Device for decoupling and protection against compensating currents in a redundant system for autonomous driving

Abstract

Device for decoupling and / or protecting against equalizing currents for use in the joint use of at least one electro-pneumatic actuator (5; 15) by a plurality of independently voltage-supplied control unit devices (1, 2) in redundant systems for autonomous driving, wherein a) the at least one electro-pneumatic actuator (5; 15) has a common connection via which the at least one electro-pneumatic actuator can be coupled and switched with a common connection of other electro-pneumatic actuators (5; 15), and at least one dedicated connection via which the at least one electro-pneumatic actuator (5; 15) can be individually powered, b) the plurality of control device units (1, 2) comprising at least a first control device unit (1) comprising a first electronic control unit (11) and a first number of switching devices (6; 16, 17) corresponding to the common connection and the number of dedicated connections of all electro-pneumatic actuators (5; 15), and at least a second control device unit (2) comprising a second electronic control unit (12) and a second number of switching devices (6; 16, 17) corresponding to the common connection and the number of dedicated connections of all electro-pneumatic actuators (5; 15), and c) the at least one first and second control device (1, 2) are arranged to switch a current into or not into the at least one electro-pneumatic actuator (5; 15) via the switching devices (6; 16, 17), wherein d) at least one current flow blocking device (A, B; 18, 19; 20; 21) is provided which is configured to block, when one of the first and second control device units (1, 2) switches a current into the at least one electro-pneumatic actuator (5; 15), a current flow resulting from this switch-on to the electronic control unit (11, 12) of another of the first and second control device units (1, 2), and wherein e) the current flow blocking device (A, B) is designed as a first equalizing current protection module (A) and a second equalizing current protection module (B), each of which is a switching semiconductor circuit module and is configured to be connected in a positive path and a ground path and to prevent equalizing currents between voltage supplies via the control device devices (1 , 2), and each of which has only an output (AUS_rp, GND_fp) providing reverse polarity protection.

Description

[0001] The invention relates to a device according to claim 1.

[0002] A device described in US 2005 / 0035656A1 for decoupling and / or protecting against equalizing currents for use when at least one electro-pneumatic actuator is shared by a plurality of independently powered control units in redundant autonomous driving systems provides that the at least one electro-pneumatic actuator has a common connection via which the at least one electro-pneumatic actuator can be coupled to a common connection of other electro-pneumatic actuators, and at least one dedicated connection via which the at least one electro-pneumatic actuator can be individually powered; the plurality of control units has at least a first control unit comprising a first electronic control unit and a first number of switching devices corresponding to the number of dedicated connections of all electro-pneumatic actuators.and at least a second control unit comprising a second electronic control unit and a second number of switching devices corresponding to the common connection and the number of dedicated connections of all electro-pneumatic actuators, and comprising at least a first and second control unit configured to switch a current into or against the at least one electro-pneumatic actuator via the switching devices. At least one current-flow blocking device is configured to prevent, when one of the first and second control units switches a current into the at least one electro-pneumatic actuator, any current flow resulting from this switching to the electronic control unit of another of the first and second control units.

[0003] US 6,121,693 A discloses a power distribution system that includes devices with a shared power bus. Supply disconnectors isolate the power supply from the shared power bus in the event of a short circuit at the power supply output. Load disconnect switches isolate the power supply from other loads that could cause a short circuit or consume excessive output current. Memory and isolators are used to detect and store the occurrence of load or supply faults.

[0004] DE 10 2016 002 676 A1 discloses a method and a control device for controlling a pneumatic braking system for vehicles, in which at least one valve switch is provided for controlling at least its valve. Two-pole switching capability is also provided.

[0005] DE 10 2008 009 043 B3 describes an electronically controlled braking system with redundant control of the brake actuators, wherein a first control unit and a second control unit are provided.

[0006] DE 10 2005 062 907 B3 also describes a pressure-medium operated braking system with redundant control of the brake actuators.

[0007] DE 199 13 131 A1 describes a power supply system with two batteries of different voltages.

[0008] DE 101 50 379 A1 discloses a redundant power supply for safety-relevant consumers in an on-board network.

[0009] DE 36 24 455 A1 describes a power supply unit for motor vehicles, with several electrical control units that are individually protected by fuse elements.

[0010] In highly automated or autonomous vehicles, such as commercial vehicles, driver assistance systems control the vehicle and monitor its surroundings instead of a human driver. This is particularly true for vehicles that perform autonomous driving functions without a driver ready to intervene at any time (assistance functions from level 3 of a total of six levels 1 to 6; in level 3, which refers to highly automated driving, an underlying system takes over longitudinal and lateral control in a specific use case, recognizes system limits, and prompts a driver to take over with sufficient time.The driver no longer needs to constantly monitor the vehicle or system, but must potentially be able to take control. Brake systems, for example, must still be able to actuate pressure control valves (PCVs) even in the event of a fault in an electrical control circuit, in order to continue to perform electrically controlled functions such as ABS, ESP, steering brakes, and the like. However, in the event of a fault, such as a component failure, the driver may no longer be able to intervene, or at least not quickly enough, and regain control of the vehicle.

[0011] For safety reasons, critical electronic systems are therefore designed with redundancy. For example, redundancy of a power supply is ensured via several, for example two, independent voltage sources, which usually share a common ground, or in vehicles several, for example two, independent electrical control circuits for the brake control are arranged with a common ground (vehicle ground).

[0012] In a compressed air brake system, this particularly concerns the brake system's electronics (i.e., the control units) as well as the control of electro-pneumatic actuators, e.g., solenoid valves or pressure control valves. While in a known system the electronics are redundantly designed through two separate control units, for many electro-pneumatic valves it is sufficient to connect a valve to two redundant brake system control units and to control such valves from one or the other control unit depending on the situation.

[0013] Fig. Figure 1 schematically and partially shows the setup of a system of the applicant with two brake control units, the first being a main brake control unit and the second a backup brake control unit, both of which access solenoid valve coils. The coils are controlled via semiconductor drivers or semiconductor switches, all of which are supplied via a common power supply and ground path.

[0014] Due to the connection via the contacts of the shared solenoid valves, detrimental equalizing currents can occur between the two power supplies. These equalizing currents are caused by voltage differences between the power supplies or a ground offset (i.e., a voltage difference between the ground inputs). The current then flows through switched MOSFETs in one control unit and the inverse diode or body diode of the MOSFET in the other control unit.

[0015] Fig. Figure 2 illustrates, by way of example, the occurrence of equalizing currents in such a system with shared solenoid valves without further protective measures.

[0016] Furthermore, if multiple independent control circuits are present for the brake control, it must be ensured that a fault in one of the control circuits does not adversely affect another control circuit. In particular, a single fault must not lead to the simultaneous failure of all, for example, both, control circuits.

[0017] In a known arrangement, a pressure control valve consists, for example, electrically of two solenoid valves, each with a common port and its own separate port. An electronic control unit has a switch that can be used to control the common ports of all solenoid valves, and a dedicated switch for each solenoid valve to allow them to be energized individually.

[0018] The switches can be implemented as electronic output stages controlled by a logic unit of the electronic control unit. A distinction is made between output stages that connect the supply lines of the solenoid valves to a positive potential (+) (highside) and output stages that connect the return lines of the solenoid valves to a negative potential (-) or ground potential (lowside). The output stage that switches one of the two paths for multiple solenoid valves can be a highside or a lowside output stage (common ground). For simplicity, a negative or lowside connection is assumed in the following. A dual-sided disconnection capability is necessary to prevent unintentional energizing of a solenoid valve, even in the event of a short circuit in one of the supply lines to the power supply or ground, or due to a short circuit (i.e., a short circuit between the emitter and collector, for example, caused by overheating and thus destroyed).

[0019] To detect other faults, especially short circuits between a supply and a return line, between a return line and the supply and between the return line and ground, as well as cable breaks, electrical values ​​(voltages at the connections, excessive currents) are usually monitored permanently and test pulses are applied to the magnets from time to time and the electrical response is evaluated.

[0020] If a pressure control valve is actuated by two or more electronic control units, then when one of the electronic control units sends test pulses to a magnet, the permanent monitoring in another electronic control unit would be triggered and falsely detect a fault. Furthermore, if two electrical circuits share a common ground (-), a ground offset between two controlling electronic control units can lead to the destruction of one or both of the electronic control units. Additionally, a defective electronic control unit can be unintentionally supplied "backwards" if, for example, it has been disconnected from its supply voltage due to a fault.If the defective electronic control unit has a short circuit to ground in its power supply, a current flowing from an intact electronic control unit to the solenoid valve can be short-circuited. This occurs because the parasitic diode of the high-side output stage of the defective electronic control unit allows current from the intact electronic control unit to pass through when the latter switches on the solenoid valve. This could lead to unintended and potentially dangerous activity of the first, defective electronic control unit and / or prevent the solenoid valve of the relevant pressure control valve from switching. Alternatively, due to the excessive current flow, it could also destroy the second electronic control unit, thereby eliminating the necessary redundancy.

[0021] If a power stage for the individual current supply of a solenoid valve is connected in an electronic control unit, it is not sufficient for only this electronic control unit to switch off the corresponding opposite-polarity, common power stage, because in this case the current would flow through the opposite-polarity, common power stage of the other electronic control unit and unintentionally activate the solenoid valve.

[0022] Based on the aforementioned problem, the present invention aims to prevent equalizing currents between power supplies via the control units in a compressed air brake system with redundant control units that share solenoid valves, even without galvanic isolation and while complying with safety requirements. Furthermore, the invention is intended to ensure that a fault in one control circuit does not affect another control circuit in a compressed air brake system.

[0023] This problem is solved according to the invention by the features of claim 1. Disclosure of the invention

[0024] The invention is based on the general idea of ​​a device for decoupling and protecting against equalizing currents when electro-pneumatic actuators are used jointly by two independently powered control units in redundant systems for autonomous driving.

[0025] The device for decoupling and protection against equalizing currents includes two modules (semiconductor circuit modules) and / or diodes or functionally equivalent elements or components configured as current blocking devices to be connected in the positive and ground paths, and which make it possible to prevent equalizing currents and other unwanted currents between power supplies via control units, even without galvanic isolation and while complying with safety requirements.

[0026] The modules are preferably designed as switching devices or switches that are directly inserted into the power supply path or the ground path. The modules are actuated via several control lines. When all control lines are activated, the modules behave as closed switches. Otherwise, the modules behave as open switches, with the internal circuit arrangement of the modules providing the aforementioned protective functions.

[0027] Furthermore, the modules are available in various configurations, each of which can be configured to meet specific safety requirements. For example, the modules can be configured to meet simpler to more stringent safety requirements, such as a predetermined tolerance for individual short circuits in internal MOSFETs or short circuits in downstream high-side or low-side solenoid valve drivers. In addition, the modules preferably also provide a tap for circuit sections that are not shared and only require protection against reverse polarity of the control unit supply voltage.

[0028] The device according to the invention for decoupling and / or protecting against equalizing currents for use in the joint use of at least one electro-pneumatic actuator by a plurality of independently powered control unit devices in redundant systems for autonomous driving provides that the at least one electro-pneumatic actuator has a common connection via which the at least one electro-pneumatic actuator can be coupled and switched with a common connection of other electro-pneumatic actuators, and at least one dedicated connection via which the at least one electro-pneumatic actuator can be individually powered; the plurality of control unit devices has at least one first control unit device,The device comprises a first electronic control unit and a first number of switching devices corresponding to the common connection and the number of dedicated connections of all electro-pneumatic actuators, and at least a second control unit comprising a second electronic control unit and a second number of switching devices corresponding to the common connection and the number of dedicated connections of all electro-pneumatic actuators, and the at least first and second control units being configured to switch a current into or against the at least one electro-pneumatic actuator. At least one current-flow blocking device is configured to switch a current into the at least one electro-pneumatic actuator whenever one of the first and second control units switches a current into it.to prevent a current flow resulting from this control input to the electronic control unit of another of the first and second control unit devices. Furthermore, the current flow blocking device is designed as a first equalizing current protection module and a second equalizing current protection module, each of which is a switching semiconductor circuit module and is configured to be connected in a positive path and a ground path and to prevent equalizing currents between voltage supplies via the control unit devices, and each of which only provides reverse polarity protection.

[0029] The features according to the invention, as described above, particularly advantageously prevent a voltage offset or a ground offset from leading to an unwanted current flow between control units and / or electronic control units in a redundantly designed system, such as a braking system for autonomous driving. This in turn advantageously prevents one or all of the electronic control units from being destroyed due to the unwanted current flow, or from a defective electronic control unit being unintentionally supplied "backwards" if, for example, it is disconnected from its supply voltage due to a fault, or from the current being short-circuited from an intact electronic control unit to a solenoid valve if a defective electronic control unit has a short circuit of its supply to ground.Overall, it is advantageous that the redundancy required for the autonomous system can be maintained even in the event of a fault or in the case of unsuitable voltage and / or mass conditions using the features according to the invention.

[0030] The measures listed in the dependent claims enable advantageous further developments and improvements of the invention specified in the independent claims.

[0031] Preferably, the first and second control unit assemblies comprise a main brake control unit with the first electronic control unit and a backup brake control unit with the second electronic control unit, and the at least one electro-pneumatic actuator comprises a solenoid valve or a pressure control module containing solenoid valves, wherein the first and second control unit assemblies are arranged to access coils of the solenoid valves and the pressure control modules together, wherein the coils are configured to be controlled via the switching devices, and wherein the switching devices include semiconductor switches configured to be supplied via a common power supply and ground path.

[0032] It is also preferred that the switching devices are configured as electronic output stages arranged to be controlled by a logic unit of the first or second electronic control unit, wherein an output stage is an output stage that connects the supply lines of an electro-pneumatic actuator to a positive potential, or an output stage that connects the return lines of the electro-pneumatic actuator to a negative potential or ground potential.

[0033] It is also particularly preferred that the first equalizing current protection module has an input, three separate control inputs for controlling internal control switches in a MOSFET gate control of switching MOSFETs provided in the module, a fully protected output, an output providing reverse polarity protection, a ground connection and a charge pump, wherein the gate control lines are decoupled from each other to protect against failures caused by individual short-circuit faults of the MOSFETs.

[0034] It is also particularly preferred that the second equalizing current protection module has an input, three separate inputs for controlling internal control switches in a MOSFET gate drive of switching MOSFETs provided in the module, a fully protected output, an output providing reverse polarity protection and a ground connection, wherein the gate drive lines are decoupled from each other to protect against failures caused by individual short-circuit faults of the MOSFETs.

[0035] Advantageously, it is provided that in the first and second balancing current protection modules, the orientation of the MOSFETs is determined internally by the orientation of the MOSFETs in downstream high-side and low-side drivers of drivers for at least one electro-pneumatic actuator, and that the MOSFETs of the first and second balancing current protection modules are interconnected such that two body diodes of two respective MOSFETs are connected in opposite directions and provide direct protection against reverse currents, and that a third MOSFET of the first and second balancing current protection modules is oriented in such a way that it provides redundant reverse current protection.

[0036] Preferably, the current flow blocking device can be designed as a diode arranged at a terminal of each of the switching devices.

[0037] In this case, the diode can preferably be arranged inside or outside the first and second control units.

[0038] In this case, it may alternatively be preferred that several diodes are arranged in a diode circuit arrangement forming a T-piece, which operates equivalently to a single diode.

[0039] Alternatively, it may be preferred in this case that a diode is arranged as the current blocking device in a common current path section between the switching devices and the electronic control units.

[0040] Alternatively, in this case it may be preferred that, on the supply potential side, a reverse-polarized and actively switched output stage is arranged as the current blocking device in a common current path section between the switching devices and the first and second electronic control units, and that, on the ground potential side, a diode is arranged as the current blocking device in a common current path section between the switching devices and the first and second electronic control units.

[0041] Alternatively, in this case it may be preferred that, on the supply potential side, a reverse-polarized and actively switched output stage is arranged as the current blocking device in a common current path section between the switching devices and the first and second electronic control units, and on the ground potential side, a reverse-polarized and actively switched output stage is arranged as the current blocking device.

[0042] Furthermore, it may be preferable and advantageous in the device that the first and second electronic control units are configured to disable the switching devices of both a positive and a negative line when no electro-pneumatic actuator is to be energized; in fault-free operation in accordance with predetermined criteria, only one of the first and second electronic control units takes over the control of the at least one electro-pneumatic actuator; an electronic control unit of the first and second electronic control units in a passive state is configured not to actively energize an electro-pneumatic actuator for testing purposes;and the electronic control unit in the passive state is configured to switch to an active state in the event of a fault in an active control unit of the first and the second electronic control units, which prevents further operation of the active control unit, and to take over the control of the electro-pneumatic actuator as the new active electronic control unit instead of the faulty electronic control unit; wherein the electronic control unit in the passive state is configured to monitor voltage levels on its lines to the at least one electro-pneumatic actuator, to validate this monitoring with information transmitted to it from the active electronic control unit regarding a momentary control of the at least one electro-pneumatic actuator, and to monitor the safe locking of the current-locking device.

[0043] The invention relates not only to the device described above for decoupling and protecting against equalizing currents in a redundant autonomous driving system, but also to a method for controlling and / or operating such a device. As mentioned above, a braking system in which the device can be installed and the method can be carried out can be electrically, hydraulically, pneumatically, electro-hydraulically, or electro-pneumatically actuated. The braking system can be a braking system of a passenger car or a commercial vehicle (tractor unit and / or trailer) and can be of any type and, in particular, be electrically, hydraulically, pneumatically, electro-hydraulically, or electro-pneumatically actuated. The invention thus extends to all types of vehicles, in particular also to passenger cars, commercial vehicles, or heavy commercial vehicles.

[0044] The control unit can be formed by a separate control unit or by an existing electronic control unit, in particular by a vehicle control unit, a brake control unit of the braking system or by the control unit of an electro-pneumatic brake control module.

[0045] Advantageous further developments of the invention are described in the claims, the description, and the drawings. The advantages of features and combinations of features mentioned in the introduction to the description are merely examples and can have an effect alternatively or cumulatively, without the advantages necessarily having to be achieved by embodiments of the invention.

[0046] Identical or similarly functioning components and assemblies are designated with the same reference numbers in different embodiments. drawing

[0047] Exemplary embodiments of the invention are shown in the drawing and explained in more detail in the following description. It should be noted that the drawing schematically and in part depicts components of a known compressed air brake system (a compressed air brake assembly) for vehicles, such as those used in commercial vehicles. Therefore, reference is made to components of the compressed air brake system or the compressed air brake assembly only to the extent that their description and explanation contribute to a better understanding of the invention. Furthermore, for the sake of clarity, identical or at least similar components are not repeatedly designated with the same reference numbers in the drawing; instead, a single reference number may be given as an example and representative of such identical or at least similar components.

[0048] The drawing shows Fig. 1 a schematic diagram of a part of a redundantly designed compressed air brake system with two control units, more precisely a main control unit and a backup control unit, as well as a plurality of solenoid valves used jointly by both control units; Fig. 2 examples of compensating currents between in Fig. 1 power supplies shown; Fig. 3 den in Fig. 1 shown part of a redundantly designed compressed air brake system, in which, according to an embodiment, a first compensating current protection module A is further arranged in a positive supply path and a second compensating current protection module B is arranged in the ground supply paths to protect against compensating currents between the independent voltage supplies; Fig. 4 Details of the exemplary first equalizing current protection module A according to Fig. 3 for protection against equalizing currents in the positive supply path; Fig. 5 Details of the exemplary second equalizing current protection module B according to Fig. 3 for protection against mass equalization currents; Fig. 6 Details of a modification of the exemplary first balancing current protection module A according to Fig. 3 in an extended expansion stage to protect the Plus supply path with increased security measures; Fig. 7 Details of a modification of the exemplary second balancing current protection module B according to Fig. 3 in an extended development stage with exemplary additional safety measures; Fig. 8 Details of a further modification of the exemplary second equalizing current protection module B in a simplified expansion stage Fig. 9 a simplified and excerpted representation of a redundantly designed compressed air brake system with an arrangement of a current blocking device according to a second embodiment; Fig. 10 an alternative arrangement of the power cut-off device according to Fig. 9; Fig. 11 another alternative arrangement of the power cut-off device according to Fig. 9; Fig. 12 another alternative arrangement of the power cut-off device according to Fig. 9; and Fig. 13 another alternative arrangement of the power cut-off device according to Fig. 9. Description of the exemplary embodiments: First exemplary embodiment

[0049] In Fig. Figure 1 shows a schematic diagram of a part of a redundant compressed air brake system for, for example, a vehicle with multiple control unit installations, here at least two control units and more precisely a main control unit (first control unit) 1 and a backup control unit (second control unit) 2, as well as a plurality, for example a first, a second and a third, of solenoid valves 5 used jointly by both control units 1, 2.

[0050] Each pin of the solenoid valves 5 is connected to both the main control unit 1 and the backup control unit 2. The main control unit 1 is supplied by a first power supply 4 at a predetermined potential relative to vehicle ground, and the backup control unit 2 is supplied by a second power supply 3 at the same predetermined potential relative to vehicle ground. The main and backup control units 1 and 2 are arranged and configured to act as switches, as required, on switching devices 6 located in the power supply path and the ground path, for example, suitable MOSFETs or other suitable power switches or output stages.

[0051] In the Fig. In the exemplary brake scheme shown in 1, the first control unit 1, i.e. the main control unit, can be a first electronic control unit or ECU (in Fig. 1 not shown) which may be part of a “standard” EBS system or electronic braking system, and may include the second control unit 2, i.e. the backup control unit, a second electronic control unit or ECU (in Fig. (1 not shown) includes a component that controls an iFBM (foot brake module with integrated magnet) as a backup system. The two electronic control units in the two control units 1 and 2 are connected to the power supplies 3 and 4, respectively, and can communicate with each other and with other vehicle systems via a data bus (not shown). Control units 1 and 2 together form control unit assemblies.

[0052] It goes without saying that the in Fig. The part of a compressed air brake system shown in Figure 1 can be part of a brake system or braking assembly of any vehicle, such as a commercial vehicle as a towing vehicle and / or its trailer, and the compressed air brake system can be of a type known per se and, in particular, be electrically, hydraulically, pneumatically, electro-hydraulically, or electro-pneumatically actuated. It is further understood that the number, configuration, and arrangement of the control units 1, 2, the solenoid valves 5, and the switches 6 are not limited to the number, configuration, and arrangement used herein as examples, as long as the effects and advantages of the invention can be achieved in a corresponding number, configuration, and arrangement. Details of the compressed air brake system known per se have been omitted from the following description for the sake of simplicity, insofar as they do not contribute to a better or easier understanding of the invention.

[0053] Fig. Figure 2 shows examples of compensating currents that flow between the in Fig. The following can occur in the voltage supplies 3 and 4 shown in Figure 1. As soon as one of the control units 1, 2 closes at least one of the switches 6 in the supply and ground paths and a correspondingly predetermined current (a) flows, in situations where, in each case in the forward direction of the body diode, there is a voltage difference between the first voltage supply 4 and the second voltage supply 3 (case (b)) or a ground offset between the ground pins of the two control units 1, 2 (case (c)), compensating currents (b), (c) can flow in the other control unit via the body diodes of the MOSFETs forming the switches 6.

[0054] Fig. 3 shows the one in Fig. Figure 1 shows the part of the redundant compressed air brake system depicted, and illustrates the overall structure of such a system. The following Fig. 4, Fig. 5, Fig. 6, Fig. 7 to Fig. 8 point to Fig. 3 building upon the circuit details of the two modules A, B for the positive supply path (A) and the ground path (B) in various expansion stages.

[0055] As in Fig. Figure 3 shows that, according to one embodiment, a first equalizing current protection module A is arranged in a positive supply path and a second equalizing current protection module B is arranged in the ground supply paths to protect against equalizing currents between the independent voltage supplies 3, 4. Fig. In this embodiment, the compensating current protection modules A and B are preferably integrated into the control units 1 and 2. It is understood that each configured number of compensating current protection modules corresponds to a configured number of control units.

[0056] Fig. Figure 4 shows details of an exemplary first equalizing current protection module A according to Fig. 3 for protection against equalizing currents in the positive supply path, and as such shows a basic variant of both modules A and B.

[0057] The in Fig. The first balancing current protection module A shown in Figure 4 has, more precisely, an input ON, three separate control inputs for controlling internal control switches (designated CTRL_1, CTRL_2, and CTRL_3) in a MOSFET gate drive configuration in this embodiment, for example, a fully protected output OFF_fp, an output OFF_rp providing only reverse polarity protection, a ground connection GND, and a charge pump 7. Preferably, to protect against failures caused by individual short-circuit faults of the MOSFETs, the gate drive lines are decoupled from each other. A suitable decoupling is provided in Fig. 4 indicated by a diode 9 in each of the individual gate lines.

[0058] Fig. Figure 5 shows details of an exemplary second equalizing current protection module B according to Fig. 3 for protection against mass equalization currents.

[0059] The in Fig. The second compensating current protection module B, shown in Figure 5, has an ON input, three separate inputs for controlling internal control switches (designated CTRL_1, CTRL_2, and CTRL_3) in a MOSFET gate drive configuration (for example), a fully protected GND_fp output, a GND_rp output providing only reverse polarity protection, and a ground connection GND. Preferably, to protect against failures caused by individual short-circuit faults of the MOSFETs, the gate drive lines are decoupled from each other. A suitable decoupling is provided in Fig. 5 is indicated by a diode 9 in each of the individual gate lines.

[0060] In this basic variant, the first and second equalizing current protection modules A and B, when in an open switch state, provide reverse polarity protection and equalizing current protection that is tolerant to individual MOSFET short-circuit faults.

[0061] The circuit arrangement of the first and second equalizing current protection modules A and B according to Fig. Each module is based on three power MOSFETs. An important design criterion is the orientation of the power MOSFETs, with the module-internal orientation determined by the orientation of the power MOSFETs in downstream high-side and low-side drivers of the solenoid valve drivers. A preferred design objective is to connect the power MOSFETs of the first and second equalizing current protection modules A and B such that two body diodes of the power MOSFETs are connected in opposite directions, providing direct protection against reverse currents. The third power MOSFET of the first and second equalizing current protection modules A and B is oriented to provide redundant reverse current protection in conjunction with the high-side or low-side driver for the solenoid valve control output. This ensures that the protection against equalizing currents is not lost due to a single short circuit of a power MOSFET.In addition to choosing the orientation of the MOSFETs, various combinations of the order of the power MOSFETs are also possible, depending on desired circuit characteristics, which may be determined by, for example, test and / or monitoring circuits.

[0062] The internal control of the power MOSFETs in the first and second balancing current protection modules A and B is in Fig. Figure 4 schematically indicates the switching via switch modules and the charge pump 7 (first balancing current protection module A) or a voltage converter (DC / DC in the second balancing current protection module B). Technically, the switching voltage for the power MOSFETs can be achieved by switching the gate-source voltage using a bipolar transistor circuit. A sufficiently high gate-source voltage for the power MOSFETs can be generated in the first balancing current protection module A, for example, by one or, depending on the safety requirements, several charge pumps. However, there is no limitation to this, and other implementations are also conceivable. Parts of the charge pump, such as the generation of the high-frequency drive signal, can also be externalized and, for example, provided by a microcontroller.In the second equalizing current protection module B in the ground path, lower voltages are sufficient, which can either be directly coupled in or converted again (to a lower voltage) by an internal voltage converter (DC / DC). Other implementations are also conceivable here.

[0063] To decouple the power MOSFETs from each other even in the event of short circuits, each gate is decoupled from the gate voltage supply by a diode 9. Additionally, the three separate control inputs STRG_1 to STRG_3 allow the power MOSFETs to be individually controlled by a microcontroller. If lower safety requirements are sufficient, several or all of the control inputs STRG_1 to STRG_3 can be connected and switched together.

[0064] For the sake of clarity, additional test and diagnostic circuits are not shown. However, in a practical implementation, they are preferably provided and arranged for both the first and second equalizing current protection modules A and B, as well as for the high-side and low-side drivers at the outputs of the solenoid valves 5, to ensure sufficient diagnostic coverage of the switches 6, the equalizing current protection, and the reverse polarity protection.

[0065] Fig. Figure 6 shows details of a modification of the exemplary first balancing current protection module A according to Fig. 3 or Fig. 4 in a modification as an extended expansion stage with increased safety measures, in which an additional redundant charge pump 8 is arranged and configured to protect the plus supply path and to provide protection against failures due to a single fault in the internal charge pump 7.

[0066] Fig. Figure 7 shows details of a modification of the exemplary second balancing current protection module B according to Fig. 3 in an extended development stage with exemplary additional safety measures for multiple available control unit supply and / or ground pins. According to this modification, if a voltage offset between a ground input GND_1 and a ground input GND_2 is below the diode forward voltage of diode 9, a redundant ground input can be configured to provide protection against, for example, a line failure.

[0067] The in Fig. 6 and Fig. The seven modifications shown for the first and second compensating current protection modules A and B provide even more extensive protection against various fault conditions.

[0068] Thus, according to Fig. 6. Additional protection against possible individual faults in the internal charge pump 7 can be achieved by arranging several separate charge pumps 7, 8.

[0069] Furthermore, if multiple supply or ground pins are available on the first and second control units 1 and 2, the first and second equalizing current protection modules A or B with redundant inputs can be controlled. This provides protection against an open circuit on a pin or against a fuse blowing in one of the control unit supply paths. Fig. Figure 7 shows an example of a circuit arrangement for the second equalizing current protection module B with two control unit ground pins. In the circuit arrangement shown in Fig. Note 7: The voltage offset between the two control unit ground pins must be below the forward voltage of the body diode of the power MOSFET. If higher voltage offsets are expected, this can be achieved through additional measures, e.g., additional MOSFETs.

[0070] Fig. Figure 8 shows details of a further modification of the exemplary second equalizing current protection module B according to Fig. 3 in a simplified version. This version uses only two MOSFETs, provides reverse polarity protection and decouples the output from ground as long as not all module-internal switches are closed.

[0071] As described above, in a compressed air brake system of the type described herein, it must be ensured that a fault in one of the control circuits does not, if possible, negatively affect another control circuit. The compensating current protection modules A and B described above cover faults induced by unwanted compensating currents. Second embodiment

[0072] Further fault scenarios are conceivable in the system under consideration. The following second embodiment addresses the objective that, in particular, not all, for example both, control circuits should be rendered completely inoperative by a single fault. The second embodiment can be presented both as an independent alternative and in combination with the first embodiment.

[0073] According to the second embodiment, diodes or functionally equivalent components or elements are arranged in electronic control units, in a wiring harness (for example, in plugs or sockets of pressure control valves or electronic control units), and / or in, for example, a special T-connector. During fault-free operation, only one of the electronic control units is responsible for controlling the pressure control valves. In all electronic control units, both the positive and negative leads are blocked as long as no solenoid valve needs to be energized.

[0074] As in Fig. As shown in Figure 9, according to the second embodiment, an electro-pneumatic actuator, e.g., a pressure control valve 15, consists electrically of two solenoid valves 5, each having one common and one individual connection. A first controlling electronic control unit (ECU) 11 and a second controlling electronic control unit (ECU) 12 each have a switching device 16 for switching the common connections of all solenoid valves 5 and a switching device 17 for each solenoid valve 5 for its individual energizing. The switching devices 16 and 17 can, for example, be configured as electronic output stages controlled by a logic unit (not shown) in the first electronic control unit 11 and the second electronic control unit 12.

[0075] A distinction is made between output stages that connect the supply lines of the solenoid valves 5 to positive (+) (highside) and output stages that connect the return lines of the solenoid valves 5 to negative (-) or ground (lowside). An output stage that switches one of the two paths for several solenoid valves 5 simultaneously can be a highside output stage or a lowside output stage (common ground). For the purposes of this description, a negative connection (lowside) is assumed.

[0076] A dual-sided disconnection capability is necessary to prevent unwanted current flow to a solenoid valve 5, even in the event of a short circuit in one of the supply lines to the supply voltage or ground, or due to a shorted output stage. Furthermore, to detect other faults in a timely manner, such as short circuits between the supply and return lines, short circuits between the return line and the supply voltage, and between the return line and ground, as well as any cable breaks, electrical values ​​(e.g., voltages at the terminals, excessive currents) are continuously monitored, and test pulses are periodically applied to the solenoids, and the electrical response is evaluated.

[0077] As in Fig. As shown in Figure 9, according to the second embodiment, a diode 18 and a diode 19 are arranged at the respective connection of the switching devices 16 (i.e., the output stages) in the direction of the solenoid valves 5 or their respective connection to the power supply or ground.

[0078] In the second embodiment according to Fig. 9 the diodes 18, 19 are arranged within the first and second control units 1, 2, indicated by a broken line.

[0079] It is noted that these diodes 18, 19 in corresponding modifications of the second embodiment are located outside the first and second control units 1, 2 ( Fig. 10), by a diode circuit arrangement 20 operating equivalently to a single or separately arranged diode ( Fig. 11), through a common current path section between the switching devices 16, 17 and the electronic control units 11, 12 respectively ( Fig. 12) and / or by an additional, reverse-polarized and actively switched output stage 21 in conjunction with a diode 19 ( Fig. 13) can be replaced. In the latter modification, it is also conceivable to replace diode 19 with a correspondingly additional actively switched output stage.

[0080] The diodes 18, 19, the circuit arrangement 20 operating equivalently to a single diode and / or an additional, reverse-polarized and actively switched output stage 21 are configured to prevent, in the event of a fault, a current from flowing in an undesired or unintended direction into the electronic control units 11, 12 via the connecting line to the pressure control valve 15 and causing damage through connections to the other electronic parts of the electronic control units 11, 12.

[0081] This advantageously prevents a ground offset between the two controlling electronic control units 11, 12 from leading to the destruction of one or both of the electronic control units 11, 12 when both electrical circuits have a common ground (-), and prevents a defective electronic control unit 11, 12 from being unintentionally supplied "backwards" if, for example, it is disconnected from its supply voltage due to a fault, or prevents the current from being short-circuited from an intact electronic control unit to the solenoid valve 5 if a defective electronic control unit has a short circuit of its supply to ground, since the parasitic diode of the high-side output stage of the defective electronic control unit would allow the current from the intact ECU to pass through when this intact electronic control unit switches on the solenoid valve 5.In such a fault scenario, the defective electronic control unit could engage in unintended and potentially dangerous activities, and the solenoid valve of the relevant pressure control valve 15 could be prevented from switching, or the intact electronic control unit could also be destroyed due to excessive current flow. In such a case, the required redundancy would no longer be present.

[0082] According to the second embodiment, in both electronic control units 11, 12, the switching devices 6 and the output stages of both the positive and negative lines are always blocked when no solenoid valve 5 needs to be energized. In fault-free operation, only one of the electronic control units 11, 12 is defined as controlling the pressure control valves 15. This distribution of tasks can be maintained during fault-free operation or changed cyclically or according to other predetermined criteria, for example, criteria configured to harmonize the thermal load on the output stages.

[0083] Furthermore, an electronic control unit in a passive state does not actively energize a solenoid valve 5 for testing purposes as long as it remains in passive mode. This prevents the output of test pulses to a solenoid and advantageously avoids triggering the values ​​of a permanent monitoring system in another electronic control unit and thus preventing unjustified fault detection.

[0084] The electronic control unit in a passive state can optionally monitor the voltage levels on its lines to the pressure control valves 15 and, if necessary, verify them with information transmitted from the active electronic control unit via a digital interface, e.g., a CAN bus, regarding the current actuation of the solenoid valves. In particular, this allows for monitoring the reliable blocking of diodes 18 and 19, for example, when diodes 18 and 19 are connected in circuits within the electronic control unit, as in Fig. 9 and Fig. 12 are shown arranged.

[0085] If a currently active first electronic control unit, for example the first electronic control unit 11, is no longer able to control the pressure control valves 15 for any reason (e.g., after a loss of supply voltage, due to an electrical fault within the electronics, e.g., due to a shorted output stage, a broken cable in a line to a pressure control valve 15), a previously passive second electronic control unit, for example the second electronic control unit 12, now becomes the active electronic control unit and henceforth takes over the control of the pressure control valves 15, insofar as this is still possible. For this purpose, this second electronic control unit 12, which switches from the passive state to the active state, can, for example, be activated by a failure of communication with or...The first electronic control unit 11 can either detect on its own that the previously active first electronic control unit 11 has failed. Alternatively, the previously active first electronic control unit 11, or another electronic control unit that has detected the fault in the previously active first electronic control unit 11, can notify the second electronic control unit 12 of the detected fault.

[0086] The second, now active, electronic control unit 12 can then detect, based on the voltage levels on its lines, whether a short circuit exists or whether one of the dedicated (individual) output stages in the no longer active first electronic control unit 11 has shorted out. In these cases, continued operation of the pressure control valves 15 is no longer possible, because switching on the common switching device 17 would immediately and unintentionally activate a solenoid valve 5. The active electronic control unit therefore terminates the operation of the pressure control valves 15 in these cases.

[0087] If none of the aforementioned fault conditions exist, i.e., if there is no short circuit or short circuit in a power stage, the active electronic control unit can pulse-switch on the common switching device 17 and one or more of the dedicated switching devices 16 to detect a fault based on excessive current flow. A short circuit to ground or a short circuit in the common switching device 16 or power stage of a faulty electronic control unit can be detected by the fact that, when the corresponding dedicated switching device or power stage is pulse-switched on with the common switching device or power stage switched off, no voltage is present on the return line upstream of the common switching device or power stage.

[0088] If one of the aforementioned faults is detected, continued operation of the pressure control valve 15 or pressure control valves 15 is not possible. This is because, in the case of a short circuit to the dedicated line of a solenoid valve 5 in an electronic control unit, it would be counterproductive for only this electronic control unit to switch off the corresponding opposite-polarity common-mode output stage, as the current would then flow through the opposite-polarity common-mode output stage of the other electronic control unit, unintentionally activating the solenoid valve. Therefore, in the aforementioned fault cases, the now active electronic control unit terminates the operation of the pressure control valve(s).

[0089] In the other fault cases of a short circuit to ground or a shorted common output stage of a defective electronic control unit, the operation of the pressure control valves 15 can, if necessary, be continued for a limited time by the active electronic control unit, which has taken over the operation of the pressure control valves 15 in place of the defective electronic control unit.

[0090] It is noted that for each detected fault, a corresponding error message may be generated, unless this has already been initiated by the defective electronic control unit or another monitoring system provided and configured for this purpose.

[0091] As described above, the invention relates to a device for decoupling and / or protecting against equalizing currents for use in the shared use of at least one electro-pneumatic actuator 5, 15 by a plurality of independently powered control unit devices 1, 2 in redundant systems for autonomous driving. The electro-pneumatic actuator 5, 15 has a common connection via which the electro-pneumatic actuator can be coupled and switched with a common connection of other electro-pneumatic actuators 5, 15, and at least one dedicated connection via which the at least one electro-pneumatic actuator 5, 15 can be individually powered.A number of switching devices 6, 16, 17 corresponding to the common connection and the number of dedicated connections of all electro-pneumatic actuators 5, 15 is arranged to switch a current into or out of the at least one electro-pneumatic actuator 5, 15. The invention provides at least one current flow blocking device A, B, 18, 19, 20, 21, which is configured to prevent an unwanted current flow to an inactive electronic control unit 11, 12 of the first and second control device units 1, 2. REFERENCE MARK LIST 1 First control unit setup (first control unit, main control unit) 2 Second control unit setup (second control unit, backup control unit) 3 First power supply 4 Second power supply 5 solenoid valve 6 Switching device (switch, power stage) 7 Charge pump 8 Charge pump 9 diode 11 First electronic control unit 12 Second electronic control unit 15 Pressure control valve 16 Switching device (switch, power stage) 17 Switching device (switch, power stage) 18 Diode 19 Diode 20 diode circuit arrangement (T-piece) 21 Power stage A First compensating current protection module B Second compensating current protection module µC Microcomputer

Claims

[1] Device for decoupling and / or protecting against equalizing currents for use in the joint use of at least one electro-pneumatic actuator (5; 15) by a plurality of independently powered control unit devices (1, 2) in redundant systems for autonomous driving, wherein a) the at least one electro-pneumatic actuator (5; 15) has a common connection via which the at least one electro-pneumatic actuator can be coupled and switched with a common connection of other electro-pneumatic actuators (5; 15), and at least one dedicated connection via which the at least one electro-pneumatic actuator (5; 15) can be individually powered, b) the plurality of control device units (1, 2) comprising at least a first control device unit (1) comprising a first electronic control unit (11) and a first number of switching devices (6; 16, 17) corresponding to the common connection and the number of dedicated connections of all electro-pneumatic actuators (5; 15), and at least a second control device unit (2) comprising a second electronic control unit (12) and a second number of switching devices (6; 16, 17) corresponding to the common connection and the number of dedicated connections of all electro-pneumatic actuators (5; 15), and c) the at least one first and second control device (1, 2) are arranged to switch a current into or not into the at least one electro-pneumatic actuator (5; 15) via the switching devices (6; 16, 17), wherein d) at least one current flow blocking device (A, B; 18, 19; 20; 21) is provided which is configured to block, when one of the first and second control device units (1, 2) switches a current into the at least one electro-pneumatic actuator (5; 15), a current flow resulting from this switch-on to the electronic control unit (11, 12) of another of the first and second control device units (1, 2), and wherein e) the current flow blocking device (A, B) is designed as a first equalizing current protection module (A) and a second equalizing current protection module (B), each of which is a switching semiconductor circuit module and is configured to be connected in a positive path and a ground path and to prevent equalizing currents between voltage supplies via the control device devices (1 , 2), and each of which has only an output (AUS_rp, GND_fp) providing reverse polarity protection. [2] Device according to claim 1, characterized by , that the first and second control unit assemblies (1, 2) comprise a main brake control unit (1) with the first electronic control unit (11) and a backup brake control unit (2) with the second electronic control unit (12), and the at least one electro-pneumatic actuator (5; 15) comprises a solenoid valve (5) or a pressure control module (15) comprising solenoid valves, wherein the first and second control unit assemblies (1, 2) are arranged to access coils of the solenoid valves (5) and the pressure control modules (15) in common, wherein the coils are configured to be actuated via the switching devices (6; 16, 17), and wherein the switching devices (6; 16, 17) include semiconductor switches configured to be supplied via a common supply and ground path. [3] Device according to claim 1 or 2, characterized by, that the switching devices (6; 16, 17) are configured as electronic output stages arranged to be controlled by a logic unit of the first or second electronic control unit (11, 12), wherein an output stage is, in each case, an output stage that connects the supply lines of an electro-pneumatic actuator to a positive potential, or an output stage that connects the return lines of the electro-pneumatic actuator to a negative potential or ground potential. [4] Device according to any one of the preceding claims, characterized by, that the first equalizing current protection module (A) has an input (ON), three separate control inputs for controlling internal control switches (STRG_1, STRG_2, STRG_3) in a MOSFET gate control of switching MOSFETs provided in the module, a fully protected output (OFF_fp), the reverse polarity protection output (OFF_rp), a ground connection (GND) and a charge pump (7), wherein the gate control lines are decoupled from each other to protect against failures caused by individual short circuit faults of the MOSFETs. [5] Device according to any one of the preceding claims, characterized by, that the second compensating current protection module (B) has an input (ON), three separate inputs for controlling internal control switches (STRG_1, STRG_2, STRG_3) in a MOSFET gate control of switching MOSFETs provided in the module, a fully protected output (GND_fp), the reverse polarity protection-providing output (GND_rp) and a ground connection (GND), wherein the gate control lines are decoupled from each other to protect against failures caused by individual short-circuit faults of the MOSFETs. [6] Device according to one of claims 4 or 5, characterized by, that in the first and second balancing current protection modules (A, B) the orientation of the MOSFETs is determined internally by the orientation of the MOSFETs in downstream high-side and low-side drivers of drivers for the at least one electro-pneumatic actuator, and that the MOSFETs of the first and second balancing current protection modules (A, B) are interconnected such that two body diodes of two respective MOSFETs are connected in opposite directions and provide direct protection against reverse currents, and that a third MOSFET of the first and second balancing current protection modules (A, B) is oriented such that it provides redundant reverse current protection. [7] Device according to one of the preceding claims, characterized by , that the current flow blocking device (18, 19) is designed as a diode (18; 19) arranged at a terminal of each of the switching devices (16, 17). [8] Device according to claim 7, characterized by, that the diode (18, 19) is arranged inside the first and second control unit devices (1, 2) or outside the first and second control unit devices (1, 2). [9] Device according to claim 7, characterized by , that several diodes (18, 19) are arranged in a diode circuit arrangement (20) forming a T-piece, which operates equivalently to a single diode (18, 19). [10] Device according to any one of claims 1 to 6, characterized by , that in each common current path section between the switching devices (16, 17) and each of the electronic control units (11, 12) a diode (18, 19) is arranged as the current blocking device (18, 19). [11] Device according to any one of claims 1 to 6, characterized by, that on the supply potential side in a common current path section between the switching devices (16, 17) and the first and second electronic control units (11, 12) a reverse-polarized and actively switched output stage (21) is arranged as the current blocking device (21), and on the ground potential side in a common current path section between the switching devices (16, 17) and the first and second electronic control units (11, 12) a diode (19) is arranged as the current blocking device (19). [12] Device according to any one of claims 1 to 6, characterized by, that on the supply potential side in a common current path section between the switching devices (16, 17) and the first and second electronic control units (11, 12) a reverse-polarized and actively switched output stage (21) is arranged as the current blocking device (21), and on the ground potential side in a common current path section between the switching devices (16, 17) and the first and second electronic control units (11, 12) a reverse-polarized and actively switched output stage (21) is arranged as the current blocking device (21). [13] Device according to any of the preceding claims, characterized by , that a) the first and second electronic control units (11, 12) are configured to block both the switching devices (6; 16, 17) of a positive and a negative line when no electro-pneumatic actuator (5; 15) is to be energized, b) in error-free operation in accordance with predetermined criteria, only one of the first and second electronic control units (11, 12) takes over the control of the at least one electro-pneumatic actuator (5; 15), c) an electronic control unit of the first and second electronic control units (11, 12) in a passive state is configured not to actively energize an electro-pneumatic actuator (5; 15) for testing purposes; and d) the electronic control unit in the passive state is configured to switch to an active state in the event of a fault in an active control unit of the first and the second electronic control units (11, 12), which prevents further operation of the active control unit, and to take over the control of the electro-pneumatic actuator (5; 15) as the new active electronic control unit instead of the faulty electronic control unit; wherein e) the electronic control unit in the passive state is configured to monitor voltage levels on its lines to the at least one electro-pneumatic actuator (5; 15), to validate this monitoring with information transmitted to it from the active electronic control unit regarding an instantaneous actuation of the at least one electro-pneumatic actuator, and to monitor the safe locking of the current-locking device.

Images