DE202022106939U1 - Safety device with a disconnection unit for the battery of an electrically powered motor vehicle - Google Patents

Abstract

Safety device (1, 301) of a drive train (5) of an electrically driven vehicle (3)
with a separation box (25, 125, 225, 325, 325 ^I , 325 ^II , 325 ^III ),
which comprises a first control unit (27, 127, 227) with a computing unit (29, 129, 229) and with a communication bus connection (35, 37)
and which is designed for the transmission of electrical power to its further contacts (175, 175 ^I , 175", 175 ^III , 175 ^IV , 175 ^V , 275, 275 ^I , 275", 275 ^III , 275 ^IV , 275 ^V ),
and with a second control unit (31, 131, 231, 331),
wherein the first control unit (27, 127, 227) is designed to execute a measuring program in the computing unit (29, 129, 229),
by which the measured values read in by the measuring sensors (179, 279) of the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) and/or measured values of the traction accumulator (21, 21 ^I , 121, 221, 221 ^I , 321, 321 ^I , 321 ^II , 321 ^III ) can be processed at regular intervals,
characterized in that
the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) is designed to
to be attached directly to a traction accumulator (21, 21 ^I , 121, 221, 221 ^I , 321, 321 ^I , 321 ^II , 321 ^III ) of the vehicle (3), whereby electrical contacts (175, 175 ^I , 175 ^II , 175 ^III , 175 ^IV , 175 ^V , 175 ^VII , 175 ^VIII , 175 ^IX , 275, 275 ^I , 275 ^II , 275 ^III , 275 ^IV , 275 ^V , 275 ^VII , 275 ^VIII , 275 ^IX , 275 ^X , 275 ^XI , 275 ^XII ) of the separation box (25, 125, 225, 325, 325 ^I , 325 ^II , 325 ^III ) can be connected, and
the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) is further designed to protect each connected electrical contact (175, 175 ^I , 175", 175 ^III , 175 ^IV , 175 ^V , 175 ^VII , 175 ^VIII , 175 ^IX , 275, 275 ^I , 275 ^II , 275 ^III , 275 ^IV , 275 ^V , 275 ^VII , 275 ^VIII , 275 ^IX , 275 ^X , 275 ^XI , 275 ^XII ) from direct access,
in that the electrical separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) is equipped with at least two separation elements (41, 41 ^I , 141, 141 ^I , 141 ^II , 141 ^III , 241, 241 ^I , 241 ^II , 241 ^III ),
and in that the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) is designed to be connected to at least two electrical contacts (17 ^VII , 175 ^VIII , 175 ^IX , 275 ^VII , 275 ^VIII , 275 ^IX , 275 ^X , 275 ^XI , 275 ^XII ) of the traction accumulator (21, 21 ^I , 121, 221, 221 ^I , 321, 321 ^I , 321 ^II , 321 ^III ) at the same time,
and that the measured values can be made available at the communication bus connection (35, 37) for the second control unit (31, 131, 231, 331),
wherein an evaluation logic is implemented in the second control unit (31, 131, 231, 331) and/or
the isolating box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) is designed for an independent interruption of the transmission of electrical power in response to measured values determined by the isolating box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ),
and that the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) has a logic for switching at least one of the separation elements (41, 41 ^I , 141, 141 ^I , 141 ^II , 141 ^III , 241, 241 ^I , 241 ^II , 241 ^III ),
which ensures opening of at least one separating element (41, 41 ^I , 141, 141 I , 141 II , 141 III , 241, 241 ^I , 241 ^II , 241 ^III ) in the event of an incorrect ^external command, in the event of an incorrect measured value, in the event of a measured value outside of ^tolerance limits and/or in the event of a measured ^value not present.

Description

The present invention relates to a safety device designed for use in an electrically powered vehicle.

Furthermore, the present invention deals with a safe and rapid disconnection of high-voltage lines, especially in the event of a fault.

In other words, the present invention relates to a safety device according to the preamble of claim 1.

Technical area

(Motor) vehicles that have one or more electric motors as a drive motor, which is also referred to as a traction motor, often obtain their drive energy from "on-board traction accumulators" (also referred to simply as "traction accumulators"), which when fully charged have energies of up to 300 kWh (large car systems), occasionally even up to 500 kWh (truck systems) and possibly even 700 kWh (heavy-duty systems), depending on the design of the (motor) vehicle and the design of the traction accumulator. If a person were to touch the electrically conductive contacts of such an accumulator, the contact could be fatal to the person, particularly due to the fact that the traction accumulator provides its electrical energy in the form of a direct current. For this reason, drive trains in electric vehicles are designed in such a way that the (collective) contacts on the traction accumulator for the electrical supply of the drive train can be de-energized by a disconnect box, which is often referred to as a “Battery Disconnect Unit” (abbreviated to “BDU”).

The primary task of such a separation box is to de-energize the vehicle's high-voltage lines when the vehicle is stationary without charging, to guarantee a low-resistance contact from the traction battery contacts to the vehicle's high-voltage lines during operation and, in the event of electrical charging of the traction battery, to ensure this low-resistance contact in the opposite direction of current flow.

State of the art

Accordingly, the intellectual property literature also repeatedly deals with “BDUs” and their integration into electrical drive systems.

For example, the CN 106 786 988 A (Applicant: Chengdu Raja New Energy Automobile Science & Tech Co. Ltd.; publication date: 31.05.2017) a so-called "high-voltage box", arranged between "charging and discharging devices", which is intended to be used to switch the positive and negative busbars on and off based on an "original" control logic. At the beginning of the description, the area of application "protection of battery packs of electric vehicles" is briefly addressed. The switching is to be carried out by means of a positive main relay and a negative main relay. However, in the CN 106 786 988 A It is not stated where exactly the switching should take place. It is simply explained that the relays should be controllable by a relay signal from a battery management system (BMS) via CAN bus. The publication assumes that the "BMS" component is a common and well-known component. The "BMS" should collect all status data from the "battery pack" and transmit it in real time to a higher-level software that should run on a "PC". The data should be analyzed in the "PC". Switching commands can then be sent from the PC to the BMS and then forwarded by the BMS. The BMS itself can interrupt the relay in the high-voltage box using an application program running on it to guarantee protection against overloads.

Also quite informative is the EP 3 413 392 A1 (Applicant: LG Chem, Ltd.; publication date: December 12, 2018), which describes a "BDU" based on its claim 1, wherein in addition to the BDU, a "control unit" is to be present in the vehicle so that data from a "battery management system" (abbreviated to "BMS") can be transmitted to the "control unit" via a CAN bus. The BMS is to calculate both a state of charge (also known in the technical world as "SOC") and a state of health (also known in the technical world as "SOH") and transmit them to the central unit "control unit".

Furthermore, the EP 3 965 207 A1 (Applicant: Samsung SDI Co., Ltd.; Disclosure date: 09.03.2022), which also relies on an existing BDU and an existing “battery system management” (instead of “BMS” the EP 3 96 207 A1 that electronic unit “BSM”). In view of the continuously increasing services to be managed via the BDU in recent years, the EP 3 965 207 A1 , the BDU must be equipped with a support plate system so that a cooling liquid can flow through the BDU for cooling purposes.

The US 2022/278 520 A1 (Applicant: Melexis Technologies SA; Disclosure date: 01.09.2022) presents a contactor, which is usually referred to as a BDU in comparable protective rights. The contactor is designed to be able to pass voltages of up to 800 V and currents of up to 3,000 amperes (i.e. up to 2.4 MW). Because such energies represent an inherent danger for the passengers of a vehicle in which a battery that supplies these energies is installed, the contactor is supposed to be able to prevent malfunctions within 5 ms. The high-voltage section of the contactor is monitored with a magnetic sensor. A BMS is provided directly on the battery. The contactor is supposed to communicate with an external electronic control unit. The battery is therefore monitored close to the battery by a BMS, as in many other energy supply systems for motor vehicles. In the event of a malfunction, the contactor is only supposed to be able to switch a high-voltage switch.

Another interesting state of the art is the EN 10 2004 051 489 B4 (Owner: Kromberg & Schubert GmbH & Co. KG; Date of publication: 17.08.2006). EN 10 2004 051 489 B4 The intelligent safety connection device described, which is to be designed as a one-piece element, is to be connected in a force-locking manner to one of the battery poles (the "positive pole"). The connection device is to be part of an electrical module that includes a measuring circuit for measuring an applied voltage, with measurement data of a measured current flowing through being forwarded to an evaluation or control unit. At least one electrical switch is to be integrated in the connection device for detachably contacting an outgoing electrical conductor, but the description also mentions several existing semiconductor switching elements. An external unit is to be able to provide information that is to be used to control the at least one switch. A connection between the external unit and the electrical module can be designed as a LIN bus or CAN bus. With such an electrical module, only one pole can be switched off. The battery remains electrically connected to the rest of the vehicle via the other pole.

The aforementioned publications are deemed to be fully incorporated into the present invention description by their naming. This is to avoid having to discuss again and repeatedly the generally known relationships between "battery pole", "BDU", "BMS", "central control unit", "high-voltage box" and their connections and interfaces, but rather the terms such as "BDU", "BMS" or "BSM", "central control unit" and "high-voltage box" should be viewed as also being defined for the present invention by reference to the publications.

The EP 3 890 059 A1 (Applicant: Samsung SDI Co., Ltd.; publication date: October 6, 2021) presents in its only figure a battery system that is to include a battery pack and a BDU ("battery disconnect unit"). The BDU has a high-voltage section and a low-voltage section. A real-time clock is to be installed in the low-voltage section, but also supplied from the high-voltage section, in addition to the low-voltage section. In this way, the battery system management can be provided with the correct time, which is, so to speak, the system time for the entire battery system.

The EN 10 2014 202 504 A1 (Applicant: Robert Bosch GmbH; publication date: August 13, 2015) presents a separation unit that is to be implemented in a modular manner using at least one switching module, at least one detection module and at least one control module, i.e. three modules. Various, fairly simple circuits are used for both the switching module and the detection module. The separation unit is also to have at least one interface that can be used to communicate with another control unit. The modular circuit concept is intended to reduce the wiring effort for the separation unit.

The CN 105 392 674 A (Applicant: TS CORPORATION; publication date: 03.09.2016) presents a power supply system for a motor vehicle that includes a battery management system and a separation unit. The logic for monitoring the cells of the battery pack is to be located in the battery management system. The separation box is to be arranged externally, which can also be demonstrated using 8th the CN 105 392 674 A can be seen.

The CN112 550 067 A (Applicant: Shanghai G Pulse Tech Co. Ltd.; publication date: March 26, 2021) is drafted in such a way that it deals with a "battery disconnect unit"("BDU") neither very concretely nor extremely abstractly. One focus of the Chinese application is the arrangement of battery monitoring units in a daisy chain series circuit, to which a "parameter acquisition unit" is to be placed parallel to the first daisy chain node. A bus between a port A and a port B is to be designed as a two-pole "daisy chain bus", consequently there must be "at least two electrical contacts" in a CN112 550 067 A described device.

The EN 10 2011 086 495 A1 (Applicant: Continental Automotive GmbH; publication date: 16.05.2013) deals in its general Invention description numerous fault cases for “their contactors”, such as “overcurrent loads”, “insulation resistance too low” or “ground loops”, and then transfers these general statements to two, in the 1 and 2 shown “version variants”. Above both variants of the EN 10 2011 086 495 A1 , that in the 1 shown and that in the 2 The keywords used in the general description of the invention are “for safety reasons a switching device must be provided” and “electromechanical box”. The second embodiment, which is shown in 2 deals with an “electromechanical box” in which the “more complex” electronics of a microcontroller unit, as described in that patent application, are placed in a central computer unit in the energy storage device. In the 1 In the variant shown, the central computer unit for evaluating measurements is to be arranged in the "electromechanical box". In both embodiments, the "electromechanical box" is not attached directly to the traction battery of the vehicle. In fact, the figures even show separate cables between the battery and the "electromechanical box". Despite the focus on "safety", numerous other measures still seem to be necessary to ensure the EN 10 2011 086 495 A1 treated “electromechanical box” and the electrical energy supply of the drive train to be made safer.

Task

For safety reasons, a BDU (Battery Disconnect Unit) is desirable in electrically powered vehicles. However, considerable development resources are spent on coordinating the individual components of a powertrain of an electrically powered vehicle. This can be attributed to the fact that each component (e.g. a first control unit and a second control unit) has its own proprietary connections, interfaces and software modules.

It would be desirable to have a reliable BDU which, when integrated into a group of control units, allows the other control units (control units) to fully perform their proprietary functions, but still intercepts numerous risks and dangers, especially for passengers, drivers and mechanics of the vehicle.

Description of the invention

The object of the invention is achieved by a safety device according to claim 1. Advantageous further developments can be found in the dependent claims.

As mentioned at the beginning, electrically powered (motor) vehicles require a safety device to prevent the large amounts of electrical energy stored in the traction battery when it is charged from being released in an uncontrolled manner. For this purpose, the vehicle has a separation box, which is preferably connected directly to the traction battery and thus prevents direct contact between the poles (both positive and negative poles) or the contacts of the traction battery.

The separation box includes a computing unit. The separation box also includes a communication bus connection to which a communication bus, such as a CAN bus, can be connected. The computing unit is advantageously part of a larger control unit, which can also include measuring inputs and electrically operated actuators, for example.

As mentioned, the separation box is designed in such a way that it can be attached directly to the poles or contacts of the traction battery. The presence of the separation box covers the contacts of the traction battery. The separation box prevents direct contact with the contacts of the traction battery. This means that a person cannot directly touch the contacts of the traction battery as long as the separation box is attached to the traction battery.

One of the tasks of the separation box is to transfer electrical energy or electrical power from the traction accumulator to electrical consumers, such as one or more drive motors, or to pass it through itself.

In addition, the isolation box can determine, store, process, prepare and transmit measured values, in particular via the communication bus connected to the communication bus connection.

If the isolating box is not intended to pass on the electrical energy to the outside, the isolating box can put its isolating elements (suitable isolating elements are contactors, circuit breakers, MOS-FETs, IGBTs or similar) into a switching state that creates an interruption between the primary contacts of the traction battery and the contacts for passing on the high voltage to devices outside the isolating box. Reasons for an interruption of the connection from the pole connections to the output-side connections of the isolating box can be found in the isolating box. be determined by the user, e.g. based on measured values (or each individual measured value) that are outside an acceptable measuring range. The isolation box can also respond to commands via the communication bus and interrupt at least one isolation element, ideally all isolation elements, due to performance requirements, safety requirements or due to intended protection for the traction battery.

For motor vehicles of larger power classes ("SUVs", "vans" or "heavy-duty vehicles"), the transferable and thus switchable power should be in the kilowatt range, if not even in the megawatt range. The separation box should therefore be able to carry out a safe separation of electrical power in its power class (e.g. in the kilowatt range or e.g. in the megawatt range).

Because the computer unit runs a measurement program that is as simple as possible but at the same time reliable, the first control unit can provide reliable measurement data, which is also extremely up-to-date if the measurement program is as stripped down as possible, to the other devices on the communication bus via the communication bus. In this way, all measurement data, with their measured values stabilized if necessary and checked for plausibility, can be placed on the communication bus within milliseconds. The first control unit makes the measurement data available to all control units on the communication bus. It is up to the second (and possibly third and possibly fourth) control unit to use the measured values and measurement data that the second control unit needs for its calculations, predictions and status observations (e.g. state of charge of the battery ("SOC"), e.g. state of health of the battery ("SOH")).

In other words, the safety device responsible for electrical safety in an electrically powered vehicle includes a separation box and a second control unit. The safety device comprises the separation box and the second control unit. The first control unit is part of the separation box.

The first control unit, which is part of the separation box, includes a computing unit in which control programs can run and a communication bus connection. The first control unit comprises a computing unit and a communication bus connection. The computing unit can be formed by a microcontroller, for example.

The separation box is designed so that the separation box can be connected to the traction battery. The separation box is designed to be attached directly to a traction battery of the vehicle. This means that each of the connected electrical contacts can be protected from direct access. The contacts (or the poles) of the traction battery are electrically decoupled if the electrical separation box is equipped with at least two separation elements (e.g. IGBTs or MOS-FETs).

If the isolating elements are in a closed switching state, they are there to pass electrical power to their further contacts. The isolating box can be put into the "closed" switching state. The isolating box is designed in such a way that electrical energy can flow through the isolating box.

There is also a second control unit. The safety device is equipped with a second control unit; the safety device includes a second control unit. An evaluation logic is advantageously implemented in the second control unit.

The isolation box is advantageously programmed in such a way that it can carry out an independent interruption. In the event of an interruption, electrical power cannot be transmitted. The interruption can occur in response to one or more measured values determined by the isolation box.

The separation box is advantageously equipped with at least two connections for simultaneous connection to at least two electrical contacts of the traction battery. The separation box should simultaneously cover all poles of the traction battery. The separation box is designed for connection from all sides.

As mentioned above, the first control unit is designed to run a measuring program in the computing unit. The measuring program enables the separation box to read the measuring sensors of the separation box and/or the measuring sensors of the traction accumulator at regular intervals. The measured values are read in so that they are made available at the communication bus connection as measured values for the second control unit.

The isolation box has a logic for switching at least one of the isolation elements. If an unfavorable or dangerous or undesirable situation or a corresponding state is detected, e.g. a faulty external command, e.g. a faulty measured value, e.g. a measured value outside of tolerance limits and/or e.g. a missing measured value (non-existent measured value), the opening of at least one separating element is ensured.

Below, advantageous embodiments and further developments are set out which, viewed individually or in combination, can also reveal inventive aspects.

The second control unit is advantageously a low-voltage control device. A low-voltage control device makes it possible for the low-voltage control device to be designed for operation with a low-voltage supply voltage and for low-voltage input voltages at the interfaces and ports. Favorable voltage ranges are 0 volts to 5 volts, 0 volts to 12 volts or 0 volts to 24 volts. The voltages that can be made available to the second control unit from outside (i.e. at the connections) and that are present or can be made available at the outputs of the second control unit are in this value range. In other words, the second control unit is a low-voltage control device that preferably operates in a voltage field up to a maximum voltage value of 60 volts, ideally less than 24 volts.

The technical solution presented here contributes to the second control unit being a peripheral-free control unit. The technical solution presented here contributes - in a mitigated version - at least to reducing the number of inputs and outputs on the second control unit. However, because the second control unit can also perform other tasks (in addition to the function of being a platform for evaluation logic), the other tasks and functions may require inputs and outputs on the second control unit, e.g. if the second control unit is (also) a thermal management device. The second control unit can - in an extreme design - be designed without any inputs or outputs (with the exception of communication bus connections). The measured values of the traction accumulator and the measured values of the separation box are processed in the separation box. For this reason, the second control unit does not need any inputs via which measured values of the traction accumulator are measured directly. The separation elements are operated or actuated by the separation box. This means that the second control unit can also have a reduced actuator output, e.g. no drivers for operating the isolating switches. If hardware resources are to be saved, the second control unit is a control unit without switching outputs, in particular one with no drivers for switching outputs, and preferably without actuator switches. However, if the second control unit is to perform other tasks in addition to its function of being a platform for evaluation logic, the control unit can have the required outputs and inputs for this. Due to the function of the isolating box as an interface device for recording the measurement signals from the high-voltage lines and the traction accumulator, the other control units can be released from or relieved of these inputs and outputs.

In addition to a low-voltage group, i.e. a component for low voltages, the isolation box, unlike the ideal second control unit, has a high-voltage part in which electrical voltages in a range of more than 60 volts can be conducted. The isolation box includes a high-voltage part, i.e. a part for electrical voltages in a range of more than 60 volts. If the low-voltage part or the low-voltage group is supplied from its own battery or accumulator, the isolation box, or at least the control unit in the isolation box, can carry out measurements and monitoring at a time when the high-voltage lines and thus many areas of the vehicle are still de-energized.

The calculation processes that are processed or carried out (or can also be said to be carried out) within the safety device can be divided into highly safety-relevant processes on the one hand and calculations, algorithms and processes on the other hand that generate, ascertain or determine additional information or that base decisions on these processes, calculations and algorithms. An evaluation logic designed in this way that can run in the second control unit is an evaluation logic that carries out a calculation of a state of charge of the traction accumulator (which is often abbreviated to "SOC of the accumulator") or its cells (which is often abbreviated to "SOC of a battery cell"). Another calculation that can be carried out using evaluation logic in the second control unit is a state of health calculation (which is often abbreviated to "SOH"). The measured values of the traction accumulator and its (accumulator) cells required for the calculation are made available to the second control unit (and thus to all control units connected to the bus) via the communication bus using the separation box. Of course, such calculations can also be carried out in a third control unit, if one is present (or even in a fourth control unit). A central vehicle control unit (often abbreviated to VCU), for example, can be used as the second control unit; while individual state calculations, display methods and input interfaces can be carried out via an information transfer device with a control unit (e.g. via an "Info tainment system" with an input interface for passengers of the vehicle). The evaluation logic is concentrated in the second control unit for a charge state calculation and/or for a health state calculation. The charge state calculation and/or the health state calculation determines the state ("SOC" and/or "SOH") of the connectable traction accumulator on the basis of measurement data from the separation box.

Ideally, there is a communication bus between the components of the control unit that can be routed past (almost) any number of bus participants. One bus that can be advantageously implemented in this application area is, for example, a CAN bus. Such a (vehicle) CAN bus allows several control devices or control units to be connected to the bus. The communication bus can be a low-voltage communication bus. A low-voltage communication bus can, for example, be implemented as a two-wire bus. A typical two-wire bus is a CAN bus. The low-voltage communication bus is preferably designed to be galvanically isolated from its communication participants. Galvanic isolation components can also be omitted for individual bus participants or control units. If galvanic isolation is not to be built into all control units, it is advantageous to at least implement galvanic isolation between the low-voltage communication bus and the (remaining) isolation box.

If the bus participants are galvanically isolated from the bus lines, the bus participants, i.e. the individual control units, can be at different voltage levels.

In a particularly simplified variant - in terms of computing capacity - the separation box is only equipped with programs and program parts (or hard-wired circuits) that allow immediate evaluation of the measured values, but the separation box does not have any "higher intelligence", i.e. more complex, evaluation logic. The actual evaluation logic takes place in the second control unit (or in other control units). The separation box is therefore implemented without circuits and without program parts for evaluation logic.

Measurement signals, i.e. signals that originate from a measurement sensor, and data communication can be processed by the separation box. Preferably, further calculations based on the measurement values, apart from a plausibility check and/or a limit check of the measurement signals or the measurement values, take place elsewhere, i.e. in one of the other control units. In this way, an emergency shutdown is ensured. The logic of what is evaluated from the individual measurement values can be carried out independently by each control unit. The measurement values are equally available to all control units connected to the communication bus.

The isolating box is preferably set up to process or handle commands. The commands can be sent to the control unit via the communication bus. The individual commands are offered via the isolating box's communication bus connection. At least one of the isolating elements is set to an open state based on a command that can come from outside; there is at least one command for a quick shutdown. The command in particular disconnects the traction accumulator from the further contacts.

The safety device advantageously has a separation box that includes a pre-charging component. The pre-charging component can include a current path section that is equipped with a resistor. The current path section is in particular a resistive, preferably switchable, current path. A current can be conducted over this section, over this current path, which is correctly set for charging an intermediate circuit capacitor of a voltage converter to be connected to the further contacts, i.e. a current-limited charging current for the intermediate circuit capacitor.

According to one embodiment, the isolating box can offer particular advantages if at least two of the isolating elements are switched based on the logic. All-pole switching is possible in this way. Opening of at least one isolating element within a period of less than 5 ms is ensured.

The safety device can be designed in such a way that algorithms are implemented in both the separation box and the second control unit that carry out a validation or check of the traction accumulator. The separation box primarily only carries out limit value analyses (threshold tests). In addition, the calculation steps are limited. Advantageously, only checks are carried out that do not cover more than 100 cycles of the processor unit. A limit value check of individual measured values should be carried out in a few cycles. Meanwhile, the second control unit can carry out analyses of more than one measured value, in particular combined measured value analyses, covering more than 100 cycles.

The separation box includes a monitoring system in one design. The monitoring system is there to Preferably, components, parts, the traction accumulator and/or control units should be monitored for functionality using measured values in the isolation box.

The isolation box can be equipped with fuses. The fuse group includes fuses such as pyro-fuses, melting fuses, overcurrent protection devices or ceramic fuses. Each of these components can be fitted in a high-voltage line.

In a favorable embodiment, the safety device has a separation box that has two voltage ranges, preferably galvanically separated from one another. The voltage ranges differ in terms of their absolute voltages. One range can be a low-voltage range. One range can be a high-voltage range.

The safety device follows a modular concept. The safety device can have more than one separation box. The safety device can also be designed for drive trains with more than one traction accumulator.

Since there are charging stations with different voltage levels, the separation box expands its application area if it has a voltage changer device. The voltage changer device can be designed for different output voltages.

Advantageously, the isolation box is equipped with components and conductors that are capable of transmitting electrical power in the kilowatt and/or megawatt range.

The combinations and embodiments presented above can also be considered in numerous other connections and combinations.

For safety reasons, there is a separation box (also called BDU (Battery Disconnect Unit)) in the drive train discussed above; the separation box is intended for use in an electrically powered vehicle (it is acceleration-proof, shock-proof, temperature-stable, splash-proof, mechanically influenced, pulse-proof, etc.). The separation box is very simple; it can be designed in such a way that it only has very slow (less than 1 MHz clocked) processors in its control unit.

Due to the simple measurement program design, the processing steps of the isolation box are very fast. The isolation box is a very fast-working isolation box; regardless of the error, the isolation box can safely isolate the high-voltage lines within a maximum of 5 ms - the high-voltage lines on the output side are de-energized within a period of less than 5 ms (if a safety-critical condition has been determined based on measured values). However, the isolation box still performs its functions of recording measured values and immediately reacting to one or more incorrect values between the measured (measured) values.

The description of the safety device has shown how individual components of a drive train of an electrically powered motor vehicle can be coordinated to create a safety device distributed across several control units. Each component (e.g. a first control unit, e.g. a second control unit) can work with its proprietary connections, interfaces and software modules. All components are provided with the measured values available to the isolation box (or its control unit). The low-voltage communication bus can be used for this.

In this way, a reliable BDU (or separation box) is created which, when integrated into a group of control units, allows the other control units (or control units) to fully perform their proprietary functions, but still absorbs numerous risks and dangers, especially for passengers, drivers and mechanics of the vehicle.

Character description

• 1 in schematischer Darstellung ein Fahrzeug mit einer Sicherheitsvorrichtung zeigt,
• 2 in einer schematischen Blockdarstellung eine Variante des ein Akkumulatorsystem umfassenden Teils einer Sicherheitsvorrichtung zeigt, die als Alternative für das Akkumulatorsystem nach 1 in ein Fahrzeug gem. 1 eingebaut werden kann,
• 3 in einer schematischen Darstellung eine dritte Ausführungsvariante einer Sicherheitsvorrichtung zeigt,
• 4 eine Sicherheitsvorrichtung mit einer spannungsadaptierbaren Trennbox als vierte Variante zeigt und
• 5 eine Sicherheitsvorrichtung für einen Mega-Watt-Antriebsstrang (LKW-Antriebsstrang) zeigt.

The present invention can be better understood if reference is made to the accompanying figures, which illustrate particularly advantageous embodiments by way of example without restricting the present invention to these, wherein

• 1 shows a schematic representation of a vehicle with a safety device,
• 2 shows in a schematic block diagram a variant of the part of a safety device comprising an accumulator system, which is an alternative to the accumulator system according to 1 in a vehicle acc. 1 can be installed,
• 3 shows a schematic representation of a third embodiment of a safety device,
• 4 shows a safety device with a voltage-adaptable disconnect box as a fourth variant and
• 5 showing a safety device for a mega-watt powertrain (truck powertrain).

Character description

1 demonstrates the component composition of the safety device 1 according to a first possible embodiment using a vehicle 3 shown as a schematic drawing.

The vehicle 3 is driven by a drive train 5. The vehicle 3 has several wheels 7, 9. At least one wheel 9 of the vehicle 3 is driven by the motor 11 when the vehicle 3 is to be moved. The motor 11 normally drives the axle 13 when traveling straight ahead. The wheels for the axle 13, such as the rear wheel 9, are then driven by the drive train 5. The drive train 5 is a rear axle drive. The electrical power for the motor 11, which is an electric motor, is made available via the power supply cable 39 from the accumulator system 23, provided that the separation box 25 is switched in a state that switches the high-voltage lines 39 ^I , 39 ^II through. If the separation box 25 is in the switched-through state, the electrical voltage of the traction accumulator 21 can be distributed in the vehicle 3 via the power supply cable 39.

The separating box 25 can separate the traction accumulator 21 from the power supply cable 39 by switching separating elements 41, 41 ^I (see 2 ) split off.

If the separation box 25 is connected to the traction accumulator 21, the accumulator system 23 is formed, in which the poles 43, 45 of the traction accumulator 21 can no longer be touched from the outside. The poles 43, 45 are covered by the separation box 25 and are thus shielded against direct contact.

The separation box 25 is equipped with a control unit 27, which also includes a computing unit 29. Measured values that the control unit 27 has determined and data that the control unit 27 has calculated, processed or prepared are transmitted via the communication bus 33 to a second control unit 31, which is arranged remotely from the first control unit 27 in the vehicle 3. The first control unit 27 offers a communication bus connection 35 for the connection via the communication bus 33. The second control unit 31 offers a communication bus connection 37 for the communication bus 33. The communication bus 33 runs through the vehicle 3, so that further parts of the communication bus 33 ^I reach as far as the electrical devices of the drive train 5, such as, for example, as far as the inverter 15 with its intermediate circuit and its intermediate circuit capacitor. The respective control unit 31, 27 (more precisely its computing unit 29) is connected to the communication bus 33 via the communication bus connection 35, 37.

The second control unit 31 is responsible for determining data by measuring processes (on and around the traction accumulator 21 or 21 ^I (cf. 2 )) nothing more to do. The measuring processes take place in the first control unit 27. The physical actuation of the separating elements 41, 41 ^I (cf. 2 ) takes place exclusively in the first control unit 27. The second control unit 31 is in relation to control circuits for the separating elements 41, 41 ^I (cf. 2 ) without any switching outputs.

2 shows, by means of a schematic arrangement, an accumulator system 23 ^I which is used in a vehicle 3 (see 1 ) because the power supply cables 39 ^III , 39 ^IV can be switched voltage-free through the first control unit 27 or through the separation box 25 due to the separation elements 41, 41 ^I. The accumulator system 23 ^I is largely similar to the accumulator system 23 according to. 1 . In relation to its poles 43 ^I , 45 ^I the 2 However, the traction accumulator 21 ^I shown in Figure 1 is implemented differently than the one in 1 shown traction accumulator 21. The poles 43, 45 of the 1 shown traction accumulator 21 give way to the poles 43 ^I , 45 ^I of the 2 shown traction accumulator 21 ^I with regard to their location, their positioning and their dimensions.

The poles 43 ^I , 45 ^I of the traction accumulator 21 ^I are located on opposite sides of the traction accumulator 21 ^I . By adding the separation box 25, access to the poles 43 ^I , 45 ^I from one side is prevented. Only the continuing high-voltage lines 39 ^III , 39 ^IV can be touched outside the accumulator system 23 ^I. The continuing, so to speak second high-voltage lines 39 ^III , 39 ^IV can, as already mentioned, be selectively switched off. For this purpose, the two separation elements 41, 41 ^I are present in the separation box 25, which can decouple both the positive and the negative voltage side of the direct voltage.

The 2 The traction accumulator 21 ^I shown is connected at its poles 43 ^I , 45 ^I via first high-voltage lines 39 ^I , 39 ^II to the separating box 25 in order to form the accumulator system 23 ^I. If the separating elements 41, 41 ^I are in an open position, the electrical voltage on the high-voltage lines 39 ^I , 39 ^II cannot be transferred to the output-side (the second, so to speak) high-voltage lines 39 ^III , 39 ^IV . The outgoing high-voltage cables 39 ^III , 39 ^IV are - in this switching state - voltage-free; they are safe to touch.

The measuring cables for the high-voltage measurements are connected to the high-voltage voltage and measurement unit 47. The measurement signals measured by the high-voltage voltage and measurement unit 47 are forwarded via a galvanic isolation to the first control unit 27, where they are converted into measurement data to be available at the communication bus connection 35.

The first control unit 27 can switch the isolating elements, such as the isolating elements 41, 41 ^I located in the high-voltage lines 39 ^I , 39 ^III or 39 ^II , 39 ^IV .

To make the decision as to whether a separating element 41, 41 ^I should be switched, the computing unit 29 carries out more than one calculation. On the other hand, the control unit 27 can receive a command via the communication bus 33, which causes the control unit 27 to switch at least one of the separating elements 41, 41 ^I.

The control unit has 27 switch drivers 57, 57 ^I , 57 ^II for switching the isolating elements 41, 41 ^I. One switch driver 57 ^II is responsible for switching the pre-charging switch 55, which is part of the pre-charging unit 51. The other switch drivers 57, 57 ^I are responsible for switching the isolating elements 41, 41 ^I.

As a further measure to limit the current and thus to protect against overcurrents or excessive electrical currents (short-circuit currents), the isolating box has 25 fuses 71, 71 ^I , of which, for example, one is a fuse and the other is a semiconductor fuse.

For calculation and data exchange in connection with calculated and determined measured values as well as for the evaluation of the measured values in data and data packets, the computing unit 29 has at least three computing modules 61, 65, 67 and a communication module 63. In the error analysis module 61, it is calculated, among other things, whether the measured values or the measurement signals are in valid value ranges. In the separation box analysis module 65, the separation box 25 is monitored for functionality, e.g. whether the separation elements 41, 41 ^I can switch reliably, and in particular whether they can separate reliably. In the resistance and insulation measurement module 67, the resistance values and the insulation values of the separation box 25 are monitored. In addition, the separation box 25 has the high-voltage voltage and measurement unit 47, which can record voltage values and electrical voltages via measuring lines 49, 49 ^I , 49 ^II , 49 ^III , 49 ^IV , 49 ^V , 49 ^VI . The traction accumulator 21 ^I is a high-voltage traction accumulator. Consequently, voltages of up to 800 volts can be present on the measuring lines 49, 49 ^I , 49 ^II , 49 ^III , 49 ^IV , 49 ^V , 49 ^VI . The voltages are measured and monitored. In addition, the separation box 25 uses the separation box analysis module 65 to monitor whether the separation box 25 is functioning properly at any given time. This means that the separation box 25 can monitor itself by carrying out monitoring at the component level. The separation box 25 also monitors the traction accumulator 21 ^I. This ensures that the functionality of the 23 ^I accumulator system is monitored.

Two voltage ranges are created by the high-voltage voltage and measurement unit 47 and the separately designed computing unit 29 in the separation box 25. The communication bus 33 can therefore be designed as a low-voltage communication bus. The other devices on the communication bus, such as the second control unit 31 (see. 1 ), can be designed as low-voltage control units. The high voltage from the high-voltage lines 39 ^III , 39 ^IV is reliably measured by the low-voltage area and the electrical measuring devices and electrical control units of the vehicle (e.g. vehicle 3 acc. 1 ) away.

• • dass bei Erhalt eines fehlerhaften externen Befehls von der zweiten Steuereinheit 31,
• • dass bei einem fehlerhaften Messwert,
• • dass bei einem außerhalb von Toleranzgrenzen angesiedelten Messwert und
• • dass bei einem nicht vorhandenen Messwert, obwohl der Messwert bekannt sein müsste,

ein Öffnen wenigstens eines der Trennelemente 41, 41^I sichergestellt wird. In solchen Fällen wird innerhalb von nur 5 ms die Trennung mithilfe der Trennelemente 41, 41^I vorgenommen. Alle diese Vorgänge und Überprüfungen gehören zu den Validierungen des Traktionsakkumulators 21^I. Die besonders schnell durchzuführenden Validierungen (in Abarbeitungszeiten von weniger als 100 Takten) finden in der ersten Steuereinheit 27 statt.The measured values and evaluation results processed by the computing unit 29 can be transmitted via the communication bus connection 35 on the communication bus 33. If an external evaluation logic, which is e.g. in a second control unit 31 (cf. 1 ) can carry out more complex analyses and transmit the result in the form of, for example, a switching command to the separating elements 41, 41 ^I , data, commands and data sets can also be transmitted via the communication bus 33 and received at the communication bus connection 35. The computing unit 29 is programmed in such a way that

• • that upon receipt of a faulty external command from the second control unit 31,
• • that in case of an incorrect measurement,
• • that if a measured value is outside the tolerance limits and
• • that if a measured value is not available, although the measured value should be known,

opening of at least one of the separating elements 41, 41 ^I is ensured. In such cases, the separation is carried out within only 5 ms using the separating elements 41, 41 ^I. All these operations and checks are part of the validation of the traction accumulator 21 ^I . The particularly Fast validations (in processing times of less than 100 cycles) take place in the first control unit 27.

The pre-charging unit 51 comprises a pre-charging switch 55 and a pre-charging resistor 53. Using the pre-charging unit 51, an intermediate circuit capacitor (see the inverter 15 in 1 ) can be charged over a delayed charging time, ie with a controlled lower current (e.g. over a time base of 5 tau, e.g. within less than 100 ms).

Should a case arise for the computing unit 29 that at least one of the isolating elements 41, 41 ^I is to be switched, the switch drivers 57, 57 ^I are controlled by the switch control 69.

3 shows a further design variant of an accumulator system 123 with a separation box 125 and a traction accumulator 121.

In 3 the traction accumulator 121 is symbolically represented by four cells connected in series. The separation box 125 can be seen, to which the first control unit 127 with the computing unit 129 belongs based on a printed circuit board (or its outline). The second control unit 131 is connected to the communication bus 133, 133 ^I , more precisely to the contacts 175 ^II , 175 ^III of the communication bus 133, 133 ^I. The second control unit 131 is responsible for the more complex evaluation algorithms. The computing unit 129 concentrates on plausibility monitoring of the measured values transmitted via the measuring lines (or data lines intended for measured data) 149, 149 ^I , 149 ^II , 149 ^III , 149 ^IV , 149 ^V , 149 ^VI , 149 ^VII , 149 ^VIII , 149 ^IX , such as voltage values on the high-voltage lines 139 ^I , 139 ^II , 139 ^III , 139 ^IV , such as voltages directly on the traction accumulator 121, such as electrical current values on the high-voltage lines 139 ^I , 139 ^II , 139 ^III , 139 ^IV and such as monitoring of switching operations on the pre-charging switch 155.

Both in the direction of the traction accumulator 121 and outwards, e.g. opposite the second control unit 131, the separation box 125 offers a manageable number of contacts, more precisely less than ten contacts, to be even more precise, exactly nine contacts 175, 175 I, 175 ^II , 175 ^III , 175 ^IV , 175 ^V , 175 ^VI , 175 ^VII , 175 ^III , 175 ^IX . With the small number of contacts 175 ^I , 175 ^II , 175 ^III , 175 ^IV , 175 ^V , 175 ^VI , 175 ^VII , 175 ^III , 175 ^IX (or tiller) ^, the risk of voltage shock is reduced.

With the help of the measuring lines 149 ^I , 149 ^II, the voltage that drops across the shunt 179 can be measured by the first control unit 127. The shunt 179 is located in the high-voltage line 139 ^III , which is responsible for the negative potential at the negative pole of the traction accumulator 121 with its cells connected in series to generate the high voltage (in the range of 400 volts). Via the further measuring line 149 ^III, the control unit 127 can directly measure the electrical current flowing in the high-voltage line 139 ^II using the integrated ammeter. Due to the double measurement of the electrical current in the high-voltage line 139 ^II by the first control unit 127, the first control unit 127, or more precisely its computing unit 129, can carry out plausibility checks and cross-checks. If any of the plausibility checks, such as e.g. B. the current flow test, in the first control unit 127 is outside a valid tolerance band, the first control unit 127 interrupts the current flow by actuating the isolating elements 141, 141 ^I .

The pre-charge switch 155, which is part of the pre-charge unit 151, can be used to start the operation of the vehicle by means of a controlled charging of capacities in the drive train, such as the drive train 5 of the vehicle 3 (see 1 ). The high-voltage lines 139 ^I , 139" fan out behind the fuses 171, 171 ^I into several high-voltage lines 139 ^III , 139 ^IV . Some of the high-voltage lines 139 ^III , 139 ^IV only allow a reduced charging or initial current to flow, e.g. due to the pre-charging resistor 153. The first control unit 127 can also detect and evaluate such current flows via its measuring lines 149 ^I , 149 ^II , 149 ^III and the measuring sensors 179 as well as the current measuring device "Hall effect sensor". Only if the charging process was reliable, conclusive and could be carried out in a sufficiently short time (e.g. within times of 5 Tau to 10 Tau), the switching process for switching through is carried out as follows.

If the drive train (see drive train 5 acc. 1 ) are to be put into operation, the isolating element 141 ^I is first closed. Then the pre-charge switch 155 is closed. In a subsequent step, the time (e.g. 3 Tau or 5 Tau or 10 Tau) is waited for and the voltage monitoring is checked. If the correct voltage is obtained, the isolating element 141 is then closed in order to then open the pre-charge switch 155.

However, if the first control unit 127 determines that a limit check or a plausibility check has produced an incorrect measurement result or an error condition, the first control unit reports the detected error to the second control unit 131 via the communication bus 133, 133 ^I. If the second control unit 131 is one of the central vehicle control units, the entire vehicle is aware that there is an error case either in the accumulator system 123 or even the drive train 5 (see 1 ) has given.

Because fuse 171 ^I is a pyro-fuse, the fuses can be triggered externally, e.g. via an airbag ignition, via contact 175 ^VI , which leads to fuse 171 ^I. This ensures that in more serious cases that have led to the ignition of one or more airbags, the isolating box 125 has switched the high-voltage lines 139 ^III , 139 ^IV off immediately (in a time interval of less than 5 milliseconds) by actuating the isolating elements 141, 141 ^I or, alternatively, by responding to the pyro-fuse 171 ^I.

The traction accumulator system 123 has a circuit board for cell monitoring by the cell monitors 183, 183 ^I , 183 ^II , 183 ^III . The cell monitoring can monitor individual cells, actually all cells, of the traction accumulator 121 using measurement technology. For this purpose, the cell monitoring carries out voltage measurements. In addition, the cell monitoring can carry out temperature measurements on individual cells. The measurement results are made available to the computing unit 129 via measurement line 149 ^V (or data lines for transmitting measurement data). The contact 175 ^VIII is a multi-pin contact so that voltage values and temperature values can be transmitted from the cell monitoring to the computing unit 129.

A further monitoring function can be carried out by the isolating element diagnosis 181, which measures whether the isolating elements 141, 141 ^I are, as calculated, either in the switched or in the separated switching state. It is therefore checked whether the isolating elements 141, 141 ^I have reached the switching state that the computing unit 129 expects for the individual isolating elements 141, 141 ^I based on its calculations. The isolating element diagnosis 181 is part of the 2 shown separation box analysis module 65.

In addition, the separation box 125 offers second separation elements 141 ^II , 141 ^III , via which the accumulator system 123 can be placed in a charging state. If the traction accumulator 121 is to be charged, ie, if an electrical current is to flow into the traction accumulator 121 to charge it, a separate charging path is switched through the separation elements 141 ^II , 141 ^III , while the separation elements 141, 141 ^I and pre-charging switch 155 are in the separated switching state.

4 shows a further embodiment of an accumulator system 223 with a separation box 225 and a first traction accumulator 221 and a second traction accumulator 221 ^I .

The accumulator system 223, which in 4 is similar in many ways to the accumulator system 123, which consists of 3 is known.

Due to the two traction accumulators 221, 221 ^I , which each have more than 80 lithium-ion cells for an operating voltage of 400 volts, the separation box 225 can, in particular depending on the available charging voltage of either 400 volts or 800 volts, switch back and forth between a voltage level of 400 volts and a voltage level of 800 volts by means of its voltage level switches 277, 277 ^I , 277 ^II by connecting the traction accumulators 221, 221 ^I in parallel or in series.

If the current flow is too high, at least one of the fuses 271, 271 ^II is triggered and interrupts the current flow by breaking the electrical connection in the high-voltage lines.

The explanations in connection with 3 can be largely attributed to the accumulator system 223, which is 4 shown, whereby components, objects and parts as well as functional information with respect to their reference symbols are provided with reference symbols numbered 100 higher for similar components, objects and parts as well as functional information.

The two traction accumulators 221, 221 ^I can be kept or operated in parallel or in series by the isolating box 225 and its voltage level switches 277, 277 ^I , 277 ^II . This is possible both during a charging process via the contacts 275, 275 ^V and the switched second isolating elements 141 ^II , 141 ^III and during regular driving with closed isolating elements 241, 241 ^I. Although a larger current through parallel-operated traction accumulators 221, 221 I is not necessary for pre-charging via the pre-charging resistor 253 after closing the pre-charging switch 255, parallel operation of the traction accumulators 221, 221 ^I can be carried out ^even in a pre-charging state (to charge the intermediate circuit capacitors). If the traction accumulators 221, 221 ^I are to be connected in parallel, the voltage level switches 277, 277 ^II are to be closed. If the traction accumulators 221, 221 ^I are to be connected in a series arrangement for a higher voltage, the voltage level switch 277 ^I is to be closed. Due to the possibility of parallel operation of the traction accumulators 221, 221 ^I , a For connection of the traction batteries 221, 221 ^I , a fuse 271, 271 ^I , 271 ^II is provided as overcurrent protection at the contact 275 ^VII , 275 ^VIII , 275 ^XI , 275 ^XII .

The computing unit 229 of the control unit 227 has measuring lines 249 ^V , 249 ^X on the circuit board contacts 5, 6, via which the voltages, temperature values and, if applicable, also gas values of the traction accumulators 221, 221 ^I can be determined.

The traction accumulators 221, 221 ^I are connected to the isolating box 225 via the contacts 275 ^VII , 275 ^VIII , 275 ^XI , 275 ^XII and via the contacts 275 ^IX , 275 ^X for the measuring lines 249 ^V , 249 ^X. On the output side, the isolating box 225 has the contacts 275, 275 ^I , 275 ^II , 275 ^III , 275 ^IV , 275 ^V. Some of the contacts, namely the contacts 275, 275 ^I , 275 ^IV , 275 ^V , are designed for high-voltage connections; they are therefore high-voltage lines. Other contacts, more precisely the contacts 275 ^II , 275 ^III , are designed for the connection of a second control unit 231 in the communication bus 233, i.e. for a very low voltage.

Electrical currents in the separation box 225 can be measured via the measuring lines 249 ^I , 249 ^II , 249 ^III . Because several measuring methods are available (see, for example, the measuring shunt 279; see the current measuring device "A"), the computing unit 229 in the first control unit 227 can carry out comparative tests and comparative calculations in order to detect, for example, deviations in the current values.

In addition, there is a separating element diagnosis 283 in the separating box 225, which is connected via the measuring line 249 ^IV to the corresponding pins of the computing unit 229, whereby the switching states of the separating elements 241, 241 ^I , 241 ^I , 241 ^III and the pre-charge switch 255 can be detected.

The voltages present on the high-voltage lines and on the contacts 275, 275 ^I , 275 ^IV , 275 ^V can be measured via the measuring lines 249 ^VI , 249 ^VII , 249 ^VIII , 249 ^IX , which are voltage measuring lines. The output-side voltages can be compared with the input-side high voltages from the traction accumulators 221, 221 ^I , because there are measuring lines 249, 249 ^I via which the input-side high voltages can be measured by the computing unit 229.

In the event of a serious accident, the isolating box 225 switches off the flow of current using its fuse 271 ^I , which is a pyro-fuse. For this purpose, there is the contact 275 ^VI , via which the pyro-fuse 271 ^I can be triggered. In this way, an instantaneous interruption of the flow of current is possible using the fuse 271 ^I , triggered by a trigger voltage at the contact 275 ^VI .

5 shows a further design variant of a (heavy vehicle) battery system, which is designed for higher power in the megawatt range and is actually made up of four battery systems 323, 323 ^I , 323 ^II , 323 ^III . The battery system is controlled and monitored by a second control unit 331 as an overarching control unit and as an overall analysis unit.

The safety device 301 comprises four accumulator systems 323, 323 ^I , 323 ^II , 323 ^III , which are connected to the central control unit of the vehicle, the second control unit 331, by their isolating boxes 325, 325 ^I , 325 ^II , 325 ^III via the respective communication buses 333, 333 ^I , 333 ^II , 333 ^III . Each is connected by its isolating box 325, 325 ^I , 325", 325 ^III in such a way that the parallel and serially connected traction accumulators 321, 321 ^I , 321 ^III , 321 ^III only allow a high voltage 373 to be applied to the high-voltage lines 339 ^III and 339 ^IV when the isolating elements (not shown) (cf. 2 to 4 ) are in a switched-through state. If the isolating elements are in an open state, the high-voltage lines 339 ^III , 339 ^IV are in a de-energized state. The high-voltage lines 339 ^III , 339 ^IV that lead to the outside can be switched to a de-energized state.

In addition, there are high-voltage cables 339 ^I , 339 ^II between the battery systems 323, 323 ^I , 323", 323 ^III , which are required for the serial or parallel connection of all battery systems 323, 323 ^I , 323 ^II , 323 ^III .

If either one of the separation boxes 325, 325 ^I , 325", 325 ^III or the second control unit 331 detects a fault, an undesirable state and/or a condition according to which at least one of the traction accumulators 321, 321 ^I , 321 ^II , 321 ^III should be protected, the high-voltage lines 339 ^III , 339 ^IV leading to the outside are switched off. A motor vehicle drive train (such as the motor vehicle drive train 5 according to 1 ) can no longer draw power from the traction accumulators 321, 321 ^I , 321 ^II , 321 ^III . The high voltage 373 is no longer present. Repairs or maintenance of the vehicle can be carried out without any problems without endangering the vehicle mechanic (vehicle mechatronics engineer) carrying out the work, as long as the contacts or pins within the traction accumulators 321, 321 ^I , 321 ^II , 321 ^III are not exposed by removing the separation boxes 325, 325 ^I , 325 ^II , 325 ^III .

The design options shown in the individual figures can also be combined with each other in any form.

The accumulator system can be designed for more than four traction accumulators.

The first control unit can comprise more than three voltage inputs. In a reduced form, however, the first control unit can also be equipped with a single voltage input.

The first control unit can also have more than one bus connection.

The first control unit can also be equipped with processor types other than those presented; the concept of distributed security offers an advantage in that the computing requirements for the computing unit of the first control unit are generally kept lower than, for example, the computing requirements for a central vehicle control unit.

List of reference symbols

1, 301

Safety device

3

vehicle

5

Drivetrain

7

first bike

9

second wheel

11

engine

13

axis

15

Inverter, in particular with an intermediate circuit with an intermediate circuit capacitor

21, 21I, 121, 221, 221I, 321, 321I, 321II, 321III

Traction accumulator

23, 23I, 123, 223, 323, 323I, 323II, 323III

Accumulator system

25,125,225, 325, 325I, 325II, 325III

Separation box

27, 127, 227

first control unit

29, 129, 229

Computing unit

31, 131, 231, 331

second control unit

33, 33I, 133, 133I, 233, 333, 333I, 333II, 333III

Communication bus

35

Communication bus connection, especially in the first control unit

37

Communication bus connection, especially in the second control unit

39

Power supply cable harness, especially bundles of high-voltage cables

39I, 39II, 39III, 39IV, 139I, 139II, 139III, 139IV, 339I,

Power supply cables, in particular high-voltage cables 339 ^II , 339 ^III , 339 ^IV

41, 41I, 141, 141I, 141II, 141III, 241, 241I, 241II, 241III

Separating element

43, 43I

first pole, especially positive pole of the traction accumulator

45, 45I

Second pole, especially negative pole of the traction accumulator

47

High-voltage voltage and measurement unit

49, 49I, 49II, 49III, 49IV, 49V, 49VI, 149, 149I, 149II, 149III, 149IV, 149V, 149VI, 149VII, 149VIII

Measurement line

, 149IX, 249, 249I, 249II, 249III, 249IV, 249V, 249VI, 249VII, 249VIII, 249IX, 249X

Measurement line

51, 151

Pre-charging unit

53, 153, 253

Precharge resistor

55, 155, 255

Pre-charge switch

57, 57I, 57II

Switch driver

61

Error analysis module

63

Communication module

65

Separation box analysis module

67

Resistance and insulation measurement module

69

Switch control

71, 71I, 171, 171I, 271, 271I, 271II

Backup

373

High voltage

175, 175I,175II, 175III, 175IV, 175V, 175VI, 175VII, 175VIII, 175IX, 275, 275I, 275II, 275III, 275IV, 275V, 275VI, 275VII, 275VIII, 275IX, 275X, 275XI, 275XII

Contact or pin

277,

first voltage level switch

277I

second voltage level switch

277"

third voltage level switch

179, 279

Shunt, especially for current measurement

181, 283

Separator diagnosis

183,183I 183II, 183III

Cell monitoring

QUOTES INCLUDED IN THE DESCRIPTION

This list of documents listed by the applicant was generated automatically and is included solely to provide the reader with better information. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions.

Cited patent literature

• CN106786988A [0007]
• EP 3413392 A1 [0008]
• EP 3965207 A1 [0009]
• EP 396207 A1 [0009]
• US 2022278520 A1 [0010]
• DE 102004051489 B4 [0011]
• EP 3890059 A1 [0013]
• DE 102014202504 A1 [0014]
• CN105392674A [0015]
• CN112550067A [0016]
• DE 102011086495 A1 [0017]

Claims (16)

Safety device (1, 301) of a drive train (5) of an electrically driven vehicle (3) with a separation box (25, 125, 225, 325, 325 ^I , 325 ^II , 325 ^III ), which comprises a first control unit (27, 127, 227) with a computing unit (29, 129, 229) and with a communication bus connection (35, 37) and which is designed for a transmission of electrical power to its further contacts (175, 175 ^I , 175", 175 ^III , 175 ^IV , 175 ^V , 275, 275 ^I , 275", 275 ^III , 275 ^IV , 275 ^V ), and with a second control unit (31, 131, 231, 331), wherein the first control unit (27, 127, 227) is designed for the execution of a measuring program in the computing unit (29, 129, 229), by means of which measured values read in by the measuring sensors (179, 279) of the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) and/or measured values of the traction accumulator (21, 21 ^I , 121, 221, 221 ^I , 321, 321 ^I , 321 ^II , 321 ^III ) can be processed at regular intervals, characterized in that the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) is designed to be connected directly to a traction accumulator (21, 21 ^I , 121, 221, 221 ^I , 321, 321 ^I , 321 ^II , 321 ^III ) of the vehicle (3), whereby electrical contacts (175, 175 ^I , 175 ^II , 175 ^III , 175 IV , 175 ^V , 175 ^VII , 175 ^VIII , 175 ^IX , 275, 275 ^I , 275 ^II , 275 ^III , 275 ^IV , 275 ^V , 275 ^VII , 275 ^VIII , 275 ^IX , 275 ^X , 275 ^XI , 275 ^XII ) of the separation box (25, 125, 225, 325, 325 ^I , 325 ^II , 325 ^III ) can be connected ^, and the isolating box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) is further designed to protect each connected electrical contact (175, 175 ^I , 175", 175 ^III , 175 ^IV , 175 ^V , 175 ^VII , 175 ^VIII , 175 ^IX , 275, 275 ^I , 275 ^II , 275 ^III , 275 ^IV , 275 ^V , 275 ^VII , 275 ^VIII , 275 ^IX , 275 ^X , 275 ^XI , 275 ^XII ) from direct access by providing the electrical isolating box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) with at least two separating elements (41, 41 ^I , 141, 141 ^I , 141 ^II , 141 ^III , 241, 241 ^I , 241 ^II , 241 ^III ), and in that the separating box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) is designed to be connected to at least two electrical contacts (17 ^VII , 175 ^VIII , 175 ^IX , 275 ^VII , 275 ^VIII , 275 ^IX , 275 ^X , 275 ^XI , 275 ^XII ) of the traction accumulator (21, 21 ^I , 121, 221, 221 ^I , 321, 321 ^I , 321 ^II , 321 ^III ) at the same time. to be made available at the communication bus connection (35, 37) for the second control unit (31, 131, 231, 331), wherein an evaluation logic is implemented in the second control unit (31, 131, 231, 331) and/or the isolating box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) is designed for an independent interruption of the transmission of electrical power in response to measured values determined by the isolating box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ), and that the isolating box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) has a logic for switching at least one of the isolating elements (41, 41 ^I , 141, 141 ^I , 141 ^II , 141 ^III , 241, 241 ^I , 241 ^II , 241 ^III ) which ensures opening of the at least one separating element (41, 41 ^I , 141, 141 I , 141 II , 141 III , 241, 241 ^I , 241 ^II , 241 ^III ) in the event of an incorrect ^external command, in the event of an incorrect measured value, in the event of a measured value outside of tolerance limits and/or in the event of a measured ^{value not} present. Safety device (1, 301) according to Claim 1 , characterized in that the second control unit (31, 131, 231, 331) is a low-voltage control device, in particular for a voltage field of maximum 60 volts, ideally less than 24 volts, wherein preferably the second control unit (31, 131, 231, 331) is a control device without switching outputs, in particular having no drivers for switching outputs, preferably constructed without actuator switches. Safety device (1, 301) according to one of the preceding claims, characterized in that the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) comprises a high-voltage part, i.e. for electrical voltages in a range of more than 60 volts. Safety device (1, 301) according to one of the preceding claims, characterized in that the evaluation logic in the second control unit (31, 131, 231, 331) is designed for a charge state calculation and/or for a health state calculation of the connectable traction accumulator (21, 21 ^I , 121, 221, 221 ^I , 321, 321 ^I , 321 ^II , 321 ^III ) on the basis of measurement data of the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ). Safety device (1, 301) according to one of the preceding claims, characterized in that the communication bus (33, 33 ^I , 133, 133 ^I , 233, 333, 333 ^I , 333 ^II , 333 ^III ) is a low-voltage communication bus, e.g. a two-wire bus such as a CAN bus, which is preferably designed to be galvanically isolated from its communication participants, at least from the separation box (25, 125, 225, 325, 325 ^I , 325 ^II , 325 ^III ). Safety device (1, 301) according to one of the preceding claims, characterized in that the separation box (25, 225, 325, 325 ^I , 325", 325 ^III ) is implemented without circuits and without program parts for an evaluation logic, but comprises one or more circuits that can process measurement signals and/or can carry out data communication via the communication bus (33, 33 ^I , 233, 333, 333 ^I , 333 ^II , 333 ^III ) and/or can implement an emergency shutdown by means of the separation elements (41, 41 ^I , 241, 241 ^I , 241 ^II , 241 ^III ). Safety device (1, 301) according to one of the preceding claims, characterized in that the separating box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) is designed to set at least one of the separating elements (41, 41 ^I , 141, 141 I, 141 II, 141 ^{III, 241, 241 I ,} 241 ^II , 241 ^III ) into an open state by means of commands which are presented via the communication bus connection (35, 37) of the separating box (25, ¹²⁵ , 225, 325, 325 ^I , 325 ^" , 325 ^III ), whereby in particular the traction accumulator (21, 21 ^I , 121, 221, 221 ^I , 321, 321 ^I , 321 ^II , 321 ^III ) is separated from the further contacts (175, 175 ^I , 175 ^II , 175 ^III , 175 ^IV , 175 ^V , 275, 275 ^I , 275 ^II , 275 ^III , 275 ^IV , 275 ^V ). Safety device (1, 301) according to one of the preceding claims, characterized in that the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) comprises a pre-charging component which in particular has a resistive, preferably switchable, current path for charging an intermediate circuit capacitor of a voltage converter (15) to be connected to the further contacts (175, 175 ^I , 175", 175 ^III , 175 ^IV , 175 ^V , 275, 275 ^I , 275", 275 ^III , 275 ^IV , 275 ^V ). Safety device (1, 301) according to one of the preceding claims, characterized in that the separating box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) has a logic for switching two of the separating elements (41, 41 ^I , 141, 141 ^I , 141 ^II , 141 ^III , 241, 241 ^I , 241 ^II , 241 ^III ), wherein the separating box (25, 125, 225, 325, 325 ^I , 325 ^II , 325 ^III ) enables opening of the separating elements (41, 41 ^I , 141, 141 ^I , 141 ^II , 141 ^III , 241, 241 ^I , 241 ^II , 241 ^III ) within a period of less than 5 ms. Safety device (1, 301) according to one of the preceding claims, characterized in that algorithms are implemented both in the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) and in the second control unit (31, 131, 231, 331) which carry out a validation of the traction accumulator (21, 21 ^I , 121, 221, 221 ^I , 321, 321 ^I , 321 ^II , 321 ^III ), wherein the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) primarily carries out limit value analyses and/or limit value tests of individual measured values comprising a maximum of 100 cycles, while the second control unit (31, 131, 231, 331) preferably carries out analyses of more than one measured value, in particular combined measured value analyses, covering more than 100 cycles. Safety device (1, 301) according to one of the preceding claims, characterized in that the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) comprises a monitoring system which preferably monitors components, parts, the traction accumulator (21, 21 ^I , 121, 221, 221', 321, 321 ^I , 321 ^II , 321 ^III ) and/or control units (27, 31, 127, 131, 227, 231, 331) for functionality based on measured values in the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ). Safety device (1, 301) according to one of the preceding claims, characterized in that the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) comprises fuses (71, 71 ^I , 171, 171 ^I , 271, 271 ^I , 271") such as pyro-fuses (171 ^I , 271 ^I ), melting fuses (71), overcurrent contactors or ceramic fuses in a high-voltage line (39, 39 ^I , 39 ^II , 39 ^III , 39 ^IV , 139 ^I , 139", 139 ^III , 139 ^IV , 339 ^I , 339 ^II , 339 ^III , 339 ^IV ). Safety device (1, 301) according to one of the preceding claims, characterized in that the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) has two, preferably galvanically separated, voltage ranges, a low-voltage range and a high-voltage range. Safety device (1, 301) according to one of the preceding claims, characterized in that the safety device (1, 301) comprises more than one separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) and more than one traction accumulator (21, 21 ^I , 121, 221, 221', 321, 321 ^I , 321", 321 ^III ). Safety device (1, 301) according to one of the preceding claims, characterized in that the separation box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) comprises a voltage changeover device for different output voltages. Safety device (1, 301) according to one of the preceding claims, characterized in that the electrical current to be passed through the separating box (25, 125, 225, 325, 325 ^I , 325", 325 ^III ) power is in the range of kilowatts and/or megawatts.

Images