (4301) ersten Werts (4110) des zeitlichen Abstands zwischen einem ersten Puls der zweiten Höhenklasse (4402) und einem zweiten Puls der zweiten Höhenklasse (4402), der vom ersten Puls verschieden ist;
• Erfassen (4301) zweiten Werts (4110) des zeitlichen Abstands zwischen einem dritten Puls der zweiten Höhenklasse (4402), der vom ersten Puls verschieden ist, und einem vierten Puls der zweiten Höhenklasse (4402), der vom ersten Puls und vom zweiten Puls und vom dritten Puls verschieden ist.
• Vergleichen (4302) des ersten Werts mit dem zweiten Wert und
• Ausgeben (4303) eines ersten logischen Werts als ein Zufallsbit (4111), wenn der erste Wert größer als der zweite Wert ist, und
• Ausgeben (4303) eines zweiten logischen Werts, der vom ersten logischen Wert verschieden ist, als das Zufallsbit (4111), wenn der erste Wert kleiner als der zweite Wert ist.

Feature 148: Electronic fuse (1, 825) arranged to perform the following random bit generation method:

• Generating a pulse sequence (4106) with random time intervals using at least two SPAD diodes (3954, 3955, 4101.1, 4101.3),
• wherein the pulse sequence (4106) comprises pulses of a first altitude class (4401) and a second altitude class (4402);
• separating the pulses of the first height class (4401) from the pulses of the second height class (4402) by means of a slice level (4403, 4104.1);
• detecting (4301) a first value (4110) of the time interval between a first pulse of the second height class (4402) and a second pulse of the second height class (4402), which differs from the first pulse;
• Recording (4301) the second value (4110) of the time interval between a third pulse of the second height class (4402), which differs from the first pulse, and a fourth pulse of the second height class (4402), which differs from the first pulse and from the second pulse and is different from the third pulse.
• comparing (4302) the first value to the second value and
• outputting (4303) a first logical value as a random bit (4111) if the first value is greater than the second value, and
• outputting (4303) a second logical value different from the first logical value as the random bit (4111) if the first value is less than the second value.

• Erzeugen einer Pulsfolge (4106) mit zufälligen zeitlichen Abständen mittels zumindest zweier SPAD-Dioden (3954, 3955, 4101.1, 4101.3),
• wobei die Pulsfolge (4106) Pulse einer ersten Höhenkasse (4401) und einer zweiten Höhenklasse (4402) umfasst;
• Trennen der Pulse der ersten Höhenklasse (4401) von den Pulsen der zweiten Höhenklasse (4402) mittels eines Schneidepegels (4403, 4104.1);
• Erfassen (4301) ersten Werts (4110) des zeitlichen Abstands zwischen einem ersten Puls der zweiten Höhenklasse (4402) und einem zweiten Puls der zweiten Höhenklasse (4402), der vom ersten Puls verschieden ist;
• Erfassen (4301) zweiten Werts (4110) des zeitlichen Abstands zwischen einem dritten Puls der zweiten Höhenklasse (4402), der vom ersten Puls verschieden ist, und einem vierten Puls der zweiten Höhenklasse (4402), der vom ersten Puls und vom zweiten Puls und vom dritten Puls verschieden ist.
• Vergleichen (4302) des ersten Werts mit dem zweiten Wert und
• Ausgeben (4303) eines ersten logischen Werts als ein Zufallsbit (4111), wenn der erste Wert größer als der zweite Wert ist, und
• Ausgeben (4303) eines zweiten logischen Werts, der vom ersten logischen Wert verschieden ist, als das Zufallsbit (4111), wenn der erste Wert kleiner als der zweite Wert ist.

Feature 148b: higher-level computer system (12) of a supply network (200) with electronic fuses, which is set up to execute the following method for generating a random bit:

• Generating a pulse sequence (4106) with random time intervals using at least two SPAD diodes (3954, 3955, 4101.1, 4101.3),
• wherein the pulse sequence (4106) comprises pulses of a first altitude class (4401) and a second altitude class (4402);
• separating the pulses of the first height class (4401) from the pulses of the second height class (4402) by means of a slice level (4403, 4104.1);
• detecting (4301) a first value (4110) of the time interval between a first pulse of the second height class (4402) and a second pulse of the second height class (4402), which differs from the first pulse;
• Recording (4301) the second value (4110) of the time interval between a third pulse of the second height class (4402), which differs from the first pulse, and a fourth pulse of the second height class (4402), which differs from the first pulse and from the second pulse and is different from the third pulse.
• comparing (4302) the first value to the second value and
• outputting (4303) a first logical value as a random bit (4111) if the first value is greater than the second value, and
• outputting (4303) a second logical value different from the first logical value as the random bit (4111) if the first value is less than the second value.

• Erzeugung (5110) eines zufälligen Einzelphotonenstroms (3957, 3958, 3959, 4101.2) aus Einzelphotonen mittels einer oder mehrerer erster SPAD-Dioden (4101.1, 3954);
• Übertragung (5120) des zufälligen Einzelphotonenstroms (3957, 3958, 3959, 4101.2) mittels eines vom Halbleitersubstrat (3949, 3948) verschiedenen Lichtwellenleiters (3944, 4101.2) an eine oder mehrere zweite SPAD-Dioden (4101.3, 3955);
• Wandlung (5130) des zufälligen Einzelphotonenstroms (3957, 3958, 3959, 4101.2) in ein Detektionssignal mittels der einen oder der mehreren zweiten SPAD-Dioden (4101.3, 55);
• Aufbereiten (5140) des Detektionssignals in ein aufbereitetes Detektionssignal;
• Abtrennen (5150) der durch Kopplungen der Emissionen einer ersten SPAD-Diode (4101.1) der einen oder der mehreren ersten SPAD-Dioden (4101.1, 3954) und einer zweiten SPAD-Diode (4101.3, 3955) der einen oder der mehreren zweiten SPAD-Dioden (4101.3, 55) entstandenen Pulse des aufbereiteten Detektionssignals von den durch spontane Emission der zweiten SPAD-Diode (4101.3, 55) entstandenen Pulsen des aufbereiteten Detektionssignals durch Vergleich des aufbereiteten Detektionssignals mit einem Schwellwert (4104.1);
• Ermittlung (5160) eines ersten zeitlichen Abstands zwischen dem ersten Puls und dem zweiten Puls eines ersten Paares aus zwei aufeinander folgenden, durch Kopplungen der Emissionen einer ersten SPAD-Diode (4101.1, 3954) und einer zweiten SPAD-Diode (4101.3, 3955) entstandenen Pulse des aufbereiteten Detektionssignals und Ermittlung eines zweiten zeitlichen Abstands zwischen einem dritten Puls und einem vierten Puls eines zweiten Paares aus zwei aufeinander folgenden, durch Kopplungen der Emissionen einer ersten SPAD-Diode (4101.1, 3954) und einer zweiten SPAD-Diode (4101.3, 3955) entstandenen Pulse des aufbereiteten Detektionssignals;
• Ermittlung (5170) des Bit-Werts eines Zufallsbits durch Vergleich des Werts des ersten zeitlichen Abstands und des Bit-Werts des zweiten zeitlichen Abstands;
• Sofern die Anzahl (3680) n der ermittelten Zufallsbits kleiner als die gewünschte Zahl m der Zufallsbits der zu erzeugenden Quantenzufallszahl QZ ist, Wiederholung der vorstehenden Schritte (5110 bis 5170) und Beenden des Prozesses zur Erzeugung einer Quantenzufallszahl sofern die Anzahl (3680) n der ermittelten Zufallsbits größer oder gleich der gewünschten Zahl m der Zufallsbits der zu erzeugenden Quantenzufallszahl QZ ist.

Feature 159: Electronic fuse (1, 825) set up to carry out the following method (3700) for generating a quantum random number QZ with m random bits, the method having the following steps:

• generating (5110) a random stream of single photons (3957, 3958, 3959, 4101.2) from single photons by means of one or more first SPAD diodes (4101.1, 3954);
• Transmission (5120) of the random single photon stream (3957, 3958, 3959, 4101.2) by means of an optical fiber (3944, 4101.2) different from the semiconductor substrate (3949, 3948) to one or more second SPAD diodes (4101.3, 3955);
• converting (5130) the random single photon stream (3957, 3958, 3959, 4101.2) into a detection signal using the one or more second SPAD diodes (4101.3, 55);
• processing (5140) the detection signal into a processed detection signal;
• Separating (5150) the emissions caused by couplings of a first SPAD diode (4101.1) of the one or more first SPAD diodes (4101.1, 3954) and a second SPAD diode (4101.3, 3955) of the one or more second SPAD diodes (4101.3, 55) resulting pulses of the processed detection signal from the spontaneous emission of the second SPAD diode (4101.3, 55) resulting pulses of the processed detection signal by comparing the processed detection signal with a threshold value (4104.1);
• Determination (5160) of a first time interval between the first pulse and the second pulse of a first pair of two consecutive ones created by coupling the emissions of a first SPAD diode (4101.1, 3954) and a second SPAD diode (4101.3, 3955). Pulses of the processed detection signal and determination of a second time interval between a third pulse and a fourth pulse of a second pair of two consecutive ones by coupling the emissions of a first SPAD diode (4101.1, 3954) and a second SPAD diode (4101.3, 3955 ) resulting pulses of the processed detection signal;
• determining (5170) the bit value of a random bit by comparing the value of the first time interval and the bit value of the second time interval;
• If the number (3680) n of determined random bits is less than the desired number m of random bits of the quantum random number QZ to be generated, repeat the above steps (5110 to 5170) and end the process for generating a quantum random number if the number (3680) n of the determined random bits is greater than or equal to the desired number m of random bits of the quantum random number QZ to be generated.

crossing protection

Feature 160: Energy-side crossing protection (1000)
wherein the crossing fuse (1000) comprises an energy source-side first supply line section (1005) of a first supply line and
wherein the crossing protection (1000) comprises a consumer-side second supply line section (1010) of a first supply line and
wherein the crossing fuse (1000) comprises an energy source-side first supply line section (1015) of a second supply line and
wherein the crossing protection (1000) comprises a consumer-side second supply line section (1020) of a second supply line and
wherein the crossing protection (1000) comprises a first electrical node (1025) and
wherein the crossing protection (1000) comprises a second electrical node (1030) and
wherein the intersection safety device (1000) comprises a first electronic safety device (1035), in particular according to one or more of features 28 to 106, and
wherein the intersection safety device (1000) comprises a second electronic safety device (1040), in particular according to one or more of features 28 to 159, and
wherein the intersection safety device (1000) comprises a third electronic safety device (1045), in particular according to one or more of features 28 to 159, and
wherein the intersection safety device (1000) comprises a fourth electronic safety device (1050), in particular according to one or more of features 28 to 159, and
the first electronic fuse (1035) depending on the switching state of the circuit breaker (17) of the first electronic fuse (1035) connecting the energy source-side first supply line section (1005) of the first supply line to the first node (1025) or the energy source-side first separating the supply line section (1005) of the first supply line from the first node (1025), and
wherein the second electronic fuse (1040), depending on the switching state of the power switch (17) of the second electronic fuse (1040), connects the energy source-side first supply line section (1015) of the second supply line to the first node (1025) or the energy source-side first supply line section (1015) of separates the second supply line from the first node (1025), and
wherein the second electronic fuse (1040) does not connect the power source-side first supply line section (1015) of the second supply line to the first node (1025) when the first electronic fuse (1035) connects the power source-side first supply line section (1005) of the first supply line to the first node (1025) connects, and
wherein the first electronic fuse (1040) does not connect the power source-side first supply line section (1005) of the first supply line to the first node (1025) when the second electronic fuse (1040) connects the power source-side first supply line section (1015) of the second supply line to the first node (1025) connects, and
wherein the third electronic fuse (1045), depending on the switching state of the circuit breaker (17) of the third electronic fuse (1045), connects the energy source-side first supply line section (1005) of the first supply line to the second node (1030) or the energy source-side first supply line section (1005) of disconnects the first supply line from the second node (1030), and
wherein the fourth electronic fuse (1050), depending on the switching state of the circuit breaker (17) of the fourth electronic fuse (1050), connects the energy source-side first supply line section (1015) of the second supply line to the second node (1030) or the energy source-side first supply line section (1030) of separates the second supply line from the second node (1030), and
wherein the fourth electronic fuse (1050) does not connect the power source-side first supply line section (1015) of the second supply line to the second node (1030) when the third electronic fuse (1045) connects the power source-side first supply line section (1005) of the first supply line to the second node connects, and
wherein the third electronic fuse (1045) does not connect the power source-side first supply line section of the first supply line to the second node (1030) when the fourth electronic fuse (1050) connects the power source-side first supply line section (1015) of the second supply line to the second node (1030) connects, and
wherein the load-side second supply line section (1055) of the first supply line is connected to the first node (1025) and
wherein the load-side second supply line section (1060) of the second supply line is connected to the second node (1030).

Feature 161: Consumer-side crossing protection (1000)
wherein the crossing fuse (1000) comprises an energy source-side first supply line section (1005) of a first supply line and
wherein the crossing protection (1000) comprises a consumer-side second supply line section (1015) of a first supply line and
wherein the crossing fuse (1000) comprises an energy source-side first supply line section (1055) of a second supply line and
wherein the crossing protection (1000) comprises a consumer-side second supply line section (1060) of a second supply line and
wherein the crossing protection (1000) comprises a third electrical node (1065) and
wherein the crossing protection (1000) comprises a fourth electrical node (1070) and
wherein the intersection safety device (1000) comprises a first electronic safety device (1035), in particular according to one or more of features 28 to 159, and
wherein the intersection safety device (1000) comprises a second electronic safety device (1040), in particular according to one or more of features 28 to 159, and
wherein the intersection safety device (1000) comprises a third electronic safety device (1045), in particular according to one or more of features 28 to 159, and
wherein the intersection safety device (1000) comprises a fourth electronic safety device (1050), in particular according to one or more of features 28 to 159, and
the first electronic fuse (1035) depending on the switching state of the circuit breaker (17) of the first electronic fuse (1035) connecting the load-side second supply line section (1055) of the first supply line to the third node (1065) or the load-side second disconnects a power line section (1055) of the first power line from the third node (1065), and
wherein the second electronic fuse (1040), depending on the switching state of the power switch (17) of the second electronic fuse (1040), connects the load-side second supply line section (1055) of the first supply line to the fourth node (1070) or the load-side second supply line section (1055) of the separates the first supply line (1055) from the fourth node (1070), and
wherein the second electronic fuse (1040) does not connect the load-side second supply line section (1055) of the first supply line to the fourth node (1070) when the first electronic fuse (1035) connects the load-side second supply line section (1055) of the first supply line to the third node (1065) connects, and
wherein the first electronic fuse (1035) does not connect the load-side second supply line section (1055) of the first supply line to the third node (1055) when the second electronic fuse (1040) connects the load-side second supply line section of the first supply line (1055) to the fourth node (1070) connects, and
the third electronic fuse (1045) depending on the switching state of the circuit breaker (17) of the third electronic fuse (1045) connecting the load-side second supply line section (1060) of the second supply line to the third node (1065) or the load-side second supply line section (1060) of the separates the second power line from the third node (1065), and
wherein the fourth electronic fuse (1050), depending on the switching state of the circuit breaker (17) of the fourth electronic fuse (1050), connects the load-side second supply line section of the second supply line (1060) to the fourth node (1070) or the load-side second supply line section (1060) of separates the second power line from the fourth node (1070), and
wherein the fourth electronic fuse (1050) does not connect the load-side second supply line section (1060) of the second supply line to the fourth node (1070) when the third electronic fuse (1045) connects the load-side second supply line section (1060) of the second supply line to the third node (1065) connects, and
wherein the third electronic fuse (1045) does not connect the load-side second supply line section (1060) of the second supply line to the third node (1065) when the fourth electronic fuse (1050) connects the load-side second supply line section (1060) of the second supply line to the fourth node (1070) connects, and
wherein the power source-side first power line portion (1005) of the first power line is connected to the third node (1065), and
wherein the power source side first power line portion (1015) of the second power line is connected to the fourth node (1070).

Feature 162: Crossing protection (1000) according to feature 160 or feature 161
wherein the switching state of the circuit breakers (17) of the electronic fuses (1035, 1040, 1045, 1050) of the crossing fuse (1000)
from a determined energy requirement of one or more consumers (830, 835) and/or
from a determined energy supply capability from one or more energy sources (250, 251)
depends.

Feature 163: crossing protection (1000) according to feature 162,
wherein the control devices (4) of the electronic safety devices (1035, 1040, 1045, 1050) of the intersection safety device (1000) are connected to a higher-level computer system (12) and/or to one another via a safety data bus (9) and
wherein the higher-level computer system (12) is set up to determine the energy requirements of one or more consumers (835, 830) that are supplied via the supply lines (1005, 1010. 1015, 1020, 1055, 1060) of the crossing safety device (1000) with electrical Energy can be supplied, and / or
wherein the higher-level computer system (12) is set up to determine the ability to supply energy from one or more energy sources (250, 251),
which can supply electrical energy to the crossing safety device (1000) via the supply lines (1005, 1010, 1015, 1020, 1055, 1060), and
wherein the higher-level computer system (12) is set up to transmit configuration commands via the safety data bus (9) to the control devices (4) of the fuses (1035, 1040, 1045, 1050) of the intersection safety device (1000), which commands are based on the ascertained energy requirements of these consumers ( 830, 831) and/or which depend on the determined energy supply capability of these energy sources (250, 251), and
these configuration commands causing the opening and closing of circuit breakers (17) of the electronic fuses (1035, 1040, 1045, 1050) of the crossing fuse (1000).

Feature 164: supply network (1100) ( 11 )
with a higher-level computer system (12) and
with a variety of supply lines and
with a plurality of crossing fuses (1110 to 1118),
wherein the crossing fuses (1110 to 1118) are inserted in supply lines of the supply network (1100) and
the higher-level computer system (12) being connected to control devices (4) for the electronic fuses of the cross fuses (1110 to 1118) by means of a security data bus (9) and
the electronic fuses of the cross fuses (1110 to 1118) having control devices (4) and
wherein electronic fuses (4) of a respective cross fuse (1110 to 1118) can also have a common control device (4) in common and
wherein the higher-level computer system (12) is set up to determine the energy requirement of electrical energy consumers (1121 to 1124) in the supply network (1100), and/or
wherein the higher-level computer system (12) is set up to determine the energy supply capability of electrical energy sources (1150 to 1155) in the supply network (1100), and/or
wherein the higher-level computer system (12) is set up to determine the current safety requirement, in particular on the basis of the current driving situation and/or the current operating state of the vehicle and/or properties of the vehicle's surroundings and
wherein the computer system (12) is set up to use configuration commands via the safety data bus (9) to the intersection safety devices (1110 to 1118) to dynamically change the electrically effective topology of the supply network of the supply lines according to the determined energy requirement and/or according to the determined energy supply capability and/or accordingly to adapt the current safety requirements, in particular based on the current driving situation and/or the current operating state of the vehicle and/or properties of the environment around the vehicle.

Process features (Figure 12)

Feature 165: Method (1200) for operating a supply network ( 12 )
with the steps
Providing (1210) a supply network (250, 251, 210 to 213, 245) with a device part of the vehicle, hereinafter referred to as the energy-supplying device part (210),
wherein the energy-supplying supply part (210) comprises a control device (280, 4) and
wherein the power supply part (210) comprises a memory in a first logic state;
supplying (1220) the power supplying device part (210) with electric power from a power source (251, 250) of the vehicle;
Connecting (1230) a first terminal of a further line section (240) to the energy-supplying device part (210) of the vehicle;
Connecting (1240) a second connection of the further line section (240) to a further device part (220, 221) of the vehicle;
signaling (1250) a switch-on signal to the control device (280, 4) of the energy-supplying device part (210);
changing (1260) the logic state of the memory to a second logic state dependent on the logic state of the memory;
Supplying (1270) the further device part (220 to 221) of the vehicle with electrical energy via the further line section (240) depending on the logic state of the memory.

Feature 166: Procedure according to feature 165
the switch-on signal being signaled (1250) via a safety data bus (9).

Feature 167: procedure according to feature 165 or feature 166,
wherein the power-supplying device part (210) has an electronic fuse (215) of the power-supplying device part (250, 251) and
the supply (1270) of the further device part (220, 221) of the vehicle with electrical energy via the further line section (240) by switching on the electronic fuse (215) of the power-supplying device part (210) depending on the logic state of the memory.

Feature 168: Method for operating a supply network (200) ( 12 )
with the steps
Providing (1210) a supply network (200) with a device part (210) of the vehicle, hereinafter referred to as the energy-supplying device part (210), and
supplying (1220) the power supplying device part (210) with electric power from a power source (250, 251) of the vehicle;
Connecting (1230) a first terminal of a further line section (240) to the energy-supplying device part (210) of the vehicle;
Connecting (1240) a second connection of a further line section (240) to a further device part (220 to 221) of the vehicle,
wherein the further supply part (220 to 221) comprises a control device (280, 4) and
wherein the further supply part (220 to 221) comprises a memory in a first logic state;
signaling (1250) of a switch-on signal to the control device (280, 4) of the further device part (220 to 221);
changing (1260) the logic state of the memory to a second logic state dependent on the logic state of the memory;
Supplying (1270) the further device part (220 to 221) of the vehicle with electrical energy via the further line section (240) depending on the logic state of the memory.

Feature 169: Procedure according to feature 168
the switch-on signal being signaled via a safety data bus (9).

Feature 170: procedure according to feature 168 or feature 169,
wherein the further device part has an electronic fuse (225) of the further device part (220) and
the supply of the further device part (220) of the vehicle with electrical energy via the further line section (240) by switching on the electronic fuse (225) of the further device part (220) depending on the logic state of the memory.

• - wobei das Fahrzeug u.a. Vorrichtungsteile (210) umfasst und
• - wobei das Fahrzeug zumindest einen Kabelbaum mit Leitungsabschnitten (240, 241, 245) umfasst und
• - wobei das Fahrzeug zumindest eine Energiequelle (250, 251) umfasst und
• - wobei das Fahrzeug zumindest einen Steuerrechner (12), beispielsweise ein übergeordnetes Rechnersystem (12), umfasst und
• - wobei das Fahrzeug zumindest zwei elektronische Sicherungen (214, 225) umfasst und
• - wobei die Vorrichtungsteile (220) elektrische Verbraucher sind und
• - wobei die zumindest eine oder mehrere Energiequellen (250, 251) dazu eingerichtet sind, zumindest zwei der Vorrichtungsteile (210, 220) mit elektrischer Energie über den Kabelbaum mit Leitungsabschnitten (240, 241, 245) zu versorgen, und
• - wobei die elektronischen Sicherungen (214, 225) in den Kabelbaum mit Leitungsabschnitten (240, 241, 245) eingefügt sind und
• - wobei jeder der elektrischen Sicherungen (214, 225) zumindest ein, als Zahl 1, elektrischer Verbraucher (210, 225) zugeordnet ist, der im Folgenden als der jeweiligen elektronischen Sicherung zugeordneter elektrischer Verbraucher bezeichnet wird, und
• - wobei eine Sicherung der Sicherungen (214, 215) dazu eingerichtet ist, die Energieversorgung des dieser Sicherung zugeordneten elektrischen Verbrauchers in Abhängigkeit von einem Steuersignal des Steuerrechners ermöglichen oder unterbinden zu können;

Unterbinden (1310) der Energieversorgung eines zugeordneten elektrischen Verbrauchers mittels der entsprechenden Sicherung, der dieser Verbraucher zugeordnet ist;
Herstellen (1315) einer verschlüsselten Datenverbindung (720) zwischen dem Steuerrechner (12) des Fahrzeugs, beispielsweise einem übergeordneten Rechnersystem (12), und einem Rechner (710) eines Dienstanbieters, insbesondere einem Rechnersystem des Automobilherstellers des Fahrzeugs;
Authentifizierung (1320) des Fahrzeugs durch den Steuerrechner (12) des Fahrzeugs, beispielsweise durch ein übergeordnetes Rechnersystem (12), beim Rechner (710) des Dienstanbieters, wobei die Authentifizierungsdaten des Fahrzeugs beispielsweise die Daten des Fahrzeugs und/oder des Autoschlüssels und/oder einer SIM-Karte im Fahrzeug und/oder einer fahrzeugspezifischen Passworteingabe oder Passworterzeugung und/oder biometrische Nutzerdaten eines Fahrzeughalters etc. umfassen können;
Authentifizierung (1325) des Rechners (710) des Dienstanbieters beim Steuerrechner (12) des Fahrzeugs, beispielsweise bei einem übergeordneten Rechnersystem (12);
Ggf. Authentifizierung (1330) der anfordernden Person (730) durch den Steuerrechner (12) des Fahrzeugs, beispielsweise durch das übergeordnete Rechnersystem (12), beim Rechner (710) des Dienstanbieters, wobei die Authentifizierungsdaten beispielsweise die Daten des Fahrzeugs und/oder des personalisierten Autoschlüssels, einer personalisierten SIM-Karte, einer personalisierten Passworteingabe, biometrische Nutzerdaten etc. umfassen können;
Erzeugen (1335) oder Bereitstellen eines Freischaltcodes durch den Rechner (710) des Dienstanbieters;
Übermitteln (1340) des Freischaltcodes durch den Rechner des Dienstanbieters (710) an den Steuerrechner (12) des Fahrzeugs, insbesondere an das übergeordnete Rechnersystem (12);
Verifikation (1345) der Zulässigkeit und/oder syntaktischen Korrektheit und/oder der situativen Zulässigkeit des Freischaltcodes durch den Steuerrechner (12) des Fahrzeugs, insbesondere durch das übergeordnete Rechnersystem (12);
Ermöglichen (1350) der Energieversorgung eines zugeordneten elektrischen Verbrauchers (220) mittels der entsprechenden Sicherung (225), wenn der Freischaltcode zulässig und/oder syntaktisch Korrekt und/oder der situativ zulässig ist;
Übermittlung (1355) von Abrechnungsdaten an einen oder den Rechner (710) eines oder des Dienstanbieters, insbesondere an ein oder das Rechnersystem des Automobilherstellers, wobei eine Speicherinformation im Rechner (710) des Dienstanbieters markiert, dass die Rechnung nicht bezahlt ist;
Erstellung (1360) einer Rechnung in Abhängigkeit von den übermittelten Abrechnungsdaten durch einen oder den Rechner (710) eines oder des Dienstanbieters, insbesondere an ein oder das Rechnersystem des Automobilherstellers;
Übermittlung (1365) der Rechnung an einem oder den Rechner (710) eines oder des Dienstanbieters, insbesondere an ein oder das Rechnersystem (740) der bestellenden Person (730), oder an die bestellende Person (730);
Begleichung (1370) der Rechnung durch einen oder den Rechner (710) eines oder des Dienstanbieters und/oder die anfordernde Person (730);
Markierung (1375) der Speicherinformation im Rechner des Dienstanbieters (740), dass die Rechnung bezahlt ist.Feature 171: Method (1300) for operating a vehicle, ( 13 ) (power source side feature version)
Providing (1305) the vehicle, (see also 7 )

• - wherein the vehicle includes device parts (210) and
• - wherein the vehicle comprises at least one wiring harness with line sections (240, 241, 245) and
• - wherein the vehicle comprises at least one energy source (250, 251) and
• - The vehicle comprising at least one control computer (12), for example a higher-level computer system (12), and
• - wherein the vehicle comprises at least two electronic fuses (214, 225) and
• - wherein the device parts (220) are electrical consumers and
• - wherein the at least one or more energy sources (250, 251) are set up to supply at least two of the device parts (210, 220) with electrical energy via the cable harness with line sections (240, 241, 245), and
• - wherein the electronic fuses (214, 225) are inserted in the cable harness with line sections (240, 241, 245) and
• - wherein each of the electrical fuses (214, 225) is assigned at least one electrical consumer (210, 225), number 1, which is referred to below as the electrical consumer assigned to the respective electronic fuse, and
• - A fuse of the fuses (214, 215) being set up to enable or prevent the energy supply of the electrical load associated with this fuse depending on a control signal from the control computer;

stopping (1310) the power supply to an associated electrical load by means of the corresponding fuse associated with that load;
Establishing (1315) an encrypted data connection (720) between the control computer (12) of the vehicle, for example a higher-level computer system (12), and a computer (710) of a service provider, in particular a computer system of the automobile manufacturer of the vehicle;
Authentication (1320) of the vehicle by the vehicle's control computer (12), for example by a higher-level computer system (12), on the service provider's computer (710), with the vehicle's authentication data for example the data of the vehicle and/or the car key and/or a SIM card in the vehicle and/or a vehicle-specific password entry or password generation and/or biometric user data of a vehicle owner etc.;
Authentication (1325) of the computer (710) of the service provider with the control computer (12) of the vehicle, for example with a higher-level computer system (12);
If necessary, authentication (1330) of the requesting person (730) by the vehicle's control computer (12), for example by the higher-level computer system (12), on the service provider's computer (710), the authentication data being, for example, the data of the vehicle and/or the personalized car keys, a personalized SIM card, personalized password entry, biometric user data, etc.;
generating (1335) or providing an activation code by the service provider's computer (710);
Transmission (1340) of the activation code by the computer of the service provider (710) to the control computer (12) of the vehicle, in particular to the higher-level computer system (12);
verification (1345) of the admissibility and/or syntactic correctness and/or the situational admissibility of the activation code by the control computer (12) of the vehicle, in particular by the higher-level computer system (12);
Enabling (1350) the power supply to an associated electrical consumer (220) by means of the corresponding fuse (225) if the activation code is permissible and/or syntactically correct and/or the situation is permissible;
Transmission (1355) of billing data to a computer (710) of a service provider, in particular to a computer system of the automobile manufacturer, with storage information in the computer (710) of the service provider marking that the bill has not been paid;
Creation (1360) of an invoice as a function of the transmitted accounting data by a computer (710) of a service provider, in particular to a computer system of the automobile manufacturer;
Transmission (1365) of the invoice to a computer (710) of a service provider, in particular to a computer system (740) of the ordering person (730), or to the ordering person (730);
settlement (1370) of the bill by a or the computer (710) of a or the service provider and/or the requesting person (730);
Marking (1375) the storage information in the service provider's computer (740) that the bill has been paid.

Feature 172: Method (1600) for detecting non-extinguishing arcs (1510) in the wiring harness (1515) with line sections (485.1505) of a vehicle,
wherein voltages of more than 40V, for example 48V and/or 800V, occur at least at times in the cable harness (1510) between the line sections (485, 1505) and
wherein electronic fuses (810, 825, 805) are inserted into line sections (245, 246,485,1505) of the cable harness (1515), which are set up to prevent the flow of current in individual or multiple line sections (245, 246,485,1505) of the cable harness (1515 ) to be able to interrupt and/or enable
wherein the cable harness (1515) is divided into line sections (485, 1505) to be protected and
wherein at least one electronic fuse of the electronic fuses (825) is assigned to a line section (1515) of these line sections (485, 1515) - hereinafter referred to as line section (1505) to be protected - which is set up to prevent the current flow in this line section assigned to it (1505) of the line sections (485, 1505) to be able to interrupt and/or enable and
a control unit (12) of the vehicle, for example the higher-level computer system (12), being set up to control this fuse (825) of the electronic fuses (810, 825, 805),
with the steps
Recording (1605) a time section of the time profile of the electric current (1525) through the line section (1505) to be secured and generating an associated value profile (1610) of the recorded current value of the electric current (1525) through the line section (1505) to be protected for this time section, in particular by means of a current measuring device (1520) in the line section (1505). is joined, wherein in particular the current measuring device (1520) can be the fuse (825) assigned to the line section (1505) to be protected or a partial device of the fuse (825) assigned to the line section (1505) to be protected, and
In particular, this recording (1605) and/or the generation of the associated value curve (1610) of this time period by means of a control device (4) of the electronic fuse or by means of a higher-level control device (12) or by means of a higher-level computer system (12) which is connected via a data bus (9) communicate with the control device (4) of the fuse (825);
Carrying out (1615) a spectral analysis of the recorded value profile (1610) of this time segment as a function of the generated time value profile (1610) of the time profile of the electric current (1525) through the line section (1505) to be secured and generating a spectral analysis result (1620), in particular by means of the control device (4) of the electronic fuse (825) or by means of a higher-level control device (12) or by means of a higher-level computer system (12), which communicate with the control device (4) of the fuse (825) via a data bus (9);
Using (1625) the values of the spectral analysis result (1620) of the recorded value profile (1610) of this time segment and/or values derived therefrom as the current claim vector (1630);
Mapping (1635) of the current claim vector (1630) of the values of the spectral analysis result (1620) of the recorded value curve (1610) of this period of time to predefined claim vectors (1640) of spectral base structures from a stored set of predefined claim vectors of spectral base structures (1650) in a base structure database (1645 ), in particular by means of scalar product formation between these claim vectors (1640), for generating a spectral parameter set (1655) with at least one, preferably one similarity value each for the similarity between a predefined claim vector (1640) of exactly one spectral base structure of the stored set of predefined claim vectors spectral base structures (1625) of the base structure database (1635) on the one hand and the current claim vector on the other hand for predefined, in particular all, claim vectors of spectral base structures from the stored set of predefined claim vectors of spectral base structures (1625) in the base structure database (1635),
this mapping and generation preferably by means of the control device (4) of the electronic fuse (825) or by means of a higher-level control device (12) or by means of a higher-level computer system (12) which is connected via a data bus (9) to the control device (4) of the fuse (825) communicate, happens;
Evaluation (1660) of the spectral parameter set (1655) to generate an evaluation result (1665),
in particular, this evaluation (1660) being carried out by applying a neural network model and
this evaluation (1660) being carried out in particular by means of the control device (4) of the electronic fuse (825) or by means of a higher-level control device (12) or by means of a higher-level computer system (12) which is connected via a data bus (9) to the control device (4) of the Communicate backup (825), done
wherein in particular the control device (4) of the electronic fuse (825) and/or the higher-level control device (12) and/or the higher-level computer system (12) execute the neural network model and
wherein in particular the spectral parameter set (1655) includes input values of the neural network model and
wherein the evaluation result (1665) of the evaluation (1660) depends on output values of the neural network model;
Interrupting (1670) the current flow (1525) through the line section (1505) to be secured using the electronic fuse (825) if the evaluation result (1665) of the spectral parameter set (1640) indicates the presence of a short circuit or a plasma discharge (1510), in particular an arc , corresponds to or suggests that
the interruption being effected by means of the control device (4) of the electronic fuse (825) and possibly also by means of a higher-level control device (12) and/or possibly by means of a higher-level computer system (12) which is connected to the control device via a data bus (9). (4) communicating with the fuse (825), and
In particular, the control device (4) of the electronic fuse (825) and/or a higher-level control device (12) and/or a higher-level computer system (12) connected via a data bus (9) to the control device (4) of the fuse (825) communicate, open the circuit breaker (17) of the electronic fuse (825).

Feature 173: Method (1800) operating a supply network (1700) of a vehicle ( 17 , 18 )
wherein the supply network (1700) has line sections (245) and
wherein the supply network (1700) comprises energy-consuming device parts (210, 211) of the supply network (1700) and
wherein the supply network (1700) comprises energy-supplying device parts (250) which are set up to feed energy into the supply network (1700), and
wherein energy-consuming device parts (210, 211) of the supply network (1700) are set up to draw electrical energy from the supply network (1700) via at least one line section (245), and
wherein energy-consuming device parts (210) of the energy-consuming device parts (210, 211) of the supply network (1700) are set up to be able to supply a further device part (220) of the vehicle with electrical energy via a further line section (240), and
wherein the energy-consuming device parts (210) have an electronic fuse (214) and
wherein the electronic fuse (255) of a device part (250) is set up to be able to prevent and/or enable the supply of this energy-consuming device part (210) and the other device parts (220, 221) supplied with electrical energy by this device part (210). ,
with the steps
Monitoring the total energy demand of device parts (210, 211, 220, 221, 222, 223) of the device parts of the vehicle
by detecting (1805) the total energy requirement of these device parts (210, 211, 220, 221, 222, 223) and
by comparing (1810) the determined total energy requirement of these device parts (210, 211, 220, 221, 222, 223) of the vehicle with an upper energy consumption threshold value;
Enabling (1820) the supply of an energy-consuming device part of these device parts with electrical energy and the other device parts supplied with electrical energy by this device part if the total energy requirement of all device parts is or could be below a lower energy transport threshold value for this line section or the operating state and/or the driving situation this is to be expected
this enabling taking place by means of the electronic protection of this part of the device.

Feature 174: Procedure according to feature 173
wherein the power supply of the device parts of the vehicle, the power supply of which is enabled, has a higher priority than the power supply of the device parts of the vehicle, the power supply of which is not enabled.

Feature 175: Method (1800) for operating a utility network (1700)
wherein the supply network (1700) has line sections (245, 240, 241) and
wherein the supply network (1700) comprises energy-consuming device parts (210, 211) of the supply network (1700), and
wherein the supply network (1700) comprises energy-supplying device parts (250) of the vehicle which are set up to feed energy into the supply network (1700), and
wherein the supply network (1700) is set up to supply energy-consuming device parts (210, 211) of the vehicle with electrical energy from the supply network (1700) via at least one line section (245), and
wherein energy-consuming device parts (210, 211) are set up to be able to supply electrical energy to a further device part (220, 221, 222, 223) of the vehicle via a further line section (240, 241), and
wherein the energy-consuming device parts (210, 211) have an electronic fuse (214, 215) and
wherein the electronic fuse (255) of a device part (250) is set up to ensure the supply of this energy-consuming device part (210, 211) and the other device parts (220, 221, 222, 223 ) to be able to prevent and/or enable
with the steps
Monitoring the total energy demand of device parts (210, 211, 220, 221, 222, 223) of the device parts of the vehicle
by detecting (1805) the total energy requirement of these device parts (210, 211, 220, 221, 222, 223) and
by comparing (1810) the determined total energy requirement of these device parts (210, 211, 220, 221, 222, 223) of the vehicle with an energy consumption threshold value;
Preventing (1820) the supply of an energy-consuming device part of these device parts with electrical energy and the other device parts supplied with electrical energy by this device part if the total energy requirement of all device parts is or could be above an energy transport threshold value for this line section or the operating state and/or the driving situation is so can be expected
this suppression being effected by means of the electronic protection of this part of the device.

Feature 176: Procedure according to feature 175
wherein the power supply of the device parts of the vehicle, the power supply of which is cut off, has a lower priority than the power supply of the device parts of the vehicle, the power supply of which is not cut off.

Feature 178: Method (1800) for operating a supply network (1700),
wherein the supply network (1700) has line sections (245, 240, 241) and
wherein the supply network (1700) comprises energy-consuming device parts (210, 211) of the supply network (1700) and
wherein the supply network (1700) comprises energy-supplying device parts (250) of the vehicle which are set up to feed energy into the supply network (1700), and
wherein the supply network (1700) is set up to supply energy-consuming device parts (210, 211) of the vehicle with electrical energy from the supply network (1700) via at least one line section (245), and
wherein energy-consuming device parts (210, 211) are set up to be able to supply electrical energy to a further device part (220, 221, 222, 223) of the vehicle via a further line section (240, 241), and
wherein the energy-consuming device parts (210, 211) have an electronic fuse (214, 215) and
wherein the electronic fuse (255) of a device part (250) is set up to ensure the supply of this energy-consuming device part (210, 211) and the other device parts (220, 221, 222, 223 ) to be able to prevent and/or enable
with the steps
Monitoring the total energy demand of device parts (210, 211, 220, 221, 222, 223) of the device parts of the vehicle
by detecting (1805) the total energy requirement of these device parts (210, 211, 220, 221, 222, 223) and
by comparing (1810) the determined total energy requirement of these device parts (210, 211, 220, 221, 222, 223) of the vehicle with a lower energy consumption threshold value;
Enabling (1820) the supply of an energy-consuming device part of these device parts with electrical energy and the other device parts supplied with electrical energy by this device part if the total energy requirement of all device parts is or could be below a lower energy transport threshold value for this line section or the operating state and/or the driving situation this is to be expected
this enabling taking place by means of the electronic protection of this part of the device.

Feature 179: procedure according to feature 178,
wherein the power supply of the device parts of the vehicle, the power supply of which is enabled, has a higher priority than the power supply of the device parts of the vehicle, the power supply of which is not enabled.

Feature 180: Method (1800) for operating a supply network (1700),
wherein the supply network (1700) has line sections (245) and
wherein the supply network (1700) comprises energy-consuming device parts (210, 211) of the supply network (1700) and
wherein the supply network (1700) comprises energy-supplying device parts (250) of the vehicle which are set up to feed energy into the supply network (1700), and
wherein the supply network (1700) is set up to supply energy-consuming device parts (210, 211) of the supply network (1700) of the vehicle with electrical energy from the supply network (1700) via at least one line section (245), and
wherein energy-consuming device parts (210) are set up to be able to supply electrical energy to a further device part (220) of the vehicle via a further line section (240). no, and
wherein the energy-consuming device parts (210) have an electronic fuse (214) and
wherein the electronic fuse (255) of a device part (250) is set up to be able to prevent and/or enable the supply of this energy-consuming device part (210) and the other device parts (220, 221) supplied with electrical energy by this device part (210). .
with the steps
Monitoring the total energy demand of device parts (210, 211, 220, 221, 222, 223) of the device parts of the vehicle
by detecting (1805) the total energy requirement of these device parts (210, 211, 220, 221, 222, 223) and
by comparing (1810) the determined total energy requirement of these device parts (210, 211, 220, 221, 222, 223) of the vehicle with an upper energy consumption threshold value;
Increasing (1820) the energy generation of an energy source 250 for supplying a first energy-consuming device part (210) with electrical energy and/or the other device parts (220: 221) supplied with electrical energy by this first device part (210),
if the determined total energy requirement of all device parts (210, 211, 220, 221, 222, 223) is or could be above the upper energy consumption threshold value or the operating state and/or the driving situation indicates this,
this increasing (1820) by means of the electronic fuse (255) of this device part (250), in particular by closing the power switch (17) of this fuse (255) of this device part (250), and/or by changing operating parameters of this device part (250) he follows.

Feature 181: Procedure according to feature 180
wherein the powering of the device parts of the vehicle, the powering of which is improved, has a higher priority than the powering of the device parts of the vehicle, the powering of which is not improved.

Feature 182: Method (1800) for operating a supply network (1700),
wherein the supply network (1700) has line sections (245) and
wherein the supply network (1700) comprises energy-consuming device parts (210, 211) of the supply network (1700) and
wherein the supply network (1700) comprises energy-supplying device parts (250) of the vehicle which are set up to feed energy into the supply network (1700), and
wherein the supply network (1700) is set up to supply energy-consuming device parts (210, 211) of the supply network (1700) of the vehicle with electrical energy from the supply network (1700) via at least one line section (245), and
wherein energy-consuming device parts (210) are set up to be able to supply electrical energy to a further device part (220) of the vehicle via a further line section (240), and
wherein the energy-consuming device parts (210) have an electronic fuse (214) and
wherein the electronic fuse (255) of a device part (250) is set up to be able to prevent and/or enable the supply of this energy-consuming device part (210) and the other device parts (220, 221) supplied with electrical energy by this device part (210). ,
with the steps
Monitoring the total energy demand of device parts (210, 211, 220, 221, 222, 223) of the device parts of the vehicle
by detecting (1805) the total energy requirement of these device parts (210, 211, 220, 221, 222, 223) and
by comparing (1810) the determined total energy requirement of these device parts (210, 211, 220, 221, 222, 223) of the vehicle with a lower energy consumption threshold value;
Reduction (1840) of the energy production of an energy source (250) for supplying a first energy-consuming device part (210) with electrical energy and/or the other device parts (220: 221) supplied with electrical energy by this first device part (210),
if the determined total energy requirement of all device parts (210, 211, 220, 221, 222, 223) is or could be below the lower energy consumption threshold value or the operating state and/or the driving situation indicates this, and
this lowering (1840) by means of the electronic fuse (255) of this device part (250), in particular by opening the circuit breaker (17) of this fuse (255) of this device part (250), and/or by changing the operating parameters of this device part (250) he follows.

Feature 183: procedure according to feature 182,
wherein the power supply of the device parts of the vehicle whose power supply is deteriorated has a lower priority than the power supply of the device parts of the vehicle whose power supply is not deteriorated.

Characteristics of the distributed measurement method

Feature 184: ( 19 , 20 ) Distributed measurement method (2000) for detecting the condition of a wiring harness (1515) of a vehicle with the steps
Possibly synchronization (2005) of a first timer (1950) of a first electronic fuse (825) with a time standard, in particular a timer (1970) of a higher-level computer system (12);
Possibly synchronization (2010) of a second timer (1955) of a second electronic fuse (805) with the time standard, in particular the timer (1970) of a higher-level computer system (12);
initiating (2015) the following two acquisition processes at the same time values of the first timer (1950) of the first electronic fuse (825) and the second timer (1955) of the second electronic fuse (805);
Detection (2025) of the second current value of the current flow (1910) into a second, subsequent line section (1905) of the cable harness (1515) to be secured, in particular by the second electronic fuse (805) and/or a second current measuring device (1935) of the second electronic fuse (805);
Determination (2030) of a first time stamp value, in particular by the first electronic fuse (825) and/or a first control device (4) of the first electronic fuse (825) and in particular with the aid of the first timer (1950) of the first electronic fuse (825) , for each first current reading or for a group of first current readings of the current flow (1525);
Determination (2030) of a first time stamp value, in particular by the first electronic fuse (825) and/or a first control device (4) of the first electronic fuse (825) and in particular with the aid of the first timer (1950) of the first electronic fuse (825) , for each first current reading or for a group of first current readings of the current flow (1525);
Determination (2035) of a second time stamp value, in particular by the second electronic security device (805) and/or a second control device (4) of the second electronic security device (805) and in particular with the aid of the second timer (1955) of the second electronic security device (805) , for each second current reading or for a group of second current readings of the current flow (1910);
Transmission (2040) of at least one second measured current value together with the second time stamp value from the second fuse (805) to a higher-level computer system (12) or to the control device (4) of the first electronic fuse (825) and in the case of the transmission of the second measured value a host computer system (12) transmitting (2025) the first current measurement value along with the first time stamp value from the first fuse (825) to the host computer system (12);
Comparison (2045) of the first measured current value with the second measured current value and
Conclusion (2050) of an energy loss in line sections (1525) between two electronic fuses (825, 805), in particular if the difference between the first measured current value and the second measured current value is outside a permitted difference value interval and/or if a quotient from the first Stromeswert and the second current measurement value is outside an allowed quotient interval.

Feature 185: Method according to feature 184 with the step
Taking (2055) countermeasures, in particular by the higher-level computer system (12) or by the computer core (2) of the evaluating control device (4) of the evaluating electronic fuse (825), if the measured current values or the ratio of the measured current values to one another or a difference of such measured current values or quantities derived from them do not correspond to one or more expected values and/or are not within an expected value interval.

• - einen Sicherungsdatenbus (9) oder
• - einen Fuse-Datenbus (9) oder
• - einen Lin-Datenbus (9) oder
• - einen DSI3- Datenbus (9) oder
• - einen PSI5-Datenbus (9) oder
• - einen CAN-Datenbus (9) oder
• - einen CAN-FD-Datenbus (9) oder
• - einen Ethernet-Datenbus oder
• - einen Flexray-Datenbus (9) oder
• - einen LVDS-Datenbus (9) oder
• - einen Ethernet-Datenbus (9) oder
• - eine sonst wie drahtgebundene oder drahtlose Datenübertragungsstrecke, beispielsweise über eine Bluetooth- oder eine WLAN-Datenverbindung oder eine optische Datenverbindung (540),
• - oder eine sonstige drahtgebundene oder drahtlose Schnittstelle (610, 10, 551, 550) abläuft.

Feature 186: procedure according to feature 184 or feature 185,
where the data communication via
where the data communication via

• - a backup data bus (9) or
• - a fuse data bus (9) or
• - a Lin data bus (9) or
• - a DSI3 data bus (9) or
• - a PSI5 data bus (9) or
• - a CAN data bus (9) or
• - a CAN FD data bus (9) or
• - an Ethernet data bus or
• - a Flexray data bus (9) or
• - an LVDS data bus (9) or
• - an Ethernet data bus (9) or
• - an otherwise wired or wireless data transmission path, for example via a Bluetooth or WLAN data connection or an optical data connection (540),
• - or any other wired or wireless interface (610, 10, 551, 550) runs.

Feature 187: Method according to one of features 184 to 186,
with the steps
Detection of changes in the measured current values of the currents (1525, 1910, 1920, 1930) and/or changes in the spectra of the voltage curve over time of the voltages between line sections to be secured (1505, 1905, 1915, 1920) of the cable harness (1515) on the one hand and a reference potential on the other one and/or changes in the spectra of the current profile of the current measured values of the currents (1525, 1910, 1920, 1930) or of the energy transport via the line sections (1505, 1905, 1915, 1920) of the cable harness (1515) to be assured;
Evaluating these changes by comparing them with expected trends and/or expected values.

Feature 188: procedure according to feature 187,
with the steps
Establishing (2060) a data connection (1990) to a server (1985) of a workshop and/or an automobile manufacturer and/or a service provider;
Transmission (2065) of vehicle data and/or operating data and/or measured values and/or damage data if the comparison of the recorded changes with the expected curves and/or expected values revealed a deviation beyond a specified level.

Feature 189: procedure according to feature 188,
with the step
Transmission (2065) of the vehicle data and/or operating data and/or measured values and/or damage data to a server (1985) or a terminal of the workshop or another user of this data.

Feature 190: procedure according to feature 188 or feature 189,
with the steps
Prediction (2070) of the failure probability of a device part of the vehicle using the vehicle data and/or operating data and/or measured values and/or damage data;
Transmission (2075) of the prognosis result to a server (1985) and/or a workshop terminal and/or a terminal (740) and/or a vehicle owner's computer (730) and/or a terminal (740) and/or a computer a vehicle driver (730) or a terminal and/or server (710) of an automobile manufacturer and/or a terminal and/or server of a logistics company and/or a terminal and/or server of another user of this data.

feature 191 procedure according to feature 190,
Providing (2080) a spare part for the device part of the vehicle in the case of a prognosis result that indicates a failure of the device part:

Feature 192: Method according to one of features 184 to 191,
Close (2085) the temperature of a line section (1915, 1925, 1505, 1905) and/or an excess temperature of a line section (1915, 1925, 1505, 1905) using the detected current values of the current flow (1920, 1925, 1525, 1910) in several line sections (1915, 1925, 1505, 1905) of the cable harness (1515) to be secured.

Device Features Battery

Feature 193: battery (2100) with diagnostic function for a vehicle, ( 21 ),
wherein the battery (2100) comprises one or more battery cell modules (2105, 2155) and
wherein the battery (2100) comprises one or more electronic shears (825, 805) and
wherein at least one terminal (2197) of the battery (2100) is connected to the first terminal (26) of the circuit breaker (17) of an electronic fuse (825) and
wherein the battery (2100) comprises a supply tree and/or a supply network with one or more supply branches (2198, 2196, 2120, 2135, 2140, 2190, 2160, 2175, 2180, 2196) and
wherein several electronic fuses (825, 805) are connected in series in a supply branch 2198, 2196, 2120, 2135, 2140, 2190, 2160,2175, 2180, 2196) of the supply tree or supply network
wherein a supply tree or a supply network can also comprise only one supply branch with a plurality of electronic fuses which are inserted in the supply branch, and
wherein one or more battery cell modules (2105, 2155) of the battery (2100) are electrically connected in series and
wherein one or more electronic fuses (805) are connected between battery cell modules (2105, 2155) of the battery (2100).

Feature 194: battery (2100) according to feature 193,
exactly one electronic fuse (805) being connected between two battery cell modules (2105, 2155) which are connected to one another in series.

Feature 195: battery (2100) according to feature 194,
wherein each battery cell module (2105, 2155) has an electronic fuse (825, 805) and
an electronic fuse (825, 805) being assigned to each battery cell module (2105, 2155) or to one or more groups, in particular battery cell modules (2105, 2155) connected in series.

Feature 196: battery (2100) according to one or more of features 193 to 195,
wherein one or more or all of these electronic fuses (825, 805) have a first power switch (17) which is set up to interrupt the flow of current (2121, 2161) through one or more battery cell modules (2105, 2155) and/or the group in question to prevent battery cell modules, i.e. the electrical connection (2140, 2190, 2160, 2175) between a first battery cell module (2105) and a second battery cell module (2155) or a first group of battery cell modules and a second group of battery cell modules, which are connected in series with one another are to be separated when the first circuit breaker (17) is open and/or
wherein one or more or all of these electronic fuses (825, 805) have a first power switch (17) which is set up to interrupt the flow of current (2121, 2161) through one or more battery cell modules (2105, 2155) and/or the group in question of battery cell modules, i.e. the electrical connection (2140, 2190, 2160, 2175) between a first battery cell module (2105) and a second battery cell module (2155) or a first group of battery cell modules and a second group of battery cell modules, which are connected in series are to be established when the first circuit breaker (17) is closed.

Feature 197: battery (2200) according to feature 196 ( 22 ),
wherein one or more or all of these electronic fuses (825) of the battery (2200) have a second circuit breaker (17') which is set up to switch off the battery cell module (2105) and/or the group of battery cell modules when the second circuit breaker (17 ') to bridge.

Feature 198: battery (2200) according to feature 197,
wherein a control device (4) of the electronic fuse (825) is set up to detect the switching state of the first circuit breaker (17) before the closing of the second circuit breaker (17'), and
wherein a control device (4) of the electronic fuse (825) is set up to detect whether the first circuit breaker (17) is open, and
wherein a control device (4) of the electronic fuse (825) is set up to close the second circuit breaker (17) only when the first circuit breaker (17) is open.

Feature 199: battery (2200) according to feature 198,
wherein the control devices (4) are set up to cause a test current (515) to be fed into the first circuit breaker (17) upstream (26) of the first circuit breaker (17) and to cause this test current (915) to be drawn downstream (28) from the first Circuit breaker (17) to cause and
the control device (4) being set up to assess whether these injections and withdrawals have been successful.

Device features battery cell module

Feature 200: battery cell module (2300),
wherein the battery cell module (2300) comprises at least one battery cell (2145) and/or an interconnection of battery cells and
wherein the battery cell module (2300) comprises a first circuit breaker (17) and
wherein the battery cell module (2300) comprises a second circuit breaker (17') and
wherein the battery cell module (2300) comprises a first electrical node (2120) and
wherein the battery cell module (2300) comprises a second electrical node (2135) and
wherein the battery cell module (2300) comprises a third electrical node (2140) and
wherein the battery cell (2300) comprises a first battery cell connection (2305) and
wherein the battery cell (2300) comprises a second battery cell terminal (2310) and
wherein the first battery cell terminal (2305) is connected to the second node (2135) and
wherein the second battery cell terminal (2310) is connected to the third node (2140) and
wherein the first power switch (17) comprises a first connection (26) and a second connection (28) and a control connection (27) and
wherein the second power switch (17') comprises a first connection (26') and a second connection (28') and a control connection (27') and
wherein the battery cell (2105) and/or the interconnection of battery cells comprises a first connection (2125) and a second connection (2130) and
wherein the first power switch (17) is connected to the first node (2120) with its first connection (26) of the first power switch (17) and
wherein the first power switch (17) is connected to the second node (2135) with its second terminal (28) of the first power switch (17) and
wherein the second power switch (17') is connected to the first node (2120) with its first connection (26') of the second power switch (17') and
wherein the second power switch (17') is connected to the third node (2140) with its second connection (28') of the second power switch (17') and
wherein a first terminal (2305) of the battery cell (2145) or the group of battery cells is connected to the second node (2135) and
wherein a second connection (2310) of the battery cell (2145) or the group of battery cells is connected to the third node (2140),
characterized by
that the battery cell module (2105) comprises a control device (4) or is connected to such a control device (4) and
that the control device (4) is set up to control the control connection (27) of the first circuit breaker (17), and
that the control device (4) is set up to control the control connection (27') of the second circuit breaker (17'), and
that the control device (4) is set up to interlock the control connection (27) of the first circuit breaker (17) with respect to the control connection (27') of the second circuit breaker (17') in such a way that it is impossible for the first circuit breaker (17 ) is conductive when the second power switch (17') is conductive.

Feature 201: battery cell module (2300) according to feature 200 ( 23 , 24 ),
the control device (4) comprising means (16, 525, 520, 920, 530, 21, 22, 28, 26, 27, 915, 515, 510, 910, 905 and 16', 525', 520', 920', 530', 21', 22', 28', 26', 27', 915', 515', 510', 910', 905') for detecting the switching state of the circuit breakers (17, 17') and
wherein the control device (4) is set up to, by means of these means (16, 525, 520, 920, 530, 21, 22, 28, 26, 27, 915, 515, 510, 910, 905 and 16', 525', 520', 920', 530', 21', 22', 28', 26', 27', 915', 515', 510', 910', 905') the switching state of at least one of the circuit breakers (17, 17' ), in particular as "on" or "off".

• - zuerst den ersten Leistungsschalter (17) zu öffnen und somit einen Stromfluss (2121) durch die Batteriezelle (2145) zu unterbinden und
• - dann insbesondere mittels der Mittel (16, 525, 520, 920, 530, 21, 22, 28, 26, 27, 915, 515, 510, 910, 905) zum Erfassen des Schaltzustands des ersten Leistungsschalters (17) zu überprüfen, ob der erste Leistungsschalter (17) geöffnet ist, und
• - dann, wenn der zweite Leistungsschalter geöffnet ist, den zweiten Leistungsschalter (17') zuschließen und
• - dann der Mittel (16', 525', 520', 920', 530', 21', 22', 28', 26', 27', 915', 515', 510', 910', 905') zum Erfassen des Schaltzustands des zweiten Leistungsschalters (17') zu überprüfen, ob der zweite Leistungsschalter (17') geschlossen ist.

Feature 202: battery cell module (2300) according to feature 201,
wherein the control device (4) is set up to bypass the battery cell module (2105),

• - First to open the first circuit breaker (17) and thus to prevent a current flow (2121) through the battery cell (2145) and
• - then to check, in particular by means of the means (16, 525, 520, 920, 530, 21, 22, 28, 26, 27, 915, 515, 510, 910, 905) for detecting the switching state of the first circuit breaker (17), whether the first circuit breaker (17) is open, and
• - when the second circuit breaker is open, close the second circuit breaker (17') and
• - then the means (16', 525', 520', 920', 530', 21', 22', 28', 26', 27', 915', 515', 510', 910', 905') for detecting the switching state of the second circuit breaker (17') to check whether the second circuit breaker (17') is closed.

Feature 203: Battery Cell Module (2200),
wherein the battery cell module (2200) itself again comprises at least one first battery cell module (2105) according to one of features 200 to 202 and
wherein the battery cell module (2200) itself again comprises at least one second battery cell module (2155) according to one of features 200 to 202 and
wherein the second terminal (2130) of the first battery cell module (2105) is connected to the first terminal (2165) of the second battery cell module (2155).

Device features battery cell module

Feature 204: battery cell module (2600) according to one of features 200 to 203,
wherein the circuit breaker (17) and the control device (4) of the fuse (825) and the fuse (825) are housed with the actual battery cell module (2105) in a housing (2605).

Feature 205: battery cell module (2600) according to one of features 200 to 204,
wherein the control device (4) of the fuse (825) has an optical data interface (550, 551).

Feature 206: battery cell module (2300) according to feature 404 and feature 205
wherein the housing (2605) has an optical window (545) which prevents access of electromagnetic radiation (540) for the optical transport of data from the optical data interface (550, 551) of the control device (4) and to the optical data interface (550, 551) allowed towards the control device (4) and
can communicate via the optical interface (550, 551) of the control device (4) inside the housing (2605) with an optical interface (555) of another device, for example a higher-level computer system (12) outside the housing (2665).

Feature 207: battery cell module (2600) according to one of features 200 to 206,
wherein the housing (2605) has an optical window (545) and/or an optical connector (2640) which prevent the exit of electromagnetic radiation (540) for the transport of data from the optical data interface (550, 551) of the control device (4) to a device (555, 12) outside the housing (2605) and/or from a device (555, 12) outside the housing (2605) to the optical data interface (550, 551) of the control device (4), and
so that in particular the optical interface (510) of the control device (4) inside the housing (2605) connects the control device (4) to an optical interface (555) of another device (12), in particular a higher-level computer system (12), outside the housing ( 2605) can communicate.

Feature 208: battery cell module (2600) according to feature 206 and/or 207
wherein the electromagnetic radiation (540) is laser radiation or radiation from an LED.

Battery cell module with electronic fuse

Feature 209: Battery cell module (2700) ( 27 )
wherein the battery cell module or a group of battery cell modules comprising the battery cell module are set up to have a control device (4) of an electronic fuse (825) and the to supply other parts of this electronic fuse (825) with electrical energy for the operation of the electronic fuse.

Feature 210: battery cell module (2700) according to feature 209,
wherein the tap point for supplying the control device (4) of the electronic fuse (825) with electrical energy between the circuit breaker (17) of the electronic fuse (825) and the first connection (2135) of the first battery cell (2145), the first battery cell module ( 2105) or the group of battery cells, so that the control device (4) is supplied with electrical energy from the battery cell (1245) when the circuit breaker (17) of the electronic fuse (17) is open.

Feature 211: battery cell module (2800) according to feature 209 or feature 210,
wherein the circuit breaker (17) of the electronic fuse (825) between the tapping point for supplying the control device (4) of the electronic fuse (825) with electrical energy and the first connection (2135) of the first battery cell (2145), the first battery cell module ( 2105) or the group of battery cells, so that the control device (4) is no longer supplied with electrical energy from the battery cell (1245) when the circuit breaker (17) of the electronic fuse (17) is open.

Feature 212: battery cell module (2200, 2300, 2600, 2700, 2800), in particular according to one or more of features 200 to 211,
wherein the battery cell module (2700) comprises an electronic fuse (825) and
wherein the electronic fuse (2700) is set up to record voltage values and/or current values, and
wherein the electronic fuse (825) is set up to perform a security function, and
wherein the electronic fuse (825) is set up to interrupt the current flow (2121) when a disconnection condition is met.

Feature 213: battery cell module (2200, 2300, 2600, 2700, 2800) according to feature 154,
wherein the electronic fuse (825) is set up to interrupt the current flow (2121) and to bridge the battery cell (1245) or the group of battery cells when a separation condition is met and when a bridging condition is met at the same time.

Feature 214: battery cell module (2200, 2300, 2600, 2700, 2800), in particular according to one or more of features 200 to 213,
wherein one or more electronic fuses (825, 805) each comprise two data interfaces (10, 610, 550, 551), which can be optical.

battery

Feature 215: Battery (2200) ( 22 ),
wherein the battery (2200) comprises one or more battery cells (2145, 2185) and
wherein the battery (2200) comprises an electronic fuse (825, 805) per battery cell (2145, 2185) or per group of battery cells.

Feature 216: battery (2200) according to feature 215,
wherein one or more electronic fuses (825, 805) of the battery (2200) are set up to transmit one or more measured values and/or values derived therefrom and/or state values and/or state information of the electronic fuses (825, 805) to a higher-level control unit (12), for example a higher-level computer system (12), in particular via a backup data bus (9).

Feature 217: battery (2200) according to feature 158,
wherein one or more control devices (4) of one or more electronic fuses (825, 805) comprise one or more temperature sensor evaluation devices (585).

Feature 218: battery (2200) according to feature 216 or 217,
one or more control devices (4) of one or more electronic fuses (825, 805) comprising one or more temperature sensors (586).

Feature 219: battery (2200) according to one or more of features 215 to 218
wherein the battery (2200) has a backup data bus (9) within the battery (2200) and
wherein control devices (4) of electronic fuses (825, 805) are connected to this fuse data bus via their respective data interfaces (10, 551, 550, 610) or are connected to the fuse data bus (9 ) are inserted. (please refer 7 )

Feature 220: Battery (2200) according to feature 219
wherein electronic fuses have data interfaces (10, 551, 550, 610) two optical data interfaces (551, 550) and
wherein at least part of the security data bus (9) comprises an optical data bus (540), in particular in the form of an optical data link (540).

Feature 221: battery (2200) according to feature 220,
wherein the optical data bus (540) comprises one or more optical fibers (580) which are preferably electrically insulating.

Feature 222: battery (2200) according to feature 220 or feature 221,
wherein the optical data bus (540) comprises an optical data bus ring (9').

ideal diode

Feature 223: Ideal diode (1)
with a first diode connection (18) and a second diode connection (19) and
with a circuit breaker (17) and
with a control device (4) and
wherein the circuit breaker (17) comprises a first connection (26) and a second connection (28) and a control connection (27) and
wherein the first terminal (26) of the power switch (17) is the first diode terminal (18) and
wherein the second terminal (28) of the power switch (17) is the second diode terminal (19) and
Firstly, the control device (4) of the ideal diode (1) is set up to measure current values of the electrical current (29) through the circuit breaker (17) in the direction from an energy source (250) to a consumer (220 to 223) but also in to detect the reverse current direction of the electric current (29), and
wherein the control device (4) is set up to measure the voltage values of the voltage drop across the circuit breaker (17), in particular between the first connection (26) and the second connection (28) and/or between the first connection (26) and the control connection ( 27) and/or between the control connection (27) and the second connection (28), and/or
wherein, secondly, the control device (4) is set up to detect the sign of the electric current (29) through the circuit breaker (17), and
wherein the control device (4) is set up to switch off this power switch (17) when the electric current (29) through the circuit breaker (17) reverses and/or when the direction of the energy flow through the circuit breaker (17) reverses.

Feature 224: Ideal diode (1) according to feature 223,
wherein the construction and/or the operation of the ideal diode provide for a preferential flow direction of the electric current (29) and
wherein the ideal diode (1) comprises means for recording and detecting a current (29) flowing backwards in comparison to the preferred direction of flow, counter to the preferred direction of flow.

Feature 225: Ideal diode (1) according to feature 223 or 224,
wherein the control device (4) comprises a computer core (2) and,
wherein the computer core (2) of the control device (4) of the ideal diode is set up to evaluate the measured values recorded in this way, in particular measured current values and/or measured voltage values and/or measured power values and/or sign of the measured current value of the electrical current (29), and
wherein the computer core is set up to transmit the measured values, in particular measured current values and/or measured voltage values and/or measured power values and/or sign of the measured current value of the electrical current (29), and/or or measured values derived therefrom to other computer cores of other ideal diodes and/or to other computer cores of other electronic fuses via a fuse data bus (9) and/or the like and/or to a higher-level control unit (12), for example a higher-level computer system (12).

Supply network with backup bus

Feature 226: supply network (200) ( 7 ) for the supply of electrical consumers (210 to 213 and 220 to 223 and 230 to 233) with electrical energy
with one or more energy sources (250, 251) and
with several consumers (210 to 213 and 220 to 223 and 230 to 233) and
with several electronic fuses (214-217, 225-228, 235-238, 250, 251) and
wherein the loads (210 to 213 and 220 to 223 and 230 to 233) are connected to the one or more energy sources (250, 251) by means of supply lines (245, 240, 241, 242, 243) and
wherein the loads (210 to 213 and 220 to 223 and 230 to 233) and the one or more energy sources (250, 251) are connected to one another together with the supply lines (245, 240 to 243) in a tree structure or in a network and
wherein the tree structure or the network comprises subtrees or subnetworks (eg 240, 220, 221) and
wherein fuses (214 to 217, 225 to 228, 235 to 238, 250, 251) are inserted in supply lines so that these sub-trees of the tree structure can be separated from the rest of the tree structure or can be connected to this rest of the tree structure, or wherein fuses (214 to 217 , 225 to 228, 235 to 238, 250, 251) are inserted into supply lines so that these sub-networks of the network can be separated from the rest of the network or can be connected to this rest of the network,
characterized,
that one or more electronic fuses (214 to 217, 225 to 228, 235 to 238, 250, 251) each have at least one data interface (280 to 293) for each electronic fuse (214 to 217, 225 to 228, 235 to 238, 250, 251) which can be optical.

Feature 227: supply network (200) according to feature 226,
where the interconnection of the data buses is star-shaped ( 3 ) or linear in a chain or closed ring ( 7 ) is done and
wherein the data buses may have branches.

Feature 228: supply network (200) according to one or more of features 226 to 227,
one or more electronic fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) each having two data interfaces (214 to 217, 225 to 228, 235 to 238, 250, 251, 610, 10) each electronic fuse (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) which may be optical. (Please refer 7 and 6 )

Feature 229: supply network (200) according to one or more of features 226 to 228,
whereby two or more electronic fuses (214 to 217, 225 to 228, 235 to 238, 250, 251) are connected in terms of data technology by an optical data bus (540), in which these electronic fuses (214 to 217, 225 to 228, 235 to 238, 250, 251) are inserted respectively.

Feature 230: supply network (200) according to one or more of features 226 to 229,
two or more electronic fuses (214 to 217, 225 to 228, 235 to 238, 250, 251) being technically connected by an electronic single-wire data bus (9) and/or an electronic two-wire data bus (9) and/or another data bus (9). are.

Feature 231: supply network (200) according to feature 230,
the electronic fuses (214 to 217, 225 to 228, 235 to 238, 250, 251) being inserted in the data bus (9):

Feature 232: supply network (2900) according to one or more of features 168 to 173,
one or more supply branches of the supply network (2900) for supplying electrical consumers (2930 to 2933) with electrical energy as a ring of a supply line (2910 to 2915), in particular when a body is used as a return ground line, and/or as two rings of two supply lines are executed and/or
one or more supply branches of the supply network for supplying electrical energy from electrical energy sources (2940, 2941) as a ring of a supply line (2910 to 2915), in particular when a body is used as a return ground line, and/or as two rings of two supply lines.

Feature 233: supply network (2900) according to feature 232,
for consumers of consumers (2930 to 2933) two fuses (2960 to 2967) in the ver supply line (2910 to 2915) at the respective energy extraction point (2920 to 2923) for this consumer of the consumer (2930 to 2933) are inserted into the supply line (2910 to 2915) and/or
two fuses (2950 to 2953) being inserted into the supply line (2910 to 2915) at the energy feed point (2924 to 2925) of the electrical energy for these energy sources (2940, 2941) into the supply line (2910 to 2915) for energy sources (2940, 2941). are.

Feature 234: supply network (2900) according to feature 233,
precisely those two electronic fuses of the fuses (2950 to 2953 and 2960 to 2967) which are assigned to a faulty line section of the line sections (2910 to 2915) are set up to open their circuit breakers (17) in the event of a fault in the line section, so that precisely these two electronic fuses of the fuses (2950 to 2953 and 2960 to 2967) thereby isolate this faulty line section of the line sections (2910 to 2915).

Feature 235: supply network (2900) according to feature 233 or feature 234,
wherein the two electronic fuses of the fuses (2960 to 2967) assigned to this faulty load are set up to open their circuit breakers (17) in the event of a fault in one of the loads (2930 to 2933), so that these two electronic fuses thereby protect the faulty load isolate, and/or
wherein the two electronic fuses of the fuses (2950 to 2953) assigned to this faulty energy source are set up to open their circuit breakers in the event of a fault in one of the energy sources (2940, 2941), so that these two electronic fuses thereby isolate the faulty energy source,
This is the case in particular if the above errors affect the energy supply of other consumers of the consumers (2930 to 2933) and/or high-priority consumers of the consumers (2930 to 2933) the energy output of other energy sources of the energy sources (2940, 2941) and/or Highly prioritized energy sources of the energy sources (2940, 2941) affect and / or could affect.

Feature 236: supply network (2900) according to one of features 226 to 235,
wherein the control device (4) of an electronic fuse of the fuses (2950 to 2953 and 2960 to 2967) is set up to transmit data such as configuration data (write/read/ programming), switching commands (write/read/programming), diagnostic data (write/read), measured values (read), comparison value settings (write/read/programming), program code (write/read/programming) to receive and/or send.

Feature 237: supply network (2900) according to one of features 226 to 236,
the data bus (9) being partly or entirely a two-wire data bus.

Feature 238: supply network (2900) according to feature 237,
wherein the data bus (9) is a differential data bus.

Feature 239: supply network (2900) according to feature 238,
wherein the data bus (9) is a differential bidirectional data bus (9).

Feature 240: supply network (2900) according to one of features 236 to 239,
wherein the data bus (9) is a CAN data bus or a data bus (9) with a physical interface of a CAN data bus, a CAN FD data bus or a Flexray data bus or an LVDS data bus or the like.

Feature 241: supply network (2900) according to one of features 226 to 240,
wherein electronic fuses (2950 to 2953 and 2960 to 2967) of the supply network (2900) comprise two data interfaces (10, 610, 550, 551) for the data bus (9) and
these being inserted into the data bus (9) and
these forming a linear chain of fuses (2950 to 2953 and 2960 to 2967) along at least part of the data bus (9).

Feature 242: supply network (2900) according to feature 241,
a higher-level computer system (12), connected in particular at the beginning of this part of the data bus (9), being set up to, by means of auto-addressing in cooperation with the control devices (4) of the electronic fuses, for each of the control devices (4) of the electronic fuses ( 2950 to 2953 and 2960 to 2967) a security address for controlling the computer cores (2) of the control devices (4) and, if necessary, to the computer cores (2) of the control devices (4) of the electronic fuses (2950 to 2953 and 2960 to 2967) to transmit.

Feature 243: supply network (2900), in particular according to one of features 236 to 242,
wherein the supply network (2900) comprises a supply line (2910 to 2915) and
wherein the supply network (2900) is annular in parts and
consumers (2920 to 2923) being connected to different energy extraction points (2920 to 2923) of the ring-shaped supply network (2900) so that they can draw electrical energy there from the supply line (2910 to 2915) of the supply network (2900), and/or
wherein energy sources (2940 to 2941) are connected to different feed points (2924 to 2925) of the ring-shaped supply network (2900) so that they can feed electrical energy there into the supply line (2910 to 2915) of the supply network (2900), and
wherein in the supply line (2910 to 2915) of the ring-shaped supply network (2900) to the left or right of the respective removal points of electrical energy or left or right of the respective feed-in points of electrical energy, respective electronic fuses of the fuses (2950 to 2953 and 2960 to 2967), in particular exactly one respective electronic fuse of the fuses (2950 to 2953 and 2960 to 2967), are inserted and
the respective electronic fuse of the fuses (2950 to 2953 and 2960 to 2967) with its respective power switch (17) in the supply line (2910 to 2915) of the supply line section
is inserted between two respective extraction points of the extraction points (2920 to 2923) for electrical consumer energy of the associated consumers of consumers (2930 to 2933) or
is inserted between two respective feed points of the feed points (2924 to 2924) for electrical energy of the associated energy sources of the energy sources (2940 to 2941) or
is inserted between a respective feed point of the feed points (2924 to 2924) for electrical energy of the associated energy source of the energy sources (2940 to 2941) and a respective extraction point of the extraction points (2920 to 2923) for electrical consumer energy of the associated consumer of the consumers (2930 to 2933). .

Feature 244: supply network (2900) according to feature 243,
the supply line of the annular supply network (2900) to the left and right of the respective tapping points (2920 to 2923) of electrical energy on each side of each tapping point of the tapping points (2920 to 2923) is interrupted by a respective electronic fuse of the fuses (2960 to 2967) and /or
wherein the supply line of the annular supply network (2900) to the left and right of the respective feed points (2924 to 2925) of electrical energy is interrupted on each side of each feed point of the feed points (2924 to 2925) by a respective electronic fuse of the fuses (2950 to 2953).

Feature 245: supply network (2900) according to feature 244,
wherein the two electronic fuses that are closest to a feed point of the feed points (2924 to 2925) or an extraction point of the extraction points (2920 to 2923) or a supply line section of the supply sections (2910 to 2915) are set up to protect this feed point or this extraction point or isolate this supply line section by opening its circuit breakers (17) if a fault occurs in one of the loads (2930 to 2933) at this tapping point in this supply line section from the supply sections (2910 to 2915) and/or if there is a fault in one of the energy sources (2940 to 2941) occurs at this feed point in this supply line section of the supply sections (2910 to 2915).

Feature 246: supply network (2900) according to feature 245,
wherein a higher-level computer system (12) is set up to report the status of the electronic fuses (2960 to 2967 and 2950 to 2953) by addressing the computer cores (2) of the control devices (4) of the electronic fuses (2960 to 2967 and 2950 to 2953). to determine the data bus (9), and
wherein the higher-level computer system (12) is set up to determine the position of the fault or the fault in the supply network (2900) if there is a fault or a fault, and
wherein the higher-level computer system (9) is set up to limit the disruption or the error at the determined position by means of an intervention in the supply network (2900), in which the higher-level computer system (12) controls the two electronic fuses of the fuses (2960 to 2967 and 2950 to 2953) of the supply network (2900) closest to the position of the fault to open their circuit breakers (17).

Feature 247: supply network (2900) according to feature 246,
wherein the intervention by the higher-level computer system (12) is faster than twice the longest time constant of the energy withdrawals of the consumers (2920 to 2923) that draw energy from the supply network (2900) at the time of the intervention, and/or
wherein the intervention by the higher-level computer system (12) is faster than twice the longest time constant of the energy feeds of the energy sources (2940 to 2941) that feed energy into the supply network (2900).

Feature 248: supply network (2900) according to feature 246 or feature 247,
whereby an electronic backup of the backups (2950 to 2953 and 2960 to 2967) is set up to record the malfunctions and/or errors in the form of a log table (2970), which can also only contain a few bits, or a log file (2970 ) to record, and/or
a higher-level computer system (12) being set up to record the disruptions and/or errors in the supply network (2900) and/or the disruptions and/or errors in the fuses (2950 to 2953 and 2960 to 2967) in the form of a log table (2970), which can also contain only a few bits, or to record it in a log file (2970).

Feature 249: supply network (2900) according to feature 248,
wherein the control device (4) of the electronic security is set up to provide the entries in the log table (2970) or the log file (2970) with a time stamp of a timer unit (35) of the control device (4) of the electronic security, and or)
the higher-level computer system (12) being set up to provide the entries in the log table (2970) or the log file (2970) with a time stamp from a timer unit (1970) of the higher-level computer system (12).

Feature 250: supply network (2900) according to feature 249
wherein the control device (4) of the electronic safety device is set up to record in the log table (2970) or the log file (2970) also with a time stamp from when the fault no longer existed, and/or
the higher-level computer system (12) being set up to also record with a time stamp in the log table (2970) or the log file (2970) when the fault no longer existed.

Feature 251: supply network (2900), in particular according to one of features 248 to 250,
wherein a higher-level computer system (12) is set up to regularly or in the event of a malfunction or an error the log table (2970) or the log file (2970) of a backup of the backups (2950 to 2953 and 2960 to 2963) via the Read data bus (9) from this electronic fuse.

Feature 252: supply network (2900) according to feature 251,
wherein the higher-level computer system (12) is set up to use one or more of its log tables (2970) or one or more of its log files (2970) and/or using one or more log tables (2970) or .One or more log files (2970) of one or more electronic fuses of the fuses (2950 to 2953 and 2960 to 2967) to identify potentially affected sensors and measuring systems that are supplied with electrical energy by the supply network (2900) and the in to mark the relevant period of time measured values acquired as potentially erroneous or to discard them.

Feature 253: supply network (3100) according to one of features 246 to 252
wherein a supply line (2910 to 2015 and 2920 to 2923) of the supply network (3100) has a plug connection of the plug connections (3020 to 2023), a plug or a socket, for connecting and supplying a load of the loads (2930 to 2033) and /or
wherein a supply line (2910 to 2015 and 2924 to 2925) of the supply network (3100) has a plug connection of the plug connections (3024 to 2025), a plug or a socket, for the connection and the power supply of an energy source of the energy sources (2940 to 2041) and
wherein an electronic fuse of the fuses (3110 to 3113) in the vicinity of the plug connection of the plug connections (3020 to 3023) for drawing energy from the electrical consumer of the electrical consumers (2930 to 2933) from the relevant supply line (2910 to 2915 and 2920 to 2925) is inserted and/or
wherein an electronic fuse of the fuses (3110 to 3113) is inserted in the vicinity of the plug connection of the plug connections (3020 to 3023) for feeding energy through the energy source of the energy sources (2940 to 2941) into the relevant supply line (2910 to 2915 and 2920 to 2925). and
wherein this electronic fuse is set up to thereby detect a hot-plug event relating to this plug connection of the plug connections (3020 to 3023),
that the electronic fuse monitors the transient time course of the voltage of the potential of a node of the circuit breaker (17) of this fuse against the potential of a reference node, in particular compared to a ground potential, and/or
that this electronic fuse monitors the transient course of the current through the circuit breaker (17) of this electronic fuse and
that the control device (4) monitors this electronic fuse one or more of these transient profiles.

Feature 254: supply network (3100) according to feature 253,
this electronic fuse being arranged to switch off the circuit breaker (17) in the event of a hot-plug event.

Feature 255: supply network (3100) according to one of features 253 to 254,
this electronic fuse being set up to report a hot-plug event via the data bus (9) to a higher-level computer system (12).

Feature 256: supply network (3100), especially after feature 255,
wherein an electronic fuse is set up to make this normal operation visually recognizable to a person during normal operation, in particular by means of a light source and/or an LED and/or an indicator and/or a display of a data output means (740) of the fuse or of the higher-level computer system (12 ) and/or as data information via the data bus (9), at least temporarily and/or upon request, in particular upon request of the higher-level computer system (12) or an operator (730) by means of the data input and data output means (740) and/ or
an electronic fuse being set up so that, in the event of a fault and/or a fault and/or a hot-plug event, this fault or this fault or this hot-plug event is visually recognizable to a person, in particular by means of a light source and/or an LED and/or an indicator and/or a display of data output means (740) of the fuse or of the higher-level computer system (12) and/or as data information via the data bus (9), at least temporarily and/or on request, in particular to signal at the request of the higher-level computer system (12) or an operator (730) by means of the data input and data output means (740).

Feature 257: supply network according to feature 255 or feature 256,
wherein the electronic safeguard is set up to transmit a message to a computer (710, 750) of a service provider in the event of a hot-plug event in the supply network (3100) and/or
wherein the electronic fuse is set up to transmit a message to a computer (710) of a vehicle manufacturer or a service provider directly or with a time delay in the event of a hot-plug event in the supply network (3100) of a vehicle.

Feature 256: supply network (3100) according to one or more of features 246 to 255,
wherein control devices (4) of electronic backups of the supply network (3100) have clocks or timers (35), in particular for the creation of time stamps for LOG tables and/or log files, and/or
wherein a higher-level computer system (12) of the supply network has one or more clocks or one or more timers (1970), in particular for creating time stamps for LOG tables and/or log files, and/or
the higher-level computer system (12) being set up to regularly synchronize clocks and/or timers (35, 1970) in the supply network (3100) by means of a synchronization signal, in particular via the data bus (9).

Feature 257: supply network (3100) according to feature 256,
wherein the synchronization of clocks and/or timers (35, 1970) in the supply network (3100) comprises resetting to a common start value of these clocks and/or timers (35, 1970) and/or
wherein the synchronization of clocks and/or timers (35, 1970) in the supply network (3100) involves a correction of the frequency and/or phase of the oscillators (30) of the electronic fuses (2950 to 2953 and 2960 to 2967 and 3110 to 3113 and 3120 to 3121), in particular by means of a PLL.

Feature 258: supply network (3100) according to feature 1200 or feature 257,
wherein a higher-level computer system (12) controls devices (4) of electronic fuses (2950 to 2953 and 2960 to 2967 and 3110 to 3113 and 3120 to 3121) by means of a command via the data bus (9) in broadcasting mode to several and/or all of these fuses (2950 to 2953 and 2960 to 2967 and 3110 to 3113 and 3120 to 3121) to preferably carry out the same measurements at the same time, "same time" referring here to the equality of the clock readings of the respective clocks and/or the timer readings of the timers (35) of the various control devices (4) of the various electronic fuses (2950 to 2953 and 2960 to 2967 and 3110 to 3113 and 3120 to 3121).

Feature 259: supply network (3100) according to feature 258,
at least two electronic fuses (2950 to 2953 and 2960 to 2967 and 3110 to 3113 and 3120 to 3121) of the supply network (3100), a first control device (4) of a first electronic fuse and a second control device (4) of a second electronic fuse of this Fuses (2950 to 2953 and 2960 to 2967 and 3110 to 3113 and 3120 to 3121) are set up to perform a distributed measurement method with synchronous measurements using two synchronized local clocks (35) and / or timers (35), the two local Clocks (35) and/or timers (35) are each located within the respective control device (4) of the at least two electronic fuses.

Feature 260: supply network (3100) according to feature 259,
wherein at least the control device (4) is set up, if necessary, to transmit the measured values recorded in this way to a higher-level computer system (12) via the data bus (9), and
wherein a first of the control devices (4) of a first of the electronic fuses can be the superordinate computer system (12) and
wherein the first fuse and the second fuse are connected to one another via one or more supply line sections and
wherein the higher-level computer system (12) is set up to infer a parameter of the supply line section between the first electronic fuse and the second electronic fuse from the transmitted data.

Feature 261: supply network (3100) according to feature 260,
the higher-level computer system (12) being set up to infer the temperature and/or the electrical resistance of one or more supply line sections between the first electronic fuse and the second electronic fuse from the data transmitted via the data bus (9).

Feature 262: supply network (1100) according to one of features 246 to 261
wherein the supply network (1100) comprises a higher-level computer system (12) and
wherein the higher-level computer system (12) is set up to determine the energy requirements of consumers (1121 to 1125) in the supply network (1100), and
wherein the higher-level computer system (12) is set up to determine the energy supply capability of energy sources (1150 to 1155) in the supply network (1100), and
wherein the higher-level computer system (12) is set up to switch the supply network (1100) by switching electronic fuses (1110 to 1118) via the data bus (9) depending on the determined energy requirement and/or the determined energy supply capability and/or the security requirement, in particular based on data on the vehicle condition and/or the vehicle environment and/or the condition of the occupants and/or other factors that are available to the higher-level computer system (12).

Feature 263: supply network (1100) according to one or more of features 246 to 262,
wherein the supply network (1100) comprises a higher-level computer system (12) and
wherein the higher-level computer system (12) is set up to protect sub-supply networks of the supply network (1100) by means of electronic fuses (1110 to 1118), which are inserted in supply branches of the supply network (1100), by means of data messages via the data bus (9), in particular for maintenance purposes, turn off

Feature 264: supply network (1100) according to feature 263,
wherein at least one of the data messages includes a security code that enables the shutdown.

Feature 265: supply network (1100) according to feature 264,
wherein a server (710) of a service provider or the automobile manufacturer or a vicarious agent of the automobile manufacturer is set up to transmit the security code or data for generating the security code through the higher-level computer system (12) or control devices (4) of the electronic security devices (1110 to 1118) to the to transmit higher-level computer system (12) or a control device (4) of the electronic security (1110 to 1118).

Feature 266: Pension scheme (1100) according to one of features 263 to 209
the data bus (9) being provided directly or indirectly, for example via gateways or the like, with a terminal (740) for an input for reconfiguration of the supply network (1100) by means of the electronic fuses.

Feature 267: supply network (1100) according to feature 265 and 266,
wherein the terminal (740) is set up to also be used to transmit authentication data to a server (710) of the automobile manufacturer or a vicarious agent of the automobile manufacturer,
wherein the authentication data comprises in particular authentication data of the operating person (730) and/or authentication data of the organization for which the person (730) works and/or authentication data of the vehicle and/or authentication data of the car key of the vehicle and/or similar authentication data can and
wherein the terminal (740) is set up to receive the security code from the server (710) of the automobile manufacturer or a vicarious agent of the automobile manufacturer as a function of the authentication data.

Feature 268: supply network (1100) according to one of features 168 to 267,
wherein a control device (4) of an isolating electronic fuse of the supply network (1100) is set up to switch or be able to switch a partial supply network of the supply network (1100) to zero current and/or voltage by means of a power switch (17) of the electronic fuse and thus to isolate it can.

Feature 269 supply network (1100) according to feature 268,
at least one electronic fuse being provided in the partial supply network that can be isolated in this way, which is set up to connect a partial supply network isolated by opening its circuit breaker (17) of this electronic fuse to a reference voltage line, in particular one, by closing the further circuit breaker (17') of this electronic fuse Ground line shorts and thus discharges or brings it to a defined potential.

Feature 270: supply network (1100) according to one of features 226 to 269,
with a higher-level computer system (12),
wherein the higher-level computer system (12), in the case of a system emergency operation scenario, transmits the power consumption of a consumer of the consumers (1121 to 1125) of the supply network (1100) to the weakest supply line in the path between one or more energy sources of the energy sources (1150 to 1155) of the supply network (1100) on the one hand and this consumer, the consumer (1121 to 1125) on the other hand, by reconfiguration or changing the operating parameters of this consumer by means of one or the data bus (9) and/or
wherein the higher-level computer system (9), in the event of a system emergency operation scenario, calculates the power supply capability of one of the energy sources (1150 to 1155) of the supply network (1100) to the weakest supply line in the path between this energy source of the energy sources (1150 to 1155) of the supply network (1100) on the one hand and Consumers of the consumers (1121 to 1125) of the supply network (1100) by reconfiguration or changing the operating parameters of this energy source of the energy sources (1150 to 1155) of the supply network (1100) adapts.

Feature 271: supply network (1100) according to feature 270,
wherein the higher-level computer system (12) initiates a configuration change of the supply network (1100) by corresponding commands via one or more data buses (9) to electronic fuses (1110 to 1118) of the supply network (1100) and
the higher-level computer system (12) first determining how much energy a consumer of the consumers (1121 to 1125) of the supply network (1100) who is affected by the change in configuration of the supply network (1100) may consume in order to supply the supply network (1100) at no point to overload and
whereby the higher-level computer system (12) assigns this relevant consumer to the consumer (1121 to and/or
secondly, the higher-level computer system (12) determines how much energy an energy source of the energy sources (1150 to 1155) of the supply network (1100), which is affected by the configuration change of the supply network (1100), may deliver in order to supply the supply network ( 1100) not to overload at any point and
the higher-level computer system (12) notifying this relevant energy source of the energy sources (1150 to 1155) of the supply network (1100) how much energy this energy source of the energy sources (1150 to 1155) of the supply network (1100) may supply.

Feature 272: supply network (1100) according to feature 271,
wherein a consumer of the consumers (1121 to 1125) of the supply network (1100) has a first state in which it consumes more energy and a second state in which it consumes less energy than in the first state, and a third state in which it does not Absorbs energy, has and / or
wherein an energy source of the energy sources (1150 to 1155) of the supply network (1100) has a first state in which it supplies more energy and a second state in which it supplies less energy than in the first state and a third state in which it does not provides energy, has.

Feature 273: supply network (1100) according to one of features 226 to 272,
wherein one or more computer cores (2) of control devices (4) of electronic fuses of the electronic fuses (1110 to 1118) in the supply network (1100) are set up to determine measured values using measuring means of these electronic fuses (1100 to 1118), and
wherein the computer cores (2) of these control devices (4) of these electronic fuses of the electronic fuses (1110 to 1118) in the supply network (1100) are set up to transmit these measured values via a data bus (9) to a higher-level computer system (12), and
wherein the higher-level computer system (12) is set up to execute a neural network model, and
wherein the higher-level computer system (12) is set up to use the measured values determined and/or values dependent thereon as input values for the neural network model, and
at least the switching state of a circuit breaker (17) of an electronic fuse (1110 to 1118) in the supply network (1100) and/or at least one data message from the higher-level computer system (12) to another computer system (710, 750, 740) or a signal from the higher-level Computer system (12) to a user (730) depends on an output signal and/or output value of the neural network model.

Feature 274: supply network (1100) according to feature 273,
wherein the neural network model has been trained and parameterized with suitable training data from the development time of one or more model laboratory supply networks before it is used in the higher-level computer system (2) of the backup.

Feature 275: supply network (1100) according to feature 274,
wherein the higher-level computer system (12) is set up to use an output signal and/or an output value of the neural network model to detect a possible impending or already occurring failure of one or more consumers (1121 to 1125) and/or a possibly impending or already occurring failure of one or more energy sources (1150 to 1155) and/or a possibly imminent or already occurring failure of one or more supply lines and/or supply line sections (1160 to 1183) and/or a possibly imminent or already occurring failure of one or more electronic fuses (1110 to 1118) or another possibly imminent or already occurred defect in the supply network (1100) and/or one or more of the device parts of the supply network (1100). recognize.

Feature 276: supply network (1100) according to one of features 226 to 275,
wherein one or more electronic fuses of the electronic fuses (1110 to 1118) of the supply network (1100) have means for detecting the respective time profile of the respective electric current (29) through the respective circuit breaker (17) of the respective electronic fuse of the electronic fuses (1110 to 1118) include and
these means are set up to at least temporarily the time course of the respective electric to detect current (29) through the respective power switch (17) of the relevant electronic fuse of the electronic fuses (1110 to 1118).

Feature 277: supply network (1100) according to one of features 226 to 276,
wherein at least one electronic fuse of the electronic fuses (1110 to 1118) of the supply network (1100) has means for detecting the time profile of the voltage between a terminal (26, 27, 28) of the respective circuit breaker (17) of the respective electronic fuse of the electronic fuses ( 1110 to 1118) on the one hand and a reference potential on the other hand and
wherein these means are set up to at least temporarily detect the time profile of the voltage between the connection (26, 27, 28) of the respective circuit breaker (17) of the respective electronic fuse of the electronic fuses (1110 to 1118) and the reference potential and/or
wherein at least this electronic fuse of the electronic fuses (1110 to 1118) of the supply network (1100) has means for detecting the time profile of the voltage between a terminal (26, 27, 28) of the respective circuit breaker (17) of the respective electronic fuse of the electronic fuses ( 1110 to 1118) on the one hand and a further connection (26, 27, 28) of the respective circuit breaker (17) of the respective electronic fuse of the electronic fuses (1110 to 1118) on the other hand and/or
wherein these means are set up to at least temporarily monitor the voltage profile over time between the connection (26, 27, 28) of the respective circuit breaker (17) of the respective electronic fuse of the electronic fuses (1110 to 1118) and the further connection (26, 27 , 28) of the respective circuit breaker (17) of the respective electronic fuse of the electronic fuses (1110 to 1118).

Feature 278: supply network (1100) according to feature 276 and/or feature 277,
wherein control devices (4) of electronic fuses (1110 to 1118) are set up to transmit the data of the detected profiles to a higher-level computer system (12) via a data bus (9).

Feature 279: supply network (1100, 1700) according to feature 278,
wherein the higher-level computer system (12) is set up to carry out spectral analyzes of the data of the curves, for example by Fourier or Laplace transformation or wavelet transformation, and to determine values of the spectra and
wherein the higher-level computer system (12) is set up, in the event of significant deviations in the values of the spectra from expected value intervals for the values of the spectra, to conclude that preventive maintenance is necessary or to send a signal to another computer system (750, 710) or a display (740 ) to do.

Feature 280: supply network (1100) according to feature 278 and/or feature 279,
wherein the higher-level computer system (12) is set up to carry out spectral analyzes of the data of the curves, for example by Fourier or Laplace transformation or wavelet transformation, and to determine values of the spectra and
wherein the higher-level computer system (2) is set up to evaluate the system availability of device parts of the supply network and/or the supply network (1100) itself using determined spectra and, if necessary, to signal the evaluation result to other computer systems (710, 750, 740, 4). and/or changes parameters of the vehicle depending on this evaluation.

Feature 281: supply network (1100) according to feature 280,
wherein the higher-level computer system (12) is set up to evaluate a consumer of the consumers (1121 to 1125) of the supply network (1100) as "probably available" if the characteristic of current or voltage spectra of measured values of an electronic fuse of the fuses (1110 to 1118) of the supply network (1100), which is assigned to this consumer of consumers (1121 to 1125) of the supply network (1100), matches the expected values within permitted bandwidths and/or
wherein the higher-level computer system (12) is set up to evaluate an energy source of the energy sources (1150 to 1155) of the supply network (1100) as "probably available" if the characteristic of current or voltage spectra of measured values of an electronic fuse of the fuses (1110 to 1118) of the supply network (1100), which is assigned to this energy source of the energy sources (1150 to 1155) of the supply network (1100), matches the expected values within permitted bandwidths.

Feature 282: supply network (1100) according to one of features 226 to 281,
wherein a higher-level computer system (12) is set up to use electronic fuses of the fuses (1110 to 1118) of the supply network (1100) in the supply network (1100) to supply sub-networks of the supply network (1100) that are not required and/or dangerous and/or endangered by means of corresponding commands to control devices (4) to switch off electronic fuses of the fuses (1110 to 1118) of the supply network (1100), which it sends via the data bus (9),
if a control unit of the vehicle and/or the higher-level computer system (12) have come to the conclusion that an accident involving the vehicle is likely.

Feature 283: supply network (1100) according to feature 282,
a higher-level computer system (12) or a control unit being set up to calculate the probability of an accident in the vehicle and to conclude that an accident in the vehicle is likely if the calculated probability is above a threshold value for such an accident.

Feature 284: supply network (110) according to one of features 226 to 283,
wherein a higher-level computer system (12) is set up to predict future power consumption of one or more consumers (1121 to 1125 of the supply network (1100), and
wherein the higher-level computer system (12) is set up to switch one or more circuit breakers (17) of one or more electronic fuses of the fuses (1110 to 1118) of the supply network (1100) in one or more subtrees of the supply network (1100 ) to open if, for whatever reason, the higher-level computer system (12) expects a future increased power consumption of a consumer of consumers (1121 to 1125 of the supply network (1100) and / or
wherein a higher-level computer system (12) is set up to predict future power feed-in from one or more energy sources of the energy sources (1150 to 1155) of the supply network (1100) and/or
wherein the higher-level computer system (12) is set up to switch one or more circuit breakers (17) of one or more electronic fuses of the fuses (1110 to 1118) of the supply network (1100) in one or more subtrees of the supply network (1100 ) to be opened if, for whatever reason, the higher-level computer system (2) expects an increased, possibly critical current feed-in or voltage feed-in of an energy source from the energy sources (1150 to 1155) of the supply network (1100) of the supply network (1100).

Feature 285: supply network (1100) according to one of features 226 to 284,
wherein electronic fuses of the fuses (1110 to 1118) of the supply network (1100) are set up to measure the voltage between a first connection (26) of their circuit breakers (17), which is preferably on the energy source side, and a reference potential (201) using suitable measuring means for these fuses detecting the fuses (1110 to 1118) of the supply network (1100), and
wherein the control devices (4) of these electronic fuses of the fuses (1110 to 1118) of the supply network (1100) are set up to compare the measured voltage values with predetermined threshold values, and
wherein the control devices (4) of these electronic fuses of the fuses (1110 to 1118) of the supply network (1100) are set up to open the circuit breaker of the electronic fuse when these threshold values are undershot,
wherein, firstly, the specified threshold values allow the shutdown of less important electrical consumers of the consumers (1121 to 1125) of the supply network (1100) before the shutdown of important and/or more important electrical consumers of the consumers (1121 to 1125) of the supply network (1100), in particular before the Prioritize and/or switch off safety-relevant electrical consumers of the consumers (1121 to 1125) of the supply network (1100).
secondly, the predetermined threshold values permit the shutdown of less important electrical energy sources of the energy sources (1150 to 1155) of the supply network (1100) before the shutdown of more important and/or more important electrical energy sources of the energy sources (1150 to 1155) of the supply network (1100), in particular before the Prioritize switching off safety-relevant electrical energy sources of the energy sources (1150 to 1155) of the supply network (1100).

Feature 286: supply network (3200) according to one of features 226 to 285,
wherein the supply network (3200) supply sub-networks (3202) with voltages of less than 50V (NV Networks) and partial supply networks (3201) with voltages greater than 50V (HV networks) and
wherein the supply network (3200) comprises a data bus (9) which is designed as an optical data bus (3290) in the area of the voltage domain boundaries between supply sub-networks (3202) with voltages of less than 50V on the one hand and supply sub-networks (3201) with voltages greater than 50V .

Feature 287: supply network (3200) according to one of features 226 to 286,
wherein the supply network (3200) has supply sub-grids (3202) with voltages of less than 50V (LV grids) and supply sub-grids (3201) with voltages greater than 50V (HV grids) and
wherein the supply network (3200) comprises a data bus (9) which is designed as a data bus with electrical isolation (3290) in the area of the voltage domain boundaries between supply sub-networks (3202) with voltages of less than 50V on the one hand and supply sub-networks (3201) with voltages greater than 50V is.

Feature 288: supply network (3200) according to one of features 226 to 287,
wherein within a supply line (3260, 3262, 3263, 3264) at least two electronic fuses (3210, 3211, 3212) are cascaded, which separate the supply line (3260, 3262, 3263, 3264) into different supply line sections (3260, 3262, 3263, 3264 ) split.

Feature 289: supply network (3300) according to feature 288,
Firstly, the electrical connection point (2920) of a more important consumer (2930) to a supply line (2910) of the supply network (3300) is arranged in the part of the supply line (2910, 2911) that is closer to the energy source (2940), while the electrical connection point (2921) of a less important consumer (2931) to the supply line (2911) is arranged in the part of the supply line (2910, 2911) further from the energy source (2940) and
an electronic fuse between the electrical connection point (2920) of the more important consumer (2930) to the supply line (2910, 2911) and the electrical connection point (2921) of the less important consumer (2931) to the supply line (2915, 2910, 2911). (2961, 2962) and
this electronic fuse (2961, 2962) being set up to protect the less important consumer (2931) and/or the supply line section (2911) of the less important consumer (2931) in the event of a fault or malfunction of the less important consumer (2931) or disconnecting the supply line section (2911) of the less important consumer (2931) from the supply network (2915, 2910, 2911) in the event of a fault or a fault and
the supply network being set up to continue to supply the more important consumer (2930) with electrical energy in this case. and or
secondly, the electrical connection point (2924) of a more important energy source (2940) to a supply line (2915, 2910, 2911) of the supply network (3300) in the part of the supply line (2915, 2910, 2911), while the electrical connection point (2925) of a less important energy source (2925) to the supply line (2915, 2910, 2911) is located in the part of the supply line ( 2915, 2910, 2911) and
between the electrical connection point (2924) of the more important energy source (2940) to the supply line (2915, 2910, 2911) and the electrical connection point (2925) of the less important energy source (2941) to the supply line (2915, 2910, 2911). electronic fuse (2951, 2952) and
this electronic fuse (2951, 2952) being set up to switch off the less important energy source (2941) in the event of a fault and/or malfunction in the less important energy source (2941) or in the supply line section (2915) of the less important energy source (2941). Disconnect supply network (3300), and
wherein the supply network (3300) is set up to draw further electrical energy from the more important energy source (2940) in that case.

Feature 290: supply network (3300), in particular according to one of features 226 to 289,
wherein the supply network (3300) comprises at least one supply line (2915, 2910, 2911) and
wherein the supply network (3300) comprises a first electrical consumer (2930) and
wherein the supply network (3300) comprises a second electrical consumer (2931) and
wherein the supply network (3300) comprises a power source (2940) and
wherein the first electrical load (2930) is connected to the supply line (2915, 2910, 2911) at a first connection point (2920) via a first electronic fuse (3110) and
wherein the second electrical load (2931) is connected to the supply line (2915, 2910, 2911) at a second connection point (2921) via a second electronic fuse (3111) and
wherein the first connection point (2920) is spaced from the second connection point (2921), and
wherein the first connection point (2920) is closer to the energy source (2940) than the second connection point (2921) and
wherein the control device (4) of the first electronic fuse (3110) is set up to switch off the circuit breaker (17) of the first electronic fuse (3110) in relation to a switch-off event with a first delay time that is shorter in terms of time than the delay time with which the control device ( 4) the second electronic fuse (3111) to switch off the circuit breaker (17) of the second electronic fuse (3111) in relation to a switch-off event.

Feature 291: supply network (3300), in particular according to one of features 226 to 290,
wherein the supply network comprises at least one supply line (2915, 2910, 2911) and
wherein the supply network (3300) comprises a first electrical energy source (2940) and
wherein the supply network (3300) comprises a second electrical energy source (2941) and
wherein the supply network (3300) comprises one or more electrical consumers (2930, 2931) and
wherein the first electrical energy source (2940) is connected to the supply line at a first connection point (2924) and
wherein the second electrical energy source (2941) is connected to the supply line (2915, 2910, 2911) at a second connection point (2925) and
wherein the first connection point (2924) is spaced from the second connection point (2925), and
wherein the first connection point (2924) is closer to the one or more electrical loads (2930, 2931) than the second connection point (2925) and
wherein the control device (4) of the first electronic fuse (3110) is set up to switch off the circuit breaker (17) of the first electronic fuse (3110) in relation to a switch-off event with a longer delay time than the delay time with which the control device (4 ) the second electronic fuse (3111) is set up to switch off the circuit breaker (17) of the second electronic fuse (3111) based on a switch-off event.

Feature 292: supply network (3300), in particular according to one of features 226 to 291,
wherein the supply network comprises at least one supply line (2915, 2910, 2911) and
wherein the supply network (3300) comprises a first electrical energy source (2940) and
wherein the supply network (3300) comprises a second electrical energy source (2941) and
wherein the supply network (3300) comprises one or more electrical consumers (2930, 2931) and
wherein the first electrical energy source (2940) is connected to the supply line at a first connection point (2924) and
wherein the second electrical energy source (2941) is connected to the supply line (2915, 2910, 2911) at a second connection point (2925) and
wherein the first connection point (2924) is spaced from the second connection point (2925), and
wherein the first connection point (2924) is closer to the one or more electrical loads (2930, 2931) than the second connection point (2925) and
wherein the control device (4) of the first electronic fuse (3110) is set up to switch off the circuit breaker (17) of the first electronic fuse (3110) with a shorter delay time than the delay time with which the control device (4 ) the second electronic fuse (3111) is set up to switch off the circuit breaker (17) of the second electronic fuse (3111) based on a switch-off event.

Process for active power management

• - Erfassen (3410) des Werts der elektrischen Ströme (29) durch einen oder mehrere Leistungsschalter (17) einer oder mehrerer elektronischer Sicherungen der Sicherungen (1110 bis 1118) des Versorgungsnetzwerks (1100) und/oder
• - Erfassen (3420) des Werts der Spannungsdifferenz zwischen einem Anschluss (26, 27, 28) dieses Leistungsschalters (17) gegen ein Bezugspotenzial (201) eines Bezugspotenzialkontakts und
• - Berechnen (3430) des theoretischen Masseversatzes infolge der Bestromung der Leistungsschalter durch den jeweiligen Rechnerkern der jeweiligen Steuervorrichtung der jeweiligen Sicherung mittels Modellbildung und
• - Korrektur (3440) der entsprechenden Spannungsmesswerte um den theoretischen Masseversatz.

Feature 293: Method (3400) for active power management in a supply network (1100) with electrical fuses (1110 to 1118) for supplying electrical consumers (1121 to 1125) in this supply network (1100) with electrical energy from one or more electrical energy sources ( 1150 to 1155) with the steps

• - detecting (3410) the value of the electrical currents (29) through one or more circuit breakers (17) of one or more electronic fuses of the fuses (1110 to 1118) of the supply network (1100) and/or
• - detecting (3420) the value of the voltage difference between a terminal (26, 27, 28) of this circuit breaker (17) against a reference potential (201) of a reference potential contact and
• - Calculation (3430) of the theoretical mass offset as a result of the energizing of the circuit breakers by the respective computer core of the respective control device of the respective fuse by means of modelling, and
• - Correction (3440) of the corresponding voltage readings by the theoretical ground offset.

Feature 294: Method (3400) according to feature 293 with the step
Inferring (3450) status parameters of supply line sections of the supply line sections (3260 to 3278) using the parameters thus detected, such as current values and voltage values.

Feature 295: Method (3400) according to feature 294 with the step
wherein a state parameter is a resistance per unit length of a supply line section of the supply line sections (3260 to 3278).

Feature 296: procedure (3400) according to feature 236 or feature 295,
wherein a condition parameter is the temperature of a feed line section of the feed line sections (3260 to 3278).

Feature 297: Method according to one of features 294 to 296 with the step
determining (3460) the temperature using a known temperature coefficient of the conduit material of the umbilical section of the umbilical sections (3260 to 3278) and the known design data.

Equipment variants of vehicles

Feature 298: Method (3500) for operating a vehicle comprising the steps
Providing (3505) a vehicle with a supply network (3300) for supplying electrical consumers (2930, 2931) of the vehicle with electrical energy
wherein the vehicle has one or more energy sources (2940, 2941), one or more consumers (2930, 2931) and several electronic fuses (2960 to 2963 and 2959 to 2953) and
wherein the loads (2930, 2931) are connected to the one or more energy sources (2940, 2941) by means of supply lines (2915, 2910, 2911) and
wherein the consumers (2930, 2931) and the energy sources (2940, 2941) are connected to one another together with the supply lines (2915, 2910, 2911) in a tree structure (3300) or a network and
wherein the tree structure comprises subtrees or the network comprises subnetworks ([2915, 3015, 3025, 2941]; [2940, 3024, 3014, 2910, 3010, 3020, 2930]; [2911, 3011, 2931]) and
first electronic fuses (2960 to 2963 and 2959 to 2953) being inserted in supply lines so that these sub-trees of the tree structure can be disconnected from the rest of the tree structure or connected to this rest of the tree structure, and/or
secondly, electronic fuses (2916, 2962, 2951, 2952) are inserted into supply lines, so that these sub-networks ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) of the network (3300) from the disconnect the rest of the network (3300) or connect to this rest of the network (3300),
such that these sub-networks ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) and/or sub-trees essentially have no energy supply and/or no energy consumption after a separation;
Programming (3510) of certain trim levels,
wherein a first equipment variant of these equipment variants of the vehicle differs from a second equipment variant of these equipment variants of the vehicle in that
that at least one electronic backup of these electronic backups (2916, 2962, 2951, 2952) is a subtree of the tree structure or a subnetwork ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) of the network (3300 ) separated from the rest of the tree structure or the rest of the network (3300) in the first equipment variant and connected to the rest of the tree structure or the rest of the network (3300) in the second equipment variant,
so that the energy source is set up to be able to fully supply this subtree or this subnetwork ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) with electrical energy from the energy source only in the second equipment variant , or that this subtree or this subnetwork ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) only in the second equipment variant has an electrical energy consumption of one or more electrical consumers (2931) of the subnetwork in question ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]).

Feature 299: Method (3500) according to feature 298, with the step
Programming (3510) of specific equipment variants by transmitting programming data to control devices (4) of electronic fuses via a data bus (9).

Feature 300: Method (3500) according to feature 299, with the step
Encrypted communication via the control data bus (9) for programming the equipment variants and/or communication via the control data bus (9) for programming the equipment variants only after transmission of a password to the control device (4) of the corresponding electronic security.

Feature 301: Method (3500) according to feature 300, characterized in that
that the communication between the control device (4) of the electronic security and its environment via such data connections (9) is encrypted with a PQC method. (PQC=post quantum cryptography);

Feature 302: Method (3500) according to one of features 296 to 301, characterized in that
that the activation and/or deactivation of an electronic fuse, i.e. switching on or off the power switch (17) of the electronic fuse, the transmission of at least one digital password from the computer core (2) of the control device (4) of another electronic fuse and/or or from the computer (12) of a control device, i.e. for example from the higher-level computer system (12), and/or from a server (710) of a service provider and/or automobile manufacturer via a data bus (9) to the control device (4) of the electronic fuse .

Feature 303: Method (3500) according to one of features 296 to 302,
wherein a supply voltage line (6) and/or a supply line section of the supply network is part of the data bus (9) and
wherein the communication via this data bus (9) takes place at least in sections by power-line communication and
this communication between the at least two control devices (4) of two electronic fuses and/or
between a control device (4) of an electronic fuse on the one hand and a higher-level computer system (12) on the other via this data bus (9).

Feature 304: Method (3500) according to one of features 296 to 303,
after changing the equipment variant by programming a new equipment variant, at least two electronic fuses, better all electronic fuses affected by the change in the equipment variant, change their switching state with a time delay and essentially do not change their switching state at the same time.

Feature 305: Method according to one of features 296 to 304,
a higher-level computer system (12) of the vehicle programming a predefined sequence of equipment variants at certain time intervals in predetermined operating states.

Feature 306: procedure according to feature 305,
after the vehicle is switched on, the higher-level computer system (12) transfers the vehicle from the parked state to the driving state by programming at least two equipment variants at two different programming times at a time interval between the programming times that differs from 0s.

Feature 307: procedure according to feature 306,
wherein the higher-level computer system (12) sends a start signal to the control devices (4) of electronic fuses, whereupon these generate and set the sequence of equipment variants for the respective electronic fuse.

Feature 308: procedure according to feature 307,
the higher-level computer system (12) before sending the start signal the values of waiting times which the control devices (4) of the electronic fuses between the arrival of the start signal from the higher-level computer system (12) and the closing or opening of their respective circuit breaker (17) should wait, programmed and / or transmitted to the control devices (4) of the relevant fuses.

Feature 309: procedure according to feature 307 or 308,
wherein values of the waiting times are programmed into a non-volatile memory (14) of the control devices (4) of electronic fuses,
This programming is carried out at the factory and/or by another computer (710) and/or by the higher-level computer system (12) and/or another computer in the vehicle, and thus possibly also by the control device (4) of another electronic fuse.

Feature 310: Method (3500) according to any one of features 296 to 309, with the additional steps
transmitting (3520) authentication data to a server (710) of an unlock code provider;
verification (3525) of the transmitted authentication data;
Generating (3530) an activation code using this or other authentication data according to a fixed method and/or providing the generated activation code or an activation code that is kept ready;
optionally purchasing (3535) an unlock code via a data connection to the unlock code provider's server 710;
Transmission (3540) of the activation code to the vehicle and/or
Transmission (3545) of an activation code for an equipment variant on the basis of the activation code received to the control device (4) of the electronic security and
Programming (3510) the unlocked trim level.

Feature 311: Method according to feature 310 with the additional step
Detecting (3550) and determining the energy flowing through an electronic fuse in a partial supply branch ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) of the supply tree (3300) as a measured value of the amount of energy and/or the underlying readings in the electronic fuse;
reading (3555) the measured value of the determined amount of energy and/or the underlying measured values from the electronic fuse;
Transmission (3560) of the measured value of the determined amount of energy and/or the underlying measured values via a data transmission link (720), which is preferably encrypted, from the higher-level computer system (12) to a computer (750) of a service provider, for example an energy supplier or its vicarious agents;
Creation (3565) of an invoice based on the transmitted measured value of the determined amount of energy and/or the underlying measured values.

Feature 312: Method according to one of features 299 to 311 with the additional steps
determining (3570) the topology of the utility network using electronic fuses of the utility network;
Comparison (3575) of the determined topology of the supply network with the equipment variant that is valid or to be set in order to check the plausibility of the equipment variant or the admissibility of the determined topology of the supply network.

Feature 313: Method according to feature 312 with the additional step
Acquisition of current values for currents through circuit breakers of electronic fuses in the supply network;
Calculating or providing expected value intervals for currents through circuit breakers of electronic fuses in the supply network;
Plausibility check of the supply network with the supply lines and the consumers and the energy sources and the electronic fuses by comparing the recorded current values with the calculated or provided expected value intervals.

Feature 314: Method according to feature 312 or feature 313 with the additional step
Inferring manipulation of the supply network and/or inferring manipulation of an electrical consumer in the supply network and/or inferring manipulation of an electrical energy source in the supply network and/or inferring manipulation of a supply line in the supply network and/or inferring manipulation of an equipment variant , if the plausibility check failed.

Feature 315: Procedure for reducing the starting current (in-rush current)
Detection of the starting current using current measuring means;
Change of trim level to one with a trim level with increased power consumption other loads if, after a waiting time, the magnitude of the starting current is below a threshold value.

Device characteristics Control device

• - wobei diese System Basis Chip Funktionalität alle Funktionen bereitstellt, um einen Rechnerkern (2) in der Steuervorrichtung (4) der elektronischen Sicherung (1) und die Datenschnittstelle (10) der Steuervorrichtung (4) der Sicherung (1) sicher betreiben zu können, und
• - die System Basis Chip Funktionalität umfasst
  • - einen Boost-Konverter (5) für
    • o die Spannungsversorgung der sicherheitsrelevanten Vorrichtungsteile der Steuervorrichtung (4) und
    • o das Laden einer internen oder externen Energiereserve (8)
  • - wobei im Normalbetrieb der Boost-Konverter (5) eine extern bereit gestellte Betriebsspannung (6) einer oder mehrerer externer Energiequellen aufbereitet und
• - wobei im Falle des Ausfalls der extern bereit gestellten Betriebsspannung (6) die Vorrichtung in einen Notlaufbetrieb wechselt und die Energiereserve (8) die Energieversorgung der Steuervorrichtung (4) der Sicherung (1) übernimmt und
• - wobei im Notlaufbetrieb der Boost-Konverter (5) oder eine funktionsäquivalente zweite Spannungsregelvorrichtung eine Notenergieversorgung (7) der sicherheitsrelevanten Vorrichtungsteile der Steuervorrichtung (4) der Sicherung (1) zur Verfügung stellt und die hierfür notwendige Energie aus der Energiereserve (8) entnimmt.

Feature 316. Control device (4) for the fuse (1) of a vehicle for operating an electronic fuse (1),

• - whereby this system basis chip functionality provides all functions in order to be able to safely operate a computer core (2) in the control device (4) of the electronic fuse (1) and the data interface (10) of the control device (4) of the fuse (1), and
• - includes the System Basis Chip functionality
  • - a boost converter (5) for
    • o the power supply of the safety-relevant parts of the control device (4) and
    • o charging an internal or external energy reserve (8)
  • - In normal operation, the boost converter (5) processes an externally provided operating voltage (6) from one or more external energy sources and
• - In the event of failure of the externally provided operating voltage (6), the device switches to emergency operation and the energy reserve (8) takes over the energy supply of the control device (4) of the fuse (1) and
• - wherein in emergency operation the boost converter (5) or a functionally equivalent second voltage control device provides an emergency energy supply (7) for the safety-relevant device parts of the control device (4) of the fuse (1) and draws the energy required for this from the energy reserve (8).

Backup with encryption of SW in memory

Feature 317: Electronic security (1), in particular according to one or more of features 28 to 159,
wherein the electronic fuse (1) comprises a control device (4), in particular according to feature 1, and
wherein the electronic fuse (1) comprises a circuit breaker (17) and
wherein the control device (4) comprises a computer core (2) and
wherein the control device (4) comprises a non-volatile memory (14) and
wherein the control device (4) comprises an internal data bus (11) and
wherein the computer core (2) is set up to have at least read access to the non-volatile memory (14) via the internal data bus (11), and
wherein instructions of a program and/or program data are stored in the non-volatile memory and
wherein the computer core is set up to execute the program with the program data in the non-volatile memory (14), and
wherein the instructions of the program and/or the program data are encrypted and
wherein the computer core (2) is set up to read the encrypted program instructions and/or the encrypted program data from the non-volatile memory (14) before the program execution of the program instructions, and
wherein the computer core (2) is set up to decrypt the read encrypted program instructions and/or the read encrypted program data before the program execution of the program instructions to decrypted program instructions and/or to decrypted program data, and
the computer core (2) being set up to store the decrypted instructions of the program and/or the decrypted program data in a memory (14, 15) of the control device (4) before the program is executed, and
wherein the computer core (2) is set up to execute the decrypted program commands from the memory (14, 15) of the control device (4) and/or the decrypted program data from the memory (14, 15) of the control device (4) during the execution of program commands.

Feature 318: electronic fuse (1) according to feature 317,
wherein the computer core (2) is set up to perform the encryption using a random number generator (60) (RNG) and/or a pseudo-random number generator (60) (PRNG) and/or a true random number generator (TRNG) and/or a quantum random number generator (QRNG).

Feature 319: Electronic fuse (1) according to one of features 317 to 318,
wherein the control device (4) comprises a data bus interface (10, 610, 550, 551) and
wherein an external computer, for example a higher-level computer system (12) and/or the server (710) of a service provider, can access the non-volatile memory (14) via the data bus interface (10, 610, 550, 551) and
the external computer being able to read data, which can also include the commands of the program and/or the program data, from the non-volatile memory (14).

Feature 320: electronic fuse (1) according to feature 319,
wherein the control device (4) is set up so that the external computer can only read predetermined areas of the non-volatile memory (14) if the external computer has previously connected to the computer core (2) of the control device (4) and/or to another part of the control device (4) has transmitted a correct password or if the external computer has previously identified itself in a different way to the computer core (2) and/or to another part of the control device (4) as being authorized to access these predetermined areas of the non-volatile memory (14) and if verification of this authentication by the computer core (2) and/or another part of the control device (4) was successful.

Feature 321: Electronic fuse (1) according to one of features 317 to 320,
wherein the control device (4) comprises a data bus interface (10, 610, 550, 551) and
wherein an external computer, for example a higher-level computer system (12) and/or the server (710) of a service provider, can access the volatile memory (15) via the data bus interface (10, 610, 550, 551) and
wherein the external computer can read data, which can also include the commands of the program and/or the program data, from the volatile memory (15).

Feature 322: electronic fuse (1) according to feature 321,
wherein the control device (4) is set up so that the external computer can only read predetermined areas of the volatile memory (15) if the external computer has previously connected to the computer core (2) of the control device (4) and/or to another part of the control device (4) has transmitted a correct password or if the external computer has previously identified itself in some other way in the computer core (2) and/or in another part of the control device (4) as authorized to access these predetermined areas of the non - has authenticated volatile memory (14) and if a verification of this authentication by the computer core (2) and / or another part of the control device (4) was successful.

Feature 323: Electronic fuse (1) according to one of features 317 to 322,
wherein the control device (4) comprises a data bus interface (10, 610, 550, 551) and
wherein an external computer, for example a higher-level computer system (12) and/or the server (710) of a service provider, can access the non-volatile memory (14) via the data bus interface (10, 610, 550, 551) and
the external computer being able to write data, which can also include the commands of the program and/or the program data, into the non-volatile memory (14).

Feature 324: electronic fuse (1) according to feature 323,
wherein the control device (4) is set up so that the external computer can only write to predetermined areas of the non-volatile memory (14) if the external computer has previously connected to the computer core (2) of the control device (4) and/or to another part of the control device (4) has transmitted a correct password or if the external computer has previously identified itself in a different way to the computer core (2) and/or to another part of the control device (4) as being authorized to access these predetermined areas of the non-volatile memory (14) and if verification of this authentication by the computer core (2) and/or another part of the control device (4) was successful.

Feature 325: Electronic fuse (1) according to one of features 317 to 324,
wherein the control device (4) comprises a data bus interface (10, 610, 550, 551) and
an external computer, for example a higher-level computer system (12) and/or the server (710) of a service provider, can access the volatile memory (15) via the data bus interface (10, 610, 550, 551) and
the external computer being able to write data, which can also include the commands of the program and/or the program data, into the volatile memory (15).

Feature 326: electronic fuse (1) according to feature 325,
wherein the control device (4) is set up so that the external computer can only write to predetermined areas of the volatile memory (15) if the external computer has previously connected to the computer core (2) of the control device (4) and/or to another part of the control device (4) has transmitted a correct password or if the external computer has previously identified itself in some other way in the computer core (2) and/or in another part of the control device (4) as authorized to access these predetermined areas of the non - has authenticated volatile memory (14) and if a verification of this authentication by the computer core (2) and / or another part of the control device (4) was successful.

Backup with access protection on SW in memory

Feature 327: Electronic security (1), in particular according to one or more of features 28 to 159 and/or 317 to 326,
wherein the electronic fuse (1) comprises a control device (4), in particular according to feature 1, and
wherein the electronic fuse (1) comprises a circuit breaker (17) and
wherein the control device (4) comprises a computer core (2) and
wherein the control device (4) comprises a non-volatile memory (14) and
wherein the control device (4) comprises an internal data bus (11) and
wherein the computer core (2) is set up to have at least read access to the non-volatile memory (14) via the internal data bus (11), and
wherein instructions of a program and/or program data are stored in the non-volatile memory and
wherein the computer core is set up to execute the program with the program data in the non-volatile memory (14) and
wherein the control device (4) comprises a data bus interface (10, 610, 550, 551) and
wherein an external computer, for example a higher-level computer system (12) and/or the server (710) of a service provider, can access the non-volatile memory (14) via the data bus interface (10, 610, 550, 551) and
wherein the external computer can read data, which can also include the instructions of the program and/or the program data, from the non-volatile memory (14) and
wherein the control device (4) is set up so that the external computer can only read predetermined areas of the non-volatile memory (14) if the external computer has previously connected to the computer core (2) of the control device (4) and/or to another part of the control device (4) has transmitted a correct password or if the external computer has previously identified itself in a different way to the computer core (2) and/or to another part of the control device (4) as being authorized to access these predetermined areas of the non-volatile memory (14) and if verification of this authentication by the computer core (2) and/or another part of the control device (4) was successful.

Feature 328: Electronic security (1), in particular according to one or more of features 28 to 159 and/or 317 to 327,
wherein the electronic fuse (1) comprises a control device (4), in particular according to feature 1, and
wherein the electronic fuse (1) comprises a circuit breaker (17) and
wherein the control device (4) comprises a computer core (2) and
wherein the control device (4) comprises a non-volatile memory (14) and
wherein the control device (4) comprises an internal data bus (11) and
wherein the computer core (2) is set up to be able to access the non-volatile memory (14) at least in writing via the internal data bus (11), and
wherein instructions of a program and/or program data are stored in the non-volatile memory and
wherein the computer core is set up to execute the program with the program data in the non-volatile memory (14) and
wherein the control device (4) comprises a data bus interface (10, 610, 550, 551) and
an external computer, for example a higher-level computer system (12) and/or the server (710) of a service provider, can access the non-volatile memory (14) via the data bus interface (10, 610, 550, 551) and
wherein the external computer can write data, which can also include the instructions of the program and/or the program data, into the non-volatile memory (14) and
wherein the control device (4) is set up so that the external computer can only write to predetermined areas of the non-volatile memory (14) if the external computer has previously connected to the computer core (2) of the control device (4) and/or to another part of the control device (4) has transmitted a correct password or if the external computer has previously identified itself in a different way to the computer core (2) and/or to another part of the control device (4) as being authorized to access these predetermined areas of the non-volatile memory (14) and if verification of this authentication by the computer core (2) and/or another part of the control device (4) was successful.

Feature 329: Electronic security (1), in particular according to one or more of features 28 to 159 and/or 317 to 328,
wherein the electronic fuse (1) comprises a control device (4), in particular according to feature 1, and
wherein the electronic fuse (1) comprises a circuit breaker (17) and
wherein the control device (4) comprises a computer core (2) and
wherein the control device (4) comprises a volatile memory (15) and
wherein the control device (4) comprises an internal data bus (11) and
wherein the computer core (2) is set up to be able to at least read the volatile memory (15) via the internal data bus (11), and
wherein the control device (4) comprises a data bus interface (10, 610, 550, 551) and
wherein an external computer, for example a higher-level computer system (12) and/or the server (710) of a service provider, can access the volatile memory (15) via the data bus interface (10, 610, 550, 551) and
wherein the external computer can read data from the volatile memory (15), which can also include the commands of the program and/or the program data, and
wherein the control device (4) is set up so that the external computer can only read predetermined areas of the volatile memory (15) if the external computer has previously connected to the computer core (2) of the control device (4) and/or to another part of the control device (4) has transmitted a correct password or if the external computer has previously identified itself in some other way to the computer core (2) and/or to another part of the control device (4) as being authorized to access these predetermined areas of the volatile Has authenticated memory (15) and if a verification of this authentication by the computer core (2) and / or another part of the control device (4) was successful.

Feature 330: Electronic security (1), in particular according to one or more of features 28 to 159 and/or 317 to 329,
wherein the electronic fuse (1) comprises a control device (4), in particular according to feature 1, and
wherein the electronic fuse (1) comprises a circuit breaker (17) and
wherein the control device (4) comprises a computer core (2) and
wherein the control device (4) comprises a volatile memory (15) and
wherein the control device (4) comprises an internal data bus (11) and
wherein the computer core (2) is set up to be able to access the volatile memory (15) at least in writing via the internal data bus (11), and
wherein instructions of a program and/or program data are stored in the non-volatile memory and
wherein the computer core is set up to execute the program with the program data in the volatile memory (15) and
wherein the control device (4) comprises a data bus interface (10, 610, 550, 551) and
wherein an external computer, for example a higher-level computer system (12) and/or the server (710) of a service provider, can access the volatile memory (15) via the data bus interface (10, 610, 550, 551) and
wherein the external computer can write data, which can also include the commands of the program and/or the program data, into the volatile memory (15) and
wherein the control device (4) is set up so that the external computer can only write to predetermined areas of the volatile memory (15) if the external computer has previously connected to the computer core (2) of the control device (4) and/or to another Part of the control device (4) has transmitted a correct password or if the external computer has previously entered the computer in some other way core (2) and/or another part of the control device (4) as authorized to access these predetermined areas of the volatile memory (15) and if a verification of this authentication by the computer core (2) and/or another Part of the control device (4) was successful.

Feature 331: electronic fuse (1) according to one or more of features 327 to 330,
wherein the control device (4) comprises a non-volatile memory (14) and
wherein the control device (4) comprises an internal data bus (11) and
wherein the computer core (2) is set up to have at least read access to the non-volatile memory (14) via the internal data bus (11), and
wherein commands of a program and/or program data are stored in the non-volatile memory (14) and
wherein the computer core (2) is set up to execute the program with the program data in the non-volatile memory (14), and
wherein the instructions of the program and/or the program data are encrypted and
wherein the computer core (2) is set up to read the encrypted program instructions and/or the encrypted program data from the non-volatile memory (14) before the program execution of the program instructions, and
wherein the computer core (2) is set up to decrypt the read encrypted program instructions and/or the read encrypted program data before the program execution of the program instructions to decrypted program instructions and/or to decrypted program data, and
the computer core (2) being set up to store the decrypted instructions of the program and/or the decrypted program data in a memory (14, 15) of the control device (4) before the program is executed, and
wherein the computer core (2) is set up to execute the decrypted program commands from the memory (14, 15) of the control device (4) and/or the decrypted program data from the memory (14, 15) of the control device (4) during the execution of program commands.

Feature 332: electronic fuse (1) according to feature 331,
wherein the computer core (2) is set up to perform the encryption using a random number generator (60) (RNG) and/or a pseudo-random number generator (60) (PRNG) and/or a real random number generator (TRNG) and/or a quantum random number generator (QRNG) to do.

• - die Steuervorrichtung (55120, 4) einer elektronischen Sicherung (1) (120) ein oder mehreren Sicherheitsmaßnahmen unterliegt, denen die erste HW-Plattform (55110, 12, 710) nicht unterliegt;
• - das SW-Programm (55113) zumindest ein Basis-Modul (55210) und zumindest ein sicherheitsrelevantes Modul (55121) umfasst;
• - das sicherheitsrelevante Modul (55121) auf sicherheitsrelevante Daten und/oder auf eine sicherheitsrelevante Funktion (55201, 55202) der Sicherung (1) zugreift;
• - das Basis-Modul (210) auf der ersten HW-Plattform (55110, 12, 710) ausgeführt wird; und
• - das sicherheitsrelevante Modul (55121) auf der Steuervorrichtung (55120, 4) einer elektronischen Sicherung (1) ausgeführt wird.

Feature 333: System (55100) for providing an application by means of a SW program (55113) in a control device (55120, 4) of an electronic fuse (1) in a supply network (200),
wherein the system (55100) comprises a first HW platform (55110, 12, 710) and the control device (55120, 4) of an electronic fuse (1);

• - The control device (55120, 4) of an electronic fuse (1) (120) is subject to one or more security measures to which the first HW platform (55110, 12, 710) is not subject;
• - The SW program (55113) comprises at least one basic module (55210) and at least one safety-relevant module (55121);
• - The security-related module (55121) accesses security-related data and/or a security-related function (55201, 55202) of the fuse (1);
• - the base module (210) is executed on the first HW platform (55110, 12, 710); and
• - The safety-related module (55121) on the control device (55120, 4) of an electronic fuse (1) is running.

• - eine Überprüfung von SW-Code eines SW-Moduls (55121), das auf der Steuervorrichtung (55120, 4) der elektronischen Sicherung (1) ausgeführt wird; und/oder
• - eine Beschränkung von Daten (55211, 55221), die an ein oder von einem SW-Modul (55121) übergeben werden können, das auf der Steuervorrichtung (55120, 4) der elektronischen Sicherung (1) ausgeführt wird.

Feature 334: system (100) according to feature 333, comprising one or more security measures,

• - a SW code check of a SW module (55121) running on the control device (55120, 4) of the electronic fuse (1); and or
• - a restriction of data (55211, 55221) that can be passed to or from a SW module (55121) running on the control device (55120, 4) of the electronic fuse (1).

Feature 335: system (100) according to one of features 333 to 334,
wherein the first HW platform (55110) is designed in such a way that a SW module (55210) running on the first HW platform (55110) has no access to a safety-related function (55201) of the supply network (200) and
wherein the control device (55120, 3) of the fuse (1) is designed such that an SW module (55121) running on the control device (55120, 3) of the fuse (1) accesses a safety-related function (55201) of the supply network (200) has.

Feature 336: System (100) according to any one of features 333 to 335,
wherein the base module (55210) is set up to call the safety-relevant module (55121) when the SW program (55113) is executed and to execute the safety-relevant module (55121) on the control device (55120, 4) of the fuse (1) to cause.

Feature 335: System (55100) according to feature 336,
wherein when the SW program (55113) is executed, data (55211) is transferred from the base module (55210) to the safety-relevant module (55121) and/or
Data (55221) are transferred from the safety-relevant module (55121) to the base module (55210).

Feature 336 system (100) according to any one of features 333 to 335,
wherein the first HW platform (55110) and the control device (55120, 3) of the fuse (1) comprise separate computers and/or
the control device (55120, 3) of the fuse (1) comprises a non-volatile (14) and/or volatile memory (15) which is separate from the first HW platform (110).

Feature 337: System (100) according to any one of features 333 to 336,
wherein the first HW platform (110) is part of a higher-level computer system (12) of the supply network (200) which is connected to the control device (55120, 3) of the fuse (1) via a data interface (10, 610, 550, 551) and is connected to a data bus (9) of the supply network (200) and/or is part of a server (710) which is connected to the control device (55120, 3) of the fuse (1) via a data interface (10, 610, 550, 551) and a data bus (9) of the supply network (200).

Feature 338: System (100) according to any one of features 333 to 337,
wherein the at least one safety-related module (55121) comprises 20%, 10% or less of a SW code of the SW program (55113); and or
the at least one basic module (55210) comprises 80%, 90% or more of the SW code of the SW program (55113).

Feature 339: System (100) according to any one of features 333 to 338,
wherein the safety-related module (55121) has a standardized interface via which data (55211, 55221) can be transferred to the safety-related module (55121) or from the safety-related module (5121).

• - Ausführen (55301) eines Basis-Moduls (55210) des SW-Programms (55113) auf einer ersten HW-Plattform (55110) des Versorgungsnetzwerks (200);
• - Aufrufen (55302), aus dem Basis-Modul (55210), eines sicherheitsrelevanten Moduls (55121) des SW-Programms (55113); wobei das sicherheitsrelevante Modul (55121) auf sicherheitsrelevante Daten und/oder auf eine sicherheitsrelevante Funktion (55201, 55202) zugreift und
• - Ausführen (55303) des sicherheitsrelevanten Moduls (55121) auf einer Steuervorrichtung (55120, 3) der Sicherung (1) des Versorgungsnetzwerks (200);
• - wobei die Steuervorrichtung (55120, 3) der Sicherung (1) ein oder mehreren Sicherheitsmaßnahmen unterliegt, denen die erste HW-Plattform (110) nicht unterliegt.

Feature 340: Method (55300) for executing a SW program (55113) in a supply network (200) with electronic fuses (1) in a vehicle;
the method (55300) comprising,

• - Execution (55301) of a base module (55210) of the SW program (55113) on a first HW platform (55110) of the supply network (200);
• - Calling (55302), from the base module (55210), a safety-related module (55121) of the SW program (55113); wherein the safety-related module (55121) accesses safety-related data and/or a safety-related function (55201, 55202) and
• - Execution (55303) of the safety-relevant module (55121) on a control device (55120, 3) of the fuse (1) of the supply network (200);
• - Wherein the control device (55120, 3) of the fuse (1) is subject to one or more security measures to which the first HW platform (110) is not subject.

multiple backups

Feature 341: Electronic security (1), in particular according to one or more of features 28 to 159,
wherein the electronic fuse (1) comprises a control device (4) and
wherein the electronic fuse (1) comprises a first circuit breaker (17) with a first connection (26) and a second connection (28) and a control connection (27) and
wherein the electronic fuse (1) comprises a second circuit breaker (17') with a first connection (26') and a second connection (28') and a control connection (27') and
wherein the electronic fuse (1) comprises a third circuit breaker (17'') with a first connection (26'') and a second connection (28'') and a control connection (27'') and
the fuse having a first terminal (18) connected to the first terminal (26) of the first circuit breaker (17) and
the fuse having a first second terminal (19) connected to the second terminal (28) of the first circuit breaker (17) and
the fuse having a second first terminal (18') connected to the first terminal (26') of the second circuit breaker (17') and
the fuse having a second terminal (19') connected to the second terminal (28') of the second circuit breaker (17') and
the fuse having a third first terminal (18'') connected to the first terminal (26'') of the third circuit breaker (17'') and
the fuse having a third second terminal (19'') connected to the second terminal (28'') of the third circuit breaker (17'') and
wherein the control device (4) controls the control terminal (27) of the first circuit breaker (17) and the control terminal (27') of the second circuit breaker (17') and the control terminal (27'') of the third circuit breaker (17'').

• - der mit dem ersten Anschluss (26) des ersten Leistungsschalters (17) verbunden ist und
• - der mit dem ersten Anschluss (26') des zweiten Leistungsschalters (17') verbunden ist und
• - der mit dem ersten Anschluss (26') des dritten Leistungsschalters (17'') verbunden ist, und

wobei die Sicherung einen ersten zweiten Anschluss (19) aufweist, der mit dem zweiten Anschluss (28) des ersten Leistungsschalters (17) verbunden ist und
wobei die Sicherung einen zweiten zweiten Anschluss (19') aufweist, der mit dem zweiten Anschluss (28') des zweiten Leistungsschalters (17') verbunden ist und
wobei die Sicherung einen dritten zweiten Anschluss (19'') aufweist, der mit dem zweiten Anschluss (28'') des dritten Leistungsschalters (17'') verbunden ist und
wobei die Steuervorrichtung (4) den Steueranschluss (27) des ersten Leistungsschalters (17) und den Steueranschluss (27') des zweiten Leistungsschalters (17') und den Steueranschluss (27'') des dritten Leistungsschalters (17'') steuert.Feature 342: Electronic security (1), in particular according to one or more of features 28 to 159,
wherein the electronic fuse (1) comprises a control device (4) and
wherein the electronic fuse (1) comprises a first circuit breaker (17) with a first connection (26) and a second connection (28) and a control connection (27) and
wherein the electronic fuse (1) comprises a second circuit breaker (17') with a first connection (26') and a second connection (28') and a control connection (27') and
wherein the electronic fuse (1) comprises a third circuit breaker (17'') with a first connection (26'') and a second connection (28'') and a control connection (27'') and
the fuse having a first terminal (18),

• - Which is connected to the first connection (26) of the first circuit breaker (17) and
• - which is connected to the first terminal (26') of the second circuit breaker (17') and
• - which is connected to the first terminal (26') of the third circuit breaker (17''), and

the fuse having a first second terminal (19) connected to the second terminal (28) of the first circuit breaker (17) and
the fuse having a second terminal (19') connected to the second terminal (28') of the second circuit breaker (17') and
the fuse having a third second terminal (19'') connected to the second terminal (28'') of the third circuit breaker (17'') and
wherein the control device (4) controls the control terminal (27) of the first circuit breaker (17) and the control terminal (27') of the second circuit breaker (17') and the control terminal (27'') of the third circuit breaker (17'').

Feature 343: Electronic security (1), in particular according to one or more of features 28 to 159,
wherein the electronic fuse (1) comprises a control device (4) and
wherein the electronic fuse (1) comprises a first circuit breaker (17) with a first connection (26) and a second connection (28) and a control connection (27) and
wherein the electronic fuse (1) comprises a second circuit breaker (17') with a first connection (26') and a second connection (28') and a control connection (27') and
wherein the electronic fuse (1) has a third circuit breaker (17'') with a first terminal (26'') and a second connection (28'') and a control connection (27'') and
wherein the electronic fuse (1) comprises a fourth circuit breaker (17''') with a first connection (26''') and a second connection (28''') and a control connection (27''') and
the fuse having a first terminal (18) connected to the first terminal (26) of the first circuit breaker (17) and
the fuse having a first second terminal (19) connected to the second terminal (28) of the first circuit breaker (17) and
the fuse having a second first terminal (18') connected to the first terminal (26') of the second circuit breaker (17') and
the fuse having a second terminal (19') connected to the second terminal (28') of the second circuit breaker (17') and
the fuse having a third first terminal (18'') connected to the first terminal (26'') of the third circuit breaker (17'') and
the fuse having a third second terminal (19'') connected to the second terminal (28'') of the third circuit breaker (17'') and
the fuse having a fourth first terminal (18''') connected to the first terminal (26''') of the fourth circuit breaker (17''') and
wherein the fuse has a fourth second terminal (19''') connected to the second terminal (28''') of the fourth circuit breaker (17''') and
wherein the control device (4) has the control connection (27) of the first circuit breaker (17) and the control connection (27') of the second circuit breaker (17') and the control connection (27'') of the third circuit breaker (17'') and the control connection (27''') of the fourth circuit breaker (17''') controls.

• - der mit dem ersten Anschluss (26) des ersten Leistungsschalters (17) verbunden ist und
• - der mit dem ersten Anschluss (26'') des dritten Leistungsschalters (17'') verbunden ist, und

wobei die Sicherung einen ersten zweiten Anschluss (19) aufweist,

• - der mit dem zweiten Anschluss (28) des ersten Leistungsschalters (17) verbunden ist und
• - der mit dem zweiten Anschluss (28') des zweiten Leistungsschalters (17') verbunden ist, und

wobei die Sicherung einen zweiten ersten Anschluss (18') aufweist,

• - der mit dem ersten Anschluss (26') des zweiten Leistungsschalters (17') verbunden ist und
• - der mit dem ersten Anschluss (26''') des vierten Leistungsschalters (17''') verbunden ist, und

wobei die Sicherung einen dritten zweiten Anschluss (19'') aufweist,

• - der mit dem zweiten Anschluss (28'') des dritten Leistungsschalters (17'') verbunden ist und
• - der mit dem zweiten Anschluss (28''') des vierten Leistungsschalters (17''') verbunden ist, und

wobei die Steuervorrichtung (4) den Steueranschluss (27) des ersten Leistungsschalters (17) und den Steueranschluss (27') des zweiten Leistungsschalters (17') und den Steueranschluss (27'') des dritten Leistungsschalters (17'') und den Steueranschluss (27''') des vierten Leistungsschalters (17''') steuert.Feature 344: Electronic security (1), in particular according to one or more of features 28 to 159,
wherein the electronic fuse (1) comprises a control device (4) and
wherein the electronic fuse (1) comprises a first circuit breaker (17) with a first connection (26) and a second connection (28) and a control connection (27) and
wherein the electronic fuse (1) comprises a second circuit breaker (17') with a first connection (26') and a second connection (28') and a control connection (27') and
wherein the electronic fuse (1) comprises a third circuit breaker (17'') with a first connection (26'') and a second connection (28'') and a control connection (27'') and
wherein the electronic fuse (1) comprises a fourth circuit breaker (17''') with a first connection (26''') and a second connection (28''') and a control connection (27''') and
the fuse having a first terminal (18),

• - Which is connected to the first connection (26) of the first circuit breaker (17) and
• - which is connected to the first terminal (26'') of the third circuit breaker (17''), and

the fuse having a first second terminal (19),

• - which is connected to the second terminal (28) of the first circuit breaker (17) and
• - which is connected to the second terminal (28') of the second circuit breaker (17'), and

the fuse having a second first terminal (18'),

• - which is connected to the first terminal (26') of the second circuit breaker (17') and
• - which is connected to the first terminal (26''') of the fourth circuit breaker (17'''), and

wherein the fuse has a third second terminal (19''),

• - which is connected to the second connection (28'') of the third circuit breaker (17'') and
• - which is connected to the second terminal (28''') of the fourth circuit breaker (17'''), and

wherein the control device (4) has the control connection (27) of the first circuit breaker (17) and the control connection (27') of the second circuit breaker (17') and the control connection (27'') of the third circuit breaker (17'') and the control connection (27''') of the fourth circuit breaker (17''') controls.

Reference List

1

electronic fuse;

2

computer cores, in particular microcontrollers;

3

control system;

4

control device;

5

power supply / boost converter;

6

operating voltage;

7

emergency power supply;

8th

energy reserve;

9

external data bus;

9'

external data bus ring;

10

data bus interface. The data bus interface can be a data bus transceiver to a wired data bus or a wireless data interface, in particular an optical data interface to an optical data connection.

11

internal data bus

12

higher-level computer system, in particular of the vehicle. The higher-level computer system can be identical to a control device (4) of a backup of the backups of a supply network;

13

Watch-dog, especially watchdog timer (English: watchdog timer). It can be the watchdog 4104.5 of the quantum random number generator 60, 4100;

14

non-volatile memory. For example, the non-volatile memory may comprise a flash memory or an EEPROM or a ROM or the like.

15

volatile read-write memory. The read-write memory can be, for example, a RAM or an SRAM or a DRAM or an FRAM or an MRAM or the like;

16

gate drive circuitry for driving and monitoring the power switch (17);

16'

Gate drive circuitry for driving and monitoring the second power switch (17');

16''

Gate drive circuit for driving and monitoring the third power switch (17'');

16''

Gate drive circuitry for driving and monitoring the fourth power switch (17''');

17

Circuit breakers, also known as circuit breakers;

17'

second circuit breaker;

17''

third circuit breaker;

17'''

fourth circuit breaker;

18

first connection of the circuit breaker (17);

18'

first connection of the second circuit breaker (17');

18''

first terminal of the third circuit breaker (17'');

18'''

first terminal of the fourth circuit breaker (17''');

19

second connection of the circuit breaker (17);

19'

second terminal of the second circuit breaker (17');

19''

second terminal of the third circuit breaker (17'');

19'''

second terminal of the fourth circuit breaker (17''');

20

Control line for controlling the circuit breaker (17);

20'

Control line for controlling the second power switch (17');

20''

Control line for controlling the third power switch (17'');

20'''

Control line for controlling the fourth power switch (17''');

21

Monitoring line for detecting the voltage between the second terminal (19) of the circuit breaker (17) and the control line (20) of the circuit breaker (17);

21'

Monitoring line for detecting the voltage between the second terminal (19') of the second circuit breaker (17') and the control line (20') of the second circuit breaker (17');

21''

Monitoring line for detecting the voltage between the second terminal (19'') of the third power switch (17'') and the control line (20'') of the third power switch (17'');

21'''

Monitoring line for detecting the voltage between the second connection (19''') of the fourth power switch (17''') and the control line (20''') of the fourth power switch (17''');

22

Monitoring line for detecting the voltage between the first connection (18) of the circuit breaker (17) and the control line (20) of the second circuit breaker (17);

22'

Monitoring line for detecting the voltage between the first terminal (18') of the second circuit breaker (17') and the control line (20') of the second circuit breaker (17');

22''

Monitoring line for detecting the voltage between the first terminal (18'') of the third power switch (17'') and the control line (20'') of the third power switch (17''');

22'''

Monitoring line for detecting the voltage between the first terminal (18''') of the fourth power switch (17''') and the control line (20''') of the fourth power switch (17''');

23

Auxiliary circuit breakers for sensing a current proportional or otherwise equal to the current (29) through the circuit breaker (17);

23'

second auxiliary circuit breaker for sensing a current proportional or otherwise equal to the current (29') through the second circuit breaker (17');

23''

third auxiliary circuit breaker for sensing a current proportional or otherwise equal to the current (29'') through the third circuit breaker (17'');

23'''

fourth auxiliary circuit breaker for sensing a current proportional or otherwise equal to the current (29''') through the fourth circuit breaker (17''');

24

shunt resistor for detecting the current through the auxiliary circuit breaker 23;

24'

second shunt resistor for detecting the current through the second auxiliary circuit breaker 23' of the second circuit breaker (17');

24''

third shunt resistor for detecting the current through the third auxiliary circuit breaker 23'' of the third circuit breaker (17'');

24'''

fourth shunt resistor for detecting the current through the fourth auxiliary circuit breaker 23''' of the fourth circuit breaker (17''');

25

Measuring line for detecting the voltage drop across the shunt resistor 24;

25'

second measuring line for detecting the voltage drop across the second shunt resistor 24';

25''

third measuring line for detecting the voltage drop across the third shunt resistor 24'';

25'''

fourth measuring line for detecting the voltage drop across the fourth shunt resistor 24''';

26

first connection of the circuit breaker 17;

26'

first connection of the second circuit breaker 17';

26''

first connection of the third circuit breaker 17'';

26''

first connection of the fourth circuit breaker 17''';

27

control connection of the circuit breaker 17;

27'

control connection of the second circuit breaker 17';

27''

control connection of the second circuit breaker 17'';

27'''

control connection of the second circuit breaker 17''';

28

second terminal of circuit breaker 17;

28'

second connection of the second circuit breaker 17';

28''

second connection of the third circuit breaker 17'';

28'''

second connection of the fourth circuit breaker 17''';

29

current through the circuit breaker 17;

29'

current through the second power switch 17';

29''

current through the third power switch 17'';

29'''

current through the fourth power switch 17''';

30

Oscillator and clock generator which supplies the control device (4) of the relevant fuse with a clock;

35

timer and/or clock of the control device (4);

36

electrical current through the shunt resistor (24);

40

temperature sensor;

50

System of electronic security (1), data bus (9) and higher-level computer system (12)

60

Quantum random number generator (QRNG) or true random number generator (TRNG) or random number generator (RNG) or pseudo random number generator (PRNG)

70

one or more cryptography accelerators 7, for example a DES accelerator and/or an AES accelerator 7;

71

one or more manufacturer storage firewalls 8;

72

manufacturer memory;

73

Suppliers -Storage firewalls;

74

Supplier -Manufacturer store

75

Semiconductor manufacturers -Memory firewalls;

76

Semiconductor Manufacturer - Manufacturer Store

77

one or more CRC (Cyclic Redundancy Check) modules;

78

one or more timer modules;

79

one or more security monitoring circuits and security control circuits;

80

one or more reset circuits;

81

one or more ground circuits;

82

one or more input/output circuits;

200

supply network;

201

reference potential node. The reference potential node is typically the ground of the vehicle. For the sake of clarity, the reference potential node is not always drawn in the figures and is also not always denoted by the reference symbol. The circuit symbol for ground designates the reference potential node in the figures when drawn.

210

first device part of the supply network (200);

211

second device part of the supply network (200);

212

third device part of the supply network (200);

213

fourth device part of the supply network (200);

214

first fuse of the first device part (210) of the supply network (200) which can electrically connect the third line section (245) to the first line section (240) or locally separate the third line section (245) from the first line section (240);

215

second fuse of the second device part (211) of the supply network (200) which can electrically connect the third line section (245) to the first line section (240) or locally separate the third line section (245) from the first line section (240);

216

third fuse of the third device part (212) of the supply network (200) which can electrically connect the third line section (245) to the second line section (241) or locally separate the third line section (245) from the first line section (240);

217

fourth fuse of the fourth device part (213) of the supply network (200) which can electrically connect the third line section (245) to the second line section (241) or locally separate the third line section (245) from the first line section (240);

220

fifth device part of the supply network (200);

221

sixth device part of the supply network (200);

222

seventh device part of the supply network (200);

223

eighth device part of the supply network (200);

225

fifth fuse capable of disconnecting the fifth device part (220) of the supply network (200) from the first line section (240) or connecting the fifth device part (220) of the supply network (200) to the first line section (240);

226

sixth fuse capable of separating the sixth device part (221) of the supply network (200) from the first line section (240) or connecting the sixth device part (222) of the supply network (200) to the first line section (240);

227

seventh fuse capable of separating the seventh device part (222) of the supply network (200) from the first line section (240) or connecting the seventh device part (223) of the supply network (200) to the first line section (240);

228

eighth fuse capable of separating the eighth device part (223) of the supply network (200) from the first line section (240) or connecting the eighth device part (224) of the supply network (200) to the first line section (240);

230

ninth device part of the supply network (200);

231

tenth device part of the supply network (200);

232

eleventh device part of the supply network (200);

233

twelfth device part of the supply network (200);

235

ninth fuse capable of separating the ninth device part (230) of the supply network (200) from the second line section (241) or connecting the ninth device part (230) of the supply network (200) to the second line section (241);

236

tenth fuse capable of separating the tenth device part (231) of the supply network (200) from the second line section (241) or connecting the tenth device part (231) of the supply network (200) to the second line section (241);

237

eleventh fuse capable of separating the eleventh device part (232) of the supply network (200) from the second line section (241) or connecting the eleventh device part (232) of the supply network (200) to the second line section (241);

238

twelfth fuse capable of separating the twelfth device part (233) of the supply network (200) from the second line section (241) or connecting the twelfth device part (233) of the supply network (200) to the second line section (241);

240

first line section;

241

second line section;

242

fifth line section;

243

sixth line section;

245

third line section

246

fourth line section

250

first energy source;

251

second energy source;

255

thirteenth fuse capable of separating the first power source (255) of the supply network (200) from the third line section (245) or connecting the first power source (255) of the supply network (200) to the third line section (245);

256

fourteenth fuse, which can separate the second energy source (256) of the supply network (200) from the third line section (245) or connect the second energy source (256) of the supply network (200) to the third line section (245) or fourth line section (246). can;

262

Plug-in option (262) for an electronic fuse (216) of a device part (212)

270

tree starting point of the tree structure of the supply network (200);

280

first control device 4 of the first fuse (214);

281

second control device 4 of the second fuse (215);

282

third control device 4 of the third fuse (216);

283

fourth control device 4 of the fourth fuse (217);

284

fifth control device 4 of the fifth fuse (220);

285

sixth control device 4 of the sixth fuse (221);

286

seventh control device 4 of the seventh fuse (222);

287

eighth control device 4 of the eighth fuse (223);

288

ninth control device 4 of the ninth fuse (230);

289

tenth control device 4 of the tenth fuse (231);

290

eleventh controller 4 of the eleventh fuse (232);

291

twelfth control device 4 of the twelfth fuse (233);

292

thirteenth control device 4 of the thirteenth fuse (255);

293

fourteenth control device 4 of the fourteenth fuse (256);

400

fuse box;

405

electronic fuse

410

Slot for an electronic fuse (405) The slot has a first contact for the first connection (18) of the circuit breaker (17) of the electronic fuse (405). The slot has a second contact for the operating voltage connection (6) of the electronic fuse (405). The slot has a third contact for the reference potential connection (201) of the electronic fuse (405). The slot has a fourth contact for the external data bus (9) of the electronic fuse (405). The slot has a fifth contact for the second connection (19) of the circuit breaker (17) of the electronic fuse (405).

415

fuse;

420

slot for a fuse (415);

425

fuse body of the electronic fuse (415);

430

first contact (430) of the slot (410) for an electronic fuse (405), the first contact being used to connect the first terminal (18) of an electronic fuse (405);

435

fourth contact (435) of the slot (410) for an electronic fuse (405), the fourth contact being used to connect a supply voltage line for supplying energy to the control device (4) of the electronic fuse (405);

440

third contact (440) of the slot (410) for an electronic fuse (405), wherein the third contact is used to connect the data line (9) of a data interface (10) of the control circuit (4) of the electronic fuse (405);

445

fourth contact (445) of the slot (410) for an electronic fuse (405), the second contact being used to connect the second terminal (19) of an electronic fuse (405);

450

first contact of the plug connector of the fuse body (425) of the electronic fuse (405), the first contact serving to connect the first terminal (18) of an electronic fuse (405);

455

fourth contact (455) of the plug connector of the fuse body (425), the fourth contact being used to connect a supply voltage line (6) in order to supply energy to the control device (4) of the electronic fuse (405) with this fourth contact (455) of the slot ( 410) to connect electrically

460

fifth contact (460) of the plug connector of the fuse body (425), the fifth contact being used to connect a reference potential line (201) in order to supply power to the control device (4) of the electronic fuse (405) with this fifth contact (460) of the slot ( 410) to electrically connect and provide a reference potential;

470

second contact (470) of the plug connector (410) of the fuse body (425), the second contact being used to connect the second terminal (19) of an electronic fuse (405);

475

fifth contact (475) of the slot (410) for an electronic fuse (405), the fifth contact being used to connect a reference potential line for supplying energy to the control device (4) of the electronic fuse (405) and as a potential reference point;

475

Control computer which controls the fuse box (400) and/or the electronic fuses (405) via the fuse bus (9) and/or reads measured values and/or data from the fuses (405);

480

Operating voltage source for the operation of the control devices (4) of the electronic fuses (405);

485

Output of the fuse box (400) for supplying a consumer;

505

first test current source, which is provided with a first modulation signal {505} of a first signal generator (520) by means of the first control signal (510). The curly brackets are intended to indicate that {505} is the first modulation signal with which the first current (515) of the first test current source is modulated.

{505}

first modulation signal with which the first current (515) of the first test current source (505) is modulated

505'

third test current source, which is provided with a second modulation signal {505'} of a second signal generator (520') by means of the second control signal (510'). The curly brackets are intended to signal that {505'} is the second modulation signal with which the current (515) of the third test current source is modulated. Preferably, the second modulation signal {505'} is orthogonal to the first modulation signal {505} in terms of dot product $〈\left\{505\right\}|\left\{505\text{'}\right\}〉={\displaystyle {\int }_0^T\left\{505\right\}\times \left\{505\right\}\mathrm{i.e}t,}$

where T is the period of the first modulation signal {505} or the second modulation signal {505'}. The period T of the first modulation signal {505} is preferably equal to the period T of the second modulation signal {505'}. This enables the two modulation signals ({505}, {505'}) to be separated. For example, the following preferably applies $〈\left\{505\right\}|\left\{505\text{'}\right\}〉={\displaystyle {\int }_0^T\left\{505\right\}\times \left\{505\right\}\mathrm{i.e}t=\mathrm{0,}}$

which means orthogonality.

{505'}

second modulation signal is, with which the second current (515 ') of the third test current source (505) is modulated

510

first control signal of the first electronic test current source (505);

510'

third control signal of the third electronic test current source (505');

515

first additional current that the first test current source (510) feeds into the circuit breaker (17);

515'

second additional current that the test current source (510) feeds into the circuit breaker (17);

520

first signal generator of the first modulation signal {505};

520'

second signal generator of the second modulation signal {505'};

525

first correlator. The first correlator preferably includes one or more input amplifiers that detect, filter and condition the voltages between the first measuring contacts (21, 25, 27, 28, 22). The first correlator preferably includes a first synchronous demodulator, for example, which examines one of the measurable voltages for first components of the first modulation signal {505} of the first current (515) of the first test current source (505). In this case, the first synchronous demodulator of the first correlator preferably uses a correlation in the form of a scalar product, for example in accordance with the form $$A=〈\left\{505\right\}|V_{xy}\left(t\right)〉={\displaystyle {\int }_0^T\left\{505\right\}\times V_{xy}}\left(t\right)\mathrm{i.e}t$$

Here, A stands for the value of the first component and V _xy for a voltage between the first measuring contacts (21, 25, 27, 28, 22). Preferably, the first correlator uses a voltage V _xy between the second terminal (28) of the first power switch (17) and the first control terminal (27) of the first power switch (17);

525'

second correlator. The second correlator preferably includes one or more input amplifiers, which detect, filter and condition the voltages between the second measuring contacts (21', 25', 27', 28', 22'). The second correlator preferably includes a second synchronous demodulator, for example, which examines one of the measurable voltages for second components of the second modulation signal {505'} of the second current (515') of the third test current source (505'). In this case, the second synchronous demodulator of the second correlator preferably uses a correlation in the form of a scalar product, for example in accordance with the form $$A\text{'}=〈\left\{505\text{'}\right\}|V{\text{'}}_{xy}\left(t\right)〉={\displaystyle {\int }_0^T\left\{505\text{'}\right\}\times V_{xy}}\left(t\text{'}\right)\mathrm{i.e}t$$

Here, A' stands for the value of the second portion and V' _xy for a voltage between the second measuring contacts (21', 25', 27', 28', 22). Preferably, the second correlator uses a voltage V _xy between the second terminal (28') of the second power switch (17') and the second control terminal (27') of the second power switch (17');

530

first gate drive of the control contact (27) of the first power switch (17) and first control signal generation for the control signal of the control line (20) of the first power switch (17) for controlling the first power switch (17);

530'

second gate drive of the control contact (27') of the second power switch (17') and second control signal generation for the control signal of the control line (20') of the second power switch (17') for controlling the second power switch (17');

535

housing of the fuse (1);

540

optical data link;

545

optical window;

550

optical data interface;

551

additional optical data interface;

555

optical data interface, for example, of the higher-level system, in particular of the higher-level computer system (12);

560

Laser or an LED, in particular a silicon-based LED, in particular a silicon avalanche LED, in particular a SPAD diode operated as an LED;

561

second laser or second LED, in particular a silicon-based LED, in particular a silicon avalanche LED, in particular a SPAD diode operated as an LED;

565

control device

570

analog to digital converters;

575

silicon LED (560) voltage signal (575);

576

voltage signal (576) of the second silicon LED (560);

580

Optical fiber;

585

temperature sensor evaluation devices;

586

temperature sensor;

610

second data bus interface;

615

Switch for dissipating currents of the load flowing to the energy source into a current sink;

710

Computers (servers) from a service provider, in particular a computer system from an automobile manufacturer and therefore possibly also from a workshop;

720

preferably encrypted data connection between the control computer of the vehicle - z. B. a higher-level computer system 12 and a computer 710 of a service provider, in particular a computer system of the automobile manufacturer of the vehicle;

730

requesting / serving person;

740

Data input means and data output means, in particular a terminal or a PC or a laptop or a tablet or a smartphone etc.;

750

Computer (750) of another service provider or other computers of the service provider that controls the computer (710);

805

further backup;

810

second further backup;

815

first connected distribution tree;

820

second connected distribution tree;

825

electronic fuse;

830

consumer

835

further consumers;

905

second test current source which is provided with a modulation signal from a second signal generator (920) by means of the control signal (910).

905'

second test current source which is provided with a modulation signal from a second signal generator (920') by means of the control signal (910').

910

second control signal of the second electronic test current source (905);

910'

fourth control signal of the fourth electronic test current source (905');

915

additional current drawn by the second test current source (910) from the circuit breaker (17);

915'

additional current drawn by the second test current source (910') from the second power switch (17');

920

second signal generator of the modulation signal;

920'

fourth signal generator of the modulation signal;

925

limp home control;

1000

cross fuse;

1005

first supply line section of a first supply line;

1010

second supply line section of a first supply line;

1015

first supply line section of a second supply line;

1020

second supply line section of a second supply line;

1025

first electrical node;

1030

second electrical node;

1035

first electronic fuse;

1040

second electronic fuse;

1045

third electronic fuse;

1050

fourth electronic fuse;

1055

second supply line section first supply line;

1060

second supply line section second supply line;

1065

third node;

1070

fourth knot;

1110

first cross fuse

1111

second cross fuse

1112

third cross fuse

1113

fourth cross fuse

1114

fifth cross fuse

1115

sixth cross fuse

1116

seventh cross fuse

1117

eighth cross fuse

1118

ninth cross fuse

1150

first energy source;

1151

second energy source;

1152

third energy source;

1153

fourth energy source;

1154

fifth energy source;

1155

sixth energy source;

1160 to 1183

umbilical section;

1200

method of operating a fuse;

1210

Providing a supply network (250, 251, 210 to 213, 245) with an energy-supplying device part of the vehicle;

1220

supplying the power supplying device part (210) with electric power from a power source (251, 250) of the vehicle;

1230

Connecting (1230) a first terminal of a further line section (240) to the energy-supplying device part (210) of the vehicle;

1240

Connecting (1240) a second connection of the further line section (240) to a further device part (220, 221) of the vehicle;

1250

signaling a switch-on signal to the control device (280, 4) of the energy-supplying device part (210);

1260

changing the logical state of the memory to a second logical state depending on the logical state of the memory;

1270

Supplying the further device part (220 to 221) of the vehicle with electrical energy via the further line section (240) as a function of the logic state of the memory;

1280

Providing (1280) a supply network (200) with a device part (210) of the vehicle, hereinafter referred to as the energy-supplying device part (210);

1300

Method of operating a vehicle, paying for allowing adjustment of a configuration of electronic fuses;

1305

providing the vehicle;

1310

stopping (1310) the power supply to an associated electrical load by means of the corresponding fuse associated with that load;

1315

Establishing (1315) an encrypted data connection (720) between the control computer (12) of the vehicle, i.e. a higher-level computer system (12), and a computer (710) of a service provider, in particular a computer system of the automobile manufacturer of the vehicle;

1320

Authentication (1320) of the vehicle by the vehicle's control computer, i.e. a higher-level computer system (12), at the service provider's computer (710), the vehicle's authentication data being, for example, the data of the vehicle and/or the car key and/or a SIM card in the vehicle and/or a vehicle-specific password entry or password generation and/or biometric user data of a vehicle owner etc.;

1325

Authentication (1325) of the service provider's computer (710) with the vehicle's control computer, ie a higher-level computer system (12);

1330

. Authentication (1330) of the requesting person (730) by the vehicle's control computer, i.e. a higher-level computer system (12), on the service provider's computer (710), the authentication data being, for example, the data of the vehicle and/or the personalized car key, a personalized SIM card, personalized password entry, biometric user data, etc.

1335

generating (1335) or providing an activation code by the service provider's computer (710);

1340

Transmission (1340) of the activation code by the computer of the service provider (710) to the control computer of the vehicle, ie to a higher-level computer system (12);

1345

Verification (1345) of the admissibility and/or syntactical correctness and/or the situational admissibility of the activation code by the control computer of the vehicle, ie by the higher-level computer system (12);

1350

Enabling (1350) the power supply to an associated electrical consumer (220) by means of the corresponding fuse (225) if the activation code is permissible and/or syntactically correct and/or the situation is permissible;

1355

Transmission (1355) of billing data to a computer (710) of a service provider, in particular to a computer system of the automobile manufacturer, with storage information in the computer (710) of the service provider marking that the bill has not been paid;

1360

Creation (1360) of an invoice as a function of the transmitted accounting data by a computer (710) of a service provider, in particular to a computer system of the automobile manufacturer;

1365

Transmission (1365) of the invoice to a computer (710) of a service provider, in particular to a computer system (740) of the ordering person (730), or to the ordering person (730);

1370

settlement (1370) of the bill by a or the computer (710) of a or the service provider and/or the requesting person (730);

1375

marking (1375) the storage information in the service provider's computer (740) that the bill is paid;

1400

Method (1400) for operating a vehicle enabling energy sources in the vehicle;

1405

providing the vehicle;

1410

disabling (1410) the delivery of power to an associated source of electrical energy (250, 251) by means of the corresponding associated fuse (255, 260);

1415

Establishing (1415) an encrypted connection (720) between the control computer of the vehicle, ie the higher-level computer system (12), and a computer (710) of a service provider, in particular a computer system (710) of the automobile manufacturer;

1420

Authentication (1420) of the vehicle by the vehicle's control computer, i.e. by the higher-level computer system (12), at the service provider's computer (710), with the vehicle's authentication data for example the data of the vehicle and/or the car key and/or a SIM card in the vehicle and/or a vehicle-specific password entry or password generation and/or biometric user data of a vehicle owner etc.;

1425

Authentication (1430) of the service provider's computer with the vehicle's control computer, ie with the higher-level computer system (12);

1430

Authentication (1430) of the requesting person (730) by the vehicle's control computer, i.e. by the higher-level computer system (12), on the service provider's computer (710), the authentication data being, for example, the data of the vehicle and/or the personalized car key, a personalized SIM card, personalized password entry, biometric user data, etc.;

1435

generating (1435) or providing an activation code by the service provider's computer (710);

1440

Transmission (1440) of the activation code by the computer (710) of the service provider to the control computer of the vehicle, ie to the higher-level computer system (12);

1445

verification (1445) of the admissibility and/or syntactic correctness and/or the situational admissibility of the activation code by the control computer (12) of the vehicle, ie by the higher-level computer system (12);

1450

enabling (1450) an associated source of electrical energy (250, 251) to be energized via the corresponding associated fuse (255, 260);

1455

Transmission (1455) of billing data to a computer (710) of a service provider, in particular to a computer system of the automobile manufacturer, with storage information in the computer (710) of the service provider marking that the bill has not been paid;

1460

Creation (1460) of an invoice as a function of the transmitted accounting data by a computer (710) of a service provider, in particular to a computer system of the automobile manufacturer;

1465

Transmission (1465) of the invoice, in particular by a computer (710) of a service provider to a computer (750) of a service provider, in particular to a computer system of the ordering person, or to the ordering person (730 );

1470

settlement (1470) of the bill by a or the computer (750) of a or the service provider and/or the requesting person (730);

1475

marking (1475) the storage information in the service provider's computer (710) that the bill is paid;

1505

line section to be secured;

1510

Electric arc;

1515

wiring harness;

1520

Current measuring device (1520) which is inserted into the line section (1505) to be protected;

1525

electric current (1525) through the line section (1505) to be secured;

1600

Method (1600) for detecting non-extinguishing arcs (1510) in the wiring harness (1515) with line sections (485,1505) of a vehicle;

1605

Recording (1605) a time section of the time profile of the electric current (1525) through the line section (1505) to be secured and generating an associated value profile (1610) of the recorded current value of the electric current (1525) through the line section (1505) to be protected for this time section, in particular by means of a current measuring device (1520) inserted in the line section (1505);

1610

Value curve (1610) of the detected current value of the electric current (1525) through the line section (1505) to be secured for this period of time

1615

Carrying out (1615) a spectral analysis of the recorded value profile (1610) of this time segment as a function of the generated time value profile (1610) of the time profile of the electric current (1525) through the line section (1505) to be secured and generating a spectral analysis result (1620), in particular by means of the control device (4) of the electronic fuse (825) or by means of a higher-level computer system (12) or by means of a higher-level control device (12) which communicates with the control device (4) of the fuse (825) via a data bus (9) and which assumes the role of a higher-level computer system (12);

1620

spectral analysis result. The spectral analysis result is preferably a vector with numerical values. Each of the numerical values of this vector essentially includes an amplitude value of the result of the Fourier transformation and/or the Laplace transformation and/or the wavelet transformation and/or another integral transformation and/or the Z transformation of the recorded value profile over time (1610) of this time section of the time profile of the electric current (1525) through the line section (1505) to be protected for a transformation parameter value of the relevant transformation, for example a frequency or a stretching for wavelets etc. The Fourier transformation and the Laplace transformation are particularly preferred. In this case, the spectral analysis result is a vector with numerical values, each of the numerical values of this vector essentially indicating an amplitude value for a frequency or a frequency range;

1625

Using (1625) the values of the spectral analysis result (1620) of the recorded value profile (1610) of this time segment and/or values derived therefrom as the current feature vector (1630);

1630

current feature vector;

1635

Mapping (1635) of the current feature vector (1630) of the values of the spectral analysis result (1620) of the recorded value curve (1610) of this time segment to predefined feature vectors (1640) of spectral base structures from a stored set (1650) of predefined feature vectors (1640) of spectral base structures in a Base structure database (1645). This mapping preferably takes place by means of scalar product formation between these feature vectors (1640). The mapping serves to generate a spectral parameter set (1655). Such a spectral parameter set (1655) is a vector and typically comprises at least one, preferably one similarity value for a pairing, but if possible for all possible pairings from one data set of the basic structure database (1645) per pairing on the one hand and the current feature vector (1640 ) per pairing on the other hand. The data record (1640) of the basic structure database (1645) is a prototypical feature vector (1640) for example for an event of normal operation or for example for a prototypical arc (1510). The basic structure database (1645) thus preferably includes a plurality of such prototypical feature vectors (1640) of different prototypical arcs (1510), which were preferably previously measured in the laboratory. The similarity value for such a pairing can then, for example, be calculated by the control device (4) of the backup (825) using a scalar product from the value for the similarity between a predefined feature vector (1640) of the data record of the basic structure database (1645) on the one hand and the current feature vector (1630) calculate on the other hand. This similarity value is therefore preferably the similarity value of exactly one spectral base structure from the stored set (1650) of predefined feature vectors (1640) of spectral base structures in the base structure database (1645) on the one hand and the current feature vector (1630) on the other. The mapping described here preferably includes the calculation of the similarity values for a predefined feature vector (1640), better all predefined feature vectors of spectral base structures (1640) in the base structure database (1645). The control device (4) of the electronic fuse (825) and/or a higher-level control device (12) which communicates with the control device (4) of the fuse (825) via a data bus (9) and which plays the role of a higher-level computer system (12) preferably perform this mapping and generation. The similarity values calculated in this way then form a new vector, with each value of this new vector corresponding to a predefined feature vector (1640) of the predefined feature vectors (1640) of spectral base structures in the base structure database (1645) and the proportion of this predefined feature vector of the predefined feature vectors of spectral base structures (1640 ) of the basic structure database (1645) in the current feature vector (1630);

1640

predefined feature vector (1640) of a basic spectral structure within a stored set (1650) of predefined feature vectors (1640) of basic spectral structures in a basic structure database (1645). Each of these predefined feature vectors (1640) of a spectral base structure corresponds to a prototypical event. Such events can also mean "no event" or be permissible events of normal operation, but also impermissible events. Training programs preferably generate the prototypical feature vectors in the laboratory by provoking the event, in that the training programs record the current feature vectors that then occur and, if necessary, store them as prototypical vectors after post-processing. Post-processing can be, for example, clustering a plurality of feature vectors to form such a prototypical feature vector;

1645

Base structure database (1645). The base structure database (1645) preferably comprises a stored set (1650) of a singular or plurality of predefined feature vectors (1640) of spectral base structures;

1650

storing a set (1650) of predefined feature vectors (1640) of spectral basis structures in a basis structure database (1645);

1655

spectral parameter set (1655) with at least one, preferably one similarity value each for the similarity between a predefined feature vector (1640) of exactly one spectral base structure of the stored set of predefined feature vectors of spectral base structures (1625) of the base structure database (1635) on the one hand and the current feature vector on the other hand predefined, in particular all, feature vectors of spectral base structures from the stored set of predefined feature vectors of spectral base structures (1625) in the base structure database (1635). Preferably, the control device (4) or a higher-level computer system (12) or the higher-level control device (12) form these similarity values by respective mapping (1635) of the current feature vector (1630) of the values of the spectral analysis result (1620) of the recorded value curve (1610) of this time segment to predefined feature vectors (1640) of basic spectral structures from a stored set of predefined feature vectors of basic spectral structures (1650) in a basic structure database (1645). This mapping can take place in particular by means of scalar product formation between these feature vectors (1640). The calculation of the similarity values results in a spectral parameter set (1655) with at least one, preferably one similarity value each for the similarity between a predefined feature vector (1640) of exactly one spectral base structure of the stored set of predefined feature vectors of spectral base structures (1625) of the base structure database (1635) on the one hand and the current feature vector on the other hand for predefined, in particular all, feature vectors of spectral base structures from the stored set of predefined feature vectors of spectral base structures (1625) in the base structure database (1635);

1660

Evaluation (1660) of the spectral parameter set (1655) to generate an evaluation result (1665).

1665

Evaluation result (1665). For example, the control device (4) of the fuse (825) and/or the higher-level computer system (12) and/or the higher-level control device (12) can carry out this evaluation (1660) by using and executing a neural network model. The control device (4) of the electronic fuse (825) can communicate with the higher-level control device (12) and/or the higher-level computer system (12), for example via the data bus (9). Similarity values of the spectral parameter set (1655) or values derived therefrom preferably form the input values of the neural network model. The evaluation result (1665) of the evaluation (1660) then depends on the output values of the neural network model that the control device (4) of the fuse (825) and/or the higher-level computer system (12) and/or the higher-level control device (12) typically calculate ;

1670

Interrupting (1670) the current flow (1525) through the line section (1505) to be secured using the electronic fuse (825) if the evaluation result (1665) of the spectral parameter set (1640) indicates the presence of a short circuit or a plasma discharge (1510), in particular an arc , corresponds to or suggests this. This is particularly the case when an evaluation result is within an expectation interval for such a case. The expectation interval can also only be limited on one side. The control device (4) of the electronic fuse (825) and/or also the higher-level control device (12) and/or the higher-level computer system (12) preferably interrupt the current flow (1525). If necessary, communication takes place via the data bus (9) between the control device (4) of the fuse (825) and the higher-level control device (12) and/or the higher-level computer system (12). The control device (4) of the electronic fuse (825) or a higher-level control device (12) or a higher-level computer system (12), which communicate with the control device (4) of the fuse (825) via a data bus (9), preferably open the Circuit breaker (17) of the electronic fuse (825) in such a fault;

1800

Method (1800) for energy dependent configuration of a utility network (1700) ( 17 , 18 );

1805

detecting (1805) the total energy requirement of these device parts (210, 211, 220, 221, 222, 223);

1810

Comparison (1810) of the determined total energy requirement of these device parts (210, 211, 220, 221, 222, 223) of the vehicle with an upper energy consumption threshold value;

1820

Preventing (1820) the supply of electrical energy to a lower-priority energy-consuming device part (210) and/or the other device parts (220, 221) supplied with electrical energy by this lower-priority device part (210) if the determined total energy requirement of all device parts (210, 211, 220, 221, 222, 223) is or could be above the upper energy consumption threshold value or the operating state and/or the driving situation indicates this. This suppression (1820) takes place by means of the electronic safety device (255) of this device part (250);

1830

Comparison (1830) of the determined total energy requirement of these device parts (210, 211, 220, 221, 222, 223) of the vehicle with a lower energy consumption threshold value;

1840

Enabling (1840) the supply of this lower-priority energy-consuming device part (210) with electrical energy and/or the other device parts (220, 221) supplied with electrical energy by this lower-priority device part (210) if the determined total energy requirement of all device parts (210, 211, 220, 221, 222, 223) is below the lower energy consumption threshold, this enabling (1840) taking place by means of the electronic fuse (255) of this device part (250).

1905

second, subsequent line section (1905) of the cable harness (1515) to be secured;

1910

second current flow (1910) in a second, subsequent line section (1905) of the cable harness (1515) to be protected;

1915

third line section to be secured;

1920

third current flow (1920) in a third, preceding line section (1915) of the cable harness (1515) to be protected;

1925

fourth line section to be secured;

1930

fourth current flow (1930) in a fourth, subsequent line section (1925) of the cable harness (1515) to be protected;

1935

second current measuring device;

1940

third current measuring device;

1945

fourth current measuring device;

1950

first timer (35) of the first electronic fuse (825);

1955

second timer (35) of the second electronic fuse (805),

1960

third timer (35) of the third electronic fuse (1975),

1965

fourth timer (35) of the fourth electronic fuse (1980),

1970

timer of the higher-level computer system (12);

1975

third electronic fuse;

1980

fourth electronic fuse;

1985

Server (1985, 710) or terminal of a workshop and/or an automobile manufacturer and/or a service provider and/or or another user of the data determined by the supply network or a higher-level computer system (12);

1990

Data connection (1990, 740) to a server (1985, 710) of a workshop and/or an automobile manufacturer and/or a service provider

2000

Distributed measurement method (2000) for detecting the condition of a wire harness (1515) of a vehicle;

2005

synchronization (2005) of a first timer (1950) of a first electronic fuse (825) with a time standard, in particular a timer (1970) of a higher-level computer system (12);

2010

synchronization (2010) of a second timer (1955) of a second electronic fuse (805) with the time standard, in particular the timer (1970) of a higher-level computer system (12);

2015

Initiation (2015) of the following two acquisition processes at the same time values of the first timer (1950) of the first electronic fuse (825) and of the second timer (1955) of the second electronic fuse (805)

2020

Detection (2020) of the first current value of the current flow (1525) into a first line section (1505) of the cable harness (1515) to be protected, in particular by a first electronic fuse (825) and/or a first current measuring device (1520), the first control device (4) the first electronic fuse (825) has a first timer (1950);

2025

Detection (2025) of the second current value of the current flow (1910) into a second subsequent line section (1905) of the cable harness (1515) to be protected, in particular by a second electronic fuse (805) and/or a second current measuring device (1935), the second Control device (4) of the second electronic fuse (805) has a second timer (1955);

2030

Determining (2030) a first time stamp value, in particular by the first control device (4) of the first electronic fuse (825) and in particular with the aid of the first timer (1950) of the first electronic fuse (825), for each measured value or for a group of measured values the current values of the current flow (1525);

2035

Determining (2035) a second time stamp value, in particular by the second control device (4) of the second electronic fuse (805) and in particular with the aid of the first timer (1955) of the first electronic fuse (805), for each measured value or for a group of measured values the current values of the current flow (1910);

2040

Transmission (2040) of at least one second measured value together with the second time stamp value from the second fuse (805) to a higher-level computer system (12) or to the control device (4) of the first electronic fuse (825) and in the case of transmission of the second measured value a host computer system (12) transmitting (2025) the first measurement along with the first time stamp value from the first backup (825) to the host computer system (12);

2045

comparing (2045) the first measurement to the second measurement;

2050

Conclusion (2050) to an energy loss in line sections (1525) between two electronic fuses (825, 805), in particular if the difference between the first measured value and the second measured value is outside a permitted difference value interval and/or if a quotient from the first Measured value and the second measured value is outside a permitted quotient interval.

2055

Taking (2055) countermeasures, in particular by the higher-level computer system (12) or the computer core (2) of the evaluating control device (4) of the evaluating electronic fuse (825), if the measured values or the ratio of the measured values to one another or a difference between them Measured values or quantities derived from them do not correspond to one or more expected values and/or are not within an expected value interval

2060

Establishing (2060) a data connection to a server (710) of a workshop and/or an automobile manufacturer and/or a service provider;

2065

Transmission (2065) of the vehicle data and/or operating data and/or measured values and/or damage data to a server (1985) or a terminal of the workshop or another user of this data;

2070

Prediction (2070) of the failure probability of a device part of the vehicle using the vehicle data and/or operating data and/or measured values and/or damage data;

2075

Transmission (2075) of the prognosis result to a server (1985) and/or a workshop terminal and/or a terminal (740) and/or a vehicle owner's computer (730) and/or a terminal (740) and/or a computer a vehicle driver (730) or a terminal and/or server (710) of an automobile manufacturer and/or a terminal and/or server of a logistics company and/or a terminal and/or server of another user of this data;

2080

providing (2080) a replacement part for the device part of the vehicle in the event of a prognosis result that indicates failure of the device part;

2085

Close (2085) the temperature of a line section (1915, 1925, 1505, 1905) and/or an excess temperature of a line section (1915, 1925, 1505, 1905) using the detected current values of the current flow (1920, 1925, 1525, 1910) in several line sections (1915, 1925, 1505, 1905) of the cable harness (1515) to be secured.

2100

battery (2100) with diagnostic function for a vehicle;

2105

first battery cell module (2105);

2120

connection between the first terminal (2125) and the first terminal (18) of the circuit breaker (17) of the first fuse (825) of the battery (2100, 2200);

2121

electrical current in the connection (2120) between the first terminal (2125) and the first terminal (18) of the circuit breaker (17) of the first fuse (825) of the battery (2100, 2200);

2125

first terminal (2125) of the first battery cell module (2105);

2130

second connection (2130) of the first battery cell module (2105);

2135

first terminal of the first electrochemical cell, the first battery cell (2145), the first battery cell module (2105);

2140

second terminal of the first electrochemical cell, the first battery cell (2145), the first battery cell module (2105);

2145

first electrochemical cell, the first battery cell, of the first battery cell module (2105);

2155

second battery cell module (2155);

2160

connection between the first terminal (2165) and the first terminal (18) of the circuit breaker (17) of the second fuse (805) of the battery (2100, 2200);

2161

electric current in the connection (2160) between the first terminal (2165) and the first terminal (18) of the circuit breaker (17) of the second fuse (805) of the battery (2100, 2200)

2165

first connection (2165) of the second battery cell module (2155);

2170

second connection (2170) of the second battery cell module (2155);

2175

first terminal of the second electrochemical cell, the second battery cell (2184), the second battery cell module (2155);

2180

second terminal of the second electrochemical cell, the second battery cell (2185), the second battery cell module (2155);

2185

second electrochemical cell, the second battery cell, of the second battery cell module (2155);

2190

Connection between the second terminal (2130) of the first battery cell module (2105) and the first terminal (2165) of the second battery cell module (2155);

2196

connecting the second terminal (2195) of the battery (2100, 2200) to the second terminal (2170) of the second battery cell module (2155);

2197

first terminal (2197) of the battery (2100);

2198

connecting the first terminal (2197) of the battery (2100, 2200) to the first terminal (2125) of the first battery cell module (2105);

2199

battery case;

2200

Battery (2200), in which an electronic fuse (825) of the battery (2200) has a second circuit breaker (17') which is suitable for closing the battery cell module (2105) assigned to the fuse when the second circuit breaker (17') is closed bridge.

2220

Housing of the battery or the battery cell module;

2225

Connection of the battery (2200) of the battery cell module for the operating voltage (6) of the electronic fuses (825, 805);

2230

Connection of the battery (2200) of the battery cell module for the reference potential node (201) of the electronic fuses (825, 805);

2235

Connection of the battery (2200) of the battery cell module for the external data bus (9) of the electronic fuses (825, 805);

2300

Battery cell module with one battery cell (2145)

2305

first battery cell terminal (2305);

2310

second battery cell terminal (2310);

2320

Connection of the battery cell module (2105) for the operating voltage (6) of the electronic fuse (825);

2325

Connection of the battery cell module (2105) for the reference potential node (201) of the electronic fuse (825);

2330

Connection of the battery cell module (2105) for the external data bus (9) of the electronic fuse (825);

2500

Battery cell module with multiple battery cells (2145, 2185). In the sense of the document presented here, the battery cell module corresponds to the battery cell module (2105);

2505

connector. The exemplary connector has a first contact (6) for the operating voltage connection (6) of the electronic fuses (825, 805). The connector has a second contact (201) for the reference potential connection (201) of the electronic fuses (805, 815). The connector has a third contact (9) for the external data bus (9) of the electronic fuses (805, 815);

2600

housed battery cell module;

2605

common housing of the battery cell module (2600) for an electronic fuse (825) and an inner battery cell module (2105);

2610

first terminal of the battery cell module (2600), which is typically connected to the first terminal (2125) of the internal battery cell module (2105) within the housing (2605) of the battery cell module (2600);

2615

second terminal of the battery cell module (2600), which is typically connected to the second terminal (2130) of the inner battery cell module (2105) within the housing (2605) of the battery cell module (2600);

2620

Connection of the battery cell module (2600) for the operating voltage (6) of the electronic fuse (825) of the inner battery cell module (2105);

2625

Connection of the battery cell module (2600) for the reference potential node (201) of the electronic fuse (825) of the internal battery cell module (2105);

2630

Connection of the battery cell module (2600) for the external data bus (9) of the electronic fuse (825) of the internal battery cell module (2105);

2635

exemplary optical fiber within the housing (2605);

2640

Optical connector system for the pluggable optical connection between the external optical fiber (580) outside the housing (2605) and the optical fiber (2635) inside the housing (2605);

2700

Battery (2700), in which an electronic fuse (825) of the battery (2200) has a second circuit breaker (17') which is suitable for closing the battery cell module (2105) assigned to the fuse when the second circuit breaker (17') is closed bridge and in which the control device from the battery cell (2145) is supplied, even if the circuit breaker (17) is open.

2800

Battery (2800), in which an electronic fuse (825) of the battery (2200) has a second circuit breaker (17') which is suitable for closing the battery cell module (2105) assigned to the fuse when the second circuit breaker (17') is closed bridge and in which the control device (4) from the battery cell (2145) continues to be supplied, even if the circuit breaker (17) is open.

2900

Supply network (2900), one or more supply branches of the supply network (2900) for supplying electrical consumers (2930 to 2933)) with electrical energy as a ring of a supply line (2910 to 2915), in particular if e.g. a body is used as a return ground line, and/ or are designed as two rings of two supply lines and/or one or more supply branches of the supply network for supplying electrical energy from electrical energy sources (2940 to 2941) as a ring of a supply line (2910 to 2915), if e.g. a body is used as a return ground line, and/or are designed as two rings of two supply lines.

2910

first line section (2910) of the supply line ring, the first line section connecting the energy feed point (2924) of the first energy source (2940) to the first energy extraction point (2920) of the first consumer (2930) in the example of 29 electrically connects, wherein the return line may be, for example, the vehicle body;

2911

second line section (2911) of the supply line ring, the second line section connecting the first energy extraction point (2920) of the first consumer (2930) to the second energy extraction point (2921) of the second consumer (2931) in the example of 29 electrically connects, wherein the return line may be, for example, the vehicle body;

2912

third line section (2912) of the supply line ring, the third line section connecting the second energy extraction point (2921) of the second consumer (2931) to the third energy extraction point (2922) of the third consumer (2932) in the example of 29 electrically connects, wherein the return line may be, for example, the vehicle body;

2913

fourth line section (2913) of the supply line ring, the fourth line section connecting the third energy extraction point (2922) of the third consumer (2932) to the third energy extraction point (2922) of the third consumer (2933) in the example of 29 electrically connects, wherein the return line may be, for example, the vehicle body;

2914

fifth line section (2914) of the supply line ring, the fifth line section connecting the fourth energy extraction point (2923) of the fourth consumer (2933) to the second energy feed point (2925) of the second energy source (2941) in the example of 29 electrically connects, wherein the return line may be, for example, the vehicle body;

2915

sixth line section (2915) of the supply line ring, the sixth line section connecting the second energy feed point (2925) of the second energy source (2941) to the first energy feed point (2924) of the first energy source (2940) in the example of 29 electrically connects, wherein the return line may be, for example, the vehicle body;

2920

first energy extraction point for supplying the first consumer (2930) with electrical energy from the supply line ring (2910 to 2915), the return line being able to be the vehicle body, for example;

2921

second energy extraction point for supplying the second consumer (2931) with electrical energy from the supply line ring (2910 to 2915), the return line being able to be the vehicle body, for example;

2922

third energy extraction point for supplying the third consumer (2932) with electrical energy from the supply line ring (2910 to 2915), the return line being able to be the vehicle body, for example;

2923

fourth energy extraction point for supplying the fourth consumer (2933) with electrical energy from the supply line ring (2910 to 2915), the return line being able to be the vehicle body, for example;

2924

first energy feeding point for feeding the energy of the first energy source (2940) into the supply line ring (2910 to 2915), wherein the return line can be, for example, the vehicle body;

2925

second energy feeding point for feeding the energy of the second energy source (2941) into the supply line ring (2910 to 2915), the return line being able to be the vehicle body, for example;

2930

first consumer of the exemplary 29 ;

2931

second consumer of the exemplary 29 ;

2932

third consumer of the exemplary 29 ;

2933

fourth consumer of the exemplary 29 ;

2940

first energy source of the exemplary 29 ;

2941

second energy source of the exemplary 29 ;

2950

first fuse of the first energy source (2940), wherein the first fuse can separate the first energy feed point (2924) from the first line section (2910) of the supply line ring (2910 to 2915) or wherein the first fuse connects the first energy feed point (2924) to the first line section (2910) of the supply line ring (2910 to 2915) and this disconnection or connection of the electrical current through the first fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the first fuse relative to a reference potential and /or depends on a data command via the backup data bus (9);

2951

second fuse of the first energy source (2940), wherein the second fuse can separate the first energy feed point (2924) from the sixth line section (2915) of the supply line ring (2910 to 2915) or wherein the second fuse connects the first energy feed point (2924) to the sixth line section (2915) of the supply line ring (2910 to 2915) and this isolating or connecting the electrical current through the second fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the second fuse relative to a reference potential and /or depends on a data command via the backup data bus (9);

2952

third fuse of the second energy source (2941), wherein the third fuse can separate the second energy feed point (2925) from the sixth line section (2915) of the supply line ring (2910 to 2915) or wherein the third fuse connects the second energy feed point (2925) to the sixth line section (2915) of the supply line ring (2910 to 2915) and this disconnection or connection of the electrical current through the third fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the third fuse relative to a reference potential and /or depends on a data command via the backup data bus (9);

2953

fourth fuse of the second energy source (2941), wherein the fourth fuse can separate the second energy feed point (2925) from the fifth line section (2914) of the supply line ring (2910 to 2915) or wherein the fourth fuse connects the second energy feed point (2925) to the fifth line section (2914) of the supply line ring (2910 to 2915) and this disconnection or connection of the electrical current through the fourth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the fourth fuse relative to a reference potential and /or depends on a data command via the backup data bus (9);

2950

thirteenth fuse of the first energy source (2940), wherein the thirteenth fuse can separate the first energy feed point (2924) from the first line section (2910) of the supply line ring (2910 to 2915) or wherein the thirteenth fuse connects the first energy feed point (2924) to the first line section (2910) of the supply line ring (2910 to 2915) and this disconnection or connection of the electrical current through the thirteenth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the thirteenth fuse relative to a reference potential and /or depends on a data command via the backup data bus (9). The thirteenth fuse (2950) and the fourteenth fuse (2951) can have a common control device (4);

2951

fourteenth fuse of the first energy source (2940), wherein the fourteenth fuse can separate the first energy feed point (2924) from the sixth line section (2915) of the supply line ring (2910 to 2915) or wherein the fourteenth fuse connects the first energy feed point (2924) to the sixth line section (2915) of the supply line ring (2910 to 2915) and this disconnection or connection of the electric current through the fourteenth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the fourteenth fuse relative to a reference potential and /or depends on a data command via the backup data bus (9). The thirteenth fuse (2950) and the fourteenth fuse (2951) can have a common control device (4);

2952

fifteenth fuse of the second energy source (2941), wherein the fifteenth fuse can separate the second energy feed point (2925) from the sixth line section (2915) of the supply line ring (2910 to 2915) or wherein the fifteenth fuse can separate the second energy feed point (2925) with the sixth line section (2915) of the supply line ring (2910 to 2915) and this disconnection or connection of the electrical current through the fifteenth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the fifteenth fuse relative to a reference potential and /or depends on a data command via the backup data bus (9). The fifteenth fuse (2952) and the sixteenth fuse (2953) can have a common control device (4);

2953

Sixteenth fuse of the second energy source (2941), wherein the sixteenth fuse can separate the second energy feed point (2925) from the fifth line section (2914) of the supply line ring (2910 to 2915) or wherein the sixteenth fuse can separate the second energy feed point (2925) with the fifth line section (2914) of the supply line ring (2910 to 2915) and this disconnection or connection of the electric current through the sixteenth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the sixteenth fuse relative to a reference potential and /or depends on a data command via the backup data bus (9). The fifteenth fuse (2952) and the sixteenth fuse (2953) can have a common control device (4);

2960

fifth fuse of the first consumer (2930), wherein the fifth fuse can separate the first energy extraction point (2920) from the first line section (2910) of the supply line ring (2910 to 2915) or wherein the fifth fuse connects the first energy extraction point (2930) to the first line section (2910) of the supply line ring (2910 to 2915) and this disconnection or connection of the electrical current through the fifth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the fifth fuse relative to a reference potential and /or depends on a data command via the backup data bus (9). The fifth fuse (2960) and the sixth fuse (2961) can have a common control device (4);

2961

sixth fuse of the first consumer (2930), wherein the sixth fuse can separate the first energy extraction point (2920) from the second line section (2911) of the supply line ring (2910 to 2915) or wherein the sixth fuse connects the first energy extraction point (2930) to the second line section (2911) of the supply line ring (2910 to 2915) and this disconnection or connection of the electrical current through the sixth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the sixth fuse relative to a reference potential and /or depends on a data command via the backup data bus (9). The fifth fuse (2960) and the sixth fuse (2961) can have a common control device (4);

2962

seventh fuse of the second consumer (2931), wherein the seventh fuse can separate the second energy extraction point (2921) from the second line section (2911) of the supply line ring (2910 to 2915) or wherein the seventh fuse connects the second energy extraction point (2921) to the second line section (2911) of the supply line ring (2910 to 2915) and this disconnection or connection of the electric current through the seventh fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the seventh fuse relative to a reference potential and /or depends on a data command via the backup data bus (9). The seventh fuse (2962) and the eighth fuse (2963) can have a common control device (4);

2963

eighth fuse of the second consumer (2931), wherein the eighth fuse can separate the second energy extraction point (2921) from the third line section (2912) of the supply line ring (2910 to 2915) or wherein the eighth fuse connects the second energy extraction point (2921) to the third line section (2912) of the supply line ring (2910 to 2915) and this disconnection or connection of the electrical current through the eighth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the eighth fuse relative to a reference potential and /or depends on a data command via the backup data bus (9). The seventh fuse (2962) and the eighth fuse (2963) can have a common control device (4);

2964

ninth fuse of the third consumer (2932), wherein the ninth fuse can separate the third energy extraction point (2922) from the third line section (2912) of the supply line ring (2910 to 2915) or wherein the ninth fuse can separate the third energy extraction point (2922) with the third line section (2912) of the supply line ring (2910 to 2915) and this disconnection or connection of the electrical current through the ninth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the ninth fuse relative to a reference potential and /or depends on a data command via the backup data bus (9). The ninth fuse (2964) and the tenth fuse (2965) can have a common control device (4);

2965

tenth fuse of the third consumer (2932), wherein the tenth fuse can separate the third energy extraction point (2922) from the fourth line section (2913) of the supply line ring (2910 to 2915) or wherein the tenth fuse can separate the third energy extraction point (2922) with the fourth line section (2913) of the supply line ring (2910 to 2915) and this disconnection or connection of the electrical current through the tenth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the tenth fuse relative to a reference potential and /or depends on a data command via the backup data bus (9). The ninth fuse (2964) and the tenth fuse (2965) can have a common control device (4);

2966

eleventh fuse of the fourth consumer (2933), wherein the eleventh fuse can separate the fourth energy extraction point (2923) from the fourth line section (2913) of the supply line ring (2910 to 2915) or wherein the eleventh fuse can separate the fourth energy extraction point (2923) with the fourth line section (2913) of the supply line ring (2910 to 2915) and this disconnection or connection of the electrical current through the eleventh fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the eleventh fuse relative to a reference potential and /or depends on a data command via the backup data bus (9). The eleventh fuse (2966) and the twelfth fuse (2967) can have a common control device (4);

2967

twelfth fuse of the fourth consumer (2933), the twelfth fuse being able to separate the fourth energy extraction point (2923) from the fifth line section (2914) of the supply line ring (2910 to 2915) or the twelfth fuse connecting the fourth energy extraction point (2923) to the fifth line section (2914) of the supply line ring (2910 to 2915) and this disconnection or connection of the electrical current through the twelfth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the twelfth fuse relative to a reference potential and /or depends on a data command via the backup data bus (9). The eleventh fuse (2966) and the twelfth fuse (2967) can have a common control device (4);

2970

Log table or log file for the errors and faults and, if applicable, other operating parameters;

2971

timer of the higher-level computer system (12);

3010

first fuse slot for the first consumer (2930) with two fuses (2960, 2961) and the first plug connection (3020);

3010'

first triple fuse and/or first fuse slot for the first consumer (2930) with two fuses (2960, 2961) and first plug connection (3020);

3011

second fuse slot for the second consumer (2931) with two fuses (2962, 2963) and second connector (3021);

3011'

second triple fuse and/or second fuse slot for the second consumer (2931) with two fuses (2962, 2963) and second plug connection (3021);

3012

third fuse slot for the third consumer (2932) with two fuses (2964, 2965) and third connector (3022);

3012'

third triple fuse and/or third fuse slot for the third consumer (2932) with two fuses (2964, 2965) and third plug connection (3022);

3013

fourth fuse slot for the fourth consumer (2933) with two fuses (2966, 2967) and fourth plug connection (3023);

3013'

fourth triple fuse and/or fourth fuse slot for the fourth consumer (2933) with two fuses (2966, 2967) and fourth plug connection (3023);

3014

fifth fuse slot for the first energy source (2940) with two fuses (2950, 2951) and fifth plug connection (3024);

3014'

fifth triple fuse and/or fifth fuse slot for the first energy source (2940) with two fuses (2950, 2951) and fifth plug connection (3024);

3015

sixth fuse slot for the second energy source (2941) with two fuses (2952, 2953) and sixth plug connection (3025);

3015'

sixth triple fuse and/or sixth fuse slot for the second energy source (2941) with two fuses (2952, 2953) and sixth plug connection (3025);

3020

first connector with first plug and first socket for connecting and supplying the first consumer (2930);

3021

second connector with second plug and second socket for connecting and supplying the second consumer (2931);

3022

third connector with third plug and third socket for connecting and supplying the third consumer (2932);

3023

fourth connector with fourth plug and fourth socket for connecting and supplying the fourth consumer (2933);

3024

fifth plug-in connection with fifth plug and fifth socket for connecting and feeding in the first energy source (2940);

3025

sixth plug-in connection with sixth plug and sixth socket for connecting and feeding in the second energy source (2941);

3100

Supply network with the ability to isolate line sections (2910 to 2915) and the ability to isolate consumers (2930 to 2933) and the ability to isolate energy sources (2940 to 2941);

3110

seventeenth fuse of the first consumer (2930), the seventeenth fuse the first energy extraction point (2920) on the one hand from the first consumer (2930) or from the first plug connection (3020) with the first plug and the first socket for the connection and the supply of the first consumer (2930) on the other hand, or wherein the seventeenth fuse connects the first energy extraction point (2920) to the first consumer (2930) or to the first plug-in connection (3020) with the first plug and the first socket for the connection and the On the other hand, the supply of the first consumer (2930) can be connected and this disconnection or connection of the electrical current through the seventeenth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the seventeenth fuse or in the area of the first plug connection (3020) relative to a reference potential and/or a data command via the fuse data bus (9). The seventeenth fuse and the fifth fuse (2960) and the sixth fuse (2961) can have a common control device (4);

3111

eighteenth fuse of the second consumer (2931), the eighteenth fuse the second energy extraction point (2921) on the one hand from the second consumer (2931) or from the second plug connection (3021) with the second plug and the second socket for the connection and the supply of the second consumer (2931) on the other hand, or wherein the eighteenth fuse connects the second energy extraction point (2921) on the one hand to the second consumer (2931) or to the second plug-in connection (3021) with the second plug and the second socket for the connection and the supply of the second consumer (2931) on the other hand, and this disconnection or connection of the electrical current through the eighteenth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the eighteenth fuse or in the area of the second plug connection (3021) relative to a reference potential and/or a data command via the fuse data bus (9). The eighteenth fuse and the seventh fuse (2962) and the eighth fuse (2963) can have a common control device (4);

3112

nineteenth fuse of the third consumer (2932), the nineteenth fuse the third energy extraction point (2922) on the one hand from the third consumer (2932) or from the third plug connection (3022) with the third plug and the third socket for the connection and the supply of the third consumer (2932) on the other hand, or wherein the nineteenth fuse connects the third energy extraction point (2922) on the one hand to the third consumer (2932) or to the third plug connection (3022) with the third plug and the third socket for the connection and the On the other hand, the supply of the third consumer (2932) can be connected and this disconnection or connection of the electrical current through the nineteenth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the nineteenth fuse or in the area of the third plug connection (3022) relative to a reference potential and/or a data command via the fuse data bus (9). The nineteenth fuse and the ninth fuse (2964) and the tenth fuse (2965) can have a common control device (4);

3113

twentieth fuse of the fourth consumer (2933), the twentieth fuse the fourth energy extraction point (2923) on the one hand from the fourth consumer (2933) or from the fourth plug connection (3023) with the fourth plug and the fourth socket for the connection and the supply the fourth consumer (2933) on the other hand, or where the twentieth fuse connects the fourth energy extraction point (2923) to the fourth consumer (2933) or to the fourth plug-in connection (3023) with the fourth plug and the fourth socket for the connection and the Supply of the fourth consumer (2933) on the other hand can connect and this disconnection or connection of the electric current through the twentieth fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the twentieth fuse or in the area of the fourth plug connection (3023) relative to a reference potential and/or a data command via the fuse data bus (9). The twentieth fuse and the eleventh fuse (2966) and the twelfth fuse (2966) can have a common control device (4);

3120

twenty-first fuse of the first energy source (2940), the twenty-first fuse the first energy feed point (2924) on the one hand from the first energy source (2940) or from the fifth plug-in connection (3024) with the fifth plug and the fifth socket for the connection and the supply the first energy source (2940) on the other hand, or where the twenty-first fuse connects the fifth energy extraction point (2924) to the first energy source (2940) or to the fifth plug-in connection (3024) with the fifth plug and the fifth socket for the connection and the On the other hand, the supply of the first energy source (2940) can be connected, and this disconnection or connection of the electrical current through the twenty-first fuse and/or the electrical voltage of the supply line ring (2910 to 2915) in the area of the twenty-first fuse or in the area of the fifth plug-in connection (3024) relative to a reference potential and/or a data command via the fuse data bus (9). The twenty-first fuse and the thirteenth fuse (2950) and the fourteenth fuse (2951) may have a common control device (4);

3121

twenty-second fuse of the second energy source (2941), the twenty-second fuse the second energy feed point (2925) on the one hand from the second energy source (2941) or from the sixth plug connection (3025) with the sixth plug and the sixth socket for the connection and the supply the second energy source (2941) on the other hand, or where the twenty-second fuse connects the sixth energy extraction point (2925) to the second energy source (2941) or to the sixth plug-in connection (3025) with the sixth plug and the sixth socket for the connection and the On the other hand, the supply of the second energy source (2941) can be connected and this disconnection or connection of the electric current through the twenty-second fuse and/or the electric voltage of the supply line ring (2910 to 2915) in the area of the twenty-second fuse or in the area of the sixth plug-in connection (3025) relative to a reference potential and/or a data command via the fuse data bus (9). The twenty-second fuse and the fifteenth fuse (2952) and the sixteenth fuse (2953) may have a common control device (4);

3200

Supply network having a first sub-supply network (3201) and a second sub-supply network (3202). The first sub-supply network (3201), for example, has high voltage values greater than 50V of the voltage between supply line sections (3260 to 3265) of the first sub-supply network (3201) on the one hand and a reference potential (201) or the supply line sections (3260 to 3265) of the second sub-supply network (3202) on the other . The second sub-supply network (3202) has, for example, low voltage values of less than 50V of the voltage between supply line sections (3266 to 3278) of the second sub-supply network (3202) on the one hand and a reference potential (201);

3201

first sub-supply network of the supply network (3200). The first sub-supply network (3201) has, for example, high voltage values greater than 50V of the voltage between supply line sections (3260 to 3265) of the first sub-supply network (3201) on the one hand and a reference potential (201) or the supply line sections (3260 to 3265) of the second sub-supply network (3202) on the other ;

3202

second sub-supply network of the supply network (3200). The second sub-supply network (3202) has, for example, low voltage values of less than 50V of the voltage between supply line sections (3266 to 3278) of the second sub-supply network (3202) on the one hand and a reference potential (201);

3206

Operating voltage for the fuses in the HV supply sub-network (3201);

3210

first cross fuse in the first supply subsystem (3201) for voltages greater than 50V;

3211

second cross fuse in the first supply network (3201) for voltages greater than 50V

3212

Third cross-fuse in the first supply network (3201) for voltages greater than 50V

3213

fourth cross-fuse in the second supply sub-network (3202) for voltages less than 50V;

3214

fifth cross-fuse in the second supply sub-network (3202) for voltages less than 50V;

3215

sixth cross-fuse in the second supply sub-network (3202) for voltages less than 50V;

3216

seventh cross fuse in the second supply subsystem (3202) for voltages less than 50V;

3217

eighth cross-fuse in the second supply sub-network (3202) for voltages less than 50V;

3218

ninth cross-fuse in the second partial supply network (3202) for voltages of less than 50V;

3250

first energy source in the first partial supply network (3201) for voltages greater than 50V;

3251

second energy source in the first partial supply network (3201) for voltages greater than 50V;

3252

third energy source in the second partial supply network (3202) for voltages of less than 50V;

3253

fourth energy source in the second partial supply network (3202) for voltages of less than 50V;

3254

fifth energy source in the second partial supply network (3202) for voltages of less than 50V;

3255

sixth energy source in the second partial supply network (3202) for voltages of less than 50V;

3260 to 3265

Supply line section in the first partial supply network (3201) for voltages greater than 50V;

3266 to 3278

Supply line section in the second partial supply network (3202) for voltages of less than 50V;

3280

Operating voltage source for the operation of the control devices (4) of the electronic fuses (405) in the first HV supply part network (3201);

3290

optical data bus for galvanic isolation;

3300

Utility Network (3300) similar 31 to explain the prioritization of consumers and energy sources and a favorable topology of the supply network to support this prioritization;

3400

Method (3400) for active power management in a supply network (1100) with electrical fuses (1110 to 1118) for supplying electrical consumers (1121 to 1125) in this supply network (1100) with electrical energy from one or more electrical energy sources (1150 to 1155 );

3410

detecting (3410) the value of the electrical currents (29) through one or more circuit breakers (17) of one or more electronic fuses of the fuses (1110 to 1118) of the supply network (1100);

3420

detecting (3420) the value of the voltage difference between a terminal (26, 27, 28) of this circuit breaker (17) against a reference potential (201) of a reference potential contact;

3430

Calculation (3430) of the theoretical ground offset as a result of the energizing of the circuit breakers by the respective computer core of the respective control device of the respective fuse using modeling;

3440

correcting (3440) the corresponding voltage readings for the theoretical ground offset;

3450

inferring (3450) state parameters of supply line sections of the supply line sections (3260 to 3278) with the aid of the parameters thus detected, such as current values and voltage values;

3460

determining (3460) the temperature using a known temperature coefficient of the conduit material of the umbilical section of the umbilical sections (3260 to 3278) and the known design data;

3500

Method (3500) for operating a vehicle with configuration variants that set the fuses.

3505

Providing (3505) a vehicle with a supply network (3300) for supplying electrical consumers (2930, 2931) of the vehicle with electrical energy. The vehicle has one or more energy sources (2940, 2941), one or more consumers (2930, 2931) and several electronic fuses (2960 to 2963 and 2959 to 2953). The consumers (2930, 2931) are preferably connected to the one or more energy sources (2940, 2941) by means of supply lines (2915, 2910, 2911). The consumers (2930, 2931) and the energy sources (2940, 2941) are preferably connected to one another together with the supply lines (2915, 2910, 2911) in a tree structure (3300) or a network. The tree structure subtrees or the network preferably includes subnetworks ([2915, 3015, 3025, 2941]; [2940, 3024, 3014, 2910, 3010, 3020, 2930]; [2911, 3011, 2931]). Firstly, electronic fuses (2960 to 2963 and 2959 to 2953) are preferably inserted in supply lines, so that these sub-trees of the tree structure can be separated from the rest of the tree structure or can be connected to this remaining tree structure and/or secondly, electronic fuses (2916, 2962, 2951, 2952) inserted into supply lines, so that these partial networks ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) of the network (3300) separate from the rest of the network (3300) or with this rest of the network (3300) can connect. These sub-networks ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) and/or sub-trees then typically essentially no longer have any energy supply and/or no energy consumption after a separation;

3510

Programming (3510) of certain trim levels. A first equipment variant of these equipment variants of the vehicle differs from a second equipment variant of these equipment variants of the vehicle preferably in that at least one electronic fuse of these electronic fuses (2916, 2962, 2951, 2952) has a subtree of the tree structure or a subnetwork ([2915 , 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) of the network (3300) in the first equipment variant from the remaining tree structure or the remaining network (3300) separated and in the second equipment variant with the remaining tree structure or The rest of the network (3300) connects, so that the energy source fully connects this subtree or subnetwork ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) with electrical energy from the energy source only in the second equipment variant can supply or this sub-tree or this sub-network ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) only in the second equipment variant an electrical energy consumption of one or more electrical consumers (29319 of the relevant sub-network ( [2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]). Possibly programming (3510) of specific equipment variants by transmitting programming data to control devices (4) of electronic fuses via a data bus (9);

3515

encrypted communication (3515) via the control data bus (9) for programming the equipment variants and/or communication via the control data bus (9) for programming the equipment variants only after transmission of a password to the control device (4) of the corresponding electronic security device;

3520

transmitting (3520) authentication data to a server (710) of an unlock code provider;

3525

verification (3525) of the transmitted authentication data;

3530

generating (3530) an activation code using this or other authentication data according to a fixed method and providing the activation code;

3535

optionally purchasing (3535) an unlock code via a data connection to the unlock code provider's server;

3540

Transmission (3540) of the activation code to a higher-level computer system (12) of the vehicle;

3545

Transmission (3545) of an activation code for an equipment variant based on the activation code received from the higher-level computer system (12) to the control device (4) of the electronic security and programming (3510) of the activated equipment variant.

3550

Detecting (3550) and determining the energy flowing through an electronic fuse in a partial supply branch ([2915, 3015, 3025, 2941]; [2911, 3011, 3021, 2931]) of the supply tree (3300) as a measured value of the amount of energy and/or the underlying readings in the electronic fuse;

3555

reading (3555) the measured value of the determined amount of energy and/or the underlying measured values from the electronic fuse;

3560

Transmission (3560) of the measured value of the determined amount of energy and/or the underlying measured values via a data transmission link (720), which is preferably encrypted, from the higher-level computer system (12) to a computer (750) of a service provider, for example an energy supplier or its vicarious agents;

3665

Creation (3565) of an invoice based on the transmitted measured value of the determined amount of energy and/or the underlying measured values;

3570

determining (3570) the topology of the utility network using electronic fuses of the utility network;

3575

Comparison (3575) of the determined topology of the supply network with the equipment variant that is valid or to be set in order to check the plausibility of the equipment variant or the admissibility of the determined topology of the supply network.

3900

Exemplary SPAD diode 30 for use as a sensor element of a single photon detector;

3941

Isolation, such as shallow trench isolation STI 3941 of example SPAD diode 3954, 3955 or LOCOS isolation;

3942

anode contact 3942 of example SPAD diode 3954, 3955;

3943

Cathode contact 3943 of example SPAD diode 3954, 3955. Cathode contact 3943 of example SPAD diode 3954, 3955 is preferably made of indium tin oxide (ITO) or other transparent and electrically conductive material;

3944

Optical fiber 3944 for transporting the photons of the first SPAD diode 3954 to the second SPAD diode 3955. The optical fiber 3944 is made of a cap oxide 3944 or optically transparent insulating layer 3944 of the exemplary SPAD diode 3954, 3955;

3945

Highly doped first connection region 3945 of a first conductivity type, also referred to as n+ S/D implantation. In a CMOS technology with a p-doped wafer material, this can be an n+-doped region in the semiconducting substrate material of the SPAD diode 3954, 3955, for example;

3946

first doped well 3946 of a second conductivity type. In a CMOS technology with a p-doped wafer material, it can be, for example, a p − -doped region in the semiconducting substrate material of the SPAD diode 3944, 3955;

3947

second doped well 3947 of a second conductivity type. In a CMOS technology with a p-doped wafer material, this can be a p--doped region in the semiconducting substrate material of the SPAD diode 3954, 3955, for example;

3948

second conductivity type epitaxial layer 3948 . In a CMOS technology with a p-doped wafer material, this can be a p-doped epitaxial layer in the semiconducting substrate material of the SPAD diode 3954, 3955, for example;

3949

Base material 3949 of the semiconducting single crystal wafer having a second conductivity type. In a CMOS technology with a p-doped wafer material, this is, for example, a p-doped monocrystalline semiconductor wafer;

3950

second doped well of a second conductivity type below the anode contact. In a CMOS technology with a p-doped wafer material, this can be a p--doped region in the semiconducting substrate material of the SPAD diode 3954, 3955, for example;

3951

Highly doped second connection region of a second conductivity type, also referred to as p+ S/D implantation. In a CMOS technology with a p-doped wafer material, this can be a p+-doped region in the semiconducting substrate material of the SPAD diode 3954, 3955, for example;

3952

insulation, for example an optically transparent oxide, in particular silicon dioxide, or the like;

3953

metal cover of optical fiber 3944;

3954

First SPAD diode. The first SPAD diode 3955 serves at least temporarily as a light source for irradiating the second SPAD diode 3955 with photons from the first SPAD diode 3954;

3955

Second SPAD diode 3955. The second SPAD diode 3955 serves, for example, at least temporarily as a photodetector for the light from the first SPAD diode 3954.

3956

surface 3956 of the wafer as used herein;

3957

light 3957 emitted vertically upwards in the direction perpendicular to the surface 3956 of the first SPAD diode 3954;

3958

light 3958 transported horizontally in the optical waveguide 3944, which is a part of the light 3957 radiated vertically from the first SPAD diode 3954 into the optical waveguide 3944;

3959

Light 3959 of the first SPAD diode 3954 radiated vertically downwards in a direction perpendicular to the surface 3956 from the optical waveguide 3944 into the second SPAD diode 3955, which was emitted by the first SPAD diode 3954 as perpendicular light 3957 into the optical waveguide 3944 and was then transported horizontally by the optical fiber 3944 to the second SPAD diode 3955.

4040

Contact;

4041

metal 1 lines;

4042

metal 2 lines / metal 2 covers;

4043

first insulating layer;

4044

second insulation layer;

4100

Quantum Random Number Generator QRNG;

4101

entropy source;

4101.1

one or more first SPAD diodes;

4101.2

Optical fiber;

4101.3

one or more second SPAD diodes;

4102

high frequency amplifier;

4103

analog to digital converter (ADC);

4104

Evaluation device, which essentially includes sub-devices of the control device 4 of the fuse 1;

4104.1

Constant;

4104.2

comparator;

4104.3

time-to-digital converter (TDC);

4104.4

Entropy Extraction Device 4104.4

4104.5

Watchdog of the quantum random number generator 4100, 60 or the control device 4 of fuse 1;

4104.6

Pseudo-random number generator, in particular linear feedback shift register LFSR. The feedback of the LFSR is preferably a simple primitive polynomial to generate pseudo-random bit sequences. Other implementations of a pseudo-random number generator, such as outputting pre-generated and stored random bits that are interleaved with one or more genuine random bits, e.g., by means of an XOR operation, are possible. It is important that the seed of such a PRNG depends as far as possible on a quantum random number or a random number from a true random number generator (TRNG).

4104.7

signal multiplexer;

4104.8

Finite State Machine (finite automaton);

4104.9

RAM The RAM can be identical to the volatile memory 15;

4104.10

finish flag;

4104.11

microcontroller. The microcontroller can be identical to the computer core 2;

4105

voltage / current signal of the entropy source 4101, signals of the current pulses;

4106

amplifier output signal 4106 of high-frequency amplifier 4102;

4107

digital 14-bit value 4107 of the analog-to-digital converter 4103. Other bit widths are conceivable. The analog-to-digital converter may be identical to analog-to-digital converter 570;

4108

Constant 4104.1 signal;

4109

Output signal 4109 of comparator 4104.2, cleaned pulse signal;

4110

output 4110 of time-to-digital converter 4104.3;

4111

output of entropy extraction 4104.4;

4112

Seed S;

4113

voltage monitor;

4114

signal lines;

4116

selection signal;

4117

pseudo random signal line;

4118

random data words;

4119

internal data bus of the quantum random number generator 60, 4100. It is preferably the internal data bus 11 of the control device 4;

4120

Interrupt signal of the watchdog 4104.5 of the quantum random number generator 4100 or the control device 4 of the fuse 1;

4300

Entropy extraction method flowchart 4300;

4301

first step 4301 with determination of the first value of the output 410 of the time-to-digital converter 4104.3 and the second value of the output 4110 of the time-to-digital converter 4104.3 and storage in a shift register of the entropy extraction 4104.4;

4302

second step of comparing the first value with the second value;

4303

third step of evaluating the first value and the second value and generating the random bit;

4401

first spikes;

4402

second spikes;

4403

clip level;

4500

generation of a socket descriptor;

4510

binding the socket descriptor to a port and IP address;

4520

passive waiting state and waiting for connection requests from a microcontroller 2 of a client;

4530

Establishment of a connection from computer core 2 of control device 4 of backup 1 (server) to computer core 2 of control device 4 of another backup 1 (client) or to higher-level computer system 12 (client) through computer core 2 of control device 4 of backup 1 (server) (or the opposite);

4540

Generation of a quantum random number 4111 and generation of a public key and a private key using an RSA method by the computer core 2 of the control device 4 of the fuse 1 (server) using a quantum random number generator 60 QRNG and an RSA method.

4550

Waiting for an encrypted message from the computer core 2 of the control device 4 of the other backup (client) or for an encrypted message from the higher-level computer system 12 (client) by the computer core 2 of the control device 4 of the backup 1 (server);

4560

decrypting the message of the private key from step 3540 temporarily stored in a memory of the computer core 2 of the control device 4 of the fuse 1 according to the RSA method;

4570

Encryption of the message from computer core 2 of control device 4 of backup 1 (server) using the public key of computer core 2 of control device 4 of the other backup 1 (client) from step 4540 or using the public key of higher-level computer system 12 (client) from step 4540 according to the RSA method by the computer core 2 of the control device 4 of the fuse 1 (server);

4580

Sending the encrypted message stored in the buffer of the computer core 2 of the control device 4 of the fuse 1 (server) to the computer core 2 of the control device 4 of the other fuse 1 (client) or to the higher-level computer system 12 (client) via the data bus interface 10, 610, 550, 551 of the computer core 2 of the control device 4 of the fuse 1 (server) and via the data bus 9 and via the data interface 10. 610, 550, 551 of the computer core 2 of the control device 4 of the other fuse 1 (client) or via the data bus interface 555 of the higher-level computer system 12 (client);

4590

Executing the close() function and closing the open connection to a socket, here the client's socket, and ending the communication with the computer core 2 of the control device 4 of the other fuse 1 (client) and/or with the higher-level computer system 12 (client) by the computer core 2 of the control device 4 of the fuse 1 (server);

4600

Generating a socket descriptor by the computer core 2 of the control device 4 of the other fuse 1 (client) and/or by the higher-level computer system 12 (client) and submitting a connection request to the computer core 2 of the control device 4 of the fuse 1 using the port and the IP address, which were specified in step 4510, by the computer core 2 of the control device 4 of the other backup (client) or the higher-level computer system 12 (client);

4610

establishing a connection between the server socket of step 4510 and the client socket of step 4600;

4620

Generation of a quantum random number 4111 and generation of a public and a private key using an RSA method by the computer core 2 of the control device 4 of the other fuse 1 (client) or by the higher-level computer system 12 (client) using a quantum random number generator 60 QRNG and an RSA procedure;

4630

Encryption of the client's own message using the public key of computer core 2 of control device 4 of backup 1 (server) from step 4540 using the RSA method by computer core 2 of control device 4 of the other backup 1 (client) or by the higher-level computer system 12 (Client);

4640

Sending the client's encrypted message to the computer core 2 of the control device 4 of the backup 1 (server) by the computer core 2 of the control device 4 of the other backup (client) or by the superordinate computer system 12 (client);

4650

Waiting for an encrypted message from the computer core 2 of the control device 4 of the backup 1 (server) by the computer core 2 of the control device 4 of the other backup 1 (client) or by the higher-level computer system 12 (client) and receiving a message from the computer core 2 of the control device 4 of backup 1 (server) by the computer core 2 of the control device 4 of the other backup 1 (client) or by the higher-level computer system 12 (client) and storing the thus received and typically encrypted message of computer core 2 of the control device 4 of backup 1 (server ) in a temporary buffer of the computer core 2 of the control device 4 of the other backup (client) or of the higher-level computer system 12 (client) by the computer core 2 of the control device 4 of the other backup 1 (client) or by the higher-level computer system 12 (client) and reading the incoming data of the computer core 2 of the control device 4 of the backup 1 (server) by the computer core 2 of the control device 4 of the other backup (client) or by the higher-level computer system 12 (client) by executing the recv() function from a socket -Descriptor, in this case from the socket descriptor of the computer core 2 of the control device 4 of the other backup 1 (client) or of the higher-level computer system 12 (client) from step 4600 and preferably store the read data in a temporary buffer of the computer core 2 the control device 4 of the other backup 1 (client) or the higher-level computer system 12 (client) by the computer core 2 of the control device 4 of the other backup 1 (client) or by the higher-level computer system 12 (client);

4660

Decryption of an encrypted message received by computer core 2 of control device 4 of the other backup 1 (client) or by the higher-level computer system 12 (client) from computer core 2 of control device 4 of backup 1 (server) by computer core 2 of control device 4 of the other Backup 1 (client) or by the higher-level computer system 12 (client) by executing the Decrypt() function by the computer core 2 of the control device 4 of the other backup 1 (client) or by the higher-level computer system 12 (client) using the private key of the computer core 2 of the control device 4 of the other backup 1 (client) or the private key of the higher-level computer system 12 (client) from step 4620 using the RSA method and then storing the message decrypted in this way in a temporary buffer of the computer core 2 the control device 4 of the other fuse 1 (client) or by the higher-level computer system 12 (client) by the computer core 2 of the control device 4 of the other fuse 1 (client) or by the higher-level computer system 12 (client);

4670

Closing the open connection to the socket by the computer core 2 of the control device 4 of the other backup 1 (client) or by the higher-level computer system 12 (client) and terminating the communication with the computer core 2 of the control device 4 of the backup 1 (server) by the Computer core 2 of the control device 4 of the other fuse 1 (client) or by the higher-level computer system 12 (client);

4700

Generation of two different prime numbers p and q and the product n=p*q and the result of Euler's phi function phi=(p-1)(q-1) by the computer core 2 of the control device 4 of the fuse 1 (server) using the Function KeyExchangeServer();

4710

Generation of a number e that is relatively prime to phi by calling the function setE() by the computer core 2 of the control device 4 of the fuse 1 (server), the number phi being that from step 3200 and where relatively prime in the sense of the present document means that it there is no natural number other than the number one that simultaneously divides the number e and the number phi by an integer;

4720

Calculation of the multiplicative inverse of the number e by means of the computer core 2 of the control device 4 of the fuse 1 (server) using the findD() function, so that (e*d)mod phi=1 applies;

4730

The computer core waits for an incoming message from the computer core 2 of the control device 4 of the other backup 1 (client) or the higher-level computer system 12 (client), which should typically include the public key of the client or the higher-level computer system 12 (client). 2 of the control device 4 of backup 1 (server) and reading the incoming data from a socket descriptor, in this case the socket descriptor of the client by the computer core 2 of the control device 4 of backup 1 (server) and storing the read data preferably in a temporary buffer of the computer core 2 of the control device 4 of the fuse 1 (server);

4740

Sending the public key (d, n) of the computer core 2 of the control device 4 of the backup 1 (server) from steps 4700 and 4720 d by the computer core 2 of the control device 4 of the backup 1 (server) to the computer core 2 of the control device 4 of the other Backup 1 (client) or to the higher-level computer system 12 (client) via a socket descriptor, in this case the socket descriptor of the client from step 4530;

4745

Leaving the KeyExchangeServer() function by the computer core 2 of the control device 4 of the fuse 1 (server);

4750

Generating the prime number p and generating the prime number q different from q and generating the product n=p*q and generating the Euler phi function phi=(p-1)(q-1) in each case by the computer core 2 of the control device 4 of the other Backup 1 (client) or by the higher-level computer system 12 (client) using the KeyExchangeClient();

4760

Generate an integer e that is relatively prime to the number phi from step 4750 by the computer core 2 of the control device 4 of the other fuse 1 (client) or by the higher-level computer system 12 (client) using the setE() function, with the prime factor in the sense of the present document means that there is no natural number other than the number one that simultaneously divides the number e and the number phi without remainder;

4770

Calculation of the multiplicative inverse of the number e by the computer core 2 of the control device 4 of the other fuse 1 (client) or by the higher-level computer system 12 (client) using the findD() function, so that (e*d)mod phi=1 applies;

4780

Sending the public key (d, n) of the computer core 2 of the control device 4 of the fuse 1 (clients) or of the higher-level computer system 12 (client) from steps 4750 and 4770 to the computer core 2 of the control device 4 of the fuse 1 (server). the computer core 2 of the control device 4 of the other backup 1 (client) or by the higher-level computer system 12 (client), with the computer core 2 of the control device 4 of the other backup 1 (client) or the higher-level computer system 12 (client) using the function send() sends data via a socket descriptor, in this case the client's socket descriptor from step 4600;

4790

Waiting for an incoming message from the computer core 2 of the control device 4 of the backup 1 (server), which is encrypted with the public key of the computer core 2 of the control device 4 of the backup 1 (server), by the computer core 2 of the control device 4 of the other backup 1 ( Client) or by the higher-level computer system 12 (client) and reading incoming data from the computer core 2 of the control device 4 of the fuse 1 (server) from a socket descriptor, in this case from the socket descriptor of the client from step 4600, by the e by the computer core 2 of the control device 4 of the other backup 1 (client) or by the higher-level computer system 12 (client) using the recv() function and store this data in a temporary buffer of the computer core 2 of the control device 4 of the other backup 1 ( Client) or the higher-level computer system 12 (client) by the computer core 2 of the control device 4 of the other fuse 1 (client) or by the higher-level computer system 12 (client);

4795

Leaving the KeyExchangeClient() function by the computer core 2 of the control device 4 of the other fuse 1 (client) or by the superordinate computer system 12 (client);

4800

Generating a random number using a Quantum Random Number Generator 28 QRNG by the calling computer core 2 of the calling control device of the calling fuse 1 or by the calling higher-level computer system 12 and determining a prime number depending on this random number by the calling first processor 10-1 and storing this prime number as a variable p in the memory of the computer, which is part of the calling computer core 2 of the calling control device of the calling fuse 1 or of the calling superordinate computer system 12;

4810

Generation of a second random number by means of a quantum random number generator 60 by the calling computer core 2 of the calling control device of the calling fuse 1 or by the calling higher-level computer system 12 and determination of a prime number depending on this random number by the calling computer core 2 of the calling control device of the calling fuse 1 or by the calling superordinate computer system 12 and storing this prime number as a variable q in the memory of the computer, which is part of the calling processor core 2 of the calling control device of the calling fuse 1 or the calling superordinate computer system 12;

4820

Checking whether the logical statement q==p applies by the calling computer core 2 of the calling control device of the calling fuse 1 or by the calling higher-level computer system 12 and repeating the steps from step 4810 by the calling computer core 2 of the calling control device of the calling backup 1 or by the calling higher-level computer system 12, if this statement is true;

4830

Calculation of the product n=p*q by the calling computer core 2 of the calling control device of the calling fuse 1 or by the calling higher-level computer system 12;

4840

Calculation of Euler's phi function phi=(q-1)*(p-1) by the calling computer core 2 of the calling control device of the calling fuse 1 or by the calling superordinate computer system 12;

4850

Leaving the setPrimes() function by the calling computer core 2 of the calling control device of the calling fuse 1 or by the calling higher-level computer system 12;

4900

Sequence of the SetE() function When calling the setE() function in step 3400, the calling computer, in the case of the present document computer core 2 of the control device of backup 1 (server) or computer core 2 of the control device of the other backup 1 (client ) or the higher-level computer system 12 (client), a random number e for which it applies that e is prime to the number phi. For the purposes of this document, coprime means that there is no natural number other than the number one that divides the number e and phi at the same time. The calling computer, in the case of the present document the computer core 2 of the control device of the fuse 1 (server) or the computer core 2 of the control device of the other fuse 1 (client) or the higher-level computer system 12 (client), can use the number e both with a random number of the quantum random number generator 60 QRNG as well as by a pseudo-random number generator PRNG as well as by a real random number generator TRNG or a random number generator RNG as well as by high integration of an integer number starting with 2. However, generation by means of the quantum random number generator 60 QRNG is preferred;

4910

Checking whether the logical statement gcd(e,phi) != 1 is fulfilled by the calling computer, in the case of the present document the computer core 2 of the control device of fuse 1 (server) or the computer core 2 of the control device of the other fuse 1 ( Client) or the higher-level computer system 12 (client), and repeat step 4905 by the calling computer if the logical statement is fulfilled. The calling computer uses this function gcd(a,b) to calculate the greatest common divisor of the transfer parameters a, b and returns the result to the calling computer;

4920

Leaving the setE() function and returning the current value of e as a return value to the calling computer by the calling computer if the logical statement gcd(e,phi) != 1 is not fulfilled. The calling computer is the computer core 2 of the control device of backup 1 (server) or the computer core 2 of the control device of the other backup 1 (client) or the superordinate computer system 12 (client), depending on;

5000

Initialization of a variable d with 0 by the calling computer, here, in the case of the present document, the computer core 2 of the control device of backup 1 (server) or the computer core 2 of the control device of the other backup 1 (client) or the higher-level computer system 12 (client) ;

5010

adding the number 1 to the number d by the calling computer;

5020

Checking whether the logical statement (e*d) (mod phi) == 1 is satisfied by the calling computer and repeating the steps from step 3510 if the logical statement (e*d) (mod phi) == 1 is not is satisfied;

5030

The caller exits the findD() function when the logical statement (e*d) (mod phi) == 1 is satisfied, and returns the current value of d as the return value to the caller, , in the case of the present document the computer core 2 of the control device of the backup 1 (server) or the computer core 2 of the control device of the other backup 1 (client) or the higher-level computer system 12 (client);

5100

Server;

5110

clients;

5120

Sending the public key of the server 5100 based on a first quantum random number of the quantum random number generator 60 QRNG of the computer core 2 of the control device 4 of the backup 1 (server) 5100 via a non-tap-proof channel to the computer core 2 of the control device 4 of the other backup 1 (client) 5110 the computer core 2 of the control device 4 of the fuse 1 (server) 5100;

5130

Generating a pseudo-random number PZ or a random number generated in another way by the computer core 2 of the control device 4 of the other fuse (client) 5110 and storing the pseudo-random number PZ or the random number generated in a different way in a memory of the computer core 2 of the control device 4 of the other fuse 1 (client) 5110 by computer core 2 of control device 4 of the other backup (client) 5110 and generation of a first private key of client 5110 and a first public key of client 5110 using this pseudo-random number PZ or this random number generated in a different way by computer core 2 of control device 4 of the other backup 1 (client) 5110 and encryption of this first public key of the client 5110 using the public key of the server 5100 by the computer core 2 of the control device 4 of the other backup (client) 5110 and sending the encrypted first public key of the client 5110 to the computer core 2 of the control device 4 of the backup (server) 5100 through the computer core 2 of the control device 4 of the other backup 1 (client) 5110;

5140

Decryption of the message from the computer core 2 of the control device 4 of the other backup 1 (client) 5110 with the first private key of the computer core 2 of the control device 2 of the other backup 1 (client) 5110, so that the computer core 2 of the control device 4 of the backup 1 (server) 5100 has the first public key of the client 5110, without this third party being able to know it, and generation of a further, second quantum random number QZ2 by the computer core 2 of the control device 4 of the fuse 1 (server) 5100 using the quantum random number generator 60 QRNG, the bit width of this second quantum random number is preferably equal to the bit width of the random number PZ of the client 5110, and encryption of the second quantum random number QZ2 with the first public key of the computer core 2 of the control device 4 of the other backup (client) 5110 to form an encrypted second quantum random number QZ2' by the computer core 2 of the control device 4 of the backup (server) 5100, in which case, for example, the first public key of the client 5110 can be the random number PZ of the client and in which case the computer core 2 of the control device 4 of the backup 1 (server) 5100 has the second quantum random number QZ2, for example by bitwise XORing of the second quantum random number QZ2 with PZ to form an encrypted second quantum random number QZ2', and sending the encrypted second quantum random number QZ2' to the computer core 2 of the control device 4 of the other fuse 1 (5110) by the computer core 2 of the control device 4 of backup 1 (server) 5100;

5150

Decryption of the encrypted second quantum random number QZ2' using the first private key of the computer core 2 of the control device 4 of the backup (server) 5100 to the second quantum random number QZ2 by the computer core 2 of the control device 4 of the other backup 1 (client) 5110. If the computer core 2 has the Control device 4 of the fuse (server) determines the second encrypted quantum random number QZ2' by bitwise XORing the random number PZ with the second quantum random number QZ2, the computer core 2 of the control device 4 of the other fuse 1 (client) 5110 can, for example, by bitwise XORing decrypt the encrypted second quantum random number QZ2' with the random number PZ known to him to form the second quantum random number QZ2. The computer core 2 of the control device 4 of the other backup (client) 5110 preferably uses the second quantum random number QZ2 now available to it as a basis for generating a second private key and a second public key according to an asymmetric encryption method. The asymmetric encryption method can be the RSA method, for example. The computer core 2 of the control device 4 of the other backup 1 (client) 3610 now sends its second public key to the server 5100 via the non-tap-proof channel Server 5100 decrypts the encrypted second public key of the client 5110 and then uses this second public key of the client to encrypt further messages to the computer core 2 of the control device 4 of the other backup 1 (client) 5110. The computer core 2 of the control device preferably generates and sends 4 of fuse 1 (server) 5100 after a predetermined time or after sending a predetermined amount of data to the computer core 2 of the control device 4 of the other fuse 1 (client) 5110 a new public key based on a new quantum random number of its quantum random number generator 60 QRNG encrypted with the second public key of the client 5110. The computer core 2 of the control device 4 of the backup (server) 5100 and the computer core 2 of the control device 4 of the other backup 1 (client) 5110 then preferably carry out the previously described method again, so that the keys change permanently . This also makes it impossible for a quantum computer to break the keys. This protects the supply network against external attacks;

5200

Method for generating a quantum random number QZ with m random bits;

5210

generating a random stream of single photons (57, 58, 59, 401.2) by means of one or more first SPAD diodes (401.1, 54);

5220

transmission of the random stream of single photons (57, 58, 59, 401.2) to one or more second SPAD diodes (401.3, 55) by means of an optical waveguide (44, 401.2) which is different from the semiconductor substrate (49, 48);

5230

Conversion of the random stream of single photons (57, 58, 59, 401.2) into a detection signal in the form of a voltage signal 405 from the entropy source 401, which preferably includes the first SPAD diodes 401.1 and the optical waveguide 401.2 and the second SPAD diodes 401.3;

5240

Processing, in particular amplifying and/or filtering and/or analog-to-digital conversion, of the detection signal into a processed detection signal, in particular a digital 14-bit value 407 of the analog-to-digital converter 403;

5250

Separation of the pulses of the processed detection signal caused by coupling the emissions of a first SPAD diode 401.1 and a second SPAD diode 401.3 from the pulses of the processed detection signal caused by spontaneous emission by comparing the processed detection signal with a threshold value, in particular in a comparator 404.2 and generating a corresponding output signal 409, in particular of the comparator 404.2;

5260

Determination of a first time interval between the first pulse and the second pulse of a first pair of pulses from two consecutive pulses of the processed detection signal caused by coupling the emissions of a first SPAD diode 401.1 and a second SPAD diode 401.3 and determination of a second time interval between a third pulse and a fourth pulse of a second pair of pulses consisting of two consecutive pulses of the processed detection signal, produced by coupling the emissions of a first SPAD diode 401.1 and a second SPAD diode 401.3, and, in particular, for determining the first value of the output 410 of the time to digital converter 404.3 and the second value of the output 410 of the time to digital converter 404.3;

ADRD

Address information within the data information DATA of a bit stream packet BP on the data bus 9;

bp

Bit stream packet (English frame), also referred to as data packet;

CHKD

Check information within the data information DATA of a bit stream packet BP. It is preferably a CRC checksum and/or parity bits etc.;

CLK

Clock within the higher-level computer system 12;

CLKAj

Sample signal within the j-th data interface 10 of the control device 4 of the j-th fuse - where j should be a positive integer;

DATA

Data information within a bit stream packet BP;

ILD

configuration information;

INFO

User information within the data information DATA of a bit stream packet BP. It is preferably configuration data for the respective backup. For example, these can be parameters for setting switching thresholds and/or delay times or for setting the switching state of circuit breaker 17 of the electronic fuse and/or program data for computer core 2 of control device 4 of the fuse or the like.;

BEGIN

start signal;

SYNC

synchronization information;

tB

length of a single bit within a bit stream packet BP;

Z1

first logical state in which the first single-wire data bus of the data bus 9 or the second single-wire data bus of the data bus 9 can be if the data bus 9 is a differential, bidirectional data bus 9. This is also referred to as high in this disclosure.

z1

first differential state in which a serial, bidirectional, differential data bus 9 can be located. This is also referred to as high in this disclosure.

Z2

second logical state in which the first single-wire data bus of the data bus 9 or the second single-wire data bus of the data bus 9 can be if the data bus 9 is a differential, bidirectional data bus 9. This is also referred to as low in this disclosure.

z2

second differential state in which a serial, bidirectional, differential data bus 9 can be located. This is also referred to as low in this disclosure.

Z3

third logical state in which the first single-wire data bus of the data bus 9 or the second single-wire data bus of the data bus 9 can be if the data bus 9 is a differential, bidirectional data bus 9. This is also referred to as “idle” in this disclosure. The corresponding physical level of the first single-wire data bus of the data bus 9 or of the second single-wire data bus of the data bus 9 preferably but not necessarily has a value around a common mean value.

z3

third differential state in which the serial, bidirectional, differential data bus 9 can be located. This is also referred to as “idle” in this disclosure. Preferably, but not necessarily, the corresponding differential physical level has a value around zero

55100

Systems 55100 for providing SW programs in a supply network 200;

55110

first HW platform (e.g. a higher-level computer system 12 or a server 710 of a service provider or a terminal 740 for input from a user 730 etc.);

55111

SW program implemented on the first HW platform 55110;

55112

SW program implemented on the first HW platform 55110;

55113

SW program implemented on the first HW platform 55110, e.g. a payment application 55113 or an equipment variant configuration program 55113;

55120

control device 4 of a fuse 1;

55121

safety-relevant SW module and safety-critical part of a SW program 55111. A safety-relevant SW module 55121, 55122 can e.g 1 change and / or SW modules 55121, 55122, which allow access to memory 14.15 of the control device 55120, 4 of the electronic fuse 1, and / or SW modules 55121, 55122, the download and / or execution of SW in memory 14, 15 of control device 55120, 4 of fuse 1, and/or SW modules 55121, 55122, which enable measured values and/or data from the memory of control device 55120, 4 of fuse 1 to be read out, and/or SW modules 55121, 55122 that allow the configuration of parameters and/or threshold values and the like in the control device 55120, 4 of fuse 1. For example, it can be the security-critical part 55121 of a payment application 55113;

55122

safety-related software module;

55130

Operating system;

55131

HW driver, e.g. to enable data communication via a communication unit 55141, 55142, 55143;

55141

communication unit for a cellular network (GSM, UMTS, LTE);

55142

communication unit for WLAN;

55143

communication unit for Bluetooth;

55150

Communications network (e.g. the Internet 720) with which communication can take place directly (e.g. via a communication unit 55141 for a cellular network) or indirectly via a smartphone 55160 with one or more SW applications 55161.

55160

Smartphone 55160 or other terminal 740 for input from user 730 and/or, for example, for entering passwords and/or authentication data from user 730 and/or biometric data such as fingerprint data from a fingerprint sensor system and/or face recognition data from a camera-based face recognition system and/or voice recognition data from a voice and /or voice recognition system of the smartphone;

55200

example sequence 55200 of a software program 55111, 55112, 55113;

55201

safety-relevant supply network internal function/ safety-critical component of the supply network;

55202

safety-relevant supply network-external function / safety-critical component outside the supply network

55210

Basic module, e.g. non-safety-critical part 55210 of the SW program 55113 implemented on the first HW platform 55110;

55211

input data;

55221

output data;

55300

Method for executing a SW program 55113 in a supply network 200;

55301

Running a base module 55210 of the SW program 55113 on a first HW platform 55110 of the vehicle (e.g. on the higher-level computer system 12 of the supply network 200);

55302

calling a safety-relevant module 55121 of the SW program 55113 from the base module 55210 when executing the SW program 55113;

55303

Running the safety-relevant module 55121 on a control device 55120, 4 of the supply network 200;

Closing remarks

The above description is not exhaustive and does not limit this disclosure to the examples shown. Those of ordinary skill in the art can, by reference to the drawings, the disclosure, and the claims, derive, understand, and practice other co-disclosed variations on the specific sampled examples described herein. The indefinite article "a" or "an" and its inflections do not exclude a plurality, while the mention of a definite number of elements does not exclude the possibility of there being more or fewer elements. A single entity may perform the functions of multiple elements recited in the disclosure, and conversely, multiple elements may perform the function of one entity. Numerous alternatives, equivalents, variations, and combinations are possible without departing from the scope of the present disclosure.

Unless otherwise noted, those of ordinary skill in the art may freely combine any features of the present invention, provided such combinations make sense. This applies to the entire document presented here. Those who have ordinary specialist knowledge in the field can also freely combine the features described in the description of the figures as features of the invention with the other features, unless otherwise stated. A limitation of individual features of the exemplary embodiments to the combination with other features of the exemplary embodiments is expressly not intended. Except physical features of the device can also be reworded as method features and method features reformulated as physical features of the device. Such a reformulation is thus automatically disclosed.

In the foregoing detailed description, reference is made to the accompanying figures. Those of ordinary skill in the art should consider the examples in the specification and figures as illustrative and not limiting of the specific example or element described. Several examples can be derived from the foregoing description and/or figures and/or claims by modification, combination or variation of certain elements by those of ordinary skill in the art. Furthermore, a person skilled in the art can derive from the description and/or the drawings and/or the claims examples or elements which the document presented here does not describe literally.

Those of ordinary skill in the art may combine features disclosed in different places in this document, and in particular the list of features, where that combination makes sense. The references used in the list of features are exemplary and expressly do not limit the disclosure of the possible features and combinations of sub-features. The applicable claim results from the claims. Those of ordinary skill in the art should refer to the relevant language in interpreting the claims. Even if no device that performs this method step is disclosed at the relevant points in this text on methods and method steps, this document hereby discloses a device and/or a device part that can carry out this method step. Those of ordinary skill in the art may combine this piece of equipment with other devices and/or pieces of equipment where appropriate. Method steps carried out by these device parts correspond to the functions of the devices and device parts disclosed in this document. Those of ordinary skill in the art can combine these process steps with each other and with process steps to form processes. Such methods are expressly part of the disclosure.

QUOTES INCLUDED IN DESCRIPTION

This list of documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• EP 1490772 B1 [0213]

Claims (4)

Control device (4) of an electronic fuse (1) of a vehicle, wherein the control device (4) is monolithic and wherein the control device (4) comprises a circuit breaker (17) and wherein the control device (4) comprises an oscillator (30) and/or a clock system and wherein the control device (4) comprises a voltage supply (5) and wherein the control device (4) comprises an externally provided operating voltage (6) and wherein the control device (4) is set up for at least a first state of normal operation of the control device (4) when the externally provided operating voltage (6) is available and a second state of emergency operation of the control device (4) when the externally provided operating voltage ( 6) accept, and wherein the voltage supply (5) is set up to supply internal supply voltages of the control device (4) required by device parts of the control device (4) during normal operation of the control device (4) and/or by conditioning an externally provided operating voltage (6) of the control device (4). to provide internal supply voltages of the electronic fuse (1) required by other device parts of the electronic fuse (1), and wherein the voltage supply (5) is set up to supply an external and/or internal energy reserve (8) with the energy of an externally provided operating voltage (6) of the control device (4) and/or the externally provided operating voltage during normal operation of the control device (4). To load operating voltage (6) of the control device (4), and wherein the power supply (5) is set up to, in emergency operation of the control device (4), supply the energy for providing these internal supply voltages and/or the energy for providing some of these internal supply voltages instead of from the externally provided operating voltage (6) of the control device ( 4) taken from the energy reserve (8), and wherein the voltage supply (5) is set up to supply the oscillator (30) and/or the clock system with electrical energy from the energy reserve (8) in the emergency operation of the control device (4) if the operating voltage (6) fails, and wherein the control device (4) sets the state of the circuit breaker (17) in normal operation and in emergency operation of the control device (4) if the operating voltage (6) fails and control device claim 1 , wherein the control device (4) comprises a computer core (2) and wherein the control device (4) comprises a non-volatile memory (14) and wherein the voltage supply (5) is set up to the computer core (2) in the emergency operation of the control device (4) supplying electrical energy from the energy reserve (8) if the operating voltage (6) fails, and the voltage supply (5) is set up to support the non-volatile memory (14) in the emergency operation of the control device (4). Supply failure of the operating voltage (6) from the energy reserve (8) with electrical energy and control device claim 2 , wherein the control device (4) comprises a data bus interface (10) and wherein the power supply (5) is set up to the data bus interface (10) in the emergency operation of the control device (4) in the event of failure of the operating voltage (6) from the energy reserve (8) with electrical energy, and wherein the computer core (2) of the control device (4) is connected to a higher-level computer system (12) of the vehicle via the data bus interface (10) and via a data bus (9), and the computer core (2) is connected to it is set up to signal this emergency operation and/or the failure of the operating voltage (6) of the control device (4) to the higher-level computer system (12) in an emergency operation of the control device (4) if the operating voltage (6) fails. control device claim 2 or 3 , wherein the control device (4) comprises a watchdog timer (13) and wherein the control device (4) is set up to activate the watchdog timer (13) in emergency operation of the control device (4) in the event of failure of the operating voltage (6) from the To supply energy reserve (8) with electrical energy..

Images