Safety device and method of operating the same

Abstract

A safety device for high voltage (HV) components of an at least partially electrically driven vehicle comprises a monitoring unit, a processing unit, an error collection device and a repair module. The monitoring unit is configured to check a crash line and to provide a first disconnect signal if the monitoring unit detects a crash. The processing unit is configured to provide a second disconnect signal upon receiving a crash message. The error collection device is configured to control an energy transfer of the HV components depending on the first disconnect signal and the second disconnect signal. The repair module is configured to detect transient errors in the crash detection depending on a status of the first disconnect signal and the second disconnect signal and to provide predefined repair steps for the detected transient errors.

Description

Technical Field

[0001] This disclosure relates to a safety device and a method of operating the same. Furthermore, this disclosure also relates to a repair module, a computer program for operating the safety device, and a computer-readable medium. Background Technology

[0002] In the high-voltage on-board electrical systems of at least partially electric vehicles (also known as hybrid vehicles), especially in the high-voltage on-board electrical systems of pure electric vehicles, it is essential to safely and quickly disconnect the power supply in the event of an accident. For this purpose, power supply components, especially energy storage devices, particularly batteries, are equipped with a dedicated control line, also known as terminal 30C (KL30C) or the collision line.

[0003] The main contactor of the energy storage system receives its power through this line. Therefore, a shutdown during maintenance, or the disconnection of this line caused by the activation of a fuse in the airbag control unit, will inevitably de-energize the vehicle's electrical system, particularly high-voltage components. Other components, such as the drive inverter if present, also have hardware and / or software safeguards in place to activate safety-related measures should the voltage on the KL30C drop.

[0004] To achieve unrestricted autonomous driving of vehicles in certain traffic areas, such as highways, parking areas, or other permitted areas (Operating Design Domain, ODD), the high-voltage components of the vehicle need to meet the highest safety requirements, namely ASIL D (Automotive Safety Integrity Level) in accordance with the ISO 26262 functional safety measurement system.

[0005] Since the vehicle has autonomous driving capabilities and meets the ASIL D safety target at the high-voltage component level, the original ASIL B level collision line disconnection is no longer sufficient to meet the requirements.

[0006] One object of this disclosure is to provide a safety device for a vehicle that enables collision detection based on the vehicle's collision lines and meets the safety requirements of ASIL D. Summary of the Invention

[0007] According to this disclosure, one or more of the above objectives are achieved by the features of the independent claim. The dependent claims provide advantageous embodiments.

[0008] According to a first aspect of this disclosure, a safety device for a high-voltage (HV) component of at least a partially electrically driven vehicle includes a monitoring unit, a processing unit, an error collection device, and a repair module. The HV component is, for example, or includes a DC / DC converter configured to convert the high-voltage on-board supply voltage of the vehicle's high-voltage on-board electrical system to the low-voltage on-board supply voltage of the vehicle's low-voltage on-board electrical system, and vice versa.

[0009] The monitoring unit can be connected to the vehicle's collision line, also known as Klemme 30c (KL30c). The monitoring unit is configured to check if the voltage on the collision line is below a predetermined threshold and provides a first disconnect signal at the monitoring unit's output. This signal is activated when the monitoring unit detects that the voltage on the collision line is below the predetermined threshold, indicating that a vehicle collision has occurred. The first disconnect signal preferably has two states: activated and deactivated. The different states are preferably distinguished by voltage levels.

[0010] The processing unit includes a communication interface and is configured to receive a collision message indicating a vehicle collision, provided by a vehicle entity configured to directly or indirectly detect the collision. This entity may be, for example, an airbag control unit, or another vehicle control unit configured to receive sensor signals indicating a vehicle collision independently of the airbag control unit, and / or a vehicle control unit configured to receive the collision message (e.g., from the airbag control unit) and forward it to the processing unit.

[0011] The processing unit is configured to provide a second disconnect signal on one of its terminals, which is activated when the processing unit receives a collision message.

[0012] The second disconnect signal preferably has two states: active and inactive. The different states are preferably distinguished by voltage levels.

[0013] Therefore, the activation of the first disconnect signal is based on a hardware detection mechanism, while the activation of the second disconnect signal is based on a software detection mechanism. In this way, both mechanisms can satisfy the requirements of ASIL B(D). Alternatively, other ASIL combinations can be used, for example, one detection mechanism containing ASIL A(D) and the other containing ASIL C(D).

[0014] ASIL decomposition can be used to break down a security requirement's ASIL level into multiple security requirements with lower ASIL levels. Here, for redundancy, the security requirement is broken down into independent elements (hardware mechanisms and software mechanisms). The decomposed ASILs are labeled accordingly, allowing for verification of the decomposition.

[0015] The error collection device is configured to receive a first disconnect signal and a second disconnect signal, and to provide a control signal to the high-voltage component to control the energy transfer of the high-voltage component according to the first disconnect signal and the second disconnect signal. Preferably, the error collection device meets the ASIL D safety requirements.

[0016] The repair module is configured to check the states of the first disconnect signal and the second disconnect signal, detect transient errors in collision detection based on the states of the first disconnect signal and the second disconnect signal, and provide predefined repair steps for the detected transient errors. The repair module can be implemented in software or as a hybrid module including both hardware and software. The repair module can be part of the processing unit, such as a software program executed by the processing unit.

[0017] The repair module allows transient errors to be fixed within the current driving cycle. This solution can be very cost-effective. Transient errors are those where it is uncertain whether they are actual errors, as error messages may be generated due to defects.

[0018] In at least one embodiment of the first aspect, the repair module is configured to check whether a first disconnect signal is activated and whether a second disconnect signal is activated. When it detects that only the first disconnect signal is activated, the repair module is configured to, after a predetermined first time period, monitor the voltage on the collision line based on a provided sensor signal, check whether the condition causing the first disconnect signal to be activated is still met, and when the voltage is higher than a predetermined threshold or another predetermined threshold, cause the monitoring unit to deactivate the first disconnect signal, thereby enabling the error collection device to provide a control signal to the high-voltage component, thereby enabling energy transfer to the high-voltage component. The sensor signal may be provided by the monitoring unit or by another sensing unit configured to sense the voltage on the collision line.

[0019] This ensures that a temporary voltage drop on the collision line will not cause high-voltage components to permanently shut down. It also allows for verification of whether the vehicle truly needs to be switched to a permanent safety state.

[0020] The repair module is also configured to: when it detects that only the second disconnect signal is activated, induce a reset of the processing unit after a predetermined second time period, and when no collision message is received within a predetermined third time period after the reset of the processing unit is completed, disable the second disconnect signal of the processing unit, thereby enabling the error collection device to provide a control signal to the high-voltage component and enabling the energy transmission of the high-voltage component.

[0021] This ensures that erroneous collision messages do not cause high-voltage components to permanently shut down. It also allows for verification of whether the vehicle truly needs to be switched to a permanent safety state.

[0022] In at least one embodiment of the first aspect, the repair module is configured to: when both the first disconnect signal and the second disconnect signal are detected to be activated, cause the processing unit to keep the second disconnect signal active for the entire remaining current driving cycle, and directly or indirectly cause the monitoring unit to keep the first disconnect signal active for the entire remaining current driving cycle. The repair module may be configured to cause the processing unit to control the monitoring unit, thereby causing the monitoring unit to keep the first disconnect signal active, causing the error collection device to provide a control signal, and disabling energy transmission to the high-voltage components for the entire current driving cycle. Thus, the vehicle is put into a permanent safe state, requiring a vehicle restart to reset.

[0023] In at least one embodiment of the first aspect, when the vehicle is restarted, the monitoring unit and the processing unit are respectively configured to disable the first disconnect signal and the second disconnect signal, thereby enabling the error collection device to provide a control signal to enable the energy transmission of the high-voltage component.

[0024] During this process, the monitoring unit and / or processing unit may be controlled by the repair module based on a received start signal or message that instructs the vehicle to begin a new driving cycle. The start signal may be vehicle-dependent.

[0025] In at least one embodiment of the first aspect, the repair module is configured to: when it is detected that only the second disconnect signal is activated after the reset of the processing unit is induced, to induce a reset of the processing unit again after a predetermined fourth time period.

[0026] In at least one embodiment of the first aspect, the repair module is configured to: induce a reset of the processing unit because the second disconnect signal is activated while the first disconnect signal is not activated, and after the number of resets reaches a predetermined number, keep the second disconnect signal activated for the entire remaining driving cycle, thereby enabling the error collection device to provide a control signal to disable the energy transmission of the high-voltage component.

[0027] This ensures that the software detection mechanism will ultimately take effect in the event of a fault in the collision line. For example, if the collision line contains a cable with worn insulation, causing a connection to another running parallel line, the safe disconnection achieved through the hardware detection mechanism in the event of a collision or maintenance will no longer be guaranteed, because the contactor may still be powered through the faulty line, and other safety responses may be suppressed.

[0028] According to a second aspect of this disclosure, a method for operating a safety device according to the first aspect includes the following steps, which are performed, for example, by a repair module.

[0029] Check whether the first disconnect signal and the second disconnect signal are activated. When it is detected that only the first disconnect signal is activated, after a predetermined first time period, monitor the voltage on the collision line based on the provided sensor signal, check whether the condition that caused the first disconnect signal to be activated is still met, and when the voltage is higher than a predetermined threshold or another predetermined threshold, disable the first disconnect signal by the monitoring unit, thereby enabling the error collection device to provide a control signal to the high-voltage component and enabling the energy transfer of the high-voltage component.

[0030] When it is detected that only the second disconnect signal is activated, a reset of the processing unit is induced after a predetermined second time period. If no collision message is received within a predetermined third time period after the processing unit is reset, the processing unit is deactivated by the second disconnect signal, thereby enabling the error collection device to provide a control signal to the high-voltage component and enabling the energy transmission of the high-voltage component.

[0031] In at least one embodiment of the second aspect, when both the first disconnect signal and the second disconnect signal are detected to be activated, the processing unit keeps the second disconnect signal active for the entire remaining current driving cycle, and the monitoring unit keeps the first disconnect signal active for the entire remaining current driving cycle.

[0032] In at least one embodiment of the second aspect, when the vehicle is restarted, the monitoring unit and the processing unit respectively disable the first disconnect signal and the second disconnect signal.

[0033] In at least one embodiment of the second aspect, when it is detected that only the second disconnect signal is activated after the reset of the processing unit is induced, the reset of the processing unit is induced again after a predetermined fourth time period.

[0034] In at least one embodiment of the second aspect, after a predetermined number of resets to the processing unit are induced due to the activation of the second disconnect signal while the first disconnect signal is not activated, the processing unit is kept in an activated state for the entire remaining driving cycle.

[0035] According to a third aspect of this disclosure, a computer program includes instructions that, when executed by a control computer, cause the computer to perform the steps of the method according to the second aspect.

[0036] The control computer has a processor and program memory. Alternatively, program memory may be allocated to the control computer. The processor may have a central processing unit (CPU). The processor may be a general-purpose processor, microprocessor, microcontroller, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, or similar device.

[0037] In this document, references to such computer programs are synonymous with the concepts of program elements and / or software modules and / or computer program products containing instructions for appropriately controlling a computer to coordinate the operation of a system or method to achieve the effects associated with the methods disclosed herein. Such computer programs may be implemented in computer-readable instruction code in any suitable programming language (e.g., JAVA, C++, etc.).

[0038] According to a fourth aspect of this disclosure, a computer-readable medium includes instructions that, when executed by a control computer, cause the control computer to perform the method according to the second aspect.

[0039] The computer program can be stored on a computer-readable storage medium (CD-ROM, DVD, Blu-ray disc, removable drive, volatile or non-volatile memory, especially random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), and / or flash memory). The storage medium can be memory integrated within the processor, memory located on an external module of the processor, or portable memory. The memory is configured to store associated program instructions and related data.

[0040] In addition, computer programs can be provided on networks (such as the Internet) and users can download them on demand.

[0041] According to a fifth aspect of this disclosure, a repair module includes a processor and a program memory, and is configured to perform the method according to a second aspect.

[0042] The embodiments of the first aspect are also applicable to the second, third, fourth, and fifth aspects. Attached Figure Description

[0043] It should be understood that the foregoing general description and the following detailed description are merely examples intended to provide an overview or framework for understanding the nature and features of the claims. The accompanying drawings are incorporated into and form part of this specification to provide further understanding. The drawings illustrate one or more embodiments and, in conjunction with the description, are used to explain the principles and operation of each embodiment. Identical elements are indicated by the same reference numerals in different drawings.

[0044] The accompanying drawings are not necessarily drawn to scale, but are configured to provide clear examples of this disclosure.

[0045] Figure 1 An exemplary embodiment of the safety device is shown; and Figure 2 An exemplary flowchart is shown for a program that implements a computer-based method for operating a security device. Detailed Implementation

[0046] The present disclosure will now be described in more detail with reference to the embodiments illustrated in the accompanying drawings. However, the present disclosure may be embodied in many different forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to enable the present disclosure to fully convey its scope to those skilled in the art. Although features of the present disclosure may be discussed below in conjunction with certain embodiments and the accompanying drawings, all embodiments of the present disclosure may include one or more advantageous features discussed herein. In other words, although one or more embodiments may be discussed as having certain advantageous features, one or more of such features may also be used in accordance with the various embodiments discussed herein. Similarly, although the exemplary embodiments below may be discussed as embodiments of apparatus, systems, or methods, it should be understood that such exemplary embodiments may be implemented in various apparatuses, systems, and methods.

[0047] Figure 1 An exemplary embodiment of a system 1 for at least a partially electric vehicle is shown. In this embodiment, the at least partially electric vehicle is a battery electric vehicle (BEV). System 1 includes a high-voltage component (HV component) 3 of the vehicle's high-voltage on-board electrical system. In this embodiment, the HV component 3 is or includes a high-voltage / low-voltage (HV / LV) DC / DC converter.

[0048] In another embodiment, HV component 3 may include a traction motor inverter.

[0049] The high-voltage side of the HV / LV DC / DC converter is connected to the high-voltage vehicle electrical system, and the low-voltage side is connected to the low-voltage vehicle electrical system.

[0050] The HV / LV DC / DC converter is configured to convert the high-voltage on-board supply voltage of the high-voltage on-board electrical system of an electric vehicle to the low-voltage on-board supply voltage of the low-voltage on-board electrical system, and vice versa. The high-voltage on-board supply voltage can be 400 V or 800 V, and the low-voltage on-board supply voltage can be 12 V, 24 V or 48 V.

[0051] During normal vehicle operation, a high-voltage battery (not in Figure 1 (As shown in the diagram) It is connected to the high-voltage vehicle electrical system, and therefore also to the HV / LV DC / DC converter. The high-voltage battery is connected to the high-voltage vehicle electrical system via a switching element. The switching element is configured to connect or disconnect the high-voltage battery from the high-voltage vehicle electrical system. The switching element may include a contactor or a semiconductor switch.

[0052] When an error is detected, the switching element may become soldered / melted or damaged, for example, stuck in the closed state or short-circuited.

[0053] Due to the ASIL D safety requirements for high-voltage batteries, especially in autonomous driving scenarios, uncontrolled energy transfer occurring at high-voltage component 3 via the HV / LV DC / DC converter must be avoided, particularly uncontrolled energy transfer from the low-voltage on-board electrical system to the high-voltage on-board electrical system, in order to protect maintenance personnel or occupants in the event of a failure in system 1 (e.g., a welded switch, uncontrolled battery discharge, or a minor collision).

[0054] Therefore, system 1 includes a safety device 5. The safety device 5 includes a monitoring unit 7, a processing unit 9, an error collection device 11, and a repair module 20. The processing unit 9 may include a microcontroller or a microprocessor.

[0055] The monitoring unit 7 is connected to the collision line KL30C and configured to check whether the voltage on the collision line KL30C is lower than a predetermined threshold, and to provide a first disconnect signal 1st_OFF at the output of the monitoring unit 7. When the monitoring unit 7 detects that the voltage on the collision line KL30C is lower than the predetermined threshold, the signal is activated and indicates that a vehicle collision has occurred.

[0056] The processing unit 9 includes a communication interface, specifically a CAN interface, and is configured to receive a collision message indicating a collision in the vehicle. The collision message can be sent by the airbag control unit or another ECU of the vehicle.

[0057] The processing unit 9 is configured to provide a second disconnect signal 2nd_OFF on one terminal of the processing unit 9, which is activated when the processing unit 9 receives a collision message.

[0058] The first disconnect signal 1st_OFF must meet specific safety requirements. The error detection mechanism for the first disconnect signal 1st_OFF is a hardware mechanism. In contrast, the second disconnect signal 2nd_OFF uses a software mechanism.

[0059] Therefore, two different mechanisms were adopted. Each mechanism meets the security requirements of ASIL B(D).

[0060] ASIL decomposition breaks down a security requirement into multiple lower ASIL-level security requirements. To achieve redundancy, the security requirement is broken down into independent elements (hardware mechanisms and software mechanisms). The decomposed ASILs are labeled accordingly, allowing for verification of the decomposition.

[0061] Processing unit 9 may include additional software modules. For example, such software modules include: - Voltage monitoring module 91, configured to check the voltage supplied by the system base chip (SBC) 13. - Current monitoring module 92 is configured to check the input and output current of HV component 3 based on sensor signals IHV and ILV provided by the first and / or second current sensors 15 and 17. -Security Logic Test Module 93 -Self-diagnosis module 94, -KL30c monitoring and control module 95.

[0062] The processing unit 9 may include hardware modules, such as an analog-to-digital converter circuit, a CAN interface, a watchdog timer, and an interrupt controller.

[0063] Each software and hardware module is configured / designed to meet specific security requirements, such as QM, ASIL A, and ASIL B.

[0064] Processing unit 9 can be configured to control the conversion operation of the DC / DC converter via pulse width modulation.

[0065] The error collection device 11 includes a first combinational logic circuit configured to receive a first disconnect signal 1st_OFF and a second disconnect signal 2nd_OFF. The first combinational logic circuit provides an OR function. Preferably, the first combinational logic circuit meets the ASILD safety requirements. The first combinational logic circuit provides a first output signal STOP_1.

[0066] In an alternative embodiment, the error collection device 11 may include a second combinational logic circuit configured to receive one or more error signals from system 1. These error signals may satisfy QM, ASIL A, or ASIL B requirements. The second combinational logic circuit may be configured to combine these error signals using AND and / or OR gates. The second combinational logic circuit provides a second output signal STOP_2.

[0067] In this configuration, the error collection device 11 includes a third combinational logic device, to which the first output signal STOP1 of the first combinational logic and the second output signal STOP2 of the second combinational logic are fed as input signals. The third combinational logic is also designed to meet ASIL D safety requirements. For example, it can be implemented with sufficient circuit redundancy. The third combinational logic circuit provides an OR function. The third combinational logic circuit provides a third output signal STOP_DCDC, which is configured to control the gate drive unit of the DC / DC converter to disable power transfer in the DC / DC converter.

[0068] If HV component 3 is an inverter, then the inverter's energy transfer is disabled in the sense that it no longer provides its primary function. The inverter's primary function is disabled.

[0069] System 1 may include a system base chip (SBC) 13. SBC 13 is configured, for example, to receive the low-voltage supply voltage of a low-voltage vehicle electrical system and to supply different supply voltages to processing unit 9, such as 5V, 3.3V, and 1.3V. SBC 13 may be configured to detect power supply errors and send a corresponding error signal, Error_SBC, to error collection device 11.

[0070] The repair module 20 is configured to check the state of the first disconnect signal 1st_OFF and the second disconnect signal 2nd_OFF, detect transient errors in collision detection based on the state of the first disconnect signal 1st_OFF and the second disconnect signal 2nd_OFF, and provide predefined repair steps for the detected transient errors.

[0071] For example, the repair module 20 is configured to provide a computer implementation method for operating the safety device 5.

[0072] Figure 2 An exemplary flowchart of the program implementing this computer method is shown. The repair module 20 may be part of the processing unit 9, and the program may be executed by the processing unit 9 of the security device 5.

[0073] The program is first started in step S01. Furthermore, program variables are initialized in step S01, for example...

[0074] In step S03, it is checked whether the first disconnect signal 1st_OFF and the second disconnect signal 2nd_OFF are activated. Additionally, it is checked whether the vehicle has been restarted. When the vehicle is restarted, the monitoring unit 7 and the processing unit 9 deactivate the first disconnect signal 1st_OFF and the second disconnect signal 2nd_OFF respectively, and then continue monitoring the first disconnect signal 1st_OFF and the second disconnect signal 2nd_OFF.

[0075] When it is detected in step S03 that only the first disconnect signal 1st_OFF is activated, in step S05a, after a predetermined first time period, the voltage on the collision line KL30C is monitored based on the provided sensor signal to check whether the condition that caused the first disconnect signal 1st_OFF to be activated is still met. When the voltage is higher than a predetermined threshold or another predetermined threshold, in step S07a, the monitoring unit 7 is deactivated by the first disconnect signal 1st_OFF, thereby causing the error collection device 11 to provide a control signal to the HV component 3, enabling the energy transfer of the HV component 3. When the voltage is equal to or lower than the predetermined threshold or another corresponding predetermined threshold, the first disconnect signal 1st_OFF remains activated. The program continues to execute in step S03. The number of times this cycle runs before the current remaining driving cycle is initiated to enter a permanent safety state can be defined by the vehicle manufacturer. In this embodiment, the permanent safety state is not initiated. As long as the first disconnect signal 1st_OFF is activated, the energy transfer of the HV component 3 is disabled.

[0076] When it is detected in step S03 that only the second disconnect signal 2nd_OFF is activated, step S05b checks whether the processing unit 9 has been reset due to the activation of only the second disconnect signal 2nd_OFF. When it is detected that the number of resets of the processing unit 9 caused by the activation of only the second disconnect signal 2nd_OFF has reached a predetermined number k, in step S11b, the processing unit 9 is kept in the second disconnect signal active state for the entire remaining driving cycle, thereby disabling the energy transmission of the HV component 3 for the entire remaining driving cycle. The number of resets caused can be stored in the current driving cycle or in a predetermined number of consecutive driving cycles. When the number of resets R does not exceed k, in step S07b it is checked whether a further collision message has been received, and when no collision message has been received within a predetermined third time period after the reset of the processing unit 9, in step S09b the processing unit 9 is deactivated by the second disconnect signal 2nd_OFF, thereby causing the error collection device 11 to provide a control signal to the HV component 3, enabling the energy transmission of the HV component 3. In this case, the program continues to execute in step S03. When it is detected that only the second disconnect signal 2nd_OFF is activated after the reset of processing unit 9 is induced, the reset of processing unit 9 is induced again after a predetermined fourth time period in step S10b. The program continues to execute in step S05b.

[0077] When both the first disconnect signal 1st_OFF and the second disconnect signal 2nd_OFF are detected to be activated in step S03, in step S05c, the processing unit 9 keeps the second disconnect signal 2nd_OFF active for the entire remaining current driving cycle, and the monitoring unit 7 keeps the first disconnect signal 1st_OFF active for the entire remaining current driving cycle, thereby disabling the energy transmission of the HV component 3 for the entire remaining driving cycle. When the current driving cycle ends, the program ends in step S13.

[0078] Explanation of reference numerals in the attached figures 1 System 3 HV components 5 Safety devices 7. Monitoring Unit 9 Processing Units 91 Voltage Monitoring Module 92 Current Monitoring Module 93 Self-diagnosis module 94 Security Logic Test Module 95 Monitoring and Control Module 96 Analog-to-Digital Conversion Circuit 97 SPL Controller Module 98 Watchdogs 99 Interrupt Controller 11 Error Collection Device 13 System Base Chips 15 First Current Sensor 17 Second Current Sensor 20 Repair Module 1st_OFF First disconnect signal 2nd_OFF Second disconnect signal CAN communication interface ERROR_SBC SBC error signal KL30C Collision Line PWM pulse width modulation signal S01… S13 Program Steps

Claims

1. A safety device (5) for a high-voltage HV component (3) in at least a partially electrically driven vehicle, comprising: - A monitoring unit (7) that can be connected to the vehicle collision line (KL30C) is configured to check whether the voltage on the collision line (KL30C) is lower than a predetermined threshold and provide a first disconnect signal (1st_OFF) to the output of the monitoring unit (7). The signal is activated when the monitoring unit (7) detects that the voltage on the collision line (KL30C) is lower than the predetermined threshold. The signal indicates that a vehicle collision has occurred when activated. - The processing unit (9) includes a communication interface (CAN) configured to receive a collision message, wherein the collision message indicates a vehicle collision and is provided by a vehicle entity configured to detect a vehicle collision, and wherein the processing unit (9) is configured to provide a second disconnect signal (2nd_OFF) on a port of the processing unit (9), which is activated when the processing unit (9) receives the collision message; - Error collection device (11) is configured to receive a first disconnect signal (1st_OFF) and a second disconnect signal (2nd_OFF) and provide a control signal to the high-voltage component (3) to control the energy transfer of the high-voltage component (3) according to the first disconnect signal (1st_OFF) and the second disconnect signal (2nd_OFF); - The repair module (20) is configured to check the state of the first disconnect signal (1st_OFF) and the second disconnect signal (2nd_OFF), detect transient errors in collision detection based on the state of the first disconnect signal (1st_OFF) and the second disconnect signal (2nd_OFF), and provide predetermined repair steps for the detected transient errors.

2. The safety device (5) according to claim 1, wherein the repair module (20) is configured as follows: - Check whether the first disconnect signal (1st_OFF) and the second disconnect signal (2nd_OFF) are activated; - When it is detected that only the first disconnect signal (1st_OFF) is activated, after a predetermined first time period, based on the provided sensor signal, by monitoring the voltage on the collision line (KL30C), it is checked whether the condition that caused the activation of the first disconnect signal (1st_OFF) is still valid, and when the voltage is higher than a predetermined threshold or another predetermined threshold, the monitoring unit (7) is deactivated to activate the first disconnect signal (1st_OFF), thereby causing the error collection device (11) to provide a control signal to the high voltage component (3) so that the energy transfer of the high voltage component (3) is enabled; - When it is detected that only the second disconnect signal (2nd_OFF) is activated, the processing unit (9) is reset after a predetermined second time period. If no collision message is received during a predetermined third time period after the processing unit (9) is reset, the processing unit (9) is deactivated to remove the second disconnect signal (2nd_OFF), thereby enabling the error collection device (11) to provide a control signal to the high-voltage component (3) so that the energy transfer of the high-voltage component (3) is enabled.

3. The safety device (5) according to claim 1 or 2, wherein the repair module (20) is configured as follows: When the activation of the first disconnect signal (1st_OFF) and the second disconnect signal (2nd_OFF) is detected, the processing unit (9) keeps the second disconnect signal (2nd_OFF) active for the entire remaining current driving cycle, and the monitoring unit (7) keeps the first disconnect signal (1st_OFF) active for the entire remaining current driving cycle.

4. The safety device (5) according to any one of claims 1 to 3, wherein the monitoring unit (7) and the processing unit (9) are configured to deactivate the first disconnect signal (1st_OFF) and the second disconnect signal (2nd_OFF) respectively when the vehicle is restarted.

5. The safety device (5) according to any one of claims 2 to 4, wherein the repair module (20) is configured to trigger a further reset of the processing unit (9) after a predetermined fourth time period when it is detected that only the second disconnect signal (2nd_OFF) is activated after the reset of the triggered processing unit (9) is completed.

6. The safety device (5) according to any one of claims 2 to 5, wherein the repair module (20) is configured to, after triggering such a reset of the processing unit (9) a predetermined number of times when the second disconnect signal (2nd_OFF) is activated but the first disconnect signal (1st_OFF) is not activated, keep the second disconnect signal activated for the entire remaining driving cycle.

7. The safety device (5) according to any one of claims 1 to 6, wherein the high-voltage component (3) is a DC / DC converter configured to convert the high-voltage on-board power supply voltage of the vehicle's high-voltage on-board electrical system into the low-voltage on-board power supply voltage of the vehicle's low-voltage on-board electrical system, and vice versa.

8. A method for operating the safety device (5) according to any one of claims 1 to 7, comprising the following steps: - Check whether the first disconnect signal (1st_OFF) and the second disconnect signal (2nd_OFF) are activated; - When only the first disconnect signal (1st_OFF) is detected to be activated, After a predetermined first time period, based on the provided sensor signal, the voltage on the collision line (KL30C) is monitored to check whether the condition that caused the activation of the first disconnect signal (1st_OFF) is still valid. When the voltage is higher than a predetermined threshold or another predetermined threshold, the monitoring unit (7) is deactivated to activate the first disconnect signal (1st_OFF), thereby enabling the error collection device (11) to provide a control signal to the high-voltage component (3) so that the energy transfer of the high-voltage component (3) is enabled. - When it is detected that only the second disconnect signal (2nd_OFF) is activated, the processing unit (9) is reset after a predetermined second time period. If no collision message is received during a predetermined third time period after the processing unit (9) is reset, the processing unit (9) is deactivated to remove the second disconnect signal (2nd_OFF), thereby enabling the error collection device (11) to provide a control signal to the high-voltage component (3) so that the energy transfer of the high-voltage component (3) is enabled.

9. The method according to claim 8, comprising the following steps: When the activation of the first disconnect signal (1st_OFF) and the second disconnect signal (2nd_OFF) is detected, the processing unit (9) keeps the second disconnect signal (2nd_OFF) active for the entire remaining current driving cycle, and the monitoring unit (7) keeps the first disconnect signal (1st_OFF) active for the entire remaining current driving cycle.

10. The method of claim 9, comprising the following steps: When the vehicle restarts, the monitoring unit (7) and the processing unit (9) deactivate the first disconnect signal (1st_OFF) and the second disconnect signal (2nd_OFF), respectively.

11. The method according to any one of claims 8 to 10, comprising the following steps: When the processing unit (9) is reset and only the second disconnect signal (2nd_OFF) is detected to be activated after the reset is completed, a further reset of the processing unit (9) is triggered after a predetermined fourth time period.

12. The method according to any one of claims 8 to 11, comprising the following steps: After the trigger processing unit (9) is reset, if the second disconnect signal (2nd_OFF) is activated more than a predetermined number of times, the processing unit (9) keeps the second disconnect signal activated for the entire remaining driving cycle.

13. A computer program comprising instructions that, when executed by a control computer, cause the control computer to perform the steps of the method according to any one of claims 8 to 12.

14. A computer-readable medium comprising instructions, when executed by a control computer, to cause the control computer to perform the method according to any one of claims 8 to 12.

Images