Device for supplying energy to at least one safety-related consumer in motor vehicle

Abstract

The invention relates to a device for supplying energy to at least one safety-related consumer in a motor vehicle, in which at least two switches (61, 62, 63) are provided for supplying and securing at least one safety-related consumer (16) or a plurality of safety-related consumers (16), wherein each of the switches (61, 62, 63) is associated with a respective control device (281, 282, 283) for controlling at least one of the switches (61, 62, 63) in accordance with at least one control signal (104, 106; the invention relates to a method for operating a control device (281, 282, 283) of a motor vehicle, said device comprising at least two mutually independent supply paths (248, 250) for supplying the control device (281, 282, 283), one of the supply paths (248) comprising a driver stage (144, 256) supplied by an auxiliary voltage (137), and the other supply path (250) comprising a further driver stage (146, 266) supplied by a further auxiliary voltage (139), the other auxiliary voltage is independent of the auxiliary voltage (137), at least two coupling elements (274) are provided for combining the output variables of the two driver stages (144, 146, 256, 266), each of the coupling elements (274, 274. N) supplying a respective one of the control devices (281, 282, 283).

Description

Technical Field

[0001] The invention relates to a device for supplying energy to safety-related electrical loads in a motor vehicle according to the preamble of the independent claim. Background Art

[0002] DE 10 2019 205 800 A1 discloses a power supply network output and a method for operating a power supply network. The power supply network output is designed for a rated current and comprises n switches sufficient to conduct the rated current, wherein an additional switch is provided, resulting in a total of n+1 switches, which are arranged in parallel with one another, wherein each switch is assigned a driver, where n>=2 applies.

[0003] DE 10 20 20 10 7 695 A1 discloses a method for configuring an onboard power supply system of a motor vehicle, wherein at least one electrical consumer is arranged in the onboard power supply system, wherein, within the scope of configuring the onboard power supply system, at least one of the at least one electrical consumer is assigned an electrical module, which in turn is selected from a module group, wherein, when selecting the electrical module, a first electrical consumer criterion related to the power supply requirement of the at least one electrical consumer and a second electrical consumer criterion related to the feedback influence degree of the at least one electrical consumer are taken into account.

[0004] The present invention is based on the object of specifying a device which further increases the reliability of the energy supply while maintaining a simple structure. This object is achieved by the features of the independent claims. Summary of the Invention

[0005] A redundant power supply concept for a switch operating device can be achieved by providing at least two mutually independent power supply paths for supplying energy to the operating device, one of which includes a driver stage fed by an auxiliary voltage, and the other includes another driver stage fed by another auxiliary voltage that is independent of the auxiliary voltage. At least two coupling elements are provided for combining the output variables of the two driver stages, with each coupling element supplying power to one of the operating devices. This allows for independent power supply of the driver stages, further increasing the reliability of the energy supply and the protection of safety-related loads. This allows for meeting specific safety-related requirements, such as those in accordance with ASIL (particularly ASIL C) standards (e.g., according to DIN ISO 26262). Furthermore, the proposed solution allows for redundant power supply of multiple operating devices for corresponding switches, requiring only two power supply paths with the corresponding driver stages. This simplifies the circuit complexity for the operating devices in the case of multiple switches.

[0006] In one advantageous embodiment, at least one current limiting device is arranged between at least one of the auxiliary voltage inputs and at least one of the control devices. This ensures that any faults that may occur in the driver stage, the control device, or the switch (or in the switching sub-elements connected in parallel) do not have a critical feedback effect on the power supply, in particular the power supply for the control devices.

[0007] In one advantageous embodiment, a central current limiting device is arranged between the input for the respective auxiliary voltage and the respective driver stage, and / or a distributed current limiting device is arranged between the respective coupling element and the driver stage. An individualized choice can be made between distributed and central current limiting devices, wherein the distributed limiting device is required to ensure that a fault in one switch does not affect other switches.

[0008] In one advantageous embodiment, when a central current limiting device is arranged in one of the power supply paths, a distributed current limiting device, in particular, is provided between each of the control devices and the power supply path not provided with a central current limiting device. This reliably ensures the absence of feedback effects in the event of a fault.

[0009] In one advantageous embodiment, one of the driver stages is designed as a holding driver stage and / or one of the driver stages is designed as a pulse driver stage, particularly for use during vehicle starting. In particular, the pulse capability allows the driver stages to quickly switch switches from a blocking state to a conducting state. The provision of an additional driver stage (i.e., a separate holding driver stage) can prevent possible feedback effects of the switches on the auxiliary voltage supply and, therefore, on the drivers of other switching stages in the event of a fault by providing a high-impedance connection for the individual switches for charge maintenance.

[0010] It is particularly preferred to arrange a holding driver stage in one of the supply paths, and a central current limiting device and a pulse driver stage in the other supply path, wherein a distributed current limiting device is arranged between the holding driver stage and the corresponding coupling element. In particular, when using a buffer current limiting device as the central current limiting device, rapid switching of the buffer can be achieved, which prevents faults in the supply paths from propagating to the central driver voltage.

[0011] In one advantageous embodiment, at least two independent control signals are provided, which cause at least one of the switches to be switched on, and / or at least two independent control signals are provided, which, when a consistent switch-off request is received, are coupled to each other, in particular via an AND gate, to cause at least one of the switches to be switched off. This allows, on the one hand, for the respective control inputs to be individually capable of maintaining the conductive state of the switch by switching on the driver stage. Similarly, single-fault safety is achieved by providing two independent control inputs that can switch the switch to the non-conductive state only when they act together. This single-fault safety allows for a particularly demanding safety concept.

[0012] In one advantageous embodiment, at least one third switch and an associated control device, in particular a gate control device, are provided, wherein the control device is supplied with power from two supply paths via a third coupling element, and / or at least two switches are arranged in parallel with one another. This makes it particularly easy to supply power to the additional switches while ensuring high availability. The parallel arrangement further increases the reliability of the arrangement.

[0013] In one expedient embodiment, one of the auxiliary voltages is supplied to the control device, in particular the gate control device, via at least one decoupling element. This ensures that a single fault does not lead to an unintended shutdown (change to high impedance).

[0014] In one advantageous embodiment, the AND gate is fed by at least one of the auxiliary voltages, wherein, when a corresponding shutdown request is present as the control signal, the corresponding actuation device is supplied with power from the auxiliary voltage, in particular via at least one decoupling element, preferably a diode. In particular, the diode decoupling prevents a fault in one switch or switching sub-element from causing the shutdown of all other switches or switching sub-elements.

[0015] In one advantageous embodiment, the pulse driver stage includes at least one electrical buffer, in particular a capacitor, in particular a multiple of the system's intrinsic capacitance with a switch designed as a field-effect transistor (in particular a MOSFET), and / or the pulse driver stage includes at least one current source, and / or the pulse driver stage includes at least one switching device for recharging the buffer or capacitor, and / or the pulse driver stage includes at least one current-limiting resistor, and / or the pulse driver stage is configured to initiate switching on the switch when a buffer is used, and / or the control signal for the switching device, which is part of a constant current source of the pulse driver stage, is fed by the buffer or the pulse accumulator. This allows for particularly fast switching on, which is particularly important in the automotive sector.

[0016] In a suitable embodiment, the current limiting device comprises at least one resistor and / or a current source, in particular a constant current source and / or an RC element and / or a buffer current limiting device. In the simplest case, a resistor is sufficient, which is selected so high that in the event of a short circuit at the input of a switch, a feedback effect on the driver voltage is prevented, or in the case of a distributed solution, a feedback effect on other switches is prevented. If a distributed resistor solution is used before each switch, a central current limiting device can be omitted. In order to be able to achieve short-term overload protection for switching transients, an RC combination can also be used. A buffer of the current limiting device is particularly suitable for a central current limiting device, which allows the corresponding power supply path to be quickly connected from the buffer, but prevents faults in the power supply path from propagating to the central driver voltage.

[0017] Redundant operational management can be achieved in a simple manner and method by the following means: The monitoring devices advantageously each include at least one measuring amplifier for detecting a corresponding characteristic variable, at least one comparator to which the output variable of the corresponding measuring amplifier is supplied, and a memory element to which the output variable of the comparator is supplied. Safety-related electrical consumers are only shut down when a higher level of safety is required, for example for component protection or line protection. This allows for a safe power supply with respect to single faults while adhering to safety objectives. A single fault in a switch does not lead to an immediate shutdown of the power supply path or the electrical consumer. This results in lower overall costs at the same reliability or safety level.

[0018] Further expedient embodiments emerge from the further dependent claims and from the description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings show:

[0020] Figure 1 An exemplary embodiment of a power distributor for interconnecting two onboard power subsystems is shown.

[0021] Figure 2 shows a block diagram for a fail-safe energy supply for outputs of, in particular, safety-relevant loads,

[0022] Figure 3 shows a more detailed embodiment of single-fault-safe current measurement,

[0023] Figure 4 shows a schematic diagram of redundant operation management,

[0024] Figure 5 shows the redundant drive concept,

[0025] Figure 6 A possible circuit-technical implementation of a redundant driver concept is shown. DETAILED DESCRIPTION

[0026] The invention is schematically illustrated based on exemplary embodiments and is described in detail below with reference to the accompanying drawings.

[0027] Figure 1A possible energy supply system topology is shown, comprising an onboard electrical system 13, which includes an energy storage device 12, particularly a battery 12, and associated sensors 14, preferably battery sensors, as well as a plurality of, in particular, safety-related electrical consumers 16, which are supplied and protected by an electrical power distributor 18. The electrical consumers 16 are special electrical consumers with high requirements or high protection needs, often referred to as safety-related electrical consumers 16. These include, for example, electric steering and / or braking systems, as components that must be supplied with power to ensure steering and / or braking of the vehicle in the event of a fault. The characteristic variables of the respective electrical consumers 16 are individually detected, and the corresponding switches 15 are opened if they deviate from tolerable values. Onboard electrical system 13 comprises a safety-related onboard electrical system subsystem 11 and a non-safety-related onboard electrical system subsystem 10. The safety-related onboard electrical system subsystem 11 can be separated from the non-safety-related onboard electrical system subsystem 10 by a power distributor 18, particularly in the event of a fault or in a critical state of the non-safety-related onboard electrical system subsystem 10. The safety-related onboard power supply subsystem 11 is, for example, an onboard power supply subsystem 11 that complies with the ASIL (particularly ASILC) standard (e.g., according to DIN ISO 26262), includes at least one of the safety-related electrical consumers 16 and may, if necessary, be equipped with its own energy storage device 12 for voltage support. The non-safety-related onboard power supply subsystem 10 includes at least one non-safety-related electrical consumer 17, which may be, for example, a so-called QM consumer or a consumer with a QM safety integrity rating. However, this does not exclude the possibility that at least one additional safety-related electrical consumer may also be arranged in the non-safety-related onboard power supply subsystem 10, for example, in the case of a redundant implementation of the safety-related electrical consumers. The non-safety-related onboard power supply subsystem 10 is an onboard power supply subsystem that does not comply with the ASIL standard.

[0028] Energy storage device 12 is connected to one terminal (terminal KL30_1) of power distributor 18. Sensor 14 can detect electrical characteristic variables, such as voltage Ub at energy storage device 12 and / or current Ib through energy storage device 12 and / or temperature Tb of energy storage device 12. Sensor 14 can determine, for example, the state of charge SOC of energy storage device 12 or other characteristic variables of energy storage device 12 from the determined electrical characteristic variables Ub, Ib, Tb. Optionally, an additional power supply branch for at least one additional electrical load 25 can be provided at another terminal (KL30_1) of power distributor 18 (to which energy storage device 12 is also connected). Electrical load 25 is protected, for example, by fuse 23. Further electrical loads 25 can also be provided, which can also be protected by fuse 23. These loads 25 are loads that should still be supplied with energy from the energy storage device 12 even when the switching device 19 in the power distributor 18 is disconnected or open. They are preferably safety-critical loads 25 that are critical with respect to disturbances in the power supply safety, or loads classified as QM that must meet specific requirements after an accident. Therefore, an (optional) safety-related or safety-critical onboard power supply path or onboard power supply subsystem 11 is connected to terminal KL30_1.

[0029] The power distributor 18 may be capable of determining corresponding characteristic variables, such as the voltage Uv and current Iv of the electrical load 16 . The power distributor 18 may also be capable of determining corresponding characteristic variables of the energy storage 12 , such as the voltage Ub and / or the current Ib and / or the temperature Tb. To this end, the power distributor 18 may include corresponding sensor systems or receive data from the sensors 14 . Similarly, the power distributor 18 may include a corresponding analysis device 21 , such as a microcontroller 21 , which stores or analyzes the detected variables. The analysis device 21 is used to determine critical states of the onboard power subsystem 11 , particularly those related to safety, such as identifying overcurrents and / or undervoltages or overvoltages in the onboard power subsystem 11 for safety-related electrical loads 16 , 25 . To this end, the corresponding characteristic variables are detected and compared with appropriate threshold values. For example, a microcontroller may be used as the analysis device 21 . Furthermore, the microcontroller or analysis device 21 is capable of actuating the corresponding switching units 15 , as described in more detail below. The switching unit 15 supplies the safety-related electrical consumers 16 connected thereto with energy or supply voltage U1 provided by a distribution point (e.g., busbar 60 or a mains line) via outputs 66. By way of example, three switching units 15 are provided, each of which supplies energy to a corresponding safety-related electrical consumer 16 via an output 66.

[0030] Optionally, an isolating switch 19 can be arranged in the power distributor 18 between the terminals KL30_0 and KL30_1. The optional isolating switch 19 enables a corresponding isolation or coupling function, in particular of the two onboard power supply branches (the onboard power supply subsystem 10 for non-safety-related loads 17 at the terminal KL30_0; the further onboard power supply subsystem 11 for safety-related loads 16 , 25 ). This serves, in particular, as a protective function to prevent the influence of critical states such as overvoltage or undervoltage and / or overcurrent and / or thermal overload. In the event of a fault, the two onboard power supply subsystems 10 , 11 can be separated from each other via the power distributor 18 by opening the isolating switch 19. The isolating switch 19 can include parallel-connected switching devices for a fail-safe power supply. The redundant monitoring or control described in more detail below can also be used for the isolating switch 19.

[0031] Onboard electrical system 13 has a lower voltage level U1 than the optionally provided high-voltage onboard electrical system 20, which can be, for example, a 14V onboard electrical system. A DC voltage converter 22 is arranged between onboard electrical system 13 and high-voltage onboard electrical system 20. High-voltage onboard electrical system 20 exemplarily includes an energy storage device 24, such as a high-voltage battery, possibly with an integrated battery management system, loads 26 (illustrated as an example), such as comfort appliances, such as an air conditioner or refrigerant compressor, which are powered at an elevated voltage level, and an electric machine 28. In this context, high voltage is understood to mean a voltage level U2 that is higher than the voltage level U1 of basic onboard electrical system 13. Thus, for example, it can be a 48V onboard electrical system. Alternatively, particularly in vehicles with an electric drive, it can be an even higher voltage level, such as 400V or 800V. Alternatively, high-voltage onboard electrical system 20 can be omitted entirely.

[0032] By way of example, in this embodiment, batteries or accumulators are described as possible energy stores 12, 24. However, other energy stores suitable for this task (eg based on inductance or capacitance), fuel cells, capacitors, etc. can also be used as an alternative.

[0033] according to Figure 2The exemplary embodiment discloses, by way of example, a switching unit 15 (or possibly a disconnector 19 ) having at least one, possibly two, and preferably three switches 61 , 62 , 63 interconnected in parallel, via which a connection 66 for a safety-related electrical load 16 can be supplied and secured with energy, in particular a supply voltage U1, provided by an energy supply device 60 . Each of the parallel-connected switches 61 , 62 , 63 is a component of a power supply path 64 . At least one, and depending on the power requirements, two parallel-connected measuring resistors 70 , 72 are provided between the energy supply device 60 , in particular a main line (a distribution point with a supply line or busbar in the onboard electrical system of a motor vehicle) and the parallel-connected switches 61 , 62 , 63 . Alternatively, other measuring devices, such as inductive measuring devices, can also be used.

[0034] At first measuring resistor 70 , the respective potentials upstream and downstream of measuring resistor 70 are fed to measuring amplifier 78 via series resistors 74 and 76 (current measurement is performed via a current amplifier or CSA (Current Sense Amplifier)). Series resistors 74 and 76 are not strictly necessary, but serve to prevent reflections (signal interference). This is known as series termination. Measuring amplifier 78 is supplied with a supply voltage 89 , preferably a first supply voltage V1 (logic supply or logic voltage: for example, 5V or 3.3V, etc.), and energy via a supply input 80 .

[0035] The output signal of the measuring amplifier 78 reaches a comparator 82, such as, for example, Figure 2 As shown in FIG, , the output signal of measuring amplifier 78 reaches its positive input. This output signal of measuring amplifier 78 is compared with a limit value 84 supplied to the negative input of comparator 82. Typically, comparator 82 compares two input signals. If the difference between the two signals (voltages) is positive or negative, the output of comparator 82 reverses its polarity. Comparator 82 is used to detect overcurrents through measuring resistor 70 or measuring resistors 70 and 72.

[0036] The limit values ​​84, 130 can be generated using corresponding circuits. In order to meet functional safety, adequate measures must be taken to prevent changes in the limit value 84 that would lead to a polarity reversal at the output of the comparator 82 when the measured variable remains unchanged. To this end, the limit values ​​84, 130 can be formed, for example, by two reference sources. In this way, one of these limit values ​​84, 130 can be predefined by the microcontroller 21, for example by means of a PWM signal and a low-pass filter or by means of a digital-to-analog output (DAC). The other limit value 130 should be implemented by an independent reference source. For this purpose, discrete circuits can be used, for example by means of a voltage divider, a Zener diode or by means of an integrated circuit (for example a bandgap reference). The reference sources must be supplied by different and mutually independent voltage sources (or power supply devices 89, 131). It is also conceivable here that each reference source is supplied by two supply voltages 89, 131. The two supply voltages 89, 131 must have no feedback influence on each other and must be connected, for example, via diodes and / or resistors (current limiting devices) or generally via an element 141 for ensuring no feedback influence (see Figure 3 ) is coupled in. The two reference signals used to generate limit values ​​84, 130 must be superimposed in such a way that the minimum threshold or minimum limit value 84, 130 remains even after a failure of one reference source. For example, limit values ​​84, 130 can also be dynamically changed when using microcontroller 21. This allows for response to vehicle system specifications and / or compensation for component-specific changes (e.g., due to temperature drift). Thus, a single fault, such as the failure of limit value 84 provided by microcontroller 21 or a second limit value 130 provided, for example, by another discrete circuit, does not result in the shutdown of power stages or switches 61, 62, 63.

[0037] Comparator 82 is supplied with supply voltages 89, 131, preferably a first supply voltage V1, via supply input 86. An output signal 87 of comparator 82 is fed to a memory element 88, such as a trigger. Memory element 88 can also be implemented as software. If the difference measured across measuring resistors 70 and 72 exceeds or, depending on the method used, falls below a corresponding limit value 84, comparator 82 generates a corresponding output signal 87 (e.g., an overcurrent is detected; for protection, switching unit 15 is disconnected "off") or the logic state of output signal 87 changes. When an overcurrent is detected, output signal 87 causes a polarity reversal at output 92 (this may, for example, mean that an overcurrent is detected at measuring resistor 70; therefore, switching unit 15 should be disconnected for protection). Output 92 of memory element 88 can be reset, for example, by microcontroller 21.

[0038] The memory element 88 has a supply input 90, via which the memory element 88 is supplied with a supply voltage 89, preferably a redundant supply voltage. The output signal 92 of the memory element 88 is fed to a driver 94. The output signal 92 of the memory element 88 is an off signal, which causes the corresponding switches 61, 62, 63 to be turned off (disconnected) in the event of an overcurrent via the corresponding output signals 114, 116 of the driver 94. As a component of the driver 94, a plausibility check device can be provided, by which it is determined whether the switching unit 15 with the associated switches 61, 62, 63 should also be turned off. In the following embodiments, this plausibility check can be carried out by combining it with other signals (in accordance with Figure 2 In the embodiment of the present invention, for example, a corresponding logic AND gate (in the following embodiments, the AND gate is marked with 180 or 230) is connected with the output signal 108 of the further memory element 134 described below. Figure 2 In the exemplary embodiment of FIG. 8 , this plausibility check logic is integrated in the driver 94. At least the memory device 88, at least the comparator 82 and at least the measuring amplifier 78 are components of a monitoring device 140 shown as a block.

[0039] A driver voltage is supplied to the driver 94 via the input 96 and / or a further driver voltage, independent of the driver voltage supplied via the input 96, is supplied to the driver via the further input 98. The two supply voltages (also referred to as auxiliary voltages 137, 139) must be connected to one another without feedback influence. A more detailed embodiment is described in Figure 5 and Figure 6 Shown in.

[0040] Driver 94 also generates other output signals 110 and 112 that cause the corresponding switches 61, 62, and 63 to be turned on (on). Here, output signal 110 causes the first switch 61 to be activated, output signal 112 causes the second switch 62 to be activated, and so on. Driver 94 also generates corresponding output signals for turning off the corresponding switches 61, 62, and 63. Here, output signal 114 is used to turn off the first switch 61, output signal 116 is used to turn off the second switch 62, and so on. This is accomplished by the corresponding drivers 67, 68, and 69 for the corresponding switches 61, 62, and 63.

[0041] If necessary, a temperature shutdown can also be carried out in the event of overheating by one or more drivers 67, 68, 69. For this purpose, a corresponding temperature detection device 118 of the switching unit 15 can optionally be provided.

[0042] A redundant input signal 102 for driver 94 is generated and supplied to driver 94 via component 100 (for generating a redundant input signal "ON"), such as another microcontroller, a register memory, or the like. Input signal 102 can be the ON signal for switching unit 15 (ON). An output signal of microcontroller 21 can be supplied to component 100 via input 104. Furthermore, a further input signal 106 is provided for driver 94, which can be supplied by microcontroller 21 and is the ON signal for switching unit 15 (ON). The two ON signals 102, 106 are ORed together. Thus, if at least one ON request is present via one of signals 102, 106, driver stage 94 generates corresponding ON signals 110, 112 for switches 61, 62, 63.

[0043] The output signal of the additional measuring amplifier 124 is supplied to a (further) comparator 128. Comparator 128 compares the supplied output signal with a limit value 130 provided to its input. When the current flowing through the switching unit 15 exceeds the limit value 130, comparator 128 is used to detect an overcurrent of this current. To increase single-fault safety, limit value 130 can again be formed by two shutdown thresholds. Thus, one of these shutdown thresholds can be predefined by the controller 21. The other shutdown threshold can be predefined by another hardware circuit, optionally powered by another supply voltage V2. Appropriate circuits can be used to generate limit values ​​84 and 130. To ensure functional safety, sufficient measures must be taken to prevent changes in limit value 84 from causing a polarity reversal at the output of comparator 82 while the measured variable remains unchanged. To this end, limit values ​​84 and 130 can be formed, for example, by two reference sources. Thus, one of the limit values ​​84, 130 can be predetermined by the microcontroller 21, for example, by means of a PWM signal and a low-pass filter or by means of a digital-to-analog output (DAC). The other limit value 130 should be realized by an independent reference source. For this purpose, a discrete circuit can be used, for example, by means of a voltage divider, a Zener diode, or by means of an integrated circuit (e.g., a bandgap reference). For example, the two standard types are connected by means of an element 141 (e.g., Figure 3 ), for example, via a diode and a resistor, a voltage divider is coupled in, which supplies a corresponding voltage signal for the overcurrent threshold to the input of the comparator 128. Thus, a single fault, such as failure of the limit values ​​84, 130 provided by the microcontroller 21 or failure of the limit values ​​84, 130 provided by other hardware, does not lead to a shutdown of the power stage or the switches 61, 62, 63.

[0044] Comparator 128 includes a supply input 132, via which it is supplied with a supply voltage 131, in particular, a further supply voltage V2. If the output signal at measuring amplifier 124 reaches limit value 130, comparator 128 generates a corresponding output signal 133, which is supplied to a further memory element 134, in particular, a trigger, and causes the corresponding output 108 to be set (switching unit 15 to "off"). Further memory element 134 is supplied with energy via supply input 136, in particular, with supply voltage 131, in particular, further supply voltage V2. Output signal 108 of further memory element 134 is in turn supplied to driver 94. If the total current flowing through switches 61, 62, 63 reaches a specific limit value 130, a corresponding off signal 108 is generated and supplied to driver 94. If both off signals 92, 108 are present, driver 94 disables the control signals for switches 61, 62, 63. The shutdown signals 92 , 108 and specific diagnostic mechanisms can be used to further diagnose and plausibly check the cause of the fault. At least one further memory device 134 , at least one further comparator 128 , and at least one further measuring amplifier 124 are components of a further monitoring device 142 , shown as a block.

[0045] The plausibility check of the shutdown request 108 is carried out via the output signal 92 of the memory element 88 and vice versa. If both output signals 92, 108 of the memory elements 88, 134 indicate a shutdown request by signaling, the switching unit 15 is switched off. When field effect transistors or MOSFETs are used as switching elements 61, 62, 63, the plausibility check can be carried out or, if necessary, an additional plausibility check can be carried out on the fault detected by the measuring resistor 70 based on the resistance Rds between the drain and the source at the MOSFET by the described measurement and software-side analysis. It is possible to completely dispense with the measurement of the switch (RDSon measurement). In this case, in order to meet certain safety requirements, it is possible, for example, Figure 4 As shown in FIG, two measurements are performed via measuring resistors 70 and 72. Switch diagnosis can then be performed via an extended gate driver that can individually switch on and off switches 61, 62, and 63. This allows each switch 61, 62, and 63 to be tested for blocking capability during each shutdown.

[0046] Element 141 for ensuring no feedback influence and decoupling (see for example Figure 3) can each have two branches consisting of a series resistor and a diode, with the two branches interconnected on the output side. The diodes are interconnected so that they only allow current to flow from the input side (i.e., from the two input signals to be correlated) to the output side. This ensures the absence of feedback effects. The resistors are provided for current limiting and are dimensioned appropriately for this purpose depending on the requirements.

[0047] In addition, the concept also provides for the technical implementation of single-fault-safe current measurement with potential fault detection, so that a single fault in the current measurement does not lead to a violation of the safety goal of "safe power supply." In addition, potential faults of the switches 61, 62, 63 in the power stage can be detected.

[0048] like Figure 3 As shown in FIG, monitoring device 140 includes a measuring amplifier 78, a comparator 82, and a memory element 88. A limit value is formed by a voltage divider 232, which is redundantly supplied by power supplies 89 and 131 and coupled to one another via element 141 without feedback influence, and is supplied to one input of comparator 82. Another monitoring device 142 includes a measuring amplifier 178, another comparator 128, and a memory element 134. The limit value of the other comparator 128 is formed by a voltage divider 232, which is redundantly supplied by power supplies 89 and 131. The corresponding output signals of measuring amplifiers 82 and 178 are also extracted and supplied to microcontroller 21 for further analysis.

[0049] In accordance with Figure 4 The block diagram summarizes the basic concept for meeting the requirements for safe power supply and safe isolation with corresponding integrity. Redundant operation management is characterized by at least two independent, mutually non-influential and decoupled control paths for the switching elements 61, 62, 63. To this end, all necessary supply voltages 89, 131 or auxiliary voltages 137, 139 (if their failure could lead to a violation of the safety objectives) must be implemented redundantly. In addition, Figure 4 All components listed in the table must be supplied with one or both redundant sources. In the exemplary concept shown here, each source is connected via element 141 to ensure feedback-free operation and decoupling. This prevents feedback effects and suppresses other crosstalk. For example, microcontroller 21, serving as the main processor, is supplied with the necessary operating and reference voltages from a power supply 89, while auxiliary computer 100 is supplied from a separate power supply 131.

[0050] according to Figure 4The embodiment is characterized by a highly integrated driver circuit. This reduces the number of components required for control to a minimum. Furthermore, the introduction of a pulse driver stage 146 and a holding driver stage 144 allows the use of an auxiliary voltage supply without feedback effects. A single fault, such as a short circuit of the gate (driver 67, 68, 69) to the source of a power semiconductor (switches 61, 62, 63), would at most result in the destruction of one of the switches 61, 62, 63, while the remaining switches 61, 62 would remain functional. A single fault in the disconnection signals 92, 108 would not result in the switching unit 15 being shut down. A single fault in the event of a failure of the microcontroller 21 would not result in the channel being shut down, since the connection signal 102 is implemented via intermediate storage in the auxiliary computer or register 100.

[0051] This ensures that the power supply path 64 remains active even if a power supply unit fails, in particular if the main source fails.

[0052] For this purpose, all circuit elements must be supplied by the first power supply 89 and by the further power supply 131. This nevertheless ensures that the loads 16 connected to the connection 66, in particular safety-related loads 16, are reliably connected to the main distribution device or energy supply 60 with the required integrity.

[0053] for Figure 3 For the two power supplies 89 and 131 in the system, a heterogeneous (non-homogeneous) redundancy concept is recommended. This may require, for example, the use of two different converter units (linear, DC / DC, etc.). By connecting the corresponding circuit units (e.g., those generating the activation signal, drivers, registers, microcontrollers, auxiliary voltages, logic voltages, etc.) via an element 141 for ensuring feedback-free operation and decoupling, a fault in one of the power supplies 89 and 131 or in one of the connected components or components is prevented from having a negative feedback effect on the shared power supply 89 and 131.

[0054] The two power supplies 89, 131 can be designed with different power levels, since the other supply voltages connected to them are connected in such a way that the power supply path 64 can maintain emergency operation if necessary, but cannot guarantee operation or rapid switching on (e.g. due to high-impedance and low-impedance connections to one of the two power supplies 89, 131). Therefore, in the event of a single fault, one of the two sources can always be used.

[0055] Additionally, one of the two power supply devices 89 , 131 can be optimized for low quiescent current consumption. This is particularly advantageous for quickly transitioning from a sleep or standby operating state to normal operation or a stable state. To maintain low quiescent current consumption (e.g., 100 μA), the power switch must be disconnected. If power supply devices 89 , 131 are also required in sleep mode, they can be implemented using another, significantly lower-power, quiescent current-optimized, and cost-effective source. This allows for significantly shorter wake-up times. Regardless of the wake-up cause (ignition signal K115 , CAN activation, consumer current exceeding the wake-up threshold, etc.), output channel 15 can bring consumer 16 to full power capacity in less than 1 ms. When applying the described fast wake-up method, power supply devices 89 , 131 are either shut down or unloaded to maintain low quiescent current consumption. This achieves strict quiescent current requirements and fast wake-up, thereby ensuring operational readiness, in particular, quickly. If output channels with safety integrity need to be quickly activated (rapid wake-up), diagnostic functions may need to be executed before the necessary safety integrity of the connected loads is provided. This ensures full power capability very quickly (<1 ms), and complete safety integrity is ensured after the microcontroller 21 starts up and executes the corresponding diagnostic functions for the switching unit 15 and the entire system. This duration can be <250 ms, for example. If all diagnostic results are within predefined ranges, the complete safety integrity of the entire system is guaranteed, allowing, for example, an immediate start of travel.

[0056] Two independent logic or control units (e.g., a main computer 99, such as a microcontroller 21, and an auxiliary computer 100, such as a register memory) redundantly provide status and control information for the output channels or power supply paths 64. Preferably, a high-performance main computer 99 is installed, which is protected against malfunctions by a comprehensive architecture and, therefore, a comprehensive monitoring concept. In the simplest case, the auxiliary computer 100 consists of only independent status and control registers, which can maintain the current operating states and control signals independently of the main computer 99 or its power supply in the event of a fault. The corresponding output signals (output signal 102 of the auxiliary computer 100, output signal 106 of the microcontroller 21) both reach the driver 94 for the switching unit 15.

[0057] Two independent monitoring devices 140, 142 are provided (eg, for example Figures 2 to 3As described above, they independently monitor the state of power supply path 64 (between 60 and 66) for faults (e.g., overloads) and, in the event of a fault, require isolation of the conductive connection between input 60 and output 66. This independence ensures that a fault situation in which both monitoring devices 140, 142 simultaneously incorrectly request isolation does not exist (or only exists with a reasonably low probability). As previously described, protective devices 140, 142 include corresponding measuring resistors 70, 72, 73 or voltage taps at switching devices 61, 62, 63, respectively, corresponding measuring amplifiers 78, 124, 178, and / or respectively corresponding comparators 82, 128 (for evaluating the measurement signals of measuring amplifiers 78, 124, 178), and / or respectively corresponding memory elements 88, 134 (for temporarily storing specific status information), and / or corresponding logic elements 180 (for plausibility checking of disconnection or connection requests). The monitoring device 140 and the further monitoring device 142 in turn each comprise a memory device 80 , 134 , not shown in detail, a comparator 82 , 128 , not shown in detail, and at least one measuring amplifier 78 , 124 , 178 , not shown in detail.

[0058] Furthermore, n mutually decoupled driver stages 67, 68, 69, etc. and switches 61, 62, 63, etc. are provided. Switches 61, 62, 63, etc. are used to provide a low-impedance connection between the main power supply 60 and an output 66 for supplying connected electrical loads, by connecting, for example, MOSFETs or IGBTs in parallel as power switches in the corresponding power supply path 64. Driver stages 67, 68, 69 are internally designed so that one of two independent logic units 99, 100 can each initiate or maintain a conductive state. The pulsed driver stage 146 shown in the example enables rapid switching of switches 61, 62, 63 from a blocked state to a conductive state due to its pulse capability. However, this pulse capability increases the risk that a single failure in one of switches 61, 62, or 63 could affect the other driver stages 67, 68, or 69 through coupling. Ultimately, a single failure in a power switch 61, 62, 63 could affect the entire channel 15. By introducing a separate sustaining driver stage 144 (for example supplied by two supply units 89 , 131 ), feedback effects can be avoided via a high-impedance connection of the faulty path to the power supply.

[0059] By ensuring the absence of feedback influences and decoupling by the corresponding element 141 or block 141 and the concept of the pulse driver stage and the holding driver stage 146, 144, it is always ensured that in the event of a single fault in a power switch 61, 62, 63, the maximum effect is the failure of one MOSFET or switch 61, 61, 63. All other power switches 61, 62, 63 and possibly also output channels connected in parallel and supplied from the same source remain activated.

[0060] The drivers 67, 68, 69 are internally designed so that only the combined action of the two monitoring devices 140, 142 can interrupt the conductive path between the input 60 and the output 66. The two isolation requirements of the two monitoring devices 140, 142 are combined only close to the corresponding switches 61, 62, 63, 63.n, so that no single fault can simultaneously disable multiple switches 61, 62, 63, 63.n.

[0061] In addition, the close association of the switches achieves a minimum number of individual switch components. The number n of switches is selected such that a failure of a higher-impedance sub-path or supply path 64.1 ... n does not jeopardize the safety goal of reliably supplying the loads connected to the output 66 (particularly safety-related consumers 16) within a sufficiently long fault tolerance time. The drivers 67, 68, 69, through their special internal design, ensure that a failure in a single switch 61 does not negatively affect the other switches 62, 63, 63n, thereby preventing the safety goal of providing a sufficiently low-impedance connection. (In practice, for example, a short circuit between gate and source must be encapsulated within the drivers 67, 68, 69 to prevent it from affecting the other switches 62, 63, 63n.)

[0062] Furthermore, a grounding concept for redundant power supply is provided, which is indicated by ground 148 and a further ground 150. This ensures a sufficiently high overall availability of the internal reference ground of the control unit.

[0063] Figure 5 The redundant drive concept is shown. For example, the drive concept is based on Figure 2 The drive 94 is used. It includes two redundantly configured power supply paths 248 and 250. One power supply path 248 is fed by the auxiliary voltage 137. The other power supply path 250 is fed by the other auxiliary voltage 139. The two auxiliary voltages 137 and 139 are independent of each other, thereby ensuring independent power supply for the drives 67, 68, 69 or the associated switches 61, 62, 63.

[0064] An auxiliary voltage 137 can preferably be active when the microcontroller 21 is active. As described below, the auxiliary voltage 137 can be used to maintain the charge. In addition, the auxiliary voltage 137 is used in particular to power internal peripheral devices. Another auxiliary voltage 139 can preferably be always active, in particular to enable a quick start of the motor vehicle.

[0065] A current measuring device 252 is provided for the auxiliary voltage 137. A further current measuring device 262 is provided for the further auxiliary voltage 139. The respective output signals of the current measuring devices 252, 262 are supplied to a diagnostic device 268. The diagnostic device 268 is used to diagnose driver faults or gate faults.

[0066] Optionally, a central current limiting device 254, in particular, can be provided for the auxiliary voltage 137. A central current limiting device 264, in particular, can be provided for the further auxiliary voltage 139. In the simplest case, a resistor 254.1 can be provided as a possible current limiting device 254, 264. The resistor 254.1 is selected to be high enough to prevent feedback effects on the driver voltage or auxiliary voltage 137, 139 in the event of a short circuit at the input of an individual switching element or switch 61, 62, 63. To provide short-term overload protection against switching transients, an RC element 254.2 can also be used as the current limiting device 254, 264. In particular, for the central current limiting device 254, 264 for each of the power supply paths 248, 250 (in which a capacitor (electric buffer 255) is connected to the ground as a buffer, which enables a fast connection from the buffer 255), the propagation of faults in the corresponding power supply path 248, 250 to the corresponding central driver voltage or auxiliary voltage 137, 139 is prevented.

[0067] Auxiliary voltage 137, which is optionally provided by driver stage 256 (possibly designed as a holding driver stage 144 or an activation driver stage or pulse driver stage 146), is supplied to any provided, in particular distributed current limiting devices 270.1, 270.2, 270.n. The respective, in particular distributed current limiting devices 270.1, 270.2, 270.n are each assigned to a driver 67, 68, 69 or an actuation device 281, 282, 283, in particular a gate actuation device (as a component of the respective driver 67, 68, 69), for the associated switching device 61, 62, 63. The further auxiliary voltage 139 or driver voltage, which is optionally provided by further driver stage 266, is supplied to any provided, in particular distributed current limiting device 272.1, for the actuation device 281 of the first switching device 61. The auxiliary voltage 137 or driver voltage, which is provided or transmitted by driver stage 256 as needed, is supplied to a possibly provided, in particular distributed, nth current limiting device 270.n, which is assigned to a corresponding actuation device 283 for the relevant nth switching device 63. The additional auxiliary voltage 139 or driver voltage, which is provided or transmitted by further driver stage 266 as needed, is supplied to a possibly provided, in particular distributed, nth current limiting device 272.n for the nth actuation device 283 of the nth switching device 63. The output variables of current limiting device 270.1 and further current limiting device 272.1 (i.e., the two auxiliary voltages 137, 139 or driver voltages from the two supply paths 248, 250) are supplied redundantly to actuation device 281 via a coupling element 274.1 (in particular, an OR gate). The same applies to each of the other actuation devices 282, 283, which are each redundantly supplied via auxiliary voltage 137, 139 or driver voltage using the corresponding current limiting device 270, 272; 254, 264. The output variables of the nth current limiting device 270.n and the further nth current limiting device 272.n (i.e., the two auxiliary voltages 137, 139 or driver voltages from the two supply paths 248, 250) are redundantly supplied to the nth actuation device 283 via an nth coupling element 274.n (in particular, an OR gate). In the simplest case, coupling element 274 can be designed as a coupling or OR gate in the form of a double diode 274.1 (which connects the two supply branches to each other via a diode) and provides them to the control inputs of the respective switching elements.

[0068] The driver stage 256 is actuated via the on signal, which controls the supply of the auxiliary voltage 137 to the respective drivers 67, 68, 69. The further driver stage 266 is actuated via the further on signal 106, which controls the supply of the further auxiliary voltage 139 to the respective drivers 67, 68, 69. Two independent on signals ("on") 104, 106, acting as control signals on the respective driver stages 256, 266, can each individually maintain or activate the conductive state of the switching device 15 consisting of the individual switches 61, 62, 63, for example, when starting the motor vehicle.

[0069] The design of driver stages 256, 266 and / or current limiting devices 254, 264, 270, 272 and / or coupling element 274 ensures that any faults that may occur in drivers 67, 68, 69, or in control devices 281, 282, 283, or in switching device 15, or in individual switches 61, 62, 63 (in the supply path for supplying the corresponding output 66 for safety-related loads 16), or in other components, do not have a critical effect on the power supply. This absence of feedback influences allows multiple (especially more than just two) switches 61, 62, 63 to be safely supplied in a control unit with two auxiliary voltages 137, 139. This lack of feedback influence can be achieved centrally (via the corresponding current limiting devices 254, 264 in the corresponding power supply paths 248, 250) and / or distributedly for each individual switch input of the corresponding switch 61, 62, 63 or the associated individual control devices 281, 282, 283 (corresponding current limiting devices 270.n, 272.n) and / or in a combination of central and distributed current limiting devices 252, 262, 270.n, 272.n. Therefore, only one current limiting device 254, 264;.n, 272.n (at least two central current limiting devices 254, 264 (for each power supply path 248, 250 or auxiliary voltage 137, 139)) is required, or n distributed current limiting devices 270.n, 272.n are required. The choice between distributed and central current limiting devices 252, 262; 270.n, 272.n can be made individually, wherein at least one distributed limiting device is required to ensure that a fault in one switch 61, 62, 63 does not affect the other n-1 switches 61, 62, 63.

[0070] So, according to Figure 5In an embodiment, central current limiting device 254 (for driver stages 256, 144) can be omitted, although local or distributed current limiting device 270.1 and local or distributed current limiting device 270.n are still mandatory, providing at least one current limiting device for this path. Conversely, if only central current limiting device 264 (for driver stages 266, 146) is provided for auxiliary voltage 139, distributed current limiting devices 272.1, 272.n can be omitted. In this concept, driver stage 266 can be designed as a pulse driver stage 146 (for short-term activation) with upstream central current limiting device 264 (and optionally distributed current limiting devices 272.1, 272.2, 272.n). Driver stage 256 can be designed as a holding driver stage 144. The central current limiting device 254 upstream of the holding driver stage 144 can be omitted, wherein however distributed current limiting devices 270 . 1 , 270 . 2 , 270 . n connected downstream of the holding driver stage 144 must be provided.

[0071] The switches 61, 62, and 63 are components of the switch unit 15 in the channel (see Figure 1 , where three channels are shown by way of example). In the control unit or power distributor 18 , a plurality of channels, each with its own redundant drive 67 , 68 , 69 or actuation device 281 , 282 , 283 , are supplied with only two auxiliary voltages 137 , 139 .

[0072] The shutdown logic must ensure that a single fault does not cause the unintended shutdown (change to a high-impedance state) of more than one switch 61, 62, 63 of the n+1 switching elements connected in parallel and each redundantly supplying a channel or safety-related load 16. Two independent shutdown signals ("off") 92, 108 are supplied to an AND gate 180. Switches 61, 62, 63 are only disconnected if both shutdown signals 92, 108 indicate a shutdown request ("off"). Thus, a single fault in, for example, redundant current sensing does not cause the shutdown of safety-related loads 16. Through this AND gate 180, the shutdown request can be transmitted to the control devices 281, 282, 283 via corresponding decoupling elements 276 (e.g., diodes). Diode decoupling prevents a fault in one sub-switching element or switch 61, 62, 63 or driver 67, 68, 69 from triggering the shutdown of all other switches 61, 62, 63 (also in other channels). A single fault in one sub-switching element or switch 61, 62, 63 that prevents the shutdown of all other switches 61, 62, 63 is a latent fault at the overall system level and can be identified through latent fault diagnosis. Within each switch 61, 62, 63 or associated driver 67, 68, 69, a shutdown signal (output signal of AND gate 180) is used to switch the corresponding switch 61, 62, 63 (e.g., MOSFET or IGBT) to the off state.

[0073] The following combination Figure 6 Example description based on Figure 5 A possible circuit technology implementation of the block diagram of FIG. For the additional power supply path 250, an additional auxiliary voltage 139 can be supplied via the input. The additional auxiliary voltage 139 is higher than the supply voltage Ub (e.g., the battery voltage Ub) by a certain amount and can be, for example, 24 V (in the case of an exemplary battery voltage Ub of 12 V). The switches 61, 62, 63, which are in particular designed as MOSFETs, are controlled by the driver. In order to switch on the switches 61, 62, 63, which are designed as (exemplarily npn) MOSFETs, the system-specific capacitance 349 between the gate and the source must first be charged. The gate voltage (in the form of the applied voltage 137, 139) must be reliably higher than the battery voltage Ub, to which the drain terminal of the MOSFET 61, 62, 63 is connected, in order to switch on the switches 61, 62, 63.

[0074] When the activation signal 104 is applied, the control devices 281, 282, and 283 are switched on while being supplied with the additional auxiliary voltage 139 or the driver voltage. The base of a switching device 306, which is designed as a transistor, is controlled by the activation signal 104. The switching device 306 is connected to an RC element on one hand and to ground on the other hand. The additional switching device 304 is actuated via the RC element. The additional switching device 304 is also designed as a transistor. The base of the additional switching device 304 is actuated by the switching device 306 via the RC element. If the additional switching device 304 is switched on by the activation signal 104, the additional auxiliary voltage 139 is generally available at the output of the additional switching device 304 in a current-limited manner (current limiting device 264), and the associated coupling element 274 is supplied to the control devices 281, 282, and 283 of the corresponding switches 61, 62, and 63.

[0075] A pulse memory 255, consisting of at least one capacitor (in the exemplary embodiment, two capacitors connected in parallel), is supplied with energy via the battery voltage Ub. The base terminals of transistors 301 and 303 of the two branches of the current source are controlled via the output of the pulse memory 255. On the other hand, the output is contacted with transistor 301 for generating the pulse current Ip and is thus also connected to the input of a further switching device 304.

[0076] The control signal for switching device 301 can be generated by buffer 255, optionally in conjunction with supply voltage U0 or battery voltage Ub. Thus, for example, one potential of buffer 255, which is configured as a capacitor or as two capacitors connected in parallel, is at the supply potential, such as battery voltage Ub. The other terminal of buffer 255 is contacted via a resistor to the base of switching element 301, which is configured as a transistor, and to the base of another switching element 303, which is also configured as a transistor. The other terminal of buffer 255 is also connected to the output of switching element 301, in particular to the collector of the transistor of switching element 301. The input or collector of switching device 301, which is configured as a transistor, is contacted to the other terminal of current limiting device 264. The output of switching device 301 and the other terminal of buffer 255 contacting it are supplied to another switching device 304, in particular configured as a transistor, particularly preferably to the emitter of transistor 304.

[0077] The connection potential of the additional auxiliary voltage 139 is supplied via the supply branch 250 to a constant current source serving as a central current limiting device 264. The pulse storage device 255 is slowly charged. Initially, a very small current flows between the emitter and base of transistor 301 via a high-impedance resistor between the base of transistor 301 and the pulse storage device 255. This also generates a voltage drop across the feedback resistor between the connection for the auxiliary voltage 139 and the emitter of transistor 301. After a certain voltage drop across this resistor, current flows through the dual diode 345. This reduces the current at the base of transistor 301. The collector current at the transistor, controlled by the base current, i.e., the pulse current Ip (which serves as the output current Ip of the pulse driver stage 146), is correspondingly reduced. This allows current source 254.3 to function as current limiting device 264. If a voltage of 0.7V is applied to the resistor, transistor 301 (and transistor 303) is disabled. The associated circuitry of current limiting device 264 can be dimensioned to generate a maximum current of approximately 2.5 mA. Therefore, it is possible to fully ensure that the further auxiliary voltage 139 is free from feedback influences.

[0078] In conjunction with further switching device 304, buffer 255 operates like a pulse source by recharging buffer 255 to actuate the switching device or to render switching device 301 conductive. This allows further auxiliary voltage 139 to be quickly made available to actuate devices 281, 282, 283 after activation of switch-on request 106, in order to close switches 61, 62, 63 and ensure the supply of safety-related loads 16. The capacitance of buffer 255 is, for example, ten times the barrier capacitance of switches 61, 62, 63, which are designed as MOSFETs, and can be, for example, in the order of 1nF. The corresponding dimensioning of the circuit results in a correspondingly simple design.

[0079] The further outputs of the further switching device 304 are each electrically conductively connected to resistors (as possible further distributed further current limiting devices) 272.1, 272.n, and subsequently to corresponding coupling elements 274.1, 274.n. The respective further resistors 272.1, 272.n are designed with relatively low impedance, for example, in the order of 250 or 200Ω. The relatively low-impedance connection and corresponding buffering enable fast switching on of the switches 61, 62, 63. The resistors are used, in particular, for symmetry purposes, rather than primarily as distributed current limiting devices 272.1, 272.2, 272.n.

[0080] A current measuring device 262 is provided for the pulse current Ip via resistor 343. Specifically, the constant current source (as current limiting device 264) and the current measuring device 262 are designed so that the additional auxiliary voltage 139 reaches the diagnostic device 268 via a branch (via the upstream resistor and transistor 303) as a mirror current of the pulse current Ip. This branch is dimensioned so that a certain portion of the flowing pulse current Ip is transmitted to the diagnostic device 268, for example, 1 / 7 of Ip, depending on the dimensioning of the resistor.

[0081] Through a further branch (via an upstream resistor and transistor 301), the pulse current Ip reaches a further switching device 304 and / or, if necessary, through current limiting devices 272.1, 272.2, 272.3, or 272.n to coupling elements 274.1, 274.2, 274.n. Current limiting devices 272.1, 272.2, 272.3, or 272.n are designed as resistors (e.g., in the order of 200 ohms). Current limiting devices 272.1, 272.2, 272.3, or 272.n ensure symmetry of the pulse current Ip with respect to the holding current Ie, as described below.

[0082] The power supply path 248 is supplied with power via the auxiliary voltage 137 .

[0083] Switching device 300, arranged in power supply path 248, is controlled or activated, if necessary, by a further switching device 302, via a switch-on signal 106. After rapid activation of switches 61, 62, and 63 using pulse driver stage 146, holding driver stage 144 is also connected in parallel by activating switching device 300. Holding driver stage 144 is supplied with auxiliary voltage 137. Auxiliary voltage 137 (like further auxiliary voltage 139) is higher than supply voltage Ub by a specific amount, preferably by an order of 12V. Switching element 300 (particularly a transistor) is activated via a control input of switching element 302 (the output signal of which forms the control signal for switching element 300), thereby conducting auxiliary voltage 137 at its input. A holding current Ie (output current Ie of holding driver stage 144) is injected via a first branch at the output of switching device 300 via a resistor and transistor 305.

[0084] The holding current Ie reaches a distributed current limiting device 270.1, 270.2, 270.n for each control device 281, 282, 283 or each switch 61, 62, 63. Distributed current limiting devices 270.1, 270.2, 270.n are configured as resistors (e.g., in the order of 10k). After the respective distributed current limiting device 270.1, 270.2, 270.n, the current Ie reaches the respective control device 281, 282, 283 for the associated switch 61, 62, 63 via the respective coupling element 274.1, 274.2, 274.3, 274.n. As previously mentioned, the coupling element 174 is constructed, for example, by two diodes, which couple two transmitted inputs (part of the pulse current Ip transmitted through the output end of the switching device 304 through resistors 272.1, 272.2, 272.n; and part of the holding current Ie transmitted through the current limiting devices 270.1, 270.2, 270.n) into one output without feedback influence.

[0085] For the purpose of current measuring device 252, the output of switching device 300 branches off into another branch, in addition to the first branch containing transistor 305. This branch consists of another transistor 307 and a resistor connected upstream. The base of further transistor 307 is in conductive contact with the output of further transistor 305. By appropriately dimensioning the resistors, a certain proportion of the holding current Ie is supplied to diagnostic device 268, exemplarily 1 / 10 Ie. To this end, the output of further transistor 307 is supplied to diagnostic device 268. This circuit thus acts as a current mirror. The current flow of the two auxiliary voltages 137 and 139 can be measured by diagnostic device 268 (for measuring Ip and Ie). Diagnostic device 268 may also preferably include a coupling element 341, which is composed of two diodes that combine the supplied portions of current Ip and Ie into a single output for further analysis. The analysis or detection of currents Ie and Ip is performed via measuring resistor 343. The output of coupling element 341 is supplied to a measuring resistor 343 , the other terminals of which are interconnected to ground.

[0086] Each control device 281, 282, 283 includes at least two parallel branches. The output of the corresponding coupling element 274.1, 274.2, 274.n branches into two parallel branches. The first branch leads to a branching point, through which the control signal is applied to the corresponding switching device 61, 62, 63. In addition, the cathode of the Zener diode 376 contacts the branching point, while the anode of the Zener diode 376 is interconnected to the common reference potential 330. The other branch of the corresponding control device 281, 282, 283 is also connected to the output of the corresponding coupling element 274.1, 274.2, 274.n, which can also be interconnected to the common reference potential 330 via the corresponding switching device 321, 322, 323. When the shutoff signals 92 and 106 agree, the corresponding switching devices 321, 322, and 323, preferably designed as transistors, are switched on by corresponding actuation of the bases, so that the outputs of the associated coupling elements 274.1, 274.2, and 274.n are pulled to the reference potential 330 and thus no corresponding actuation of the switching devices 61, 62, and 63 in the sense of switching on occurs. Consequently, the switching devices 61, 62, and 63 are switched off.

[0087] The shutdown signals 92, 108 each control a further switching device 308, 310 (e.g., by controlling the bases of the switching devices 308, 310, which are designed as transistors). By way of example, multiple shutdown signals 108 (e.g., from different sources) can also be combined and used to control the switching device 310. The output signals of the correspondingly controlled switching devices 308, 310 are supplied to an AND gate 180. The AND gate 180 includes, for example, two further switching devices 312, 314, preferably designed as transistors, which are connected in series and whose switching paths can be applied by one of the auxiliary voltages 137, 139, in particular the further auxiliary voltage 139. If a consistent shutdown request 92, 106 is present, both switching devices 312, 314 of the AND gate 180 conduct, so that the further auxiliary voltage 139 or the driver voltage is present at the output of the AND gate 180.

[0088] The output signal of AND gate 180 is transmitted to a decoupling element 276, in the exemplary embodiment, to two decoupling elements 276. Decoupling element 276 comprises at least one diode, which is arranged in the flow direction between the output of AND gate 180 and the input of the corresponding actuation device 281, 282, 283. The input signal of decoupling element 276 can also be supplied to another actuation device 282 via another diode. The output signal of decoupling element 276 is supplied to actuation device 281 (for first switch 61) and also to actuation device 282 (for second switch 62). The output signal of AND gate 180 is transmitted to actuation device 283 (for third switch 63) via another decoupling element 276.

[0089] The output signal of the corresponding decoupling element 276 controls the associated switching device 321 (for driving device 281), the switching device 322 for driving device 282, and the switching device 323 for driving device 283. Accordingly, they are each connected to the base of the switching devices 321, 322, 323 designed as transistors.

[0090] The output signal of coupling element 274.1 is connected to control device 281 or transistor 321 and, via a branch point, to first switching device 61 and to a reference potential via Zener diode 376. The output signal of coupling element 274.2 is connected to control device 282 or transistor 322 and, via a branch point, to second switching device 61 and to a reference potential via another Zener diode 376.2. The output signal of coupling element 274.n is connected to control device 283 or transistor 323 and, via a branch point, to the third or nth switching device 63 and to a reference potential via another Zener diode 376.n. If there are consistent shutdown requests 92, 108, the corresponding switching devices 321, 322, 323 are switched on so that no more on signals reach switches 61, 62, 63, as described above. Switches 61, 62, 63 are then opened.

[0091] Power splitter 18 is arranged, for example, in a 12V onboard electrical system 13 in a motor vehicle directly at the interface between a non-safety-related onboard electrical system subsystem 10 and a safety-related onboard electrical system subsystem 11 , in particular an ASIL-compliant onboard electrical system subsystem 11 . However, the use is not limited thereto.

Claims

1. A device for supplying energy to at least one safety-related electrical consumer in a motor vehicle, wherein at least two switches (61, 62, 63) are provided for supplying power to and protecting at least one safety-related electrical consumer (16) or a plurality of safety-related electrical consumers (16), wherein each of the switches (61, 62, 63) is respectively assigned its own control device (281, 282, 283) for switching on or off the corresponding switch (61, 62, 63) according to at least one control signal (104, 106; 92, 108), and the device comprises at least two mutually independent power supply paths (248, 250) for supplying power to the control devices (281, 282, 283) 82, 283), wherein one of the supply paths (248) comprises a driver stage (144, 256) fed by an auxiliary voltage (137), wherein the other supply path (250) comprises a further driver stage (146, 266) fed by a further auxiliary voltage (139), the further auxiliary voltage being independent of the auxiliary voltage (137), wherein at least two coupling elements (274) are provided for combining output variables of the two driver stages (144, 146, 256, 266), wherein each of the coupling elements (274, 274.n) supplies power to one of the control devices (281, 282, 283).

2. The device according to claim 1, characterized in that At least one current limiting device (254, 264, 270, 272) is arranged between at least one of the inputs of the auxiliary voltage (137, 139) and at least one of the control devices (281, 282, 283).

3. The device according to any one of the preceding claims, characterized in that In particular, a central current limiting device (254, 264) is arranged between an input for the respective auxiliary voltage (137, 139) and the respective driver stage (256, 266), and / or in particular a distributed current limiting device (270, 272) is arranged between the respective coupling element (274.1, 274.n) and the driver stage (256, 266).

4. The device according to any one of the preceding claims, characterized in that When a central current limiting device (264) is arranged in one of the power supply paths (250), a distributed current limiting device (270.1, 270.n) is provided between each of the control devices (281, 282, 283) and the power supply path (248) not provided with the central current limiting device (264).

5. The device according to any one of the preceding claims, characterized in that One of the driver stages (144, 256) is designed as a holding driver stage (144), and / or one of the driver stages (266, 146) is designed as a pulse driver stage (146), in particular for use when starting the motor vehicle.

6. The device according to any one of the preceding claims, characterized in that A holding driver stage (256) is arranged in one of the supply paths (248, 250), and a central current limiting device (264) and a pulse driver stage (146) are arranged in the other supply path (250), wherein distributed current limiting devices (270.1, 270.2, 270.n) are respectively arranged between the holding driver stage (256) and the corresponding coupling element (274).

7. The device according to any one of the preceding claims, characterized in that At least two mutually independent control signals (104, 106) are provided, which cause at least one of the switches (61, 62, 63) to be turned on, and / or at least two mutually independent control signals (92, 108) are provided, which cause at least one of the switches (61, 62, 63) to be turned off when a consistent turn-off request is present, in particular by being coupled to each other via an AND gate (180).

8. The device according to any one of the preceding claims, characterized in that The driver stage (256) is actuated by a control signal (104) that causes switching on, and the further driver stage (266) is actuated by a further control signal (106) that causes switching on.

9. The device according to any one of the preceding claims, characterized in that At least one third switch (63) and an associated control device (283), in particular a gate control device, are provided, wherein the control device (283) is supplied with power from two power supply paths (248, 250) via a third coupling element (274.n), and / or at least two switches (61, 62) are arranged in parallel with each other.

10. The device according to any one of the preceding claims, characterized in that At least one of the auxiliary voltages (139) is supplied to the actuation device (281, 282, 283), in particular a gate actuation device, via at least one decoupling element (276).

11. The device according to any one of the preceding claims, characterized in that The AND gate (180) is fed by at least one of the auxiliary voltages (137, 139), wherein when a consistent shutdown request is present as a control signal (92, 108), the corresponding control device (281, 282, 283) is supplied with the auxiliary voltage (137, 139), in particular via at least one decoupling element (276), preferably a diode.

12. The device according to any one of the preceding claims, characterized in that At least one current measuring device (252, 262) is provided in each power supply path (248, 250) for detecting the current (Ip, Ie) provided by the corresponding driver stage (256, 266).

13. The device according to any one of the preceding claims, characterized in that The pulse driver stage (146) comprises at least one electrical buffer (255), in particular a capacitor (255), in particular a multiple of the same intrinsic capacitance of a switch (61, 62, 63) designed as a field effect transistor, in particular a MOSFET, and / or the pulse driver stage (146) comprises at least one current source, and / or the pulse driver stage (146) comprises at least one switching device (304) for recharging the buffer (255) or the capacitor, and / or the pulse driver stage (146) comprises at least one current-limiting resistor, and / or the pulse driver stage (146) is configured to initiate the switching of the switches (61, 62, 63) using the buffer (255), and / or the control signal of the switching device (301) as a component of the constant current source of the pulse driver stage (146) is fed by the buffer (255) or the pulse memory.

14. The device according to any one of the preceding claims, characterized in that The current limiting device (254, 264, 270, 272) comprises at least one resistor and / or a current source, in particular a constant current source and / or an RC element and / or a buffer current limiting device (254.2, 254.3).

15. The device according to claim 1 , further comprising at least one first monitoring device (140) for monitoring at least one power supply path (64) for the energy supply of safety-related electrical loads (66), the device comprising a further monitoring device (142) independent of the first monitoring device (140) for monitoring at least the power supply path (64) for the energy supply of safety-related electrical loads (66), wherein the monitoring devices (140, 142) independently of one another monitor at least one electrical characteristic variable of the power supply path (64) for the presence of a fault and compare them with limit values ​​(84, 130), wherein a plausibility check is provided. A switch-off signal (114, 116) is generated for the switch (61, 62, 63) when both output signals (92, 108) of a monitoring device (140, 142) infer that a corresponding limit value (84, 130) has been reached and thus a fault has been inferred, wherein the monitoring device (140, 142) respectively includes at least one measuring amplifier (78, 124) for detecting a corresponding characteristic variable and / or respectively includes at least one comparator (82, 128) to which the output variable of the corresponding measuring amplifier (78, 124) is supplied and / or respectively includes a memory element (88, 134) to which the output variable of the comparator (82, 128) is supplied.

Images