EP2593325A2

EP2593325A2 - Method for safety-dependent disconnection of an electrical power supply system

Info

Publication number: EP2593325A2
Application number: EP11743787.1A
Authority: EP
Inventors: Berengar Krieg; Andreas Heyl
Original assignee: Robert Bosch GmbH; Samsung SDI Co Ltd
Current assignee: Robert Bosch GmbH; Samsung SDI Co Ltd
Priority date: 2010-07-16
Filing date: 2011-07-06
Publication date: 2013-05-22
Also published as: WO2012007329A2; DE102010031456A1; WO2012007329A3

Abstract

A method is described for safety-dependent disconnection of an electrical power supply system (10), as well as a safety device (100) for carrying out the method. A plurality of electrical components (11, 12, 13, 14, 15, 16) are connected to the electrical power supply system (10) and include at least one electrical energy source (11) and at least one electrical load. The electrical energy source (11) is disconnected or decoupled from the electrical power supply system (10) when safety line loop (20) is interrupted. Operating data of at least one of the electrical components (16) is monitored by at least one monitoring unit (22). The safety line loop (20) is interrupted when a safety-critical situation is detected on the basis of the operating data by the monitoring unit (22).

Description

Description title

Method for the safety-related disconnection of an electrical network

The present invention relates to a method for the safety-related disconnection of an electrical network, a safety device suitable for carrying out the method according to the invention, a battery suitable for carrying out the method according to the invention and a motor vehicle which comprises the safety device or battery according to the invention.

State of the art

Methods for safety-related disconnection of an electrical network are known from the prior art, in which a safety line loop (also called interlock or pilot line or interlock or pilot line) is used, when disconnected, an electrical power source belonging to the electrical network is disconnected or disconnected from the electrical network is decoupled if a danger to persons due to live parts is to be feared.

Thus, in electrical networks in vehicles with a nominal voltage exceeding 60 volts, a safety line loop is used which is implemented as a signal loop. The generation of the signal is usually carried out in a power source (for example in a battery) which supplies power to the electrical network. The signal is passed through all electrical network plugs and all components connected to the mains. The system is designed so that when opening a connector or a cover, which prevents access to live parts, inevitably the safety line loop is interrupted. The evaluation of the signal takes place in all participants of the network, which act as an energy source. In case of interruptions

Safety line loop, each of these components turns on the feeding of Energy in the network and if necessary performs a discharge of the network. The typically required time between interruption of the

Safety line loop and shutdown of the protected by this network is in the range below one second.

In addition, from the prior art monitoring mechanisms are known, which are provided in vehicles and systems in which by electronic

Assemblies or functions performed on these assemblies can pose a hazard. For example

Torque monitoring units known in engine control units, which perform a continuous torque monitoring. Generally, such

Monitoring units integrated in the monitored component itself, which depending on the classification of the hazard (for example, according to IS026262) can lead to considerable effort, for example, the required use of

Two computer systems.

The monitoring units can also be provided in separate components, which have free computing capacity. In this case, the separate component must have a special intervention mechanism, which can prevent the risk in the component to be monitored. The integration of the monitoring units in separate components has the advantage that the monitoring is distributed in the overall system and this results in a flexible structure, by which computer resources can be saved if necessary.

Disclosure of the invention

According to the invention, a method is provided for safety-related disconnection of an electrical network. To the electrical network, a plurality of electrical components are connected, which at least one electrical energy source (for

Example, a battery, preferably a lithium-ion battery) and at least one electrical load include. The electrical energy source is switched off or disconnected from the electrical network, if a safety line loop (also called interlock or pilot line or interlock or pilot line) on which the electrical components are or which by the electrical

Components is led, is interrupted. The interruption of Safety line loop may be accomplished by splitting / breaking the signal path, switching to an electrical potential that does not conform to the closed state, or otherwise disturbing the signal flow. The interruption may occur at any point in the safety line loop, but may also be that a signal carried by the safety line loop (eg, a DC signal, a

Constant current signal or an AC signal defined time behavior) is turned off. Operating data of at least one of the electrical components are monitored by at least one monitoring unit, in particular by an electronic computing unit. The safety line loop is interrupted if a safety-critical situation is detected on the basis of the operating data by the monitoring unit. Because the interruption of

Safety line loop causes the protected from unwanted contact network is isolated from the power source, the controlled interruption of the safety line loop can be used to prevent hazards that may arise directly or indirectly through the use of energy from the electrical network. Thus, the safety line loop can be used as an additional shutdown path in the monitoring of electronic systems. In a preferred embodiment of the invention, the electrical network is included

Unload interruption of safety line loop. In addition, it is preferred that at least one monitoring unit is part of a first electrical component and monitors the operating data of a second electrical component. This can lead to a redistribution of computing capacity. The free

Computing capacity of the first electrical component can be used to the possibly existing computing capacity of the second electrical

Relieve component. Only condition is that the first electrical

Component has at least indirect access to the safety line loop. The method according to the invention can be applied flexibly to various situations. The electrical energy source may be a battery, in particular a lithium-ion battery, and a battery current flowing through the battery may be monitored by a first monitoring unit. The

Safety line loop may be interrupted if the battery current exceeds a predetermined current threshold. In another embodiment of the method according to the invention, the electrical network may be a traction network of an electric motor vehicle, to which an electric motor is connected. A target torque transmitted from a torque control device to the electric motor may be controlled by a second

Monitoring unit to be monitored. In this case, the safety line loop can be interrupted if the setpoint torque does not correspond to other operating data acquired by the second monitoring unit. In particular, an interruption can occur when the amount of the target torque is higher than the amount of a torque comparison value, which of the second

Monitoring unit based on the other operating data is calculated.

Typically, the following monitoring data is monitored by the second monitoring unit: a variable determinable by a driver of the motor vehicle, in particular an accelerator pedal position and / or a wheel speed and / or an engine speed and / or a vehicle speed.

In a further embodiment of the method according to the invention, a torque applied to the electric motor is monitored by a third monitoring unit and the safety line loop is interrupted when the set torque is not applied to a torque control device

Motor sent target torque corresponds.

A further aspect of the invention relates to a safety device which comprises at least one electrical energy source (for example a battery, preferably a lithium-ion battery) and at least one electrical consumer, which can be connected to an electrical network. The safety device further comprises a guided by the electrical components

Safety line loop, in the interruption of the electrical energy source can be switched off or decoupled from the electrical network. A monitoring unit of the safety device, which is preferably designed as an electronic computing unit, is adapted to the inventive method for

safety shutdown of the electrical network.

It is preferred that the monitoring unit has immediate access to the

Security loop has, for example, by a relay or a MOSFET (Metal Oxide Semiconductor Field Effect Transistor) which are each designed to break the safety line loop.

Another aspect of the invention relates to a battery. The battery is configured to be turned off or disconnected from an electrical network when a safety line loop passing through it is broken. In this case, the interruption can be done either inside or outside the battery.

In addition, it can consist in that a signal transported by the safety line loop (for example a DC voltage signal) is switched off, in particular by the battery itself. The battery comprises a

Monitoring unit, in particular an electronic processing unit, which is designed to monitor operating data of an electrical component and to interrupt the safety line loop when it determines a safety-critical situation based on the operating data.

Using the battery according to the invention as an electrical energy source, the inventive method can be carried out.

Another aspect of the invention relates to a motor vehicle, in particular an electric motor vehicle, which comprises the safety device or battery according to the invention.

drawings

Embodiments of the invention will be explained in more detail with reference to the drawing and the description below.

It shows:

1 shows a safety device according to a first embodiment of the invention.

Figure 1 shows a generally designated 100 safety device as part of an electric vehicle, not shown. The safety device 100 includes the electrical components 1 1, 12, 13, 14, 15 and 16. The first electrical

Component 1 1 is an energy source in the form of a lithium-ion battery. The Lithium-ion battery 1 1 supplies the electrical components 12, 13 and 14 via a high-voltage network 10 with electrical energy. The electrical components 1 1, 12, 13 and 14 are connected via high-voltage connector 17 to the high-voltage network 10. The lithium-ion battery 1 1 supplies a signal generated by a signal generator 18

DC signal on a closed circuit, which as

Safety line loop 20 is executed and to which the electrical

Components 12, 13 and 14 are connected as participants in the high-voltage network. When one of the high-voltage plugs 17 is pulled, the safety-line loop 20 is interrupted, preferably before the high-voltage path is interrupted. Similarly, the safety line loop 20 when opening a non-illustrated

Cover of an electrical component of the motor vehicle interrupted. An evaluation unit 19a detects the interruption of the safety line loop 20 and switches off the high-voltage network 10 by the electrical lithium-ion battery 1 1 either switched off or disconnected from the high-voltage network 10.

Without limiting the generality forms the high-voltage line 10 is a traction network of the electric vehicle to which the component 14 is connected, which consists of an inverter or a pulse inverter and a

Electric motor exists. The electrical component 14 can also be operated as a generator, in which case one in the electrical component 14

arranged evaluation unit 19b monitors the safety line loop 20 and disconnected when acting as a generator electrical component 14 decouples from the high-voltage network 10. In the following, the embodiment shown in Figure 1 will be described in the situation in which the electrical component 14 is operated as an electric motor and comprises a pulse inverter and an electric motor, not shown. The electrical components 1 1 to 16 are connected to a CAN (Controller Area Network) bus 21, which is used for communication between the individual components. The electrical component 16 is a

Vehicle or torque coordinator, which controls the electric motor in the electrical component 14. The torque coordinator 16 acquires relevant operating data, e.g. As determined by a driver accelerator pedal position, the

Wheel speed of the electric vehicle, the engine speed of the electric motor or the vehicle speed. On the basis of this operating data, the Torque coordinator 16 a target torque of the electric motor and sends it to the electrical component 14th

In the electrical component 13, which in normal operation has any other main function than the torque coordination, is a monitoring unit

22 provided in the form of an electronic processing unit, which also detects operating data via the CAN bus 21, which are used to calculate a desired torque. Regardless of the moment coordinator 16 calculates the

Monitor unit 22 software-based a target torque and compares it with the torque from the coordinator 16 to the CAN bus 21 sent target torque.

If the monitoring unit 22 determines that the amount of the from

Torque coordinator calculated target torque is higher than the amount of a torque comparison value, which is calculated by the monitoring unit 22 based on the operating data, so the monitoring unit 22 controls a relay not shown in detail 23, which interrupts the safety line loop 20.

The evaluation unit 19a detects this interruption and sets a shutdown of the high-voltage network 10 in motion. This happens because the lithium-ion battery

1 1 is disconnected from the high-voltage network 10 and the pulse inverter arranged in the electrical component 14 discharges the high-voltage network 10 and the inductances in the electric motor. As a result, the electric motor in the electrical component 14 no longer build up a moment, and there is no further danger from too high torque position.

In this way, in an erroneous calculation of the target torque by the torque coordinator 16, an additional, redundant shutdown mechanism in the form of an interruption of the safety signal line 20 is provided, which can prevent a hazard to the driver.

The example described corresponds to an arrangement in which the

Monitoring unit 22 is disposed in the electrical component 13 and controls the operation of the electrical component 16. The invention is not limited to such an arrangement. In further exemplary embodiments, which are not shown in more detail, monitoring units provided in the electrical components 11 through 13 can be used to monitor the critical functions of both component 14 and component 16. Likewise, the components 12 to 14 can take over a monitoring of the component 1 1. For example, after interruption of the safety line loop 20 no current flows through the

Lithium-ion battery 1 1, so that further heating of the lithium-ion battery 1 1 is prevented.

While a monitoring unit arranged in the components 12 to 14 has to control a separating device, which supports the software

Safety signal line 20 interrupts, a arranged in the electrical component 1 1 monitoring unit can directly control the signal generator 18 and turn off the generation of the signal.

Typically, the security line loop 20 is configured so that the exact location of the monitoring unit is not critical as long as the monitoring unit has direct or indirect access to the security line loop 20. In specific arrangements it may be preferable that the monitoring of each component whose malfunction leads to a hazard in each of the other components present in the safety line loop path between the generation of the signal (eg in the lithium-ion battery 1 1) and the signal evaluation of the component to be monitored, or their actuator causing the hazard, are, takes place.

Claims

claims

1 . Method for safety-related disconnection of an electrical network (10), to the electrical network (10) a plurality of electrical components (1 1, 12, 13, 14, 15, 16) are connected, which at least one electrical energy source (1 1) and at least an electric

Consumers, and wherein the electrical energy source (1 1) is switched off or disconnected from the electrical network (10) when a guided through the electrical components safety line loop (20) is interrupted, characterized in that operating data of at least one of the electrical components (16) be monitored by at least one monitoring unit (22), in particular an electronic processing unit, and that the safety line loop (20)

is interrupted, if based on the operating data by the

Monitoring unit (22) a safety-critical situation is detected.

2. The method of claim 1, wherein the electrical network (10) is discharged when the safety line loop (20) is interrupted.

3. The method according to claim 1 or 2, wherein at least one

Monitoring unit (22) is part of a first electrical component (13) and monitors the operating data of a second electrical component (16).

4. The method according to any one of the preceding claims, wherein the electrical energy source (1 1) is a battery, a safety-relevant battery size, in particular by the battery (1 1) flowing battery current, a voltage, a temperature and / or a charge content, by a first monitoring unit is monitored and the safety line loop (20) is interrupted when the battery size leaves a predetermined range of values.

Method according to one of the preceding claims, wherein the electrical network (10) is a traction network of an electric motor vehicle, to which an electric motor is connected.

The method of claim 5, wherein one of

Torque control device (16) to the electric motor sent target torque is monitored by a second monitoring unit (22) and the safety line loop (20) is interrupted, if the target torque does not correspond to other of the second monitoring unit (22) detected operating data, in particular if a value of the target torque a safety-critical deviation to a

Torque comparison value, which is calculated by the monitoring unit (22) based on the other operating data.

The method of claim 6, wherein the other operating data, which are detected by the second monitoring unit (22), a determinable by a driver of the motor vehicle size, in particular a

Accelerator pedal position, and / or a wheel speed and / or an engine speed and / or a vehicle speed include.

Method according to one of claims 5 to 7, wherein a torque provided to the electric motor is monitored by a third monitoring unit and the safety line loop (20) is interrupted, if the set torque is not one of a

Torque control device to the electric motor sent target torque corresponds.

Safety device (100) comprising at least one electrical

Power source (1 1) and at least one electrical load (12, 13, 14, 15, 16), which are connectable to an electrical network (10), as well as by the electrical energy source (1 1) and the electrical

Consumer (12, 13, 14, 15, 16) guided safety line loop (20), wherein the electrical energy source (1 1) can be switched off or disconnected from the electrical network (10) when the safety line loop (20) is interrupted, characterized in that the safety device (100) comprises a monitoring unit (22), in particular an electronic computing unit, and is designed to carry out a method according to one of the preceding claims.

10. Battery (1 1) which can be switched off or disconnected from an electrical network (10) when a guided through them safety line loop (20) is interrupted, characterized in that the battery (1 1) a monitoring unit (22), in particular an electronic processing unit, which is adapted to monitor operating data of an electrical component (16) and to interrupt the safety line loop (20) if, on the basis of the operating data, a

safety-critical situation.

1 1. Battery (1 1) according to claim 10, wherein the battery (1 1) as a source of electrical energy, a method according to any one of claims 1 to 8 is executable.

12. Motor vehicle, in particular electric motor vehicle, comprising a safety device (100) according to claim 9 or a battery (1 1) according to claim 10 or 1 1.