Method and device for safety-related shutdown of an electrical network and safety device

Abstract

Method for the safety-related shutdown of an electrical network, wherein several electrical components are connected to the electrical network, which include at least one electrical energy source (12) and at least one electrical consumer (14, 16, 18), and wherein the electrical energy source is switched off or disconnected from the electrical network (20) when a safety line loop (26) passing through the electrical components is interrupted, characterized in that the safety line loop (26) is monitored to determine whether an interruption occurs due to an internal interruption of the safety line loop (26) within the at least one energy source (12) or due to an external interruption of the safety line loop (26) within the at least one electrical consumer (14, 16, 18).

Description

[0001] The present invention relates to a method for the safety-related shutdown of an electrical network, a safety device suitable for carrying out the method according to the invention, a battery suitable for carrying out the method according to the invention, and a motor vehicle comprising the safety device or battery according to the invention. State of the art

[0002] Methods for the safety-related shutdown of an electrical network are known from the prior art, in particular from DE 10 2008 021 542 A1, in which a safety line loop (also called interlock or pilot line or interlock or pilot line) is used, in the event of an interruption of which an electrical energy source belonging to the electrical network is switched off or disconnected from the electrical network, in particular if there is a risk of personal injury from live parts.

[0003] In electrical systems in vehicles with a nominal voltage exceeding 60 V, a safety loop is used, implemented as a signal loop. The signal is typically generated in a power source, such as a battery, that supplies power to the electrical system. The signal is then routed through all connectors of the electrical system and all components connected to it. The system is designed so that opening a connector or a cover that prevents access to live parts inevitably interrupts the safety loop. The signal is evaluated in all components of the system that act as power sources. If the safety loop is interrupted, each of these components shuts off the power supply to the system and, if necessary, discharges the system.The time typically required between interruption of the safety line loop and shutdown of the network protected by it is less than one second.

[0004] It is known to route the safety circuit exclusively within the power source, exclusively outside the power source through the electrical loads connected to the power source, as described in particular in DE 10 2010 048 348 A1, or as a common signal safety circuit through the power source and through the electrical loads connected to the power source. Furthermore, according to DE 10 2010 048 348 A1, the fault in the electrical loads connected to the power source can be located by reading the fault information from the fault memory using a diagnostic tool. Disclosure of the invention

[0005] According to the invention, a method for the safety-related shutdown of an electrical network is provided. Several electrical components are connected to the electrical network, each including at least one electrical energy source, e.g., a battery, preferably a lithium-ion battery, and at least one electrical load. The electrical energy source is switched off or disconnected from the electrical network when a safety circuit, in which the electrical components are located or which passes through the electrical components, is interrupted. The interruption of the safety circuit can be achieved by separating / interrupting the signal path by switching to an electrical potential that does not correspond to the closed state, or by otherwise disrupting the signal flow.The interruption can occur at any point in the safety loop, but it can also consist of switching off a signal carried by the safety loop, such as a DC voltage signal, a constant current signal, or an AC signal with a defined time-dependent behavior. The safety loop is then monitored to determine whether an interruption occurs due to an internal break within the at least one power source or due to an external break within the at least one electrical load. Since interrupting the safety loop isolates the network protected against unintentional contact from the power source, controlled interruption of the safety loop can be used to prevent hazards that may arise directly or indirectly from the use of energy from the electrical network.

[0006] The method according to the invention enhances the diagnostic capability of the electrical network, as it now allows for the determination, upon interruption of the safety loop, whether this interruption is due to a break in the power source or to a break in the safety loop within a load connected to the power source. For example, it is possible to reliably detect whether there is a short circuit to the housing ground, breaks in the internal wiring harness of the power source, or a disconnected high-voltage plug. This reliable information can be transmitted to a service function (software interface). No knowledge of any other electrical load connected to the electrical network, through which the safety loop also runs, is required.This allows for improvements to the on-board diagnostics (OBD) of a control unit of the power source.

[0007] Another aspect of the invention relates to a safety device comprising at least one electrical energy source, e.g., a battery, preferably a lithium-ion battery, and at least one electrical load, which can be connected to an electrical network. The safety device includes a safety circuit loop running through the electrical components, the interruption of which allows the electrical energy source to be switched off or disconnected from the electrical network. The safety device according to the invention comprises a first evaluation unit designed to detect an interruption of the safety circuit loop and a second evaluation unit designed to detect an interruption of the safety circuit exclusively in the electrical energy source.

[0008] This advantageously allows the second evaluation unit to additionally monitor the safety loop within the power source directly at the transition point between the safety loop and the electrical loads connected to the power source. By evaluating the data from the second unit, fault localization is possible in such a way that it can be clearly distinguished whether the fault in the safety loop is located inside or outside the power source.

[0009] Another aspect of the invention relates to a battery. The battery is configured to switch off or disconnect from an electrical network if a safety circuit running through it is interrupted. This interruption can occur either inside or outside the battery, and the interruption of the safety circuit can be distinguished based on whether it originates inside the battery or outside the battery in an electrical load connected to the battery.

[0010] Another aspect of the invention relates to a motor vehicle, in particular an electric motor vehicle, which includes the safety device or battery according to the invention. Drawings

[0011] The invention is explained in more detail below using exemplary embodiments and the accompanying drawings. These show: Fig. 1 a block diagram of a safety device according to the invention; Fig. 2 the safety device according to the invention in a first embodiment, and Fig. 3 the safety device according to the invention in a second embodiment variant.

[0012] Fig. Figure 1 shows a safety device, designated as 10, as part of an electric vehicle (not shown). The safety device 10 comprises the electrical components 12, 14, 16, and 18. The electrical component 12 is a power source, specifically a lithium-ion battery. The lithium-ion battery 12 supplies the electrical components 14, 16, and 18 with electrical energy via a high-voltage network 20. For this purpose, the electrical components 12, 14, 16, and 18 are connected to the high-voltage network 20 via high-voltage connectors 22.

[0013] The lithium-ion battery 12 also feeds a signal generated by a signal generator 24 into a closed circuit, which is configured as a safety loop 26. The electrical components 14, 16, and 18 are connected to the safety loop 26 as participants in the high-voltage network 20. If one of the high-voltage connectors 22 is disconnected, the safety loop 26 is interrupted, preferably before the high-voltage path of the high-voltage network 20 is interrupted. Similarly, the safety loop 26 is interrupted when a cover (not shown) of an electrical component of the vehicle is opened. A first evaluation unit 28 detects the interruption of the safety loop 26 and disconnects the high-voltage network 20 by either switching off the lithium-ion battery 12 or disconnecting it from the high-voltage network 20.

[0014] The electrical components 14, 16 and 18 are, for example, electric motors, inverters, pulse inverters, generators or the like, which are intended for use in an electric vehicle and are supplied with electrical energy via the lithium-ion battery 12.

[0015] The safety circuit loop 26 forms an internal circuit 30 within the lithium-ion battery 12 and an external circuit 32 via the electrical components 14, 16 and 18. A second evaluation unit 34 is connected to the internal circuit 30 of the safety circuit loop 26.

[0016] The in Fig. The safety device shown in 10 demonstrates the following function: During normal operation, the lithium-ion battery 12 supplies electrical energy to the electrical components 14, 16, and 18. Simultaneously, the signal generator 24 sends a signal, such as a DC voltage signal, a constant current signal, or an AC signal with a defined timing behavior, via the safety circuit 26. This signal is received and evaluated by the first evaluation unit 28. If the safety circuit 26 is uninterrupted, the first evaluation unit 28 detects the incoming signal and issues a status message indicating that the operating state of the entire electrical system is OK. If the safety circuit 26 is interrupted, for example, if one of the high-voltage connectors 22 is not electrically connected correctly, this is detected by the first evaluation unit 28, and a corresponding status message is generated.This status message contains the general information that the safety circuit 26 is interrupted. However, it does not specify whether the high-voltage connector 22 of the lithium-ion battery 12 or a high-voltage connector 22 of the electrical components 14, 16 and 18 is not electrically connected.

[0017] The additional second evaluation unit 34, being directly connected to the internal circuit 30 of the safety line loop 26, can now provide additional information as to whether the interruption of the safety line loop 26 originates within the internal circuit 30 or within the external circuit 32. This provides an additional diagnostic function. Signal generator 24, first evaluation unit 28, and second evaluation unit 34 are components of a battery control unit 36, indicated here.

[0018] In the Fig. 2 and Fig. Figure 3 shows two possible configurations of the battery control unit 36, in particular the second evaluation unit 34. The same parts are used as in Figure 3. Fig. Items 1 have the same reference number and are not explained again.

[0019] According to the representation in Fig. The second evaluation unit 34 is configured as a threshold switch. The threshold switch can be implemented using either unipolar or bipolar technology. An on / off signal is present at the output of the second evaluation unit 34, which is provided to a microcontroller (µC). Based on the switching state, an interruption of the internal circuit 30 of the safety line loop 26 can be inferred. If the safety line loop 26 is interrupted in the external circuit 32, this is detected via the first, already known evaluation unit 28. Thus, the second evaluation unit 34 provides additional information about the state of the internal circuit 30 of the safety line loop 26.

[0020] Fig.Figure 3 shows another embodiment. Here, the second evaluation unit 34 is implemented as a resistor divider, the output of which is connected to an analog-to-digital input of a microcontroller (µC). Here, too, an interruption of the internal circuit 30 of the safety line loop 26 can be easily detected.

Claims

[1] Method for the safety-related shutdown of an electrical network, wherein several electrical components are connected to the electrical network, which include at least one electrical energy source (12) and at least one electrical load (14, 16, 18), and wherein the electrical energy source is switched off or disconnected from the electrical network (20) when a safety line loop (26) passing through the electrical components is interrupted, characterized by , that the safety line loop (26) is monitored to determine whether an interruption occurs due to an internal interruption of the safety line loop (26) within the at least one energy source (12) or due to an external interruption of the safety line loop (26) within the at least one electrical consumer (14,16,18). [2] Method according to claim 1, wherein the findings of the monitoring are transferred to a service functionality. [3] Safety device (10) comprising at least one electrical power source (12) and at least one electrical load (14, 16, 18) which can be connected to an electrical network (20), and a safety line loop (26) passing through the electrical power source (12) and the electrical loads (14, 16, 18), wherein the electrical power source (12) can be switched off or disconnected from the electrical network (20) when the safety line loop (26) is interrupted, characterized by, that the safety device (10) comprises a first evaluation unit (28) designed to detect an interruption of the safety line loop (26) and a second evaluation unit (34) designed to detect an interruption of the safety line loop (26) in the electrical power source (12). [4] Safety device according to claim 3, wherein the second evaluation unit (34) comprises a threshold switch. [5] Safety device according to claim 3, wherein the second evaluation unit (34) comprises a resistance divider. [6] Safety device according to one of the preceding claims 3-5, wherein the evaluation units (28, 34) are components of a battery control unit (36). [7] Battery (12) which can be switched off or disconnected from an electrical network (20) when a safety line loop (26) through it and through electrical consumers (14, 16, 18) connected to the battery (12) is interrupted, characterized by , that the battery (12) comprises a first evaluation unit (28) designed to detect an interruption of the safety line loop (26) in an internal circuit (30) or an external circuit (32) of the safety line loop (26) and comprises a second evaluation unit (34) designed to detect an interruption of the safety line loop (26) in an internal circuit (30) of the safety line loop (26). [8] Motor vehicle, in particular electric motor vehicle, comprising a safety device (10) according to claim 3 or a battery (12) according to claim 7.

Images