WO2022002496A1

WO2022002496A1 - Device for safeguarding in particular safety-related loads in a motor vehicle

Info

Publication number: WO2022002496A1
Application number: PCT/EP2021/064237
Authority: WO
Inventors: Michael Muerken; Nils Draese; Frederik TEKOTTE
Original assignee: Robert Bosch Gmbh
Priority date: 2020-07-03
Filing date: 2021-05-27
Publication date: 2022-01-06
Also published as: DE102020208399A1

Abstract

The invention relates to a device for safeguarding in particular safety-related loads in a motor vehicle, comprising at least two parallel-connected main paths (30, 40) which are situated between an onboard electrical sub-network for at least one safety-related load (16, 25), in particular of a motor vehicle, and a further onboard electrical sub-network for at least one load (17) which is not safety-related. The onboard electrical sub-network for the safety-related load (16, 25) is supplied by an energy store (12), and each of the main paths (30, 40) comprises at least one switching means (34, 36; 44, 46), each of the main paths (30, 40) comprising at least one detection means (38, 39; 48, 49) for detecting a current flowing through the main path (30, 40) in question. At least one additional path (50) is provided, which is connected in parallel to the main paths (30, 40), and the additional path (50) has at least one switching means (54), the switching means (34, 36; 44, 46) of the main paths (30, 40) being designed to open when a critical state is recognised, in particular an overcurrent and/or an overvoltage or undervoltage on the onboard electrical sub-network for the safety-related load (16, 25).

Description

description

title

Device for securing, in particular, safety-relevant consumers in a motor vehicle

The invention relates to a device for securing, in particular, safety-relevant consumers in a motor vehicle according to the preamble of the independent claims.

State of the art

A battery connection for an on-board network is already known from DE 1020182029871. This includes an electronically controlled on-board network coupling / disconnection functionality to implement electronically controlled power distribution, the battery connection comprising a number of switching elements, at least some of which are connected to one another in a star point.

From DE 102018212507 A1 an electronic power distributor for an on-board power supply system with at least one first connection for safety-critical consumers and at least one second connection for a branch in which at least one consumer is arranged is known. It further comprises an electronic fuse which enables a current flow to the at least one second connection in a closed state and interrupts this current flow in an open state, a bypass to the electronic fuse being provided, which in an operating state in which the electronic cal Fuse is open, which allows current to flow to the at least one second connection.

The invention is based on the object of specifying a device that reliably conducts high currents and can switch off, in particular with on-board networks with high safety requirements, for example in connection with automated driving functions. This problem is solved by the features of the independent claim.

Disclosure of the invention

Because at least two main paths connected in parallel to one another and an additional path are provided, each main path comprising at least one switching means and one detection means, a redundant power supply option for safety-relevant consumers can be made possible on the one hand. Especially with a special symmetrical structure, peak currents can be avoided without triggering a shutdown too early in these cases. By providing detection means in each path, the functionality can be checked with a high degree of reliability and ensured even if a path fails via the redundant path. This enables high safety requirements (for example ASIL C) to be achieved, as is required, for example, for automated driving functions. In addition, a high current capability can be achieved, which is advantageous for the targeted melting of fuses in order to maintain the availability of the vehicle. By providing the additional path, current limiting and clamping functions can be implemented via which high currents can be switched off even with inductive loads.

In an expedient development it is provided that the main paths each include at least two parallel-connected partial paths, each with at least one switching means and / or each with at least one detection means. As a result, a redundant but also symmetrical design of the high-current-capable disconnector can be further improved.

In an expedient development it is provided that the additional path has at least one resistance. This is preferably used to limit the current and / or to absorb energy during the switching process of the switching means in the main paths. In an expedient development, it is provided that a coupling in the parking mode of the vehicle and / or a pre-charging of an intermediate circuit capacitor can take place via the additional path.

In an expedient development it is provided that at least one capacitor and at least one resistor are connected in parallel at least in parallel to the switching means as a commutation aid for the respective switching means. Short-term power peaks can be stored via these RC elements, which supports rapid commutation.

In an expedient development, at least one partial path is provided connected in parallel to the additional path, the partial path including at least one voltage limiter, in particular a diode, particularly preferably a TVS diode. This prevents operation in the avalanche mode during the switching operations of the switching means of the main path in the case of mosfets, for example.

In an expedient development it is provided that the switching means is formed from two switching elements arranged in antiserial order (operated inversely to one another). As a result, bidirectional separability is achieved when using Mosfets. In addition, the center point of the anti-serial interconnection can be deflected for diagnostic purposes.

In an expedient development, it is provided that the switching means and the detection means are used in the respective main paths and / or partial paths with identical parameters. This results in a symmetrical or even current distribution in the main paths. In particular, when the partial paths are interleaved, undesirable current peaks, which might result in the switching element being triggered, can be reduced. Furthermore, the error detection is facilitated by the targeted evaluation of any asymmetries that may be present.

In an expedient development, it is provided that the currents in the respective main paths and / or partial path (s) are evaluated and, in the case of different currents in the main paths and / or partial path (s), on one Error case is recognized. This indicates the malfunctioning of the detection means and / or the control circuit (s) for the switching means and / or defects in the switching means themselves.

In an expedient development, it is provided that the detection means detects at least one value before changing a threshold value and / or before switching off another main path and / or another partial path and that the recording means detects at least one value after changing the threshold value and / or after switching off another main path and / or another partial path. By specifically recording before and after switching off certain paths, plausibility tests of the determined current values can be carried out, which is used for error evaluation. This increases the security for fault detection.

In an expedient development, it is provided that detection means and / or a threshold value comparison and / or activation of the respective switching means are in each case independent of one another in the individual main paths. This prevents mutual interference in the event of a fault.

Further useful developments result from further dependent claims and from the description.

Brief description of the drawing

Figure 1 shows an on-board network in which the switching means is implemented,

Figure 2 shows the more detailed structure of the switching means,

FIG. 3 shows the different activation steps during error-free commissioning or when separating the sub-electrical systems as well

FIG. 4 shows a flow chart for the fuse being blown.

Embodiment of the invention The invention is illustrated schematically using an exemplary embodiment and will be described in detail below with reference to the drawing.

Figure 1 shows a possible topology of an energy supply system, consisting of an on-board network 10, which includes an energy store 12, in particular a battery 12 with an associated sensor 14, preferably a battery sensor, and several particularly safety-relevant consumers 16, which are protected by an electrical power distributor 18 or controlled, includes. The consumers 16 are special consumers with high requirements or a high need for protection, generally referred to as safety-relevant consumers 16. This is, for example, an electric steering and / or a braking system as such components that must be supplied in order to ensure the steering and / or braking of the vehicle in the event of a fault. For this purpose, corresponding parameters of the respective consumer 16 are recorded separately and, in the event of a deviation from tolerable values, the respective switch 15 is opened to protect the respective consumer 16.

The energy store 12 is also connected to a connection (terminal KL30_1) of the power distributor 18. The sensor 14 is able to detect an electrical characteristic such as a voltage Ub at the energy store 12 and / or a current Ib through the energy store 12 and / or a temperature Tb of the energy store 12. The sensor 14 can, for example, determine the state of charge SOC of the energy store 12 or other parameters of the energy store 12 from the electrical parameters Ub, Ib, Tb determined. At the further connection (KL 30_1) of the power distributor 18, to which the energy store 12 is also connected, a further supply branch for at least one further consumer 25 is optionally provided. The consumer 25 is protected by a fuse 23. Further consumers 25 can also be provided, which ments 23 can also be secured via fusible links. These loads 25 are those that are still supplied with energy from the energy store 12 even when the switching means 19 in the power distributor 18 is disconnected or opened should be, so preferably to those safety-critical consumers 25 or consumers 25, which are critical with regard to the generation of disturbances in relation to the security of supply. An (optional) safety-relevant or safety-critical vehicle electrical system path is thus connected to the connection KL 30 _1.

The power distributor 18 is able to determine corresponding parameters such as voltage Uv, current Iv of the consumer 16. The power distributor 18 is also able to determine corresponding parameters of the energy store 12 such as voltage Ub and / or current Ib and / or temperature Tb. For this purpose, the power distributor 18 contains the appropriate sensors. The power distributor 18 also has corresponding processing means such as a microcontroller 13 for storing or evaluating recorded variables. The microcontroller 13 is also able to control corresponding switches 15 or switching means 34, 36, 44, 46, 54 of the switching means 19 (high-current-capable isolating switch). Alternatively, the evaluation could also take place in another control unit.

Furthermore, the power distributor 18 is able, depending on the state of the energy store 12, to deliver signals on the basis of which the transition to a safe state is initiated. Then, for example, a higher-level control device initiates a safe stop of the vehicle (approaching the next parking space, immediate stop at the hard shoulder, etc.) and leaves the autonomous ferry service.

The power distributor 18 also has corresponding processing means, such as the microcontroller 13 for example, in order to store or evaluate recorded variables. In addition, the power distributor 18 can include a user-specific circuit (ASIC) via which a safety function in connection with the appropriately controlled switches 15 is implemented for the particularly safety-relevant consumers 16 connected to the outputs. In certain critical states (for example exceeding a certain temperature, power loss, overcurrent, overvoltage, undervoltage, etc.) the switch 15 and / or switching means 19 is opened in order to prevent an overload, for example. The power distributor 18 can be provided with a connection for a communication system, in particular a bus system such as a CAN bus and / or LIN bus. In addition, a connection for at least one further connection signal, for example the so-called terminal 31 signal (ignition on), can be provided. As can be seen, the associated energy store 12 is connected to one connection of the power distributor 18. However, this does not have to be provided as a direct connection, but could optionally take place with the interposition of further components such as conventional fuse boxes or the like.

In addition, the switching means 19 is provided, which is located between the connection (KL30_0) of the power distributor 18 and the further connection (KL3CM) for the energy store 12. If necessary, the loads 16 connected to the outputs of the power distributor 18 could be supplied by another energy source, for example from another on-board network branch via a DC voltage converter 22 via the switching means 19 if the energy store 12 connected to the other terminal KL3CM fails. A corresponding separation or coupling function, in particular of the two on-board network branches (sub-on-board network for non-safety-relevant consumers 17 at connection KL 30_0; further sub-on-board network for safety-relevant consumers 16, 25) can be implemented via switching means 19. This serves in particular as a safety function in order to prevent the effects of critical states such as overvoltage or undervoltage and / or overcurrents and / or thermal overload. In the event of a fault, the two sub-electrical systems can be separated from one another by the switching means 19. The safety-relevant consumers 16, 25 of the safety-relevant sub-board network are thus separated from the non-safety-relevant consumers 17 of the other sub-board network.

The safety-relevant consumers 16, 25 supplied by the power distributor 18 could, for example, include safety-relevant vehicle functions such as braking, steering, etc., in particular consumers 16 with high requirements in terms of protection requirements. In general, safety-relevant consumers 16, 25 are consumers that are particularly worthy of protection and that are necessary, for example, to maintain certain emergency functions. In addition to the functions described, such as steering and braking, these can also be functions that, for example, occur after an accident should still be functional if possible, such as restraint systems, locking systems for opening and closing vehicle doors, emergency call systems, for example for making an electronic emergency call, sliding roof functions, lighting, windshield wipers or the like.

The basic on-board network 10 has a lower voltage level U1 than a high-voltage on-board network 20, for example it can be a 14 V on-board network. A DC voltage converter 22 is arranged between the basic on-board power supply 10 and the high-voltage on-board power supply 20. The high-voltage on-board network 20 includes, for example, an energy store 24, for example a high-voltage battery, possibly with an integrated battery management system, shown as an example a load 26, for example a convenience consumer such as an air conditioning system supplied with an increased voltage level, etc., and an electric machine 28 In this context, a voltage level U2 is understood which is higher than the voltage level U1 of the basic on-board network 10. For example, it could be a 48-volt on-board network. Alternatively, electric vehicles in particular could have even higher voltage levels. Alternatively, the high-voltage on-board network 20 could be omitted entirely.

Between the connection (KL30_0) of the power distributor 18 and the DC voltage converter 22 there is a further branch or a further sub-board network for supplying further consumers 17. The respective consumers 17 are protected by corresponding fuses 23, as shown by way of example. These consumers 17 are typically comfort consumers or consumers that are not safety-relevant. Comfort consumers 17 and fuses 23 can, depending on the application, be divided into main and sub-groups and thus grouped. These are consumers 17 that are not characterized by high security relevance (such as consumers 25) or by high requirements with regard to a need for protection (such as consumers 16). Effects of these consumers 17 on safety-relevant consumers 25 and 16 can be prevented by isolating the fault by opening the switching means 19. The switching means 19 is thus arranged between the consumers 17 and the safety-relevant consumers 25 and / or the consumers 16 with a high protection requirement. At least one or further, in particular, safety-relevant channels or on-board network branches 10 'can be connected to the high-voltage on-board network 20 via a further DC voltage converter 22'. The safety-relevant channels could each have a further electronic power distributor 18 '. Optionally, the further power distributor 18 ′ can also be connected directly to the same connection KL30_0 as the power distributor 18 without a further DC voltage converter 22 ′. The further electronic power distributor 18 'could be used for protection, control and the safe and reliable shutdown of safety-relevant consumers 16' or the electronic power network distribution. These consumers 16 'could be designed to be functionally redundant in relation to those consumers 16 that are supplied by another safety-relevant branch of the on-board network 10. In addition, the further electronic power distributor 18 'can be able to detect the flowing consumer currents or applied voltages. This briefly described ne, optional version, could be provided for a high-availability design, for example, for autonomous driving to increase safety. A further energy store 12 'with a further sensor 14' could also be provided in the further on-board network branch.

The high-current-capable switching means 19 or the high-current-capable isolating switch is arranged in the power distributor 18 between the connection (KL30_1) and the connection (KL30_0) or a connection for the consumer 16 of the power distributor 18. The switching means 19 is able to open in the event of an overcurrent and / or in the event of an undervoltage or similar critical vehicle electrical system states.

The switching means 19 comprises at least two main paths 30, 40 connected in parallel, switching means 34, 44 being provided in each main path. The switching means 34, 44 are particularly preferably each connected by at least two switching elements 34.1, 34.2; 44.1,44.2 formed, preferably using power semiconductors, particularly preferably ^FET's or ^MOSFET's. Instead of MOSFETs also relays, bipolar transistors or IGBTs, for example. Parallel with diodes, etc. used to who. The respective main paths 30, 40 with associated switching means 34, 44 are particularly preferably constructed symmetrically, so that the same currents flow through the two main paths 30, 40 during proper operation. An additional path 50 is connected in parallel to the main paths 30, 40. The additional path also has a switching means 54 and a series resistor 58 as a current limiter or “braking resistor”. The switching means 54 consists of at least two switching elements 54.1,54.2 connected in reverse series. The additional path 50 has the ability to separate the current flow under high currents (for example greater than 900 A) even under an inductive load 57. Furthermore, a detection means is also provided in the additional path 50 in order to carry out a current measurement. For example, the resistance (RDSon) between the drain and source of a mosfet is monitored when it is switched on.

Optionally, a further partial path 52 can be connected in parallel to the additional path 50. In the further partial path 52 there is at least one voltage limiter 55, for example a specific diode such as preferably a TVS diode.

In the exemplary embodiment, a battery or accumulator is described as a possible energy store 12, 24 as an example. Alternatively, however, other energy storage devices suitable for this task, for example on an inductive or capacitive basis, fuel cells, capacitors or the like, can be used to the same extent.

In the exemplary embodiment according to FIG. 2, the structure of the switching means 19 is shown in more detail. The main path 30 thus comprises two partial paths 31, 32 which are connected in parallel to one another. The two switching elements 34.1, 34.2 connected in reverse series and a detection means 38 for a current flowing through the partial path 31 are arranged in one partial path 31. The detection means 38 is designed, for example, as a resistor. A corresponding current detection circuit for detecting the current flowing through the detection means 38 is indicated. In the further partial path 32, the two antiserially ver switched further switching elements 36.1,36.2 and a further Erfassungsmit tel 39 for a current flowing through the further partial path 32 are arranged.

The detection means 39 is designed, for example, as a resistor and connected in series with the switching elements 36.1 and 36.2. Instead of a resistor, it is also possible to use other detection means such as magnetic field sensors. evaluate the or, for example, the voltage drop at one or more switching elements.

The further main path 40 thus also comprises two partial paths 41, 42 which are connected in parallel to one another. The two switching elements 44.1, 44.2 connected in reverse series and a detection means 48 for a current flowing through the partial path 41 are arranged in one partial path 41. The detection means 48 is designed, for example, as a resistor. In the further sub-path 42 (of the wider main path 40), the two antiserially interconnected further switching elements 46.1, 46.2 and a further detection means 49 for a current flowing through the white direct sub-path 42 are arranged. The detection means 49 is designed as a Wderstand for example. A corresponding current detection circuit for detecting the current flowing through the detection means 48 is indicated.

The detection means 38, 39, 48, 49 could either forward the currents flowing through the associated sub-paths 31, 32, 41, 42 to the microcontroller 13, for example. Or else it could be by averaging two acquisition means 38, 39; 48,49 of the respective main path 30.40 the current flow in the partial paths 31,32; 41.42 can be determined.

The switching means 34, 36; 44, 46 and the associated acquisition means 38, 39; 48, 49 designed symmetrically, that is, with the same resistance values or parameters, etc. designed. This is intended to result in error-free operation in each of the various partial paths 31, 32; 41, 42 each set an identical current flow. If there are deviations in symmetry, this indicates an error case to be evaluated.

Furthermore, the respective partial paths 31, 32; 41, 42 ideally each arranged nested to one another. In the circuit layout, the corre sponding sub-branches 31,41; 32, 42 can be arranged such that, for example, two partial paths 31, 32; 41, 42 of a main path 30; 40 a partial path 41; 32 of the respective further main path 40; 30 or that the respective partial paths 31, 41, 32, 42 are arranged alternately with respect to the main path 30, 40. The additional path 50 and / or the partial path 52 in the middle is particularly preferred arranged and are each of two partial paths 31, 41; 32,42 different main paths 30,40.

In addition to the optimized placement on the circuit board, the high-current switching processes can be supported by switching relief networks.

The switching relief networks are also nested close to the Schaltmit means 34,44 and 36,46. The switching relief networks are built up from the capacitors 69,67 and the resistor 71. As well as 63,61 and the resistor 65. The resistors not only dampen the tendency to oscillation, but also absorb switching energy through the highest possible resistance value, as well as through the high resistive voltage drop accelerates the commutation process. By placing the switching relief between the partial paths, each switching relief can accommodate both shutdown energy from the main path 30 and from the main path 40. The embodiment outlined in FIG. 2 represents the special case in which a common resistor 71 is kept for two capacitors 69, 67 (or 65 for capacitors 61 and 63).

An optional partial path 52 is provided for the additional branch 50, in which the switching means 54 (again, switching elements 54.1, 54.2 arranged antiserially) and the series resistor 58 connected in series are arranged. The optional partial path 52 is connected in parallel to the additional branch 50. In the optional additional branch 52, a switching means 56 (consisting of two back-to-back connected switching elements 56.1, 56.2) and at least one voltage limiter 55, preferably two voltage limiter 55 (in particular a diode, particularly preferably a TVS diode to prevent an avalanche) are connected in series Control of the switching elements in the main paths 30, 40) and optionally a detection means 59, in particular a resistor for detecting the current and for limiting the current through the partial path 52, is provided. An inductance 57 is shown as an example of a line inductance between the common potential of additional path 50 and optional partial path 52 and the connection (terminal KL 30_0) of power distributor 18. The device described relates to a high-current disconnector concept (switching means 19) for low-voltage vehicle electrical systems <100V. In the context of the advancing electrification of safety-relevant vehicle components, the availability of the on-board network 10 is becoming more important. In this context, switches are introduced to control the energy flows and functional availability in the electrical system 10 and secure. The IS026262 places far-reaching requirements on the functional safety of these components and the entire on-board power supply system.

To completely separate the current flow between the connection KL 30_1 or the safety-relevant sub-board network and the connection KL 30_0 or the non-safety-relevant sub-board network, six serial MOSFET paths (sub-paths 31, 32, 41, 42, 50, 52) are used in the example . Four (partial paths 31, 32, 41, 42) are closed in normal operation and represent a low-resistance (<2mQ) connection between connection KL30_1 or the safety-relevant sub-board network and connection KL30_0 or non-safety-related sub-board network Additional path 50 is equipped with the additional series resistor 58. The current flow in parking mode (idle mode of the vehicle) can be guided via this and limited (by the resistor 58). Due to this limitation, there is a natural protection against an uncontrolled increase in electricity in park operation. This means that complex protective circuits and diagnostics can be dispensed with in park operation. In addition, the series resistor 58 serves as a “braking resistor”. In the event that a very high current flow with a high line inductance 57 has to be switched off by the switch 19, a stepped switch-off via the current-limited additional path 50 is possible.

The optional, further partial path 52 of the additional path 50 can be equipped with a voltage limiter (for example by TVS diodes) 55 in order to prevent the switching means 34, 44, 36, 46 (in particular Mosfets) from operating in avalanche mode.

The paths are divided into two main paths 30, 40, main path 30 with partial paths 31, 32 (which are connected in parallel), main path 40 with partial paths 41, 42. Both main paths 30.40 have their own independent electricity measurement or current recording (recording means 38,39; 48,49), which record the current flow in each main path 30,40. The recorded current is compared with a predefinable threshold value G. If the recorded current exceeds a permissible threshold value G (for example 250 A in a partial path 31, 32,

41, 42), it is concluded that there is an error and appropriate countermeasures are initiated, such as opening the switching means 34, 36, 44, 46. The main paths 30, 40 preferably each have independent threshold comparisons and / or controls for the respective switching means 34, 36, 44, 46.

Due to a symmetrical structure and the use of low-resistance (for example less than 2 mΩ) switching means 34, 44 there is a fairly even distribution of the total current I over the two main paths 30, 40 in normal operation. An increasing asymmetry of the two current measurement signals in the two main paths 30, 40 is an indicator of an error either in the current measurement or in the detection means 38, 39, 48, 49, the control (not specifically shown) of the switching means 34, 36, 44, 46 (for example, MOSFET ^'s from the gate-source voltage drop), or the switch means 34, 44 itself (for example, die attach at ^MOSFET' s etc.).

To isolate a fault, the main paths 30, 40 can be switched off individually in order to direct the entire flow of current through a single main path 30, 40 in a row. This enables a plausibility check of the two current measurement signals to one another or to their sum. A targeted shutdown of one of the main paths 30, 40 could be implemented, for example, by briefly lowering the threshold value, which leads to a shutdown, below a value of the current flowing in this main path 30, 40. If the increased current value (increase in the current value after shutdown in the main path 30 compared to the current value in the main path 30 before shutdown) in one main path 30 after the shutdown of the other main path 40 deviates significantly from the current value that was before the shutdown of the other main path 40 has determined, it is concluded that there is an error in the detection means 48, 49. Correspondingly, the detection means 38, 39 and 48, 49 can also be checked by switching off the main path 30 with corresponding detection of the current before and after switching off in the further main path 40. By measuring the current (by detection means 38, 39; 48, 49) in two independent main paths 30, 40 and diagnosing it, it is possible to operate both main paths 30, 40 redundantly to one another. In this case, each main path 30, 40 has its own overcurrent shutdown (shutdown as soon as a critical threshold value or state is reached) and its own gate driver including the supply.

This overcurrent shutdown can, if necessary, also be tested during operation in order to detect latent errors in the overcurrent shutdown, the control or the switching means 34, 44. To this end, the overcurrent shutdown of a main path 30, 40 can be triggered by reducing the threshold value (for example from 250 A to 75 A or depending on which current is currently flowing). The switching means 34, 44 must be opened in sequence and the common current flow from the two main paths 30, 40 change to the remaining closed main path 30 or 40.

The described operational management for testing ensures that o the current measurement or detection means 38,39, 48,49 works, o the current value is correctly compared with a threshold value o if the threshold value is exceeded, a shutdown (opening switch means 34,36, 44 , 46) triggers. o The shutdown actually opens the switching means 34, 36, 44, 46.

In addition, it is possible to increase the center potential between the switching elements 34.1, 34.2; 44.1, 44.2 e.g. to move into the negative range to check whether both switching elements 34.1; 34.2; 44.1,44.2 can block a defined voltage.

The extensive diagnostics make it possible to guarantee high safety requirements (for example ASIL C) for the isolating capability of the switching means 19.

The redundant control of both main paths 30, 40 also makes it possible to meet high safety requirements (for example ASIL C) for the To guarantee conductivity of at least one main path 30.40. In the event of a fault, it is possible to maintain reduced operation with just a single main path 30, 40. For this purpose, the main paths 30, 40 are ideally nested in one another in order to prevent the formation of local power peaks.

The additional path 50, which is implemented with the series resistor 58, is held parallel to the low-resistance main path 30, 40. Via the series resistor 58 (e.g. 40mQ), the maximum current level, which can flow through the resistor 58 in a 12V vehicle electrical system, for example, can be limited to uncritical values. A “high-resistance” connection between connection KL30_1 and connection KL30_0 can thereby also be achieved via this additional path 50, in particular in parking operation (idle operation of the vehicle, vehicle is parked). The detection of the current flow via the additional path 50, in particular in parking operation, can be used as a wake-up signal for the control device. When you wake up, the cause of the increase in current can be assessed and, in the event of a fault current, a complete separation of both networks (for example separation of the sub-on-board network with energy storage 12 from the other sub-on-board networks 10 or 10) can be carried out. In the event of an authorized wake-up from parking operation, connection KL30_1 or the safety-relevant sub-board network and connection KL30_0 or non-safety-relevant sub-board network are connected and there is a change to active operation.

For the initial pre-charging of capacitive on-board network branches, a resistive pre-charging functionality can be implemented via the additional path 50.

In order to be able to disconnect the connection KL30_1 or the safety-relevant sub-board network (with the safety-relevant consumers 16, 25) and the connection KL30_0 or the non-safety-relevant sub-board network (with the non-safety-relevant consumers 17) under a high current load in the event of a short circuit, the inductive Load are clamped by the disconnection process. As a robust approach to reducing the current level when a short circuit is disconnected to uncritical values, the additional path 50 with the series resistor 58 is also used to cut off the current. For this purpose, only the low-resistance main switch 34, 36, 44, 46 ge opens at an over current shutdown. The energy which is stored in the line inductance 57 is in Result on the RL member from line 57 and series resistor 58 reduced to an uncritical level. Only then is the additional path 50 (the path with the series resistor 58) opened in order to finally interrupt the flow of current.

In order to support the commutation of the current from the main path 30, 40 to the high-resistance additional path 50, additional RC elements (snubbers) can support the commutation process. These RC elements are formed by capacitors 61, 63, 67, 69 and associated resistors 65, 71.

Since the clamping function of the additional path 50 with the series resistor 58 is necessary for compliance with the functional safety goals, its availability must be ensured via a diagnosis. One possibility is to monitor the partial current flow through the additional path 50 during operation. Another possibility is to check the conductivity of the additional path 50 via a test current which is impressed between the antiserial switching elements 54.1, 54.2 of the additional path 50.

The automotive main switch concept or switching means 19 described for safety-critical high-current applications is, as described below, also particularly suitable for the targeted triggering of fuses 23 while maintaining certain safety requirements. Under suitable on-board network boundary conditions, almost all fuses 23 can be triggered directly during ferry operation. The power distributor 18 ensures that the voltage limits are not violated in order to guarantee the availability of safety-relevant consumers. However, the fuses 23 do not burn free while driving, for example in the following scenarios. For example, a high-current consumer such as a radiator fan could exceed the current current limit (e.g. 900 A) through a direct short circuit. The fan is connected with such low resistance that the short-circuit current exceeds 900-1000 A when the vehicle electrical system voltage is high (while driving with the generator / active DC voltage converter 22 running). In this case, the switching means 19, the high-current switch, is opened for self-protection. Another critical scenario could be that, for example, a low-resistance short circuit directly on the main distributor leads to currents that are so high that the voltage drop causes certain voltage limits get hurt. This short circuit would be so high-resistance that the 900 A threshold is not exceeded, but so low-resistance that the switching means 19 or the isolating switch detects a safety-critical voltage drop. Critical safety-relevant consumers 16 such as steering and brakes could no longer be safely supplied with this undervoltage. In order to ensure the supply of the safety-critical consumers 16 such as brakes and steering, the switching means 19 is opened. The vehicle coasts with full steering / braking assistance (the engine control as part of the consumer 17 connected to terminal KL 30_0 can no longer be supplied due to the short circuit in this branch of the vehicle electrical system). All fuses 23 offer the potential to be triggered when the vehicle is at a standstill when the terminals are changed. This avoids breakdowns, as the vehicle can be restarted from a standstill after the "blow out fuse" function. In the case of the cooling fan described, a lower battery voltage when stationary leads to a reduced short-circuit current. In the case of the main distribution short circuit described, the voltage limits can be deactivated because the vehicle is stationary. This is achieved through the ability of the power distributor 18 to trigger, for example, fuses 23 with currents greater than 400 A in a controlled manner.

In Figure 3, the initial start-up of the vehicle or the disconnection of the sub-wiring systems in a critical condition is described. The operating current flowing through the consumer 17 is indicated by dashed lines in FIG. 3A. Initially, a current flow 60 is initiated only through the additional path 50. For this purpose, the switching means 34, 36, 44, 46 of the main paths 30, 40 are open. By activating the additional path 50, the intermediate circuit capacitance 11 is precharged. Especially when the vehicle is started up for the first time, charging the empty intermediate circuit capacities 11 would possibly lead to excessively high currents in the main thread 30, 40. This is counteracted, as described, by charging the intermediate circuit capacitance 11 via the additional path 50. At the point in time when the additional path 50 is activated, the current briefly increases slightly, only to then decrease slightly. The voltage on the additional path 50 drops suddenly when activated, in order to initially rise more sharply in the course of charging the intermediate circuit capacitor 11 and then slowly decrease again in the further course. If the intermediate circuit capacitance 11 has been precharged (for example after 5 ms), the switching means 19 is activated so that at least one of the two main paths 30, 40 carries the current 60, FIG. 3B. Both main paths 30, 40 can also carry the current 60. The on-board network is now in the regular operating state and both sub-on-board networks (KL30_0 and KL30_1) are connected with low resistance). The additional path 50 can remain closed or be opened.

In FIG. 3C, the occurrence of a short circuit in front of the consumer 17 to ground is shown as an exemplary fault. The on-board network branch KL30_0 becomes low-resistance to ground and there is a rapid current increase through the switching means 19. The current increase leads to a decrease in the on-board network operating voltage of both (low-resistance) coupled on-board network branches KL30_0 and KL30_1. The voltage on the safety-critical electrical system side KL30_1 is permanently monitored by the power distributor 18 in order to guarantee an error-free energy supply for the safety-critical loads 16, 25. If the voltage dip is too strong to guarantee error-free operation, both on-board networks (sub-on-board network at connection KL 30_ 0 and sub-on-board network at connection KL 30_ 1) are separated according to the sequence in FIGS. 3D and 3E. In addition to the evaluation of the voltage level, an evaluation of the duration is also carried out, since strong voltage drops are not critical for short periods of time and only become safety-critical after a certain period of time. In addition to the voltage drop, evaluating the direction of the current can also be used to check whether current is flowing from the safety-critical on-board network KL30_1 into the basic on-board network KL30_0. Only when this current direction occurs (i.e. no support for the safety-relevant consumer 16, 25 or the safety-relevant sub-board network by the non-safety-relevant sub-board network) does the switching device 19 open. exceeds, a separation of the two vehicle electrical systems according to Figure 3D and 3E is carried out in order to prevent operation of the switching means 19 outside the relevant specification. In Figure 3D, the separation process of both sub-electrical systems (KL 30 _ 0 and KL 30 _

1) started by opening the switching means 34, 36, 44, 46. The current 60 now flows via the additional path 50. The additional path 50 is closed. The current is limited via the additional path 50 using the resistor 58. The short-term high currents during commutation can be buffered via the corresponding RC elements (compare FIG. 2 (capacitors 61, 63, 67, 69, resistors 65, 71) .

It is preferably provided that the current flows via the additional path 50 only for a limited period of time, in particular in order to avoid overload conditions. For example, a fixed period of time could be provided (for example in the ms range, for example for 1 ms) for which the additional path 50 is closed. For this purpose, for example, when the main paths 30, 40 are opened, a timer could be started, when the timer expires, the additional path 50 is opened again. Alternative configurations would be possible. For example, the additional path 50 could be switched off as a function of certain parameters, for example when a certain limit value for current or temperature or the like is exceeded.

FIG. 3E shows how the additional path 50 is opened. However, the partial path 52 is still closed or active. For this purpose, for example, the limiting means 55,56 (for example, diodes, particularly preferably TVS diodes) provided to accommodate the shift energy or by the Schaltmit tel 34.36, 44.46, especially ^MOSFET's, shakers before the avalanche mode to zen, Figure 3E. In addition to the partial path 52 (as part of the circuit for the switching means 19), this could also be done, for example, via an external circuit in connection with the main paths 30, 40.

In the procedure described for burning the fuse 23 free, the current level that occurs is limited by the impedance of the short circuit. The switching means 34, 36, 44, 46 in the main paths 30, 40 must be able to store the peak losses or have a better thermal resistance than the fuse 23. The energy for melting the fuse 23 is obtained via the cold start Path provided by the energy store 12. If necessary, the DC-DC converter 22 can support. Furthermore, the switching means 19 can be designed in such a way that, within the scope of an availability-optimized design, it is possible to burn the fuses 23 at the connection KL 30_0 with just a single main path 30, 40 (supply redundancy).

The stepped shutdown described in FIG. 3 prevents oscillations and leads to switching losses, for example via robust metal resistors 58.

Short circuits with too low an impedance cannot be triggered. It is ensured that the burning of a fuse 23 to protect against thermal events can always be canceled. The current flow always remains within the design limits. In addition, the switching means 19 is designed so that it can carry the short-circuit current until the fuse 23 has blown or an undervoltage occurs.

A flow chart is explained in FIG. 4 by way of example. In step 101, a short circuit occurs in the consumer 17, which is connected to the connection KL 30_0 of the power distributor 18 or in the sub-on-board network for consumers 17 that are not safety-relevant.

In branch 102 a distinction is made as to whether the current through the switching means 19 exceeds a threshold value (for example 900 ... 1000 A) or whether an undervoltage occurs in the voltage at connection KL 30_ 1 of the power distributor 18 (for example U_30_1 <9.6V ) or occurs for a certain period of time. If none of the conditions are met, step 103 follows, followed by step 104.

In step 103, fuse 23 at connection KL 30_0 of power distributor 18 is burned free while the ferry is in operation. This takes place by a suitable activation of the switching means 19.

Should a safety-critical operating case have been detected in query 102, switching means 19 is first opened in step 104. In this way, on the one hand, the switching means 19 is protected. On the other hand, it ensures that the short The end of the consumer 17 does not continue to lead to an undervoltage for the safety-relevant consumer 16.

After a fault has been detected (in step 102), a safe stop of the vehicle is initiated in step 105. As soon as the vehicle is at a standstill, step 106 follows.

In step 106 the undervoltage criterion (as described by way of example in step 102) is deactivated.

In step 107, the precharge path or additional path 50 and the clamping path or partial path 52 are switched on. The switching means 19 is also switched on. As a result of this step, a first current flows into the short circuit and reduces the voltage level in the safety-relevant on-board network branch KL30_1. For the safe burning of the fuse 23, the current paths 30 and 40 both (but at least one) are also closed. The now low-resistance connection causes the fuse 23 to burn out quickly. The overcurrent threshold for protecting the switching means 19 remains active during this time in order to be able to interrupt the burn-out process at any time without exceeding the design limits. Thermal monitoring within the egg. Power distributor 18 also remain active to protect the component.

After the fuse 23 has burned out, the undervoltage criterion is reactivated, step 108.

Continuation of travel is enabled, step 109.

The switching means 19 is particularly suitable for safeguarding, in particular, safety-relevant consumers 16, 25 in a motor vehicle, in particular in connection with a power distributor 18 which has a microcontroller 13 to evaluate specific parameters in a targeted manner. This microcontroller 13 can now also be used through the corresponding evaluation of the parameters of the detection means 38, 39, 48, 49 and corresponding control of the switching means 34, 36, 44, 46. However, its use is not restricted to this.

Claims

Expectations

1. Device for safeguarding in particular safety-relevant consumers in a motor vehicle, comprising at least two main paths (30,40) connected in parallel to one another, between a sub-board network for at least one safety-relevant consumer (16, 25) in particular a motor vehicle and a further sub-board network for at least one non-safety-relevant consumer (17) are arranged, the sub-on-board network for the safety-relevant consumer (16, 25) being supplied by an energy store (12), each of the main paths (30, 40) at least one switching means (34, 36) ; 44,46), each of the main paths (30,40) comprising at least one detection means (38,39; 48,49) for detecting a current flowing through the respective main path (30,40), wherein at least one additional path ( 50) is provided, which is connected in parallel to the main paths (30, 40), the additional path (50) having at least one switching means (54), the switching means l (34.36; 44, 46) of the main paths (30, 40) are designed to open when a critical state is detected, in particular an overcurrent and / or an undervoltage or overvoltage on the sub-electrical system for the safety-relevant consumer (16, 25).

2. Device according to claim 1, characterized in that the main paths (30, 40) each comprise at least two parallel-connected partial paths (31, 32, 41, 42) each with at least one switching means (34, 36, 44, 46) and / or each with at least one detection means (38, 39, 48, 49).

3. Device according to one of the preceding claims, characterized in that the additional path (50) has at least one resistor (58), in particular for current limitation and / or absorption of energy during the switching process of the switching means (34, 36, 44, 46) .

4. Device according to one of the preceding claims, characterized in that a coupling in parking operation of the vehicle and / or a pre-charging of an intermediate circuit capacitor (11) takes place via the additional path (50).

5. Device according to one of the preceding claims, characterized in that at least one capacitor (61, 63, 67, 69) and at least one resistor (65, 71) are connected in parallel to at least the switching means (34, 36, 44, 46) is as a commutation aid for the respective switching means (34,36, 44,46).

6. Device according to one of the preceding claims, characterized in that a partial path (52) connected in parallel to the additional path (50) is provided, the partial path (52) at least one voltage limiter (48), in particular a diode, particularly preferred comprises a TVS diode.

7. Device according to one of the preceding claims, characterized in that the partial path (52) comprises at least one switching means (56) and / or at least one detection means (59) arranged in series with the voltage limiter (48).

8. Device according to one of the preceding claims, characterized in that the switching means (34, 36, 44, 46, 54, 56) consists of two switching elements (34.1, 34.2, 36.1, 36.2, 44.1, 44.2, 46.1, 46.2, 54.1, 54.2, 56.1,56.2) are formed, in particular power semiconductor particular, DERS preferably ^FET's or ^MOSFET's.

9. Device according to one of the preceding claims, characterized in that the switching means (34, 36, 44, 46) and the detection means (38, 39, 48, 49) in the respective main paths (30, 40) and / or partial paths (31, 32, 41, 42) are used with identical parameters, in particular for a symmetrical or uniform current distribution in the main paths (30, 40) or partial paths (31, 32, 41, 42).

10. Device according to one of the preceding claims, characterized in that an evaluation of the currents in the respective main paths (30, 40) and / or partial paths (31, 32, 41, 42) takes place and in the case of different current values in the main paths (30 , 40) and / or partial paths (31, 32, 41, 42) is recognized in the event of an error.

11. Device according to one of the preceding claims, characterized in that for checking the detection means (38, 39, 48, 49) a threshold value for overcurrent shutdown is changed, in particular is reduced to a value below a current flowing through the respective main path (30,40) and / or partial path (31,32, 41,42) is currently flowing.

12. Device according to one of the preceding claims, characterized in that in the individual main paths (30, 40) detection means (38, 39, 48, 49) and / or a threshold value comparison and / or a control of the respective switching means (34, 36 , 44,46) are each independent of one another.

13. Device according to one of the preceding claims, characterized in that the detection means (38, 39, 48, 49) have at least one value before changing the threshold value and / or before switching off another main path (30, 40) and / or another Partial path (31, 32, 41, 42) detected and that the detection means (38, 39, 48, 49) detected at least one value after changing the threshold value and / or after switching off another main path (30, 40) and / or another partial path (31,32, 41,42) recorded.

14. Device according to one of the preceding claims, characterized by an arrangement in a power distributor (18), wherein at least one microcontroller (13) in the power distributor (18) is provided to control the switching means (34,36, 44,46) and / or evaluation of the values transmitted by the detection means (38, 39, 48, 49) and / or for controlling the switch (15) is provided.

15. Device according to one of the preceding claims, characterized in that the switching means (34, 36, 44, 46, 54, 56) are provided for burning a consumer (17) securing fuse (23), in particular with the following special steps : Opening the main paths (30,40) and / or closing the additional path (50), in particular for charging an intermediate circuit capacitance (11) and / or opening the additional path (50) and / or closing at least one main path (30,40), to the fuse (23) is burned free and / or the main paths (30, 40) are opened and / or the additional path (50) is closed until the current flow through the additional path (50) has, in particular, been reduced exponentially.

16. Device according to one of the preceding claims, characterized in that when a critical state is detected, such as the exceeding of the current through the main path (30, 40) and / or by falling below a lower voltage limit on the sub-on-board network for the safety-relevant consumer (16, 25) the main paths (30, 40) are opened, the vehicle being able to be brought to a standstill without any loss of function of the safety-relevant consumer (16, 25), in which at least one monitoring of a safety-critical state is deactivated, in particular a voltage drop below a lower limit on the sub-on-board network for the safety-relevant consumer (16, 25) and / or an activation of the additional path (50) and / or a closing of at least one main path (30, 40) for burning the fuse (23) and / or a reactivation of the monitoring of a safety-critical one State and / or the vehicle is allowed to continue its journey.