Battery system for safety-relevant systems

Abstract

Battery system (110) for a safety-related system of a vehicle, wherein the safety-related system (101) comprises at least one consumer and is connected via the battery system (110) to an on-board electrical system which has a power supply, wherein the battery system (110) comprises a battery management unit (115), an energy storage unit (111) with a fuse (112), a first terminal (102), a second terminal (103), and a first MOSFET switch (113, 303) and a second MOSFET switch (114, 304) connected in series, wherein the first MOSFET switch (113, 303) is connected to the first terminal (102), the second MOSFET switch (114, 304) is connected to the second terminal (103), and the connection between the first MOSFET switch (113, 303) and the second MOSFET switch (114, 304) is 304) is connected to the positive terminal of the energy storage unit (111), and wherein the battery management unit (115) is configured toby controlling the first MOSFET switch (113, 303) and the second MOSFET switch (114, 304) to perform safety management for the safety-related system (101) and the energy storage unit (111), wherein the safety management includes at least one of the following steps: • Opening the second MOSFET switch (114) when a fault occurs in the vehicle electrical system; • Opening the first MOSFET switch (113) and the second MOSFET switch (114) when an impermissible battery condition occurs, wherein the battery system (110) between the energy storage unit (111) and the common connection of the first and second MOSFET switches (113, 114) additionally includes a third MOSFET switch (216), which is configured bidirectionally, and wherein the battery management unit (115) is further configured to control the third MOSFET switch (216),where, in the event of an impermissible battery condition, the safety management optionally includes the following further step as an alternative to opening the first MOSFET switch (113) and the second MOSFET switch (114): • Opening the third MOSFET switch (216).

Description

The present invention relates to a battery system for safety-relevant systems, which is designed to continue to operate safety-relevant systems of a vehicle for a bridging time in the event of a fault in an on-board power supply system.Future driver assistance systems, abbreviated as ADAS, or highly automated driving, abbreviated as HAF, assume a safe and reliable power supply of safety-relevant control units. This necessitates the provision of redundant and fault-tolerant architectures and creates a need for control units aligned therewith, for example for current distribution in energy networks. The development relates to multiple and independent batteries or energy sources, smart and fault-tolerant current distribution concepts, a wide variety of fuses, safety switches and electrical fuses, and modular designs in order to equip correspondingly adapted vehicles with the safety measures. Furthermore, extended diagnostics are also necessary in order to be able to evaluate and certify the aforementioned control units according to the automotive safety integrity level, abbreviated as ASIL, or the standard ISO WD 26262.A fault-tolerant battery storage system is presented by the publication DE 10 2018 100 746 A1, which has two energy storage units. The two energy storage units can be connected either jointly or individually to an on-board power supply system by means of a cross-disconnect switching device without the respective other.The document DE 10 2017 104 958 A1 presents a battery storage system for the electrical supply of at least one vehicle function, which is connected redundantly via two supply branches to the battery storage system. Since the two supply branches can be separated from one another by circuitry, in the event of a fault in one of the two supply branches, the respective other can ensure further operation.Document DE 10 2015 121 946 A1 provides a drive train for a vehicle comprising an engine, a motor / generator either for providing power to the engine or as a generator, a starter mechanism coupled to the engine, a secondary supply, a first energy storage device connected in parallel with the starter mechanism and a second energy storage device connected in parallel with the motor / generator. Between the starter mechanism including the first energy storage device, the secondary supply and the motor / generator including the second energy storage device, a first switch and a second switch are arranged, which can each be configured bidirectionally.The document DE 10 2017 012 069 A1 relates to a semiconductor relay for bidirectional electronic power circuit, which has two field effect transistors and a control circuit. The two field effect transistors are connected anti-serially.US 2020 / 0 287 537 A1 describes a bidirectional switch for power control from an AC source to a load. The power switches used are MOSFETs which form a bidirectional switch.The publication U.S. Pat. No. 4,491,750 A discloses field effect transistors connected together bidirectionally at their respective source terminal. A gate circuit is referenced to the respective drains.In the case of fault-tolerant design of the battery storage system, it should be noted that the energy storage units themselves require protection in order to protect them from short circuits in the on-board power supply system. In particular, modern lithium-ion batteries, for example. LiFePO 4, are provided with an additional shutdown device in order to be able to specifically perform a shutdown of the energy storage units, for example, in the event of overloading or overheating. Traditional techniques, such as, for example. Contactors are disadvantageous because of their weight and their space requirement in the case of redundant provision of a plurality of branches of energy storage units.Against this background, it is an object of the present invention to propose a battery system for safety-relevant systems, which is designed to continue to operate safety-relevant systems of a vehicle in the event of a fault in an on-board power supply system. It should be designed to save space and weight. Furthermore, an on-board power supply system is to be claimed which comprises a battery system according to the invention.To achieve the object mentioned above, a battery system for a safety-relevant system of a vehicle is proposed, wherein the safety-relevant system comprises at least one load and is connected via the battery system to an on-board power supply system which has a power supply. The battery system comprises a battery management unit, an energy storage unit having a fuse, a first terminal, a second terminal, and a first MOSFET switch and a second MOSFET switch connected in series to one another. The first MOSFET switch is connected to the first terminal and the second MOSFET switch is connected to the second terminal. The connection between the first MOSFET switch and the second MOSFET switch is connected to the positive pole of the energy storage unit. The battery management unit is configured to carry out a safety management for the safety-relevant system and the energy storage unit by controlling the first MOSFET switch and the second MOSFET switch, wherein the safety management comprises at least one of the steps "opening the second MOSFET switch in the event of a fault in the on-board power supply system" and "opening the first MOSFET switch and the second MOSFET switch in the event of an impermissible battery state".The battery state refers to the state of the energy storage unit of the battery system. The at least one load of the safety-relevant system is formed, for example, by an ADAS or HAF for the automated longitudinal and lateral guidance of the vehicle.With the aid of the battery system according to the invention, a separate on-board power supply system branch, which can also be designed to be redundant, is realized. In a time-limited emergency operation situation, a singular and autonomous energy supply is thus advantageously ensured. In this way, safety-relevant systems are supplied even in the event of a fault, which systems are necessary, for example, for automated longitudinal and transverse guidance of the vehicle.The battery system according to the invention, by virtue of the two-sided connection of the energy storage unit, on the one hand realizes fault insulation with respect to the rest of the on-board power supply system, i.e. only the switch facing the rest of the on-board power supply system is actuated in the event of a fault. On the other hand, the energy storage unit is enabled by actuating both switches.The first MOSFET switch and the second MOSFET switch are connected to one another, for example, via their respective source terminals, wherein the drain terminal of the first MOSFET switch is then connected to the first terminal of the battery system and the drain terminal of the second MOSFET switch is connected to the second terminal of the battery system. However, it is also possible for the two MOSFET switches to be connected to one another via their respective drain connections. In this case, the source terminal of the first MOSFET switch is connected to the first terminal of the battery system and the source terminal of the second MOSFET switch is connected to the second terminal of the battery system.In view of fault isolation in the on-board power supply system, for example in the event of a short circuit in order to avoid undervoltage, the MOSFETs arranged according to the invention have the necessary reaction times and switching times in order to avoid damage to other electronic components arranged in the on-board power supply system. This substantial technological advantage is distinguished by the MOSFETs advantageously with respect to the electro-mechanical contactors known from the prior art.The battery system according to the invention advantageously meets the requirements of the automotive safety integrity level (ASIL). In addition, it can also be used advantageously in on-board power supply systems of non-automated vehicles, since there are also high ASIL requirements here, for example for an electronically assisted steering system or for an electronic brake system. The battery system according to the invention disconnects such safety-relevant systems from the faulty on-board power supply system by means of segregation ("activation") in the event of a fault and thus advantageously maintains the power supply of these safety-relevant systems.The power supply of the on-board power supply system represents a main energy storage unit of the vehicle. It is conceivable for individual supply branches to have additional energy storage units which are designed as intermediate energy storage units. The battery system according to the invention is dedicated to emergency energy supply of safety-relevant systems in the event of failure of all other energy storage units or failure of electrical connections to all other energy storage units.According to the invention, the battery system additionally has a third MOSFET switch between the energy storage unit and the common connection of the first and second MOSFET switches. The third MOSFET switch is configured bidirectionally, i.e. two MOSFET switches are connected to one another with their respective source terminal or with their respective drain terminal. The battery management unit is further configured to control the third MOSFET switch, wherein the safety management optionally comprises a further step "opening the third MOSFET switch" in the event of the occurrence of the impermissible battery state alternatively to the opening of the first MOSFET switch and the second MOSFET switch. In this way, the energy storage unit is advantageously protected when the impermissible battery state occurs and a power supply of the safety-relevant system is also maintained via the on-board power supply system.In a further configuration of the battery system according to the invention, the first MOSFET switch is of the depletion type and the second MOSFET switch is of the enhancement type. The second MOSFET switch is thus open without a voltage "normal" applied to its gate and thus advantageously disconnects the on-board power supply system for safety purposes in the event of a failure to actuate the gate. The first MOSFET switch, on the other hand, is "normally" closed and thus advantageously ensures an emergency power supply of the safety-relevant system by the energy storage unit of the battery system according to the invention in the event of failure of a control of its gate.In yet another embodiment of the battery system according to the invention, the energy storage unit is formed with lithium ion cells. The MOSFET switches of the battery system according to the invention advantageously implement a protective circuit which enables the lithium-ion cells in impermissible battery states. Such impermissible states are detected by the battery management unit.In a further embodiment of the battery system according to the invention, an impermissible battery state of the energy storage unit is formed by at least one criterion according to the following list: overload, overvoltage, undervoltage, excessive battery temperature, deep discharge. The respective battery state is monitored by the battery management unit of the battery system according to the invention. This naturally also includes permissible battery states, such as a state of charge with proportional values, a battery temperature or a life age. In the case of a low state of charge, the battery management unit can, for example, initiate charging of the energy storage unit via the on-board power supply system. By means of the battery system according to the invention, such a measure advantageously ensuring the safety of the safety-relevant system can also be carried out during ongoing operation, for example during a journey of the vehicle or during charging of the main energy storage unit on a charging column.In a further embodiment of the battery system according to the invention, a Schottky diode is connected between the common connection of the MOSFET switches and ground. The Schottky diode improves the function of the MOSFET switches, in particular taking into account an avalanche effect, since a free-wheeling path is advantageously carried in the MOSFET switch and the dissipation energy associated with the avalanche effect is reduced. Thus, it is further advantageous that primary voltage peaks are not smoothed. A diagnosis for the Schottky diode arranged according to the invention measures, for example, a reduction of the dissipation energy by 57% in relation to an arrangement without a Schottky diode.In an even further continued embodiment of the battery system according to the invention, a respective suppressor diode is arranged between the respective terminals of the MOSFET switches connected to the terminals of the battery system and a respective ground. Together with the Schottky diode, the MOSFET switches are advantageously protected from higher voltage peaks by further reducing the dissipation energy. Thus, for example, the diagnosis for minimizing a clamping voltage, which occurs exactly during the switching torque, results in correspondingly less energy being input into the MOSFET switches when a magnitude of the clamping voltage is reduced or also when a duration of the switching torque is reduced.Furthermore, an on-board power supply system of a vehicle is claimed, which comprises an on-board power supply system, at least one safety-relevant system, and at least one battery system. The safety-relevant system comprises at least one load and is connected via the battery system to an on-board power supply system which has a power supply. The battery system comprises a battery management unit, an energy storage unit having a fuse, a first terminal, a second terminal, and a first MOSFET switch and a second MOSFET switch connected in series to one another. The first MOSFET switch is connected to the first terminal and the second MOSFET switch is connected to the second terminal. The connection between the first MOSFET switch and the second MOSFET switch is connected to the positive pole of the energy storage unit. The battery management unit is configured to carry out a safety management for the safety-relevant system and the energy storage unit by controlling the first MOSFET switch and the second MOSFET switch, wherein the safety management comprises at least one of the steps "opening the second MOSFET switch in the event of a fault in the on-board power supply system" and "opening the first MOSFET switch and the second MOSFET switch in the event of an impermissible battery state".According to the invention, the battery system additionally has a third MOSFET switch, which is configured bidirectionally, between the energy storage unit and the common connection of the first and second MOSFET switches. The battery management unit is further configured to control the third MOSFET switch, wherein the safety management optionally comprises a further step "opening the third MOSFET switch" in the event of the occurrence of the impermissible battery state alternatively to the opening of the first MOSFET switch and the second MOSFET switch.In a further configuration of the on-board power supply system according to the invention, the at least one safety-relevant system has a redundant power supply. This means that the load arranged in the safety-relevant system also has an additional connection to the on-board power supply system or additional energy storage units arranged.Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawing.It is understood that the features mentioned above can be used not only in the respectively specified combination, but also in other combinations or alone, without departing from the scope of the present invention.The figures are described in contiguous and overlapping terms; identical components are assigned the same reference numerals. FIG. 1 shows a schematic diagram of an embodiment of the battery system according to the invention. FIG. 2 shows a schematic diagram of a further embodiment of the battery system according to the invention. FIG. 3 schematically shows bidirectional MOSFET switches in still further embodiments of the battery system according to the invention.FIG. 1 shows a schematic diagram 100 for an embodiment of the battery system 110 according to the invention. The battery system has a battery management unit 115, an energy storage unit 111 having a fuse 112, a first terminal 102, a second terminal 103, a first MOSFET switch 113 and a second MOSFET switch 114. A safety-relevant system 101 is connected to the first connection 102, which system is necessary, for example, for an autonomous driving maneuver. At the second connection 103, the battery system 110 is connected to a remaining on-board power supply system.FIG. 2 shows a schematic diagram 200 for a further embodiment of the battery system 110 according to the invention. A third MOSFET switch 216 is additionally arranged between the energy storage unit 111 and the fuse 112. The third MOSFET switch 216 is a bidirectional switch and has two MOSFETs connected to one another at their source terminal. When an impermissible battery state occurs, for example when the operating temperature of the energy storage unit 111 formed by lithium ion cells is too high, the bidirectional MOSFET switch 216 is opened, while when the first MOSFET switch 113 is closed and the second MOSFET switch 114 is closed, the safety-relevant system 101 continues to be supplied via the on-board power supply system.FIG. 3 schematically shows bidirectional MOSFET switches 310, 320, 330 in still further embodiments of the battery system according to the invention. The switching diagram 310 shows two MOSFET switches 303, 304 connected to one another at their source terminal, in each case with their intrinsically present free-wheeling diode 301 and their gate terminal 302. The MOSFET switch 303 is designed as a depletion type which is closed without voltage at the gate terminal 302. The MOSFET switch 304 is designed as an enhancement mode, which is open without voltage at the gate terminal 302. In the switching diagram 320, a Schottky diode 321 is connected to the common source terminal of the two MOSFET switches 303, 304, and in the switching diagram 330, a respective TVS or suppressor diode 331 is additionally connected to the respective drain terminals of the two MOSFET switches 303, 304. Further embodiments are conceivable in which the bidirectional MOSFET switches 310, 320, 330 are connected to one another, for example, via their respective source connections. In this case, analogously to the switching diagram 320, a respective Schottky diode would be arranged "on the outside" at the respective source terminals. Similarly, similar to circuit diagram 330, a suppressor diode would be routed "inward" to the common drain terminal.List of reference characters100 Circuit diagram for battery system 101 safety-relevant system 102 Connection to safety-relevant system 103 Connection to on-board power supply system 110 Battery system 111 Battery 112 Fuse 113 First MOSFET switch 114 Second MOSFET switch 115 Battery management unit 200 Circuit diagram of further battery switch 216 Battery switch 301 Free-wheeling diode 302 Gate connection 303 Depletion-type MOSFET ("normally close" depletion type) 304 Enhancement-type MOSFET ("normally open" enhancement type) 310 Bidirectional MOSFET switch 320 Bidirectional MOSFET switch with Schottky diode 321 Schottky diode 330 Bidirectional MOSFET with Schottky and suppressor diode 331 Suppressor diode

Claims

Battery system (110) for a safety-relevant system of a vehicle, wherein the safety-relevant system (101) comprises at least one load and is connected via the battery system (110) to an on-board power supply which has a power supply, wherein the battery system (110) comprises a battery management unit (115), an energy storage unit (111) having a fuse (112), a first terminal (102), a second terminal (103) and, connected in series, a first MOSFET switch (113, 303) and a second MOSFET switch (114, 304), wherein the first MOSFET switch (113, 303) is connected to the first terminal (102), the second MOSFET switch (114, 304) is connected to the second terminal (103), and the connection between the first MOSFET switch (113, 303) and the second MOSFET switch (114, 304), 304) is connected to the positive pole of the energy storage unit (111), and wherein the battery management unit (115) is configured to perform a safety management for the safety-relevant system (101) and the energy storage unit (111) by controlling the first MOSFET switch (113, 303) and the second MOSFET switch (114, 304), wherein the safety management comprises at least one of the following steps: • opening the second MOSFET switch (114) in the event of a fault occurring in the on-board power supply system; • Opening the first MOSFET switch (113) and the second MOSFET switch (114) upon occurrence of an impermissible battery state, wherein the battery system (110) additionally comprises a third MOSFET switch (216), which is configured bidirectionally, between the energy storage unit (111) and the joint connection of the first and second MOSFET switches (113, 114), and wherein the battery management unit (115) is further configured to control the third MOSFET switch (216), wherein the safety management comprises the following further step, alternatively to opening the first MOSFET switch (113) and the second MOSFET switch (114), upon occurrence of the impermissible battery state: • Opening the third MOSFET switch (216).The battery system of any preceding claim, wherein the first MOSFET switch (113, 303) is of depletion-type and the second MOSFET switch is of enhancement-type (114, 304).Battery system according to one of the preceding claims, wherein the energy storage unit (111) is formed with lithium ion cells.Battery system according to one of the preceding claims, wherein an impermissible battery state of the energy storage unit (111) is formed by at least one criterion according to the following list: overload, overvoltage, undervoltage, excessive battery temperature.Battery system according to one of the preceding claims, wherein a Schottky diode (321) is connected between the common connection of the MOSFET switches (303, 304) and ground.Battery system according to one of the preceding claims, wherein a respective suppressor diode (331) is arranged between the respective terminals of the MOSFET switches (303, 304) connected to the terminals of the battery system and a respective ground.An on-board energy system of a vehicle, which comprises an on-board power supply system, at least one safety-relevant system (101) and at least one battery system (110), wherein a respective safety-relevant system (101) comprises at least one load and is connected via a respective battery system (110) to an on-board power supply system which has a power supply, wherein the respective battery system (110) comprises a battery management unit (115), an energy storage unit (111) having a fuse (112), a first terminal (102), a second terminal (103) and, connected in series, a first MOSFET switch (113, 303) and a second MOSFET switch (114, 304), wherein the first MOSFET switch (113, 303) is connected to the first terminal (102), the second MOSFET switch (114, 304) is connected to the second terminal (103), and the connection between the first MOSFET switch (113, 303) and the second MOSFET switch (114, 304) is connected to the positive pole of the energy storage unit (111), and wherein the battery management unit (115) is configured to perform a safety management for the respective safety-relevant system (101) and the energy storage unit (111) by controlling the first MOSFET switch (113, 303) and the second MOSFET switch (114, 304), wherein the safety management comprises at least one of the following steps: • opening the second MOSFET switch (114) in the event of a fault in the on-board power supply system; • Opening the first MOSFET switch (113) and the second MOSFET switch (114) upon occurrence of an impermissible battery state, wherein the at least one battery system between the energy storage unit (111) and the joint connection of the first and second MOSFET switches (113, 114) additionally comprises a third MOSFET switch (216), which is configured bidirectionally, and wherein the battery management unit (115) is further configured to control the third MOSFET switch (216), wherein the safety management upon occurrence of the impermissible battery state alternatively to opening the first MOSFET switch (113) and the second MOSFET switch (114) optionally comprises the following further step: • opening the third MOSFET switch (216).The on-board power supply system according to claim 7, wherein the at least one safety-relevant system (101) has a redundant energy supply.

Images