Devices used for decoupling and preventing compensation current in redundant systems for autonomous driving.

Abstract

This invention relates to a device for decoupling and / or preventing compensating current, for use in redundant systems for autonomous driving where multiple independently powered controller devices share at least one electrical actuator. Each electrical actuator has: a common connection terminal via which it can be coupled and switched to the common connection terminals of other electrical actuators; and at least one dedicated connection terminal through which the at least one electrical actuator can be individually energized. A number of switching devices corresponding to the number of the common and dedicated connection terminals of all electrical actuators are provided for switching current into or out of the at least one electrical actuator. The invention specifies at least one current cutoff device configured to prevent unintended current from flowing to the inactive electronic control unit of the first and second controller devices.

Description

[0001] This application is a divisional application of the invention patent application filed on August 26, 2019, with application number 201980058998.1, international application number PCT / EP2019 / 072718, and entitled "A device for decoupling and preventing compensation current in a redundant system for autonomous driving". Technical Field

[0002] This invention relates to a device for decoupling and preventing compensation current in a redundant system used for autonomous driving. Background Technology

[0003] In highly automated or autonomous vehicles (such as highly automated or autonomous trucks), driver assistance systems take over vehicle control from the driver and also monitor the vehicle's surroundings. According to the SAE (Society of Automotive Engineers), driver assistance systems are classified into six levels (0 to 5). Particularly in vehicles where autonomous driving is implemented at least temporarily without a driver ready to intervene (in assistance functions from Level 3 onwards—which involves highly automated driving—the basic system takes over longitudinal and lateral guidance in specific application situations, identifies system limits, and requires the driver to take over with sufficient time margin. The driver no longer needs to continuously monitor the vehicle or system but can potentially take over control), even in the event of a fault in the electrical control circuit, the braking system can still operate actuators, such as pressure control valves (PCVs), to enable electronic control functions such as ABS (Anti-lock Braking System), ESP (Electronic Stability Program), steering brakes, and the like. However, in fault conditions, such as component failure, the driver may no longer be able, or at least no longer be able to intervene and take over control of the vehicle sufficiently quickly. For this reason, the functions must be immediately taken over by the backup controller. Therefore, redundancy is essential for safety-critical electronic systems.

[0004] Therefore, for safety reasons, critical electronic systems are designed with redundancy. This is achieved, for example, by using multiple, such as two independent voltage sources that typically share a common ground wire, or by having multiple, such as two independent electrical control circuits for braking control in the vehicle that share a common ground wire (vehicle ground wire).

[0005] In compressed air braking systems, this specifically involves the operation of the braking system's electronics (i.e., controllers) and the electro-pneumatic actuators (such as solenoid valves or pressure control valves). In known systems, the electronics are designed to be redundant with two separate controllers, while in many electro-pneumatic valves, it is sufficient to connect one valve to two redundant braking system controllers and, depending on the situation, have either controller operate the valve.

[0006] Figure 1 The structure of a system with two brake controllers is schematically and partially shown, wherein the first brake controller is the main brake controller, and the second brake controller is the backup brake controller, both of which jointly operate a solenoid valve coil. The coil is operated by a semiconductor driver or semiconductor switch, all of which are powered through a common power supply path and ground path. A wire protection device is schematically shown.

[0007] Because the connection is made through the contacts of a shared solenoid valve, a compensating current may adversely occur between the two voltage sources. This compensating current arises from the voltage difference or ground offset between the voltage sources (typically GND1 and GND2 are equal, however, ground offset may occur in some cases, i.e., a voltage difference between the ground inputs). Thus, current flows through the on-state MOSFET (Metal-Oxide-Semiconductor Field-Effect Transistor) in one controller and the reverse diode or body diode of the MOSFET in the other controller.

[0008] Figure 2 This example illustrates the occurrence of compensating current in a system with a shared solenoid valve and no additional protection. Figure 2 For example, the desired current is schematically shown with solid lines, while the possible compensation current is shown with dashed lines.

[0009] Furthermore, in the presence of multiple independent control loops for braking control, it is essential to ensure that a fault in one control loop does not adversely affect other control loops. In particular, a single fault must not cause all, for example, control loops to fail simultaneously.

[0010] In known devices, pressure control valves, for example, electrically comprise two solenoid valves having a common connection terminal and an individual connection terminal. An electronic control unit (ECU) for operation has a switch that connects the common connection terminal of all solenoid valves, and a dedicated switch for each solenoid valve to energize them individually.

[0011] The switch can be configured as an electronic output stage, which is controlled by the logic unit of an electronic control unit. Here, a distinction is made between an output stage (high-voltage side) that connects the solenoid valve's feed line to a positive potential (+) and an output stage (low-voltage side) that connects the solenoid valve's return line to a negative potential (-) or ground potential. The output stage that commonly connects one of the two paths used for multiple solenoid valves can be a high-voltage side output stage or a low-voltage side output stage (Common Ground). Hereinafter, it is simplified to assume a negative side or low-voltage side connection. There must be a possibility of shutting off on both sides so that even if one of the feed lines is short-circuited relative to the power supply or ground, or if the output stage is damaged due to a short circuit ("durchlegiert"), i.e., a short circuit between the drain and source due to overheating (with a short-circuit fault), undesirable energization of the solenoid valve is prevented.

[0012] In order to identify other faults in a timely manner, especially short circuits between the feeder and return conductors, short circuits between the return conductor and the power supply, short circuits between the return conductor and the grounding conductor, and cable breaks, electrical values ​​(voltage at the connection point, excessive current) are usually monitored over a long period of time, and test pulses are periodically sent to the magnet and its electrical response is evaluated.

[0013] However, if the pressure control valve is operated by two or more electronic control units (ECUs), long-term monitoring in another ECU will take effect and falsely identify the fault when one ECU sends a test pulse to the magnet. Furthermore, when two electrical circuits share a common ground (-), ground offset between the two controlling ECUs can cause damage to one or both ECUs. Additionally, when a defective ECU is disconnected from its supply voltage, for example due to a fault, it may be unintentionally "reverse-powered," or when a short circuit to ground exists in the defective ECU, the current flowing from the intact ECU to the solenoid valve may be short-circuited because the parasitic diodes of the high-voltage output stage of the defective ECU allow current to flow from the intact ECU when the second ECU turns on the solenoid valve. This could unintentionally and potentially dangerously activate the defective first ECU and / or prevent the solenoid valve from turning on the pressure control valve involved, or damage the second ECU due to excessive current and thus eliminate necessary redundancy.

[0014] If the output stage used to individually energize a solenoid valve in an electronic control unit is short-circuited, it is not enough for this electronic control unit to simply turn off the corresponding common output stage of opposite polarity, because in this case current will flow through the common output stage of the other electronic control unit of opposite polarity and undesirably activate the solenoid valve. Summary of the Invention

[0015] Based on the above problems, the object of the present invention is to prevent compensating current between voltage sources in a compressed air braking system having a solenoid valve and a shared redundant controller, even without electrical isolation, while complying with safety requirements. Furthermore, the present invention should ensure that a fault in one control circuit does not affect another control circuit in the compressed air braking system.

[0016] According to the present invention, this objective is achieved by the features of claim 1.

[0017] The general concept of this invention is to provide a device for decoupling and preventing compensating current in redundant systems used for autonomous driving when two independently powered controllers share an electrical actuator. In a modular embodiment, the invention includes circuit modules (A and B) that complement conventional controllers, and these circuit modules, in combination with the controllers, provide protection against compensating current and reverse coupling when shared.

[0018] Devices used for decoupling and preventing compensation currents comprise two modules (semiconductor circuit modules) and / or diodes or functionally equivalent elements or components configured as current cut-off devices for connection to the positive path and ground path, and these enable the prevention of compensation currents and other unintended currents between voltage sources by a controller, even without electrical isolation and in compliance with safety requirements.

[0019] The module is preferably designed as a switching device or switch that is directly inserted into the power supply path or grounding path. The module is operated via multiple control wires. When all control wires are activated, the module functions as an on switch. Otherwise, the module remains in an off state, with its internal circuitry providing the aforementioned protection functions.

[0020] Furthermore, the module can be implemented in different augmentation stages, each configured to meet specific safety requirements. For example, the module can be configured to meet safety requirements ranging from simple to advanced, such as predetermined tolerances for individual short circuits in the internal MOSFETs or predetermined tolerances for short circuits in downstream high-side or low-side solenoid valve drivers. Additionally, the module preferably provides taps for non-shared circuit sections that only require protection against reverse polarity of the controller supply voltage.

[0021] The device for decoupling and / or preventing compensation current according to the present invention is used in a redundant system for autonomous driving where multiple independently powered controller devices share at least one electrical actuator. The at least one electrical actuator is specified to each have: a common connection terminal, through which the at least one electrical actuator can be coupled and switched with the common connection terminals of other electrical actuators; and at least one dedicated connection terminal, through which the at least one electrical actuator can be individually energized. The multiple controller devices include: at least one first controller device having a first electronic control unit and a first number of switching devices corresponding to the number of the common and dedicated connection terminals of all electrical actuators; and at least one second controller device having a second electronic control unit and a second number of switching devices corresponding to the number of the common and dedicated connection terminals of all electrical actuators. The at least one and the first controller devices are configured to, via the switching devices, selectively introduce or withhold current into the at least one electrical actuator. At least one current cut-off device is configured to prevent the current generated by the introduction of current to the electronic control unit of the other controller device when one of the first and second controller devices switches to introduce current into the at least one electrical actuator.

[0022] By employing the features described above according to the invention, particularly advantageously preventing unintended currents between controllers and / or electronic control units (ECUs) in systems (e.g., braking devices) with redundant designs for autonomous driving, caused by voltage or ground misalignment, it also advantageously prevents: damage or failure of one or all of the ECUs due to unintended currents; unintended "reverse" power supply to a defective ECU when it is disconnected from its supply voltage, for example due to a fault; or short-circuiting of current from a healthy ECU to a solenoid valve when the power supply of a defective ECU is short-circuited to ground or its ground wire is short-circuited relative to the supply voltage. Utilizing the features according to the invention, the redundancy required for autonomous driving can be advantageously maintained overall, even in fault conditions or under inappropriate voltage and / or grounding conditions.

[0023] Further advantageous extensions and improvements of the invention given in the independent claims can be achieved through the measures described in the dependent claims.

[0024] According to the present invention, the first and second controller devices include a main brake controller having a first electronic control unit and a backup brake controller having a second electronic control unit, and the at least one electrical actuator includes a solenoid valve or a pressure control module including a solenoid valve. The first and second controller devices are provided with coils for jointly actuating the solenoid valve and the pressure control module. The coils are configured for operation by a switching device, and the switching device includes a semiconductor switch configured for power supply through a common power supply path and a ground path.

[0025] According to the present invention, the switching device is configured as an electronic output stage, which is configured to be controlled by the logic unit of a first or second electronic control unit. The output stage is either an output stage that connects the feed line of the electrical actuator to a positive potential, or an output stage that connects the return line of the electrical actuator to a negative potential or a ground potential.

[0026] Particularly preferably, the current cutoff device is configured as a first compensation current protection module and a second compensation current protection module, which are respectively configured as switching semiconductor circuit modules and configured to be connected to the positive path and the ground path and prevent compensation current between voltage sources by a controller device.

[0027] Particularly preferably, the first compensation current protection module has: an input terminal; three separate control input terminals for operating the internal control switch in the MOSFET gate control section of the MOSFET provided in the module for switching; a fully protected output terminal; an output terminal providing reverse polarity protection; a ground connection terminal; and a charge pump, wherein the gate control leads are configured to be mutually decoupled in order to prevent failure due to individual short-circuit faults of the MOSFET.

[0028] Particularly preferably, the second compensation current protection module has: an input terminal; three separate input terminals for controlling the internal control switch in the MOSFET gate control section of the MOSFET provided in the module for switching; a fully protected output terminal; an output terminal providing reverse polarity protection; and a ground connection terminal, wherein the gate control wires are configured to be decoupled from each other in order to prevent failure due to individual short-circuit faults of the MOSFET.

[0029] Advantageously, the orientation of the MOSFETs within the first and second compensation current protection modules is determined by the orientation of the MOSFETs in the downstream high-voltage and low-voltage side drivers of the driver for the at least one electrical actuator, and the wiring of the MOSFETs in the first and second compensation current protection modules is such that the two body diodes of the two corresponding MOSFETs are connected in reverse and provide direct protection against reverse current, and the third MOSFET of the first and second compensation current protection modules is oriented such that the third MOSFET provides redundant reverse current protection.

[0030] More preferably, the current cut-off device may be configured as a diode disposed on the connection terminal of each of the switching devices in the switching device.

[0031] In this case, preferably, the diode can be located inside or outside the first and second controllers.

[0032] Alternatively, in this case preferably, multiple diodes can be arranged in a diode circuit layout that constitutes a T-shaped element and operates equivalently to each individual diode.

[0033] Alternatively, in this case, preferably, the diode as a current cutoff device can be placed in a common current path segment between the switching device and the corresponding electronic control unit.

[0034] Alternatively, in this case, preferably, a reverse-polarized and actively switching output stage is provided as a current cutoff device in the common current path section between the switching device and the first and second electronic control units on the power supply potential side, and a diode is provided as a current cutoff device in the common current path section between the switching device and the first and second electronic control units on the ground potential side.

[0035] Alternatively, in this case, preferably, a reverse-polarized and actively switching output stage is provided as a current cutoff device in the common current path section between the switching device and the first and second electronic control units on the power supply side, and a reverse-polarized and actively switching output stage is provided as a current cutoff device in the common current path section between the switching device and the first and second electronic control units on the ground potential side.

[0036] Furthermore, it is preferred and advantageous in the device that the first and second electronic control units can be configured to, when there is no need to energize the electrical actuator, cut off not only the positive wire but also the ground wire switching device; during fault-free operation conforming to predetermined standards, only one of the first and second electronic control units is limited to taking over the control of the at least one electrical actuator; the electronic control unit in the inactive state of the first and second electronic control units is configured to not actively energize the electrical actuator for testing purposes; and the electronic control unit in the inactive state is configured to, in the event of a failure of the active control unit of the first and second electronic control units (the failure preventing the active control unit from continuing to operate), switch to the active state and become the new active electronic control unit to take over the control of the electrical actuator thereafter; wherein the electronic control unit in the inactive state is configured to monitor the voltage level and / or current level on the wires from the electronic control unit in the inactive state to the at least one electrical actuator, the monitoring being verified using information about the current operation of the at least one electrical actuator transmitted from the active electronic control unit to the electronic control unit in the inactive state; and to monitor the reliable cut-off of the current cutting-off device.

[0037] This invention relates not only to the aforementioned devices for decoupling and preventing compensating currents in redundant systems used for autonomous driving, but also to a method for controlling and / or operating such devices. As already described above, the braking device in which the device can be installed and in which the method can be implemented can be electrically, hydraulically, pneumatically, electro-hydraulically, or electro-pneumatically operated. This braking device can be a braking device for passenger cars or trucks (tractors and / or trailers), and can be of any type and, in particular, electrically, hydraulically, pneumatically, electro-hydraulically, or electro-pneumatically operated. In this respect, the invention extends to all types of vehicles, and particularly to passenger cars, trucks, or heavy-duty trucks.

[0038] The controller device may be formed by a separate controller or by an existing electronic controller, particularly by a vehicle controller, a brake controller for a braking device, or a controller for an electro-pneumatic brake control module.

[0039] Advantageous further extensions of the invention are derived from the specification and drawings. The advantages of the individual features and combinations thereof mentioned at the beginning of the specification are merely exemplary and may work alternatively or cumulatively without being mandatory to achieve these advantages from embodiments according to the invention.

[0040] Further features can be derived from the accompanying drawings, particularly from the geometry and interrelationships of the various components, as well as their relative arrangement and functional connections. Combinations of features from different embodiments of the invention or from different claims may also differ from, and are thereby encouraged, the chosen reference relationships of the claims. This also applies to features shown in separate drawings or mentioned in the description of the drawings. These features may also be combined with features from different claims. Similarly, features listed in the claims may be omitted for other embodiments of the invention.

[0041] The same or equivalent components and assemblies are labeled with the same reference numerals in different embodiments. Attached Figure Description

[0042] Embodiments of the invention are illustrated in the accompanying drawings and described in more detail in the following description. Note that the drawings schematically and partially illustrate portions of a compressed air braking system (compressed air braking device) known per se for use in vehicles, such as those used in trucks. Therefore, components of the compressed air braking system or compressed air braking device are specifically referred to only when the description and explanation therewith contribute to a better understanding of the invention. Furthermore, for clarity, the same reference numerals are not repeatedly used to denote the same or at least similar components in the drawings; rather, it is exemplary that a single reference numeral is given representatively and at one time for such the same or at least similar components.

[0043] In the picture:

[0044] Figure 1 The schematic structure of a portion of a redundant compressed air braking system is shown, which has two controllers (more precisely, a main controller and a backup controller) and multiple solenoid valves shared by the two controllers.

[0045] Figure 2 Shown in Figure 1 Examples of compensation currents between voltage sources are shown (solid lines: desired current, dashed lines: possible compensation currents);

[0046] Figure 3 The redundant design of the compressed air braking system is shown in Figure 1 The portion shown in the figure, wherein according to one embodiment, a first compensation current protection module A is further provided in the positive power supply path and a second compensation current protection module B is provided in the ground power supply path to prevent compensation current between independent voltage sources;

[0047] Figure 4 Showing according to Figure 3 Details of an exemplary first compensation current protection module A, which is used to prevent compensation current in the positive power supply path;

[0048] Figure 5 Showing according to Figure 3 Details of an exemplary second compensation current protection module B, which is used to prevent ground compensation current;

[0049] Figure 6 The extended level is shown according to Figure 3 Details of an exemplary modification of the first compensation current protection module A, wherein the expansion stage is used to protect the positive power supply path with enhanced safety measures;

[0050] Figure 7 The extended level is shown according to Figure 3 Details of an exemplary modification of the second compensation current protection module B, wherein the expansion stage has exemplary additional safety measures;

[0051] Figure 8 Details of another modification of the exemplary second compensation current protection module B are shown in a simplified expansion stage;

[0052] Figure 9 A simplified and concise diagram of a redundant compressed air braking system is shown, the compressed air braking system being provided with a current cut-off device according to the second embodiment;

[0053] Figure 10 Showing according to Figure 9 An alternative arrangement for the current cutoff device;

[0054] Figure 11 Showing according to Figure 9 Another alternative arrangement for the current cutoff device;

[0055] Figure 12 Showing according to Figure 9 Another alternative arrangement for the current cutoff device; and

[0056] Figure 13 Showing according to Figure 9 Another alternative arrangement for the current cut-off device. Detailed Implementation

[0057] First Embodiment

[0058] exist Figure 1 The diagram shows a schematic structure of a portion of a redundant compressed air braking system, for example, for a vehicle, the compressed air braking system having: a plurality of controller devices, of which at least two controllers, and more precisely a main controller (first controller) 1 and a backup controller (second controller) 2; and a plurality of solenoid valves 5, such as first, second and third solenoid valves, shared by the two controllers 1 and 2.

[0059] Each pin of the solenoid valve 5 is connected not only to the main controller 1 but also to the backup controller 2. The main controller 1 is powered by a first voltage source 4 at a predetermined potential relative to the vehicle ground wire, while the backup controller 2 is powered by a second voltage source 3 at a predetermined potential relative to the vehicle ground wire. The main controller 1 and the backup controller 2 are configured to switch, as needed, switching devices 6 (e.g., suitable MOSFETs or other suitable power switches or output stages) located in the power supply path and ground path, respectively.

[0060] exist Figure 1In the exemplary braking diagram shown, the first controller 1, i.e., the main controller, may include a first electronic control unit or ECU (in... Figure 1 (Not shown in the image), the first electronic control unit or ECU may belong to a "standard" EBS system or electronic braking system, while the second controller 2, i.e., the backup controller, may contain a second electronic control unit or ECU (in the image). Figure 1 (Not shown in the diagram), the second electronic control unit or ECU controls the backup brake controller, which is used for redundant braking as a backup system. The two electronic control units in the two controllers 1 and 2 are respectively connected to voltage sources 3 and 4, and are capable of communicating with each other and with other vehicle systems via a data bus (not shown). Controllers 1 and 2 together constitute a controller unit.

[0061] It goes without saying that compressed air braking systems are... Figure 1 The portions shown can be part of the braking system or braking device of any vehicle (e.g., a cargo truck acting as a tractor and / or a trailer of that tractor), and the compressed air braking system can be operated in a manner known per se and, in particular, electrically, hydraulically, pneumatically, electrohydraulically, or electropneumatically. Furthermore, it is self-evident that the number, configuration, and arrangement of controllers 1 and 2, solenoid valves 5 and switches 6 are not limited to the numbers, configurations, and arrangements exemplarily used herein, as long as the effects and advantages according to the invention can be achieved with appropriate quantities, configurations, and arrangements. In the following description, details of known compressed air braking systems are omitted for simplicity, provided that such details do not contribute to a better or easier understanding of the invention.

[0062] Figure 2 Shown in Figure 1 Examples of possible compensation currents between voltage sources 3 and 4 are shown. If one of the controllers 1 and 2 closes at least one switch of switch 6 in the power supply path and in the ground path and a corresponding predetermined current (a) flows through it, in the case of a voltage difference between the first voltage source 4 and the second voltage source 3 (case (b)) corresponding to the conduction direction of the body diode, or in the case of a ground offset between the ground pins of the two controllers 1 and 2 (case (c)), the compensation currents (b) and (c) in the other controller can flow through the body diode of the MOSFET forming switch 6.

[0063] Figure 3 This illustrates a redundant compressed air braking system. Figure 1 The diagram shows a portion of the overall structure of such a system. The following... Figures 4 to 8 based on Figure 3The circuit details of the two modules A and B for the positive power supply path (A) and the ground path (B) are shown in different expansion stages.

[0064] As in Figure 3 As shown, according to one embodiment, a first compensation current protection module A is provided in the positive power supply path, and a second compensation current protection module B is provided in the ground power supply path to prevent compensation current between independent voltage sources 3 and 4. Figure 3 In this embodiment, the compensation current protection modules A and B are preferably integrated into the controllers 1 and 2. Therefore, it goes without saying that the number of corresponding configurations of the compensation current protection modules is equal to the number of configurations of the controllers.

[0065] Figure 4 Showing according to Figure 3 Details of an exemplary first compensation current protection module A, which is used to prevent compensation current in the positive power supply path, are shown, and basic variations of the two modules A and B are illustrated.

[0066] More precisely, in Figure 4 The first compensation current protection module A shown has: an input terminal EIN; three separate control input terminals for operating internal control switches (referred to as STRG_1, STRG_2, STRG_3) in this embodiment, for example, the MOSFET gate control section; a fully protected output terminal AUS_fp; an output terminal AUS_rp that only provides reverse polarity protection; a ground connection terminal GND; and a charge pump 7. Preferably, to prevent failure due to individual short-circuit faults of the MOSFET, the gate control leads are decoupled from each other. Figure 4 The appropriate decoupling is demonstrated by a diode 9 in each of the gate control lines and a MOSFET individually controlled by the three input terminals STRG_1, STRG_2, and STRG_3. Note that diode 9 can be optionally provided. The diode is not necessary when, for example, bipolar transistors or MOSFETs are used for STRG_1, STRG_2, and STRG_3.

[0067] Figure 5 Showing according to Figure 3 Details of an exemplary second compensation current protection module B, which is used to prevent ground compensation current.

[0068] exist Figure 5The second compensation current protection module B shown has: an input terminal EIN; three separate input terminals for controlling internal control switches (referred to as STRG_1, STRG_2, STRG_3) in this embodiment, for example, the MOSFET gate control section; a fully protected output terminal GND_fp; an output terminal GND_rp that only provides reverse polarity protection; and a ground connection terminal GND. Preferably, to prevent failure due to individual short-circuit faults of the MOSFET, the gate control leads are decoupled from each other. Figure 5 The appropriate decoupling is demonstrated by a diode 9 in each of the gate control lines and a MOSFET individually controlled by the three input terminals STRG_1, STRG_2, and STRG_3. Note that diode 9 can be optionally provided. The diode is not necessary when, for example, bipolar transistors or MOSFETs are used for STRG_1, STRG_2, and STRG_3.

[0069] In this basic variant, when the first compensation current protection module A and the second compensation current protection module B are in the open state, the first compensation current protection module and the second compensation current protection module provide reverse polarity protection and prevent compensation current, which can tolerate a single MOSFET short-circuit fault.

[0070] according to Figure 4 The circuit layout of the first compensation current protection module A and the second compensation current protection module B is based on three power MOSFETs, respectively. An important design criterion here is the orientation of the power MOSFETs, where the orientation of the power MOSFETs within the module is determined by their orientation in the downstream high-voltage and low-voltage side drivers used to drive the solenoid valve. The preferred design objective is to wire the power MOSFETs of the first compensation current protection module A and the second compensation current protection module B such that the two body diodes of the power MOSFETs are connected in reverse and provide direct protection against reverse current. The third power MOSFET of the first compensation current protection module A and the second compensation current protection module B is oriented such that it, in conjunction with the high-voltage side or low-voltage side driver, provides redundant reverse current protection for the solenoid valve control output. This ensures that protection against compensation current is not lost due to a single short circuit in a power MOSFET. Besides selecting the MOSFET orientation, different combinations of the power MOSFET sequence can be made according to desired circuit characteristics (which can be determined, for example, by testing and / or monitoring circuitry).

[0071] exist Figure 4The diagram schematically illustrates the internal operation of the power MOSFETs in the first and second current compensation protection modules A and B via a switching module and either a charge pump 7 (in the first current compensation protection module A) or a voltage converter (in the second current compensation protection module B, a DC / DC converter). Technically, the switching voltage for the power MOSFET can be achieved, for example, by switching the gate-source voltage of a bipolar transistor circuit. In the first current compensation protection module A, a sufficiently high gate-source voltage for the power MOSFET can be generated, for example, via one or more charge pumps (depending on safety requirements). However, this is not the only possibility; other implementations are also conceivable. The components of the charge pump (e.g., a high-frequency control signal generator) can also be outsourced and provided, for example, via a microprocessor. In the second current compensation protection module B, located in the ground path, a lower voltage is sufficient; this voltage can either be directly input coupled or converted again (to a lower voltage) by an internal voltage converter (DC / DC converter). Other implementations are also conceivable here.

[0072] To decouple the power MOSFETs even under short-circuit conditions, each gate of the power MOSFET is decoupled from the gate voltage source via the switching of the gate control wires and, if necessary, via an optional additional diode 9. Additionally, the three separate control inputs STRG_1 to STRG_3 provide the possibility of individually controlling each power MOSFET via a microprocessor. If lower safety requirements are sufficient, multiple or all of the control inputs STRG_1 to STRG_3 can be connected and switched together.

[0073] For better clarity, additional test and diagnostic circuitry is not shown. However, preferably, in a practical implementation, the test and diagnostic circuitry not only provides and configures the first compensation current protection module A and the second compensation current protection module B, but also serves as the high-voltage and low-voltage side driver at the output of the solenoid valve 5, to facilitate adequate diagnostic coverage of the switch 6, compensation current protection, and reverse polarity protection.

[0074] Figure 6 Showing according to Figure 3 or Figure 4 Details of the exemplary first compensation current protection module A in the modification, which is an extended expansion stage with improved safety measures, wherein an additional redundant charge pump 8 for protecting the positive power supply path is set and configured to provide protection against failure due to a single fault in the internal charge pump 7.

[0075] Figure 7 Showing according to Figure 3Details of an exemplary second compensation current protection module B modified in an extended expansion stage, which has exemplary additional safety measures in multiple available controller power pins and / or ground pins. According to this modification, when the voltage offset between ground input GND_1 and ground input GND_2 is lower than the diode forward voltage of diode 9, redundant ground inputs can be configured to provide protection against, for example, conductor voltage drops (Abfall).

[0076] The first compensation current protection module A and the second compensation current protection module B are in Figure 6 and 7 The extended level shown in the modified version provides further protection against various fault conditions.

[0077] Therefore, according to Figure 6 Additional protection against possible individual failures in the internal charge pump 7 can be achieved by setting multiple separate charge pumps 7 and 8.

[0078] Furthermore, when multiple power supply pins or ground pins are available on the first and second controllers 1 and 2, redundant inputs can be used to control the first and second compensation current protection modules A or B. This provides protection against pin disconnection or protection against triggering of a fuse in one of the power supply paths of each controller. Figure 7 An example circuit layout for a second compensation current protection module B with two controller ground pins is shown. Figure 7 In the circuit layout, it should be noted that the voltage offset between the two controller ground pins is lower than the forward voltage of the body diode of the power MOSFET. If a higher voltage offset is desired, it can be achieved through additional measures, such as adding an additional MOSFET.

[0079] Figure 8 Simplified extension level shown according to Figure 3 Details of another modification of the exemplary second compensation current protection module B. This extension stage uses only two MOSFETs, provides reverse polarity protection, and decouples the output from the ground line as long as not all switches inside the module are closed.

[0080] As previously explained, in this basic type of compressed air braking system, it is essential to ensure that a fault in one control circuit does not negatively impact other control circuits as much as possible. In this regard, the aforementioned compensation current protection modules A and B cover faults induced by unexpected compensation currents.

[0081] Second Embodiment

[0082] In the second embodiment, the MOSFET can be economically and simply replaced by a diode. Therefore, the second embodiment can form an optimized and simplified implementation of the first embodiment. By replacing the MOSFET with a diode, at least the measurement of voltage and current signals for monitoring and the manipulation of the corresponding MOSFETs are eliminated, resulting in reduced costs in both hardware and software. Furthermore, and more economically and simply, at least one diode can be located external to the controller, i.e., outside the controller or control device, for example, integrated in a cable bundle or in an actuator, such as a pressure control valve (PCV).

[0083] According to the second embodiment, a diode, or a functionally equivalent component or element, is disposed in the electronic control unit, in the cable bundle (e.g., in the plug or socket of the pressure control valve or electronic control unit), and / or, for example, in a specific T-shaped element. During trouble-free operation, only one control unit in each electronic control unit specifically takes over the operation of the pressure control valve. In all electronic control units, not only the positive wire but also the ground wire is disconnected whenever the solenoid valve does not need to be energized.

[0084] As in Figure 9 As shown, according to the second embodiment, the electro-pneumatic actuator (e.g., pressure control valve 15) electrically comprises two solenoid valves 5, each having a common connection terminal and its own individual connection terminal. The controlled first electronic control unit (ECU 11) and the controlled second electronic control unit (ECU 12) each have a switching device 16 for switching the common connection terminal of all solenoid valves 5 and a switching device 17 for each solenoid valve 5 for individually energizing the solenoid valve. The switching devices 16 and 17 can, for example, be configured as an electronic output stage controlled by a logic unit (not shown) in the first and second electronic control units 11 and 12.

[0085] Here, a distinction is made between the output stage (high-pressure side) where the feed wire of solenoid valve 5 is connected to the positive (+) terminal and the output stage (low-pressure side) where the return wire of solenoid valve 5 is connected to the negative (-) terminal or the ground wire. The output stage that connects one of the two paths of multiple solenoid valves 5 can be either a high-pressure side output stage or a low-pressure side output stage (common ground). In the following description, the negative connection terminal (low-pressure side) will be specifically identified.

[0086] There must be a shut-off capability on both sides to prevent unintended energization of solenoid valve 5 even in the event of a short circuit in one of the feeders relative to the supply voltage or ground wire, or due to a short circuit in the output stage. Furthermore, to promptly identify other fault conditions, such as short circuits particularly between the feeder and return conductor, between the return conductor and the supply voltage, and between the return conductor and the ground wire, as well as possible cable breaks, electrical values ​​(e.g., voltage at the connection points, excessive current) must be continuously monitored, and test pulses must be periodically applied to the magnet and its electrical response evaluated.

[0087] As in Figure 9 As shown in the figure, according to the second embodiment, diodes 18 and 19 are respectively provided on the corresponding connection terminals of the switching device 16 (i.e., the output stage) in the direction of the solenoid valve 5 or on the corresponding connection terminals of the switching device connected to the voltage source or the ground wire.

[0088] In accordance with Figure 9 In the second embodiment, diodes 18 and 19 are disposed within the first and second controllers 1 and 2, which are shown by dashed lines.

[0089] Note that in the corresponding modification of the second embodiment, these diodes 18, 19 are located outside the first and second controllers 1, 2. Figure 10 ), consisting of a diode circuit arrangement structure 20 that operates equivalently to a corresponding single or separately arranged diode. Figure 11 Instead, a common current path segment is formed between the switching devices 16, 17 and the corresponding electronic control units 11, 12. Figure 12 ) replace and / or combine with diode 19 by an additional reverse-polarized and actively switched output stage 21. Figure 13 In the last modification mentioned, it is also conceivable to replace the diode 19 with a corresponding additional actively switched output stage.

[0090] Diodes 18, 19, circuit arrangement 20 operating equivalent to a single diode, and / or additional reverse-polarized and actively switched output stage 21 are configured to prevent current from flowing into electronic control units 11, 12 in an unexpected or undesirable direction via the connection wire to pressure control valve 15 in the event of a fault, and to prevent damage caused by connection to other electronic components of electronic control units 11, 12.

[0091] This advantageously prevents: when two electrical circuits share a common ground wire (-), ground offset between the two controlling electronic control units 11, 12 may cause damage to one or both of the electronic control units 11, 12; and when a defective electronic control unit 11, 12 is disconnected from its supply voltage due to a fault, the electronic control unit may be unintentionally powered "reversely," or when the power supply of the defective electronic control unit is short-circuited to ground, the current from the intact electronic control unit to the solenoid valve 5 may be short-circuited because when the intact electronic control unit turns on the solenoid valve 5, the parasitic diode of the high-voltage side output stage of the defective electronic control unit allows current to flow through the intact ECU. Because unintentional and potentially dangerous activity of the defective electronic control unit may occur in such fault conditions, and the solenoid valve of the pressure control valve 15 involved may prevent switching, or the intact electronic control unit may also be damaged due to excessive current. In such cases, the necessary redundancy is no longer available.

[0092] According to the second embodiment, when there is no need to energize the solenoid valve 5, not only the output stage of the switching device 6 or the positive wire, but also the output stage of the ground wire in the two electronic control units 11 and 12 are always off. During trouble-free operation, only one control unit in the electronic control units 11 and 12 exclusively takes over the operation of the pressure control valve 15. This task allocation can be maintained during trouble-free operation or switched periodically or according to other predetermined criteria (e.g., according to criteria set to coordinate the thermal load of the output stage).

[0093] Furthermore, the electronic control unit, when inactive, will not actively energize solenoid valve 5 for testing purposes as long as it remains inactive. This prevents the transmission of test pulses to the magnet and advantageously prevents the triggering of long-term monitored values ​​in another electronic control unit and the resulting unfounded fault identification.

[0094] Alternatively, the inactive electronic control unit can also monitor the voltage and / or current levels on the wires from the electronic control unit to the pressure control valve 15, and, if necessary, verify this information regarding the current operation of the solenoid valve transmitted from the active electronic control unit via a digital interface (e.g., a CAN bus) to the inactive control unit. In particular, for example, when diodes 18 and 19 are in... Figure 9 and Figure 12 When connected in the electronic control unit as shown, the reliable cutoff of diodes 18 and 19 can be monitored in this way.

[0095] If the currently active first electronic control unit, such as the first electronic control unit 11, is no longer able to operate the pressure control valve 15 for some reason (e.g., due to an electrical fault within the electronics, such as a short circuit in the output stage, or a loss of power supply due to a broken cable in the lead to the pressure control valve 15), the previously inactive second electronic control unit, such as the second electronic control unit 12, now becomes the active electronic control unit and, from then on—as long as this is possible—takes over the operation of the pressure control valve 15. For this purpose, the second electronic control unit 12, transitioning from an inactive state to an active state, may do so, for example, due to a communication interruption with the first electronic control unit 11, or by recognizing the malfunction of the previously active first electronic control unit 11 itself. Alternatively, the previously active first electronic control unit 11, or another electronic control unit that has recognized a fault in the previously active first electronic control unit 11, can notify the second electronic control unit 12 of the recognized fault.

[0096] Then, the now active second electronic control unit 12 can identify whether a short circuit exists based on the voltage level on its wires, or whether one of the dedicated (separate) output stages in the no longer active first electronic control unit 11 is short-circuited. In these cases, the pressure control valve 15 can no longer continue to operate because turning on the common switching device 17 will immediately and undesirably activate the solenoid valve 5. Therefore, in these cases, the active electronic control unit terminates the operation of the pressure control valve 15.

[0097] If the aforementioned fault condition does not exist, i.e., there is no short circuit and no output stage fusion, the active electronic control unit can pulse-connect one or more of the common switching device 17 and the dedicated switching device 16 to identify the fault by means of excessive current. A short circuit in the common switching device 16 or output stage of the electronic control unit relative to a short circuit or fault in the ground wire can be identified as follows: when the corresponding dedicated switching device or output stage is pulse-connected and when the common switching device or output stage is turned off, there is no voltage on the return wire before the common switching device or output stage.

[0098] If one of the aforementioned faults is identified, then one or more pressure control valves 15 cannot continue to operate. This is because if the output stage of the dedicated wiring for solenoid valve 5 in one electronic control unit is short-circuited, it is inappropriate for only this electronic control unit to shut off the corresponding common output stage of reverse polarity, as current would then flow through the common output stage of another electronic control unit of reverse polarity and undesirably activate the solenoid valve. Therefore, in the aforementioned fault condition, the currently active electronic control unit terminates the operation of one or more pressure control valves.

[0099] In other cases where the faulty electronic control unit is short-circuited relative to the ground wire or the common output stage is short-circuited, if necessary, the active electronic control unit that takes over the operation of the pressure control valve 15 in place of the faulty electronic control unit may continue the operation of the pressure control valve 15 for at least a limited time.

[0100] Note that a corresponding fault report can be made if any fault is identified, if no fault report has been made in the faulty electronic control unit or other monitoring systems prepared and configured for this purpose.

[0101] As previously stated, the present invention relates to a device for decoupling and / or preventing compensation current, the device being used in situations where, in a redundant system for autonomous driving, multiple independently powered controller devices 1, 2 share at least one electrical actuator 5, 15. Each of the electrical actuators 5, 15 has: a common connection terminal via which it can be coupled and switched to the common connection terminals of other electrical actuators 5, 15; and at least one dedicated connection terminal through which the at least one electrical actuator 5, 15 can be individually energized. A number of switching devices 6, 16, 17 corresponding to the number of the common and dedicated connection terminals of all electrical actuators 5, 15 are provided for switching current into or out of the at least one electrical actuator 5, 15. The invention specifies at least one current cut-off device A, B, 18, 19, 20, 21 configured to prevent unintended current from flowing to the inactive electronic control units 11, 12 of the first and second controller devices 1, 2.

[0102] List of reference numerals

[0103] 1. First controller device (first controller, main controller)

[0104] 2. Second controller device (second controller, backup controller)

[0105] 3 First voltage source

[0106] 4 Second voltage source

[0107] 5. Solenoid valve

[0108] 6. Switching devices (switches, output stages)

[0109] 7. Charge Pump

[0110] 8. Charge Pump

[0111] 9 diodes

[0112] 11 First Electronic Control Unit

[0113] 12 Second Electronic Control Unit

[0114] 15 Pressure control valve

[0115] 16 Switching devices (switches, output stages)

[0116] 17 Switching devices (switches, output stages)

[0117] 18 diodes

[0118] 19 Diodes

[0119] 20. Diode circuit layout structure (T-shaped component)

[0120] 21 Output stage

[0121] A First Compensation Current Protection Module

[0122] B. Second Compensation Current Protection Module

[0123] μC Microcomputer

Claims

1. A device for decoupling and / or for preventing compensation current, said device being used in a redundant system for autonomous driving where multiple independently powered controller devices (1, 2) share at least one electrical actuator (5; 15), wherein a) Each of the at least one electrical actuator (5; 15) has: a common connection terminal, through which the at least one electrical actuator can be coupled to and switched with the common connection terminal of another electrical actuator (5; 15); and at least one dedicated connection terminal through which the at least one electrical actuator (5; 15) can be individually powered. b) The plurality of controller devices (1, 2) each comprises: at least one first controller device (1), the first controller device having a first electronic control unit (11) and a first number of switching devices (6; 16, 17) corresponding to the common connection terminals of all electrical actuators (5; 15) and the number of each dedicated connection terminal; and at least one second controller device (2), the second controller device having a second electronic control unit (12) and a second number of switching devices (6; 16, 17) corresponding to the common connection terminals of all electrical actuators (5; 15) and the number of each dedicated connection terminal; and c) The at least one first and second controller devices (1, 2) are configured to, via switching devices (6; 16, 17), selectively introduce or de-introduce current into the at least one electrical actuator (5; 15). d) Provide at least one current cut-off device (A, B; 18, 19; 20; 21) configured to prevent the current generated by one of the first and second controller devices (1, 2) from flowing to the electronic control unit (11, 12) of the other controller device when one of the first and second controller devices (1, 2) switches to introducing current into the at least one electrical actuator (5; 15). e) The first and second controller devices (1, 2) include a main brake controller (1) having a first electronic control unit (11) and a backup brake controller (2) having a second electronic control unit (12), and the at least one electrical actuator (5; 15) includes a solenoid valve (5) or includes a pressure control module (15) containing a solenoid valve. The first and second controller devices (1, 2) are provided with coils for jointly actuating the solenoid valve (5) and the pressure control module (15), the coils being configured for operation via switching devices (6; 16, 17), and the switching devices (6; 16, 17) including semiconductor switches configured for power supply via a common power supply and ground path. f) The switching device (6; 16, 17) is configured as an electronic output stage, which is configured to be controlled by the logic unit of the first or second electronic control unit (11, 12). The output stage is either an output stage that connects the feed line of the electrical actuator to a positive potential, or an output stage that connects the return line of the electrical actuator to a negative potential or a ground potential.

2. The device according to claim 1, characterized in that, The current cut-off devices (A, B) are configured as a first compensation current protection module (A) and a second compensation current protection module (B). The first compensation current protection module and the second compensation current protection module are respectively configured as switching semiconductor circuit modules and configured to be connected to the positive path and the ground path and prevent compensation current between each voltage source by the controller devices (1, 2).

3. The device according to claim 2, characterized in that, The first compensation current protection module (A) has: an input terminal (EIN); three separate control input terminals for controlling the internal control switches (STRG_1, STRG_2, STRG_3) in the gate control section of the MOSFET provided in the module for switching; a fully protected output terminal (AUS_fp); an output terminal providing reverse polarity protection (AUS_rp); a ground connection terminal (GND); and a charge pump (7), wherein the gate control wires are configured to be decoupled from each other in order to prevent failure due to individual short-circuit faults of the MOSFET.

4. The device according to claim 2, characterized in that, The second compensation current protection module (B) has: an input terminal (EIN); three separate input terminals for controlling the internal control switches (STRG_1, STRG_2, STRG_3) in the gate control section of the MOSFET provided in the module for switching; a fully protected output terminal (GND_fp); an output terminal providing reverse polarity protection (GND_rp); and a ground connection terminal (GND), wherein the gate control wires are configured to be decoupled from each other to prevent failure due to individual short-circuit faults of the MOSFET.

5. The device according to claim 3 or 4, characterized in that, In the first and second compensation current protection modules (A, B), the orientation of the MOSFETs within the modules is determined by the orientation of the MOSFETs in the downstream high-voltage and low-voltage side drivers of the driver for the at least one electrical actuator, and the wiring of the MOSFETs in the first and second compensation current protection modules (A, B) is such that the two body diodes of the two corresponding MOSFETs are connected in reverse and provide direct protection against reverse current, and the third MOSFET of the first and second compensation current protection modules (A, B) is oriented such that the third MOSFET provides redundant reverse current protection.

6. The device according to any one of claims 1 to 4, characterized in that, The current cut-off devices (18, 19) are configured as diodes disposed on the connection terminals of each of the switching devices (16, 17).

7. The device according to claim 6, characterized in that, The diode is located either inside or outside the first and second controllers (1, 2).

8. The device according to claim 6, characterized in that, Multiple diodes are arranged in a diode circuit layout (20) that is equivalent to each individual diode and is configured as a T-shaped element.

9. The device according to any one of claims 1 to 4, characterized in that, Diodes (18, 19) are used as current cut-off devices in a common current path segment between the switching devices (16, 17) and the corresponding electronic control units (11, 12).

10. The device according to any one of claims 1 to 4, characterized in that, On the power supply potential side, a reverse-polarized and actively switching output stage is provided as a current cutoff device (21) in a common current path section between the switching device (16, 17) and the first and second electronic control units (11, 12), and on the ground potential side, a diode is provided as a current cutoff device (19) in a common current path section between the switching device (16, 17) and the first and second electronic control units (11, 12).

11. The device according to any one of claims 1 to 4, characterized in that, On the power supply potential side, a reverse-polarized and actively switching output stage is provided as a current cutoff device (21) in a common current path section between the switching device (16, 17) and the first and second electronic control units (11, 12), and on the ground potential side, a reverse-polarized and actively switching output stage is provided as a current cutoff device (21) in a common current path section between the switching device (16, 17) and the first and second electronic control units (11, 12).

12. The device according to any one of claims 1 to 4, characterized in that, a) The first and second electronic control units (11, 12) are configured to, when there is no need to energize the electrical actuator (5; 15), disconnect not only the positive wire but also the ground wire of the switching device (6; 16, 17); b) During trouble-free operation conforming to predetermined standards, only one of the first and second electronic control units (11, 12) is limited to taking over the control of the at least one electrical actuator (5; 15); c) The electronic control units of the first and second electronic control units (11, 12) in the inactive state are configured to not actively energize the electrical actuators (5; 15) for testing purposes; and d) The electronic control unit in the inactive state is configured to, in the event of a malfunction in the active electronic control unit of the first and second electronic control units (11, 12) that prevents the active control unit from continuing to operate, switch to the active state and become the new active electronic control unit, replacing the faulty electronic control unit and thereafter taking over the control of the electrical actuators (5; 15); wherein, e) The inactive electronic control unit is configured to monitor the voltage level on the wires of the inactive electronic control unit to the at least one electrical actuator (5; 15), verify the monitoring using information about the current operation of the at least one electrical actuator transmitted from the active electronic control unit to the inactive electronic control unit, and monitor the reliable cut-off of the current cut-off device.

Images