Method for protecting, in particular, safety-relevant electrical loads in a motor vehicle

Abstract

The invention relates to a method for protecting safety-related electrical loads, in particular in a motor vehicle, comprising at least one main path (30, 40) arranged between an onboard power supply subsystem (16, 25) for at least one safety-related electrical load, in particular in a motor vehicle, and a further onboard power supply subsystem for at least one non-safety-related electrical load (17), wherein the onboard power supply subsystem for the safety-related electrical loads (16, 25) is supplied by an energy storage device (12), wherein the main path (30, 40) comprises at least one switching device (34, 36; 44, 46), wherein the main path (30, 40) comprises at least one detection device (38, 39; 48, 49), wherein the at least one detection device is used to detect the current flowing through the main path (30, 40), wherein at least one additional path (50) is provided, which is connected in parallel with the main path (30, 40), wherein the additional path (50) has at least one switching device (54), characterized by the following steps: when a critical state is detected, in particular an overcurrent and / or undervoltage or overvoltage on the onboard subsystem for safety-related electrical consumers (16, 25), the main path (50) is disconnected, wherein the additional path (50) is closed or kept closed during the disconnection of the main path (30, 40), and wherein the additional path (50) is subsequently disconnected again.

Description

Technical Field

[0001] The invention relates to a method for protecting, in particular, safety-relevant electrical loads in a motor vehicle according to the subject matter of the independent claims. Background Art

[0002] A battery connection for an onboard electrical system is known from DE 10 2018 2029 871. This includes an electrically controlled onboard electrical system coupling-isolating functionality for realizing an electrically controlled current distribution, wherein the battery connection comprises a plurality of switching elements, at least some of which are each connected to one another in a star point-like manner.

[0003] DE 102018212507 A1 discloses an electronic power distributor for an onboard energy system, comprising at least one first terminal for a safety-critical load and at least one second terminal for a branch in which the at least one load is arranged. The electronic power distributor also includes an electronic fuse that, in the closed state, enables a current flow to the at least one second terminal and, in the open state, interrupts this current flow. A bypass is provided for the electronic fuse, which, in the open operating state of the electronic fuse, enables a current flow to the at least one second terminal. Summary of the Invention

[0004] The present invention is based on the object of specifying a device that can reliably and safely conduct and disconnect high currents, in particular in vehicle electrical systems with high safety requirements, for example in conjunction with automated driving functions. This object is achieved by the features of the independent claims.

[0005] The safe isolation of the onboard power subsystem is achieved by disconnecting the main path upon detecting a critical state, in particular an overcurrent and / or undervoltage or overvoltage, in a safety-related onboard power subsystem. The auxiliary path is closed or remains closed while the main path is disconnected, and the auxiliary path is subsequently disconnected again. Furthermore, high current capabilities can be achieved, which is advantageous for targeted fuse blowing to maintain vehicle availability. The provision of the auxiliary path enables current limiting and clamping functions, which can shut down high currents even with inductive loads. This allows for a robust design, preventing excessive energy loading on safety-critical power semiconductors. Furthermore, the phased shutdown prevents oscillations.

[0006] In one advantageous embodiment, the additional path is disconnected again after a predeterminable time interval, in particular in the range of 0.1 ms to 10 ms. This allows for a simple implementation that is also particularly easy to test. Furthermore, the switching device in the additional path is not subjected to excessive loads.

[0007] In one advantageous embodiment, a timer is started when the main path is disconnected, during which the additional path is closed or remains closed, and the additional path is disconnected when the timer expires. Implementation using a timer is particularly simple and allows for checking the functional capacity, for example, even under no-load conditions.

[0008] In one advantageous embodiment, the additional path is used to limit current and / or absorb energy during switching operations in the main path, in particular by means of at least one resistor, particularly preferably a metallic resistor, arranged in the additional path. Due to the corresponding current limiting in the additional path, the switching elements of the main travel wheels are not subjected to excessive energy loads in the event of a fault. This increases the safety of the arrangement. In particular, metallic resistors, for example those made of metal alloys, are characterized by high energy absorption.

[0009] In one advantageous embodiment, a voltage limiting device, in particular a diode, particularly preferably a TVS diode, is activated or remains activated during the disconnection of the main path and / or the additional path. This enables targeted voltage limiting that limits the current independently of the voltage drop across the switching element. This prevents operation in avalanche mode during the switching of the switching device of the main path, for example in the case of MOSFETs. This further increases the safety of the arrangement.

[0010] In one advantageous embodiment, the additional path remains closed until the current through the switching device decays exponentially and / or reaches a certain threshold value. This allows for rapid energy dissipation, while also ensuring that the additional path is deactivated after a certain decay behavior or reaching a threshold value, so that the associated switching device is not subjected to critical loads.

[0011] In one advantageous embodiment, when a critical state is detected, countermeasures are taken, in particular the safe parking of the vehicle and / or the main path is closed or remains closed until the fuses protecting non-safety-relevant loads have burned out. This reliably prevents the vehicle from stalling and thus prevents the vehicle from being towed away, for example, for repairs.

[0012] In one advantageous embodiment, if no critical state is detected, the main path for protecting non-safety-relevant loads from burning out is closed during driving of the motor vehicle. This prevents ongoing operation from being affected and is therefore not noticeable to the driver.

[0013] In one advantageous embodiment, the undervoltage criterion is deactivated and / or the overcurrent threshold and / or thermal monitoring is activated or remains activated. This, on the one hand, enables burnout. On the other hand, hazardous states for the switching device are avoided. This is achieved, in particular, by closing the main path and / or the additional path after deactivating the undervoltage criterion.

[0014] In a suitable embodiment, it is provided that after the fuse has burned out, the undervoltage criterion is reactivated. Thus, the onboard electrical system for safety-related electrical loads is fully monitored again. Particularly preferably, continued driving is then enabled.

[0015] In one advantageous embodiment, it is provided that, in particular when the motor vehicle is first put into operation, the additional path is closed to charge the intermediate circuit capacitor and / or that, after the intermediate circuit capacitor has been charged, in particular after a certain time interval, the main path is closed. As a result, in particular during initial operation, the current flow is kept at a level that is generally not critical for the switching device.

[0016] In one advantageous embodiment, the direction of the current flowing between the two onboard power subsystems is evaluated and / or, in critical situations, in particular undervoltage conditions, the main path is disconnected only when current flows from the onboard power subsystem with safety-related loads to the other onboard power subsystem with non-safety-related loads. This ensures that, in particular in the event of undervoltage, the voltage level in the onboard power subsystem with the safety-related loads does not drop further.

[0017] In one advantageous embodiment, at least one capacitor and at least one resistor are connected in parallel with at least one switching device as commutation aids for the respective switching device. These RC links can store short-term power peaks, thereby supporting fast commutation.

[0018] Further advantageous developments are apparent from the further dependent claims and from the description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 shows an onboard electrical system in which a switching device is implemented,

[0020] Figure 2shows a more detailed structure of the switching device,

[0021] FIG. 3 shows the different activation steps in the case of fault-free operation or in the case of disconnection of the onboard power supply subsystem, and

[0022] Figure 4 A flow chart for burnout of a fuse is shown. DETAILED DESCRIPTION

[0023] The invention is schematically shown on the basis of an embodiment and is described in detail below with reference to the accompanying drawings.

[0024] Figure 1 A possible topology of an energy supply system is shown, which consists of an onboard electrical system 10, which includes an energy storage device 12 (in particular, a battery 12 with associated sensors 14, preferably battery sensors) and a plurality of, in particular, safety-related electrical consumers 16, which are protected or controlled by an electrical power distributor 18. The electrical consumers 16 are special electrical consumers with high requirements or high protection needs, generally referred to as safety-related electrical consumers 16. For example, these are electric steering systems and / or braking systems as components that must be unconditionally powered in order to ensure steering and / or braking of the vehicle in the event of a fault. To this end, the corresponding characteristic variables of the respective electrical consumers 16 are individually detected, and if they deviate from tolerable values, the corresponding switches 15 are opened to protect the respective electrical consumers 16.

[0025] Energy storage device 12 is also connected to a terminal (terminal KL30_1) of power distributor 18. Sensor 14 can detect an electrical characteristic variable, such as voltage Ub across energy storage device 12 and / or current Ib through energy storage device 12 and / or temperature Tb of energy storage device 12. Sensor 14 can determine, for example, the state of charge SOC of energy storage device 12 or other characteristic variables of energy storage device 12 from the determined electrical characteristic variables Ub, Ib, and Tb. Optionally, another power supply branch for at least one additional electrical load 25 is provided at another terminal (KL30_1) of power distributor 18, to which energy storage device 12 is also connected. Electrical load 25 is protected by fuse 23. Further electrical loads 25 may also be provided, which can also be protected by fuse 23. These loads 25 are loads that should still be supplied with energy from the energy storage device 12 even if the switching device 19 in the power distributor 18 is switched off or open, i.e., preferably safety-critical loads 25 or loads 25 that are critical with respect to the generation of disturbances relevant to the safety of the power supply. Therefore, an (optional) safety-related or safety-critical onboard power supply path is connected to the terminal KL 30_1.

[0026] The power distributor 18 is capable of determining corresponding characteristic variables, such as the voltage Uv and current Iv of the electrical load 16. Furthermore, the power distributor 18 is also capable of determining corresponding characteristic variables of the energy storage 12, such as the voltage Ub and / or the current Ib and / or the temperature Tb. To this end, the power distributor 18 includes corresponding sensor devices. Similarly, the power distributor 18 has corresponding processing devices, such as a microcontroller 13, for storing or analyzing the detected variables. Furthermore, the microcontroller 13 is capable of actuating the corresponding switches 15 or the switching devices 34, 36, 44, 46, 54 of the switching device 19 (high-current-capable disconnect switch). Alternatively, the analysis can also be performed in another control device.

[0027] Furthermore, the power distributor 18 can provide a signal based on the state of the energy storage device 12, on the basis of which a transition to a safe state is initiated. For example, a higher-level control device can then initiate a safe parking of the vehicle (driving to the nearest parking space, stopping immediately on the roadside, etc.) and exit the autonomous driving mode.

[0028] Likewise, the power distributor 18 has a corresponding processing device, such as a microcontroller 13, in order to store or analyze the detected variables. In addition, the power distributor 18 can include a user-specific circuit (ASIC), by which the safety function is implemented in conjunction with the corresponding controlled switches 15 of the, in particular, safety-related electrical consumers 16 connected to the output. In certain critical states (for example, exceeding a certain temperature, power loss, overcurrent, overvoltage, undervoltage, etc.), the switches 15 and / or the switching devices 19 are opened in order to thereby prevent, for example, an overload situation. The power distributor 18 can be provided with a connection for a communication system, in particular a bus system (such as a CAN bus and / or a LIN bus). In addition, a connection for at least one further connection signal can also be provided, such as the so-called terminal 31 signal (ignition on). As can be seen, the associated energy storage device 12 is connected to one of the connections of the power distributor 18. However, this does not have to be provided as a direct connection, but can be carried out with the interposition of further components, such as a conventional fuse box, if necessary. or similar.

[0029] Furthermore, a switching device 19 is provided between the connection (KL30_0) of the power distributor 18 and a further connection (KL30_1) for the energy storage device 12. If the energy storage device 12 connected to the further connection KL30_1 fails, the loads 16 connected to the output of the power distributor 18 can be supplied via the switching device 19 from a further energy source, for example, a further onboard power supply branch via the DC voltage converter 22. The switching device 19 enables corresponding isolation or coupling functions, in particular of two onboard power supply branches (the onboard power supply subsystem for the non-safety-relevant load 17 at the connection KL30_0 and the further onboard power supply subsystem for the safety-relevant loads 16 and 25). This serves in particular as a safety function to prevent the influence of critical states, such as overvoltage or undervoltage and / or overcurrent and / or thermal overload. In the event of a fault, the two onboard power supply subsystems can be isolated from each other by the switching device 19. Safety-related electrical consumers 16 , 25 of the safety-related onboard power subsystem are therefore isolated from non-safety-related electrical consumers 17 of the other onboard power subsystems.

[0030] Safety-related loads 16 , 25 supplied by power distributor 18 can include, for example, safety-related vehicle functions such as braking, steering, and the like, particularly loads 16 with high safety requirements. Generally speaking, safety-related loads 16 , 25 are loads that require special protection, such as those necessary to maintain certain emergency functions. In addition to the aforementioned functions, such as steering and braking, these also include functions that should remain functional, if possible, after an accident, such as restraint systems, locking systems for opening and closing doors, emergency call systems, such as for issuing an electronic emergency call, sunroof functions, lighting, windshield wipers, and the like.

[0031] Compared to the high-voltage onboard power supply system 20, the basic onboard power supply system 10 has a lower voltage level U1; for example, it can be a 14V onboard power supply system. A DC voltage converter 22 is arranged between the basic onboard power supply system 10 and the high-voltage onboard power supply system 20. As an example, the high-voltage onboard power supply system 20 includes an energy storage system 24, such as a high-voltage battery (possibly with an integrated battery management system), loads 26 (illustrated as an example), such as convenience appliances (such as an air conditioning system powered at an increased voltage level), and an electric machine 28. In this context, a voltage level U2 is considered high voltage if it is higher than the voltage level U1 of the basic onboard power supply system 10. Thus, for example, it can be a 48V onboard power supply system. Alternatively, it can be an even higher voltage level, particularly in vehicles with electric drives. Alternatively, the high-voltage onboard power supply system 20 can be omitted entirely.

[0032] Between the connection (KL30_0) of the power distributor 18 and the DC voltage converter 22, another branch or another onboard power subsystem is arranged for supplying additional electrical loads 17. Each of these electrical loads 17 is protected by corresponding fuses 23, as shown in the example. These electrical loads 17 are typically comfort loads or non-safety-relevant loads. Depending on the application, the comfort loads 17 and fuses 23 can be divided into main groups and subgroups, and grouped accordingly. This applies to loads 17 that are not characterized by high safety relevance (such as load 25) or high protection requirements (such as load 16). Any adverse effects of these loads 17 on safety-relevant loads 25 or 16 can be prevented by isolating the fault via a disconnecting switching device 19. Therefore, the switching device 19 is arranged between the load 17 and the safety-relevant loads 25 and / or loads 16 with high protection requirements.

[0033] At least one or more, particularly safety-related, channels or onboard power supply branches 10' can be connected to the high-voltage onboard power supply 20 via an additional DC voltage converter 22'. Each safety-related channel can have an additional electronic power distributor 18'. Alternatively, the additional power distributor 18' can also be connected directly to the same terminal KL30_0 as the power distributor 18, without the need for an additional DC voltage converter 22'. The additional electronic power distributor 18' can be used to protect, control, and safely and reliably shut down safety-related electrical consumers 16' or the electronic energy network distribution. These electrical consumers 16' can be designed with functional redundancy, such as electrical consumers 16 that are supplied via an additional, safety-related branch of the onboard power supply 10. Furthermore, the additional electronic power distributor 18' can be capable of detecting the current flowing or the applied voltage. This briefly described, optional embodiment can be provided for a highly available design, such as for autonomous driving to increase safety. In further onboard power supply branches, further energy storage devices 12 ′ with further sensors 14 ′ may also be provided.

[0034] A high-current-capable switching device 19 or a high-current-capable disconnect switch is arranged in the power distributor 18 between the terminal (KL30_1) and the terminal (KL30_0) or the terminals for the electrical loads 16 of the power distributor 18. The switching device 19 can disconnect in the event of an overcurrent and / or undervoltage or similar critical onboard electrical system. By way of example, the switching device 19 includes at least two parallel-connected main paths 30, 40, wherein a switching device 34, 44 is provided in each main path. However, for the switching characteristics of the switching device 19 described below, only a single main path 30, 40 is sufficient.

[0035] The switching devices 34, 44 are particularly preferably each formed from at least two switching elements 34.1, 34.2; 44.1, 44.2, preferably connected in series with one another and, more precisely, in opposite directions, for example, back-to-back or with a common source connection, preferably power semiconductors, particularly preferably FETs or MOSFETs. For example, relays, bipolar transistors, or IGBTs with parallel diodes can also be used instead of MOSFETs. The respective main paths 30, 40 with the associated switching devices 34, 44 are particularly preferably designed symmetrically so that, during normal operation, the same current flows through both main paths 30, 40.

[0036] An additional path 50 is connected in parallel with the main paths 30 and 40. This additional path also includes a switching device 54 and a series resistor 58 serving as a current limiter or "brake resistor." The switching device 54 consists of at least two switching elements 54.1 and 54.2 connected in series in opposite directions. The additional path 50 is capable of isolating the current flow even at high currents (e.g., greater than 900 A), even under inductive loads 57. Furthermore, a detection device is provided in the additional path 50 to measure the current. For example, in the case of a MOSFET in the on state, the resistance between the drain and source (RDSon) is monitored.

[0037] Optionally, a further subpath 52 can be connected in parallel with the additional path 50. In the further subpath 52 there is at least one voltage limiting device 55, for example a specific diode, such as preferably a TVS diode.

[0038] By way of example, in the present exemplary embodiment, batteries or accumulators are described as possible energy stores 12, 24. However, other energy stores suitable for this task, such as inductive or capacitive ones, fuel cells, capacitors or the like, can also be used in the same manner as an alternative.

[0039] In accordance with Figure 2 In the embodiment of FIG, the construction of the switching device 19 is shown in more detail. Thus, the main path 30 includes two sub-paths 31 and 32 connected in parallel to each other. Two switching elements 34.1 and 34.2 connected in series in opposite directions are arranged in one sub-path 31, as well as a detection device 38 for the current flowing through the sub-path 31. The detection device 38 is designed as a resistor by way of example. The corresponding current detection circuit for detecting the current flowing through the detection device 38 is indicated. In another sub-path 32, two further switching elements 36.1 and 36.2 connected in series in opposite directions are arranged, as well as a further detection device 39 for the current flowing through the further sub-path 32. The detection device 39 is designed as a resistor by way of example and is connected in series with the switching elements 36.1 and 36.2. Instead of a resistor, other detection devices can also be used, such as a magnetic field sensor or, for example, the voltage drop across one or more switching elements can be analyzed.

[0040] Thus, the additional main path 40 also includes two sub-paths 41 and 42 connected in parallel. Two switching elements 44.1 and 44.2 connected in series in opposite directions are arranged in one sub-path 41, as well as a detection device 48 for the current flowing through the sub-path 41. Detection device 48 is exemplarily configured as a resistor. In the additional sub-path 42 (of the additional main path 40), two additional switching elements 46.1 and 46.2 connected in series in opposite directions are arranged, as well as a further detection device 49 for the current flowing through the additional sub-path 42. Detection device 49 is exemplarily configured as a resistor. The corresponding current detection circuit for detecting the current flowing through detection device 48 is indicated.

[0041] For example, detection devices 38, 39, 48, 49 can each transmit the current flowing through the associated subpath 31, 32, 41, 42 to microcontroller 13. Alternatively, however, the current flow in subpaths 31, 32; 41, 42 can be determined by averaging the two detection devices of the corresponding main path 30, 40.

[0042] It is particularly preferred that the switching devices 34, 36; 44, 46 and the associated detection devices 38, 39; 48, 49 are symmetrically designed, i.e., have the same resistance values ​​or characteristic variables, etc. Therefore, in fault-free operation, the same current should flow in each of the different subpaths 31, 32; 41, 42. Deviations from this symmetry indicate a fault that requires evaluation.

[0043] Furthermore, the respective sub-paths 31, 32; 41, 42 are ideally arranged in a staggered manner. In the circuit layout, the respective sub-paths 31, 41; 32, 42 can be arranged such that, for example, two sub-paths 31, 32; 41, 42 of a main path 30; 40 surround a sub-path 41; 32 of a respective other main path 40; 30, or the respective sub-paths 31, 41, 32, 42 are arranged alternately relative to the main paths 30, 40. It is particularly preferred that the additional path 50 and / or sub-path 52 be arranged centrally and each be surrounded by two sub-paths 31, 41; 32, 42 of different main paths 30, 40.

[0044] In addition to the optimized placement on the circuit carrier, the high-current switching process can also be supported by a switch pressure relief network (Schaltentlastungnetze). The switch pressure relief networks are also arranged in a staggered manner near the switching devices 34, 44 and 36, 46. The switch pressure relief network is constructed from capacitors 69, 67 and resistor 71 as well as 63, 61 and resistor 65. Via the resistors, not only the oscillation tendency is attenuated, but the switching energy is absorbed by the highest possible resistance value, and the commutation process is accelerated by the high-resistance voltage drop. By placing the switch pressure relief devices between the sub-paths, each switch pressure relief device can absorb the shutdown energy not only from the main path 30, but also from the main path 40. In Figure 2 The embodiment shown in represents the special case where a common resistor 71 is provided for both capacitors 69, 67 (or 65 for capacitors 61 and 63).

[0045] An optional subpath 52 is provided for the additional branch 50, in which a switching device 54 (switching elements 54.1, 54.2, again arranged in anti-series connection) and a resistor 58 are arranged in series. The optional subpath 52 is connected in parallel with the additional branch 50. In the optional additional branch 52, a switching device 56 (composed of two switching elements 56.1, 56.2, connected in anti-series connection) and at least one voltage limiting device 55, preferably two voltage limiting devices 55 (in particular diodes, particularly preferably TVS diodes, to prevent avalanche control of the switching elements in the main paths 30, 40) are provided, as well as an optional detection device 59, in particular a resistor for detecting the current and for limiting the current flowing through the subpath 52. An inductor 57 is shown as an example of a line inductance between the common potential of the additional path 50 and the optional subpath 52 and the connection (terminal KL 30_0) of the power distributor 18.

[0046] The described device is a high-current isolating switch concept (switch device 19) for low-voltage onboard power systems in motor vehicles below 100 V. With the progressive electrification of safety-related vehicle components, the availability of onboard power system 10 is becoming increasingly important. Within this framework, switches are being used to control and ensure the energy flow and functional availability in onboard power system 10. ISO 26262 imposes extensive requirements on the functional safety of these components and the entire onboard power system.

[0047] In order to completely isolate the current flow between terminal KL 30_1 or the safety-related onboard power subsystem and terminal KL 30_0 or the non-safety-related onboard power subsystem, six MOSFET paths (subpaths 31, 32, 41, 42, 50, 52) connected in reverse series are used in this example. Four (subpaths 31, 32, 41, 42) are closed in normal operation and represent a low-resistance (less than 2 mΩ) connection between terminal KL 30_1 or the safety-related onboard power subsystem and terminal KL 30_0 or the non-safety-related onboard power subsystem. A further current path, additional path 50, is equipped with an additional series resistor 58. The current flow during parking mode (the vehicle's idle state) can be guided through this current path and limited (via resistor 58). This limitation provides a natural protection against uncontrolled current increases during parking mode. This eliminates the need for complex protective circuits and diagnostics during parking mode. Furthermore, series resistor 58 serves as a "braking resistor." In the case that very high current flows must be shut off via the switch 19 at high line inductances 57 , a phased shutdown can be performed via the current-limited additional path 50 .

[0048] The optional further subpath 52 of the additional path 50 can be equipped with a voltage limiting device (eg, via a TVS diode) 55 in order to prevent the switching devices 34 , 44 , 36 , 46 , in particular MOSFETs, from operating in avalanche mode.

[0049] The path is divided into two main paths 30 and 40, with main path 30 having subpaths 31 and 32 (which are connected in parallel), and main path 40 having subpaths 41 and 42. Both main paths 30 and 40 have their own independent current measuring or current detection devices (detection devices 38 and 39; 48 and 49), which detect the current flowing in each main path 30 and 40. The detected current is compared with a predefinable threshold value G. If the detected current exceeds a permissible threshold value G (e.g., 250 A in subpaths 31, 32, 41, 42), a fault is inferred and appropriate countermeasures are initiated, such as disconnecting switching devices 34, 36, 44, 46. Main paths 30 and 40 preferably each have independent threshold value comparisons and / or control of the respective switching devices 34, 36, 44, 46.

[0050] Due to the symmetrical design and the use of low-resistance (e.g., less than 2 mΩ) switching devices 34, 44, during normal operation, the total current I is divided fairly evenly between the two main paths 30, 40. An increasing asymmetry in the two current measurement signals in the two main paths 30, 40 is an indicator of a fault either in the current measuring or detection devices 38, 39, 48, 49, in the control devices (not specifically shown) of the switching devices 34, 36, 44, 46 (e.g., in the case of a drop in the gate-source voltage of a MOSFET), or in the switching devices 34, 44 themselves (e.g., in the die attach of a MOSFET, etc.).

[0051] To limit faults, the main paths 30, 40 can be individually shut down so that the entire current flow is directed sequentially through a single main path 30, 40. This allows the two current measurement signals to be plausibly checked against one another or against their sum. For example, targeted shutoff of one of the main paths 30, 40 can be achieved by briefly lowering the threshold value that triggers shutoff below the current value currently flowing in that main path 30, 40. If the increased current value in one main path 30 after shutting down the other main path 40 (the increase in the current value in the main path 30 after shutting down compared to the current value in the main path 30 before shutting down) significantly deviates from the current value determined before shutting down the other main path 40, a fault in the detection devices 48, 49 is inferred. Accordingly, the detection devices 38, 39 and 48, 49 can also be checked by shutting down the main path 30 and correspondingly measuring the current in the other main path 40 before and after shutting down.

[0052] By measuring the current in the two independent main paths 30, 40 (via detection devices 38, 39; 48, 49) and their diagnosis, the two main paths 30, 40 can be operated redundantly with each other. In this case, each main path 30, 40 has its own overcurrent shutdown (shutdown as soon as a critical threshold value or state is reached) and its own gate driver, including power supply.

[0053] If necessary, this overcurrent shutdown can also be tested during operation in order to identify potential faults in the overcurrent shutdown, control, or switching devices 34, 44. To this end, the overcurrent shutdown of the main paths 30, 40 can be triggered by lowering the threshold value (e.g., from 250 A to 75 A or depending on the current currently flowing). The switching devices 34, 44 must be opened sequentially, and the common current flow from the two main paths 30, 40 must be switched to the remaining closed main path 30 or 40.

[0054] The operational management for the test ensures that:

[0055] ○ The current measuring or detecting devices 38, 39, 48, 49 are in operation,

[0056] ○Compare the current value to the threshold value accurately.

[0057] o Above a threshold triggers a shutdown (opening the switching devices 34, 36, 44, 46).

[0058] o Turning off actually opens the switching devices 34, 36, 44, 46 as well.

[0059] Additionally, it is possible to bring the center potential between the switching elements 34.1, 34.2; 44.1, 44.2 connected in series in opposite directions into the negative range in order to check whether both switching elements 34.1; 34.2; 44.1, 44.2 are able to block a defined voltage.

[0060] Due to the extensive diagnostics, high safety requirements (eg ASILC) on the isolation capability of the switching device 19 can be guaranteed.

[0061] Due to the equally redundant control of both main paths 30, 40, high safety requirements (e.g., ASIL C) can also be guaranteed for the conductivity of at least one main path 30, 40. In the event of a fault, it is possible to maintain reduced operation with only a single main path 30, 40. To this end, the main paths 30, 40 are ideally staggered with one another to prevent the formation of local power peaks.

[0062] In parallel with the low-resistance main paths 30, 40, an additional path 50 is provided, which is implemented with a series resistor 58. The maximum current level that can flow through resistor 58, for example in a 12V onboard power supply, can be limited to a non-critical value via series resistor 58 (e.g., 40 mΩ). This additional path 50 also allows a "high-resistance" connection between terminal KL30_1 and terminal KL30_0, particularly during parking mode (idling mode of the vehicle, when the vehicle is parked). Detecting the current flow via additional path 50, particularly during parking mode, can serve as a wake-up signal for the control unit. During wake-up, the cause of the current increase can be evaluated, and in the event of a fault current, the two networks can be completely isolated (e.g., isolating the onboard power supply subsystem with energy storage device 12 from the other onboard power supply subsystem 10 or 10'). When waking up from parking mode is authorized, terminal KL30_1 or the safety-related onboard power subsystem and terminal KL30_0 or the non-safety-related onboard power subsystem are connected in a low-resistance manner and switched to active mode.

[0063] For the initial pre-charging of a capacitive onboard electrical system branch, a resistive pre-charging functionality can be implemented via an additional path 50 .

[0064] In order to isolate terminal KL30_1, or the safety-related onboard power subsystem (with safety-related loads 16 and 25), from terminal KL30_0, or the non-safety-related onboard power subsystem (with non-safety-related loads 17) under high current load in the event of a short circuit, the inductive load must be clamped by the isolation process. As a robust approach to reducing the current level to a non-critical value in the event of an isolation short circuit, an additional path 50 with a series resistor 58 also serves to interrupt the current. To this end, in the event of an overcurrent shutdown, only the low-resistance main switches 34, 36, 44, and 46 are initially opened. The energy stored in the line inductance 57 is then reduced to a non-critical level via the RL link consisting of line 57 and series resistor 58. Only then is the additional path 50 (the path with series resistor 58) also opened to finally interrupt the current flow.

[0065] To support the commutation of the current from the main paths 30 , 40 to the high-resistance additional path 50 , additional RC elements (snubbers) can support the commutation process. These RC elements are formed by capacitors 61 , 63 , 67 , 69 and associated resistors 65 , 71 .

[0066] Since the clamping function of the additional path 50 with the series resistor 58 is necessary to comply with functional safety requirements, its availability must be ensured via diagnostics. One option is to monitor the proportional current flow through the additional path 50 during continuous operation. Another option is to check the conductivity of the additional path 50 via a test current applied between the anti-series switching elements 54.1 and 54.2 of the additional path 50.

[0067] As described below, the described automotive main switch concept, or switching device 19 for safety-critical high-current applications, is also particularly suitable for targeted triggering of fuses 23 while maintaining specific safety requirements. Under appropriate onboard power supply boundary conditions, nearly all fuses 23 can be triggered directly during driving. The power distributor 18 ensures that voltage limits are not violated, thereby guaranteeing the availability of safety-related loads. However, fuses 23 do not burn out during driving, such as in the following scenarios. For example, a high-current load such as a cooling fan could exceed the current limit (e.g., 900 A) due to a direct short circuit. The fan is connected with such low resistance that the short-circuit current exceeds 900 A to 1000 A when the onboard power supply voltage is high (during driving with the generator / active DC converter 22 in operation). In this case, the switching device 19, i.e., the high-current switch, opens for self-protection. Another critical scenario could be when, for example, a low-resistance short circuit directly on the main distributor causes such a high current that, due to the voltage drop, specific voltage limits are violated. Although this short circuit is sufficiently high-resistance that it does not exceed the 900A threshold, it is nevertheless sufficiently low-resistance that the switching device 19 or disconnector detects a safety-critical voltage drop. Safety-critical loads 16, such as the steering and brakes, can no longer be safely powered under this undervoltage. To ensure the power supply to safety-critical loads 16 (such as the brakes and steering), the switching device 19 is opened. The vehicle coasts to a stop with full steering / brake support (due to the short circuit in this onboard power supply branch, the engine control unit, as part of the loads 17 connected to terminal KL 30_0, can no longer be powered). All fuses 23 offer the potential for triggering when the vehicle is stationary in the event of a terminal change. This prevents vehicle stalling, as the vehicle can be restarted at rest after the "fuse burnout" function. In the case of the cooling fan, the lower battery voltage at rest results in reduced short-circuit current. In the event of a short circuit in the main distributor, voltage limiting can be deactivated because the vehicle is stationary. This is achieved by enabling the power distributor 18, for example by triggering a fuse 23 with a current greater than 400A in a controlled manner.

[0068] FIG3 illustrates the initial commissioning of a vehicle or the isolation of a sub-onboard power supply in a critical state. The operating current flowing through the load 17 is Figure 3AThis is indicated by a dashed line. Initially, a current flow 60 is introduced solely through the additional path 50. To this end, the switching devices 34, 36, 44, 46 of the main paths 30, 40 are opened. By activating the additional path 50, the intermediate circuit capacitor 11 is precharged. Especially when the vehicle is first put into operation, charging the empty intermediate circuit capacitor 11 could lead to excessive currents in the main paths 30, 40. As described, this is counteracted by charging the intermediate circuit capacitor 11 via the additional path 50. At the moment of activation of the additional path 50, the current briefly increases slightly before then decreasing slightly again. During activation, the voltage on the additional path 50 drops suddenly, initially increasing more strongly while charging the intermediate circuit capacitor 11 and then decreasing more slowly.

[0069] If the intermediate circuit capacitor 11 has been precharged (for example after 5 ms), the switching device 19 is activated so that at least one of the two main paths 30 , 40 conducts the current 60 . Figure 3B The two main paths 30 , 40 can also carry the current 60 . The onboard power supply is now in normal operation, with the two onboard power supply subsystems ( KL30_0 and KL30_1 ) connected in a low-resistance manner. The additional path 50 can remain closed or can also be opened.

[0070] exist Figure 3C As an example fault, a short circuit to ground upstream of the load 17 is shown in FIG. As a result, the onboard power supply branch KL30_0 becomes low-resistance with respect to ground, and a rapid current increase occurs through the switching device 19. This current increase causes a drop in the onboard power supply operating voltage of the two (low-resistance) coupled onboard power supply branches KL30_0 and KL30_1. The voltage on the safety-critical onboard power supply side KL30_1 is permanently monitored by the power distributor 18 in order to ensure a trouble-free energy supply to the safety-critical loads 16, 25. If the voltage drop is too severe to ensure trouble-free operation, the onboard power supply branch KL30_0 is switched off according to the voltage distribution circuit breaker. Figure 3D and Figure 3EThe process in FIG. 1 isolates two onboard power supplies (the sub-onboard power supply at terminal KL 30_0 and the sub-onboard power supply at terminal KL 30_1). In addition to the evaluation of the voltage level, the duration is also evaluated, since a strong voltage dip is not critical for a short duration and only becomes safety-critical after a certain duration. In addition to the voltage dip, it is also possible to check whether a current flows from the safety-critical onboard power supply KL 30_1 into the basic onboard power supply KL 30_0 by evaluating the current direction. Only if this current direction occurs (i.e., the non-safety-relevant onboard power supply does not support the safety-relevant electrical load 16, 25 or the safety-relevant sub-onboard power supply) is the switching device 19 opened. If the current value exceeds the threshold value for disconnection (e.g., 500 A per path 30, 40), the switching device 19 is disconnected according to the switching device 19. Figure 3D and Figure 3E The two onboard power systems are isolated in order to prevent the switching device 19 from being operated outside the relevant specifications.

[0071] exist Figure 3D In the example, the isolation process of the two onboard power subsystems (KL 30_0 and KL 30_1) is initiated by opening the switching devices 34, 36, 44, 46. The current 60 now flows via the additional path 50. The additional path 50 is closed. Current limitation is performed via the additional path 50 using the resistor 58. Via the corresponding RC link (see Figure 2 (Capacitors 61, 63, 67, 69, resistors 65, 71), can buffer short-term high currents in commutation situations.

[0072] It is preferably provided that current flows through the additional path 50 only for a limited period of time, in particular to avoid overload conditions. For example, a fixed period of time (e.g., in the millisecond range, for example, 1 ms) can be set, during which the additional path 50 is closed. To this end, for example, a timer can be started upon disconnection of the main paths 30, 40, during which the additional path 50 is disconnected again. Alternative configurations are possible. For example, the additional path 50 can be disconnected based on a specific characteristic variable, such as when a specific current, temperature, or the like is exceeded.

[0073] exist Figure 3E , which shows how the additional path 50 is disconnected. However, the subpath 52 remains closed or active. For this purpose, for example, limiting devices 55, 56 (for example diodes, particularly preferably TVS diodes) are provided in order to absorb the switching energy or to protect the switching devices 34, 36, 44, 46, in particular the MOSFETs, from avalanche operation. Figure 3EApart from the sub-path 52 (as a component of the circuit of the switching device 19 ), this can also be done in conjunction with the main paths 30 , 40 via, for example, an external circuit.

[0074] In the described method for handling the burnout of fuse 23, the current level occurring is limited by the impedance of the short circuit. The switching devices 34, 36, 44, 46 in the main paths 30, 40 must be able to absorb peak losses or have a better thermal resistance than fuse 23. The energy for melting fuse 23 is provided by energy storage 12 via the cold start path. If necessary, DC voltage converter 22 can provide support.

[0075] Furthermore, the switching device 19 can be designed such that within the framework of an availability-optimized design, the fuse 23 at the connection KL 30_0 can be burned out with only a single main path 30 , 40 (power supply redundancy).

[0076] The phased shutdown depicted in FIG. 3 prevents oscillations and switching losses, for example via robust metal resistors 58 .

[0077] A short circuit with too low an impedance cannot be triggered. This ensures that the burnout of the fuse 23 can always be interrupted, protecting against thermal events. As a result, the current flow always remains within design limits. Furthermore, the switching device 19 is designed so that it can carry the short-circuit current until the fuse 23 blows or an undervoltage occurs.

[0078] For example, in Figure 4 In step 101 , a short circuit occurs in a load 17 that is connected to terminal KL 30_0 of power distributor 18 or in an onboard power supply subsystem for non-safety-related loads 17 .

[0079] In branch 102, a check is performed to determine whether the current through switching device 19 exceeds a threshold value (e.g., 900 ... 1000 A) or whether an undervoltage (e.g., U_30_1 < 9.6 V) occurs at terminal KL30_1 of power distributor 18 or occurs within a specific time interval. If neither of these conditions is met, step 103 is followed; otherwise, step 104 is followed.

[0080] In step 103 , the fuse 23 at the terminal KL 30_0 of the power distributor 18 is blown out during the ongoing driving operation. This is achieved by appropriately activating the switching device 19 .

[0081] If a safety-critical operating situation has been detected in query 102, the switching device 19 is initially opened in step 104. This protects the switching device 19 on the one hand. On the other hand, it ensures that the short circuit of the load 17 does not further lead to an undervoltage in the safety-related load 16.

[0082] After a fault condition has been detected (in step 102), a safe stop of the vehicle is initiated in step 105. Once the vehicle is at a standstill, step 106 follows.

[0083] In step 106 , the undervoltage criterion (as exemplarily described in step 102 ) is deactivated.

[0084] In step 107, the pre-charging path or additional path 50 and the clamping path or sub-path 52 are connected. Similarly, the switching device 19 is connected. This step causes a first current to flow into the short circuit and reduce the voltage level in the safety-related onboard power supply branch KL30_1. To ensure that the fuse 23 burns out safely, both current paths 30 and 40 (however, at least one) are additionally closed. Due to the now low-resistance connection, the fuse 23 burns out quickly. The overcurrent threshold for protecting the switching device remains active during this time, allowing the burnout process to be interrupted at any time without exceeding the design limit. Thermal monitoring within the power distributor 18 also remains active to protect this component.

[0085] After the fuse 23 has burned out, the undervoltage criterion is reactivated again, step 108 .

[0086] Continue driving is enabled, step 109 .

[0087] Switching device 19 is particularly suitable for protecting safety-related loads 16 and 25, particularly in motor vehicles, in particular in combination with a power distributor 18, which includes a microcontroller 13 for targeted evaluation of specific characteristic variables. This microcontroller 13 can also be used to perform corresponding evaluation of the characteristic variables of detection devices 38, 39, 48, and 49 and to control switching devices 34, 36, 44, and 46 accordingly. However, its use is not limited to this.

Claims

1. A method for protecting safety-related electrical loads in a motor vehicle, comprising at least one main path (30, 40), said at least one main path being arranged between an onboard power supply subsystem for at least one safety-related electrical load (16, 25) of the motor vehicle and a further onboard power supply subsystem for at least one non-safety-related electrical load (17), wherein: A sub-onboard power supply system for safety-related electrical consumers (16, 25) is supplied via an energy storage device (12), wherein the main path (30, 40) comprises at least one switching device (34, 36; 44, 46), wherein the main path (30, 40) comprises at least one detection device (38, 39; 48, 49) for detecting a current flowing through the main path (30, 40), wherein at least one additional path (50) is provided, which is connected in parallel with the main path (30, 40), wherein the additional path (50) has at least one switching device (54), characterized by the following steps: upon recognition of a critical state, the main path (30, 40) is disconnected, wherein the additional path (50) is closed or remains closed while the main path (30, 40) is disconnected, and wherein the additional path (50) is subsequently disconnected again.

2. The method according to claim 1, characterized in that The additional path (50) is disconnected again after a predeterminable time interval.

3. The method according to claim 1 or 2, characterized in that With the main path (30, 40) opened, a timer is started during which the additional path (50) is closed or remains closed, and the additional path (50) is opened upon expiration of the timer.

4. The method according to claim 1 or 2, characterized in that The additional path (50) is used for current limiting and / or for absorbing energy during switching processes of the main path (30, 40).

5. The method according to claim 1 or 2, characterized in that A voltage limiting device (48) is activated or remains activated during disconnection of the main path (30, 40) and / or the additional path (50).

6. The method according to claim 1 or 2, characterized in that The additional path (50) remains closed until the current through the switching device (19) decays exponentially and / or decays to a determined threshold value.

7. The method according to claim 1 or 2, characterized in that When a critical state is detected, countermeasures are taken and / or the main path (30, 40) is closed or remains closed until the fuse (23) protecting the non-safety-relevant load (17) burns out.

8. The method according to claim 1 or 2, characterized in that If no critical state is detected, the main path (30, 40) is closed during driving operation of the motor vehicle in order to protect the fuse (23) of the non-safety-relevant load (17) from burning out.

9. The method according to claim 7, characterized in that The undervoltage criterion is deactivated, and / or the overcurrent threshold and / or thermal monitoring is activated or remains activated.

10. The method according to claim 9, characterized in that After deactivation of the undervoltage criterion, the main path (30, 40) and / or the additional path (50) are closed.

11. The method according to claim 9 or 10, characterized in that After the fuse (23) has burned out, the undervoltage criterion is reactivated.

12. The method according to claim 11, characterized in that Then enable Continue driving.

13. The method according to claim 1 or 2, characterized in that The additional path (50) is closed for charging the intermediate circuit capacitor (11) and / or the main path (30, 40) is closed after the intermediate circuit capacitor (11) has been charged.

14. The method according to claim 1 or 2, characterized in that The direction of the current flowing between the two onboard power subsystems is evaluated and / or, in a critical state, the main path (30, 40) is disconnected only when current flows from a onboard power subsystem with safety-related loads (16, 25) into another onboard power subsystem with non-safety-related loads (17).

15. The method according to claim 1 or 2, characterized in that At least one capacitor (61, 63, 67, 69) and at least one resistor (65, 71) are connected in parallel with at least one of the switching devices (34, 36, 44, 46) as commutation aids for the corresponding switching device (34, 36, 44, 46).

16. The method according to claim 1, wherein The detection of the critical state includes the detection of an overcurrent and / or an undervoltage or an overvoltage on the onboard power supply subsystem for safety-related electrical loads (16, 25).

17. The method according to claim 2, characterized in that The predefinable time interval is in the range of 0.1 ms to 10 ms.

18. The method according to claim 4, characterized in that The additional path (50) is used for current limiting via at least one resistor (48) arranged in the additional path (50) and / or for absorbing energy during switching processes of the main path (30, 40).

19. The method according to claim 18, characterized in that The at least one resistor is a metal resistor.

20. The method according to claim 5, characterized in that The voltage limiting device (48) is a diode.

21. The method according to claim 20, characterized in that The diode is a TVS diode.

22. The method according to claim 7, characterized in that The countermeasures include safely stopping the motor vehicle.

23. The method according to claim 13, wherein When the motor vehicle is first put into operation, the additional path (50) is closed in order to charge the intermediate circuit capacitor (11).

24. The method according to claim 13, wherein After the intermediate circuit capacitor (11) has been charged, the main path (30, 40) is closed after a defined time interval.

25. The method according to claim 14, wherein The critical state is an undervoltage condition.

Images