Battery cell module with battery cell module and electronic fuses
Patent Information
- Authority / Receiving Office
- DE · DE
- Patent Type
- Patents
- Current Assignee / Owner
- ELMOS SEMICON AG
- Filing Date
- 2022-10-13
- Publication Date
- 2026-07-30
AI Technical Summary
Existing automotive supply networks in vehicles rely on centralized fuse boxes with elaborate wiring harnesses, limiting flexibility and adaptability to individual customer requirements, and there is a need for decentralized, modular, and intelligent energy distribution systems that can handle both low and high voltage levels efficiently while ensuring functional safety and rapid response to electrical faults.
The implementation of electronic fuses with integrated control devices that allow for decentralized, tree-like energy distribution networks, enabling flexible configuration, rapid fault detection and response, and communication with higher-level computer systems to manage energy distribution dynamically, using spectral analysis and distributed measurement methods to ensure safety and efficiency.
This approach reduces vehicle weight, enhances system reliability, and enables adaptive power management, allowing for rapid fault isolation and efficient energy distribution, while minimizing material usage and improving safety margins in electrical systems.
Abstract
Description
priorities
[0001] This German patent application claims the priority of German patent application DE 10 2021 130 107.6 of November 18, 2021.
[0002] This German patent application claims the priority of German patent application DE 10 2022 110 713.2 of May 2, 2022.
[0003] This German patent application claims the priority of German patent application DE 10 2021 128 005.2 of October 27, 2021.
[0004] This German patent application claims the priority of German patent application DE 10 2022 125 574.3 of October 4, 2022.
[0005] This German patent application claims the priority of German patent application DE 10 2022 125 617.0 of October 5, 2022.
[0006] This German patent application claims the priority of German patent application DE 10 2022 125 768.1 of October 6, 2022.
[0007] From page 3 onwards, the text of this document is identical to the text of DE 10 2022 125 768 of October 6, 2022.
[0008] The differences from the text of DE 10 2022 125 617.0 of October 5, 2022 are the same as the differences from DE 10 2022 125 768.1 to DE 10 2022 125 617.0. The texts of DE 10 2022 125 617.0 are contained in their entirety in identical form in DE 10 2022 125 768.1. subject of the invention
[0009] The invention relates to a battery cell module (2300) with a battery cell (2145) and / or with an interconnection of battery cells, a first circuit breaker (17), a second circuit breaker (17'), a first electrical node (2120), a second electrical node (2135), a third electrical node (2140), a first battery cell connection (2305) and a second battery cell connection (2310). The first battery cell terminal (2305) is connected to the second node (2135). The second battery cell terminal (2310) is connected to the third node (2140). The battery cell (2105) and / or the interconnection of battery cells has a first connection (2125) and a second connection (2130). The first power switch (17) is connected to the first node (2120) with its first terminal (26). The first circuit breaker (17) is connected to the second node (2135) with its second terminal (28) of the first circuit breaker (17). The second circuit breaker (17') is connected to the first node (2120) with its first terminal (26'). The second power switch (17') is connected to the third node (2140) with its second terminal (28'). A first connection (2305) of the battery cell (2145) or the group of battery cells is connected to the second node (2135). A second connection (2310) of the battery cell (2145) or the group of battery cells is connected to the third node (2140). The battery cell module (2105) includes a control device (4) or is connected to such a control device (4) which controls the control connection (27) of the first circuit breaker (17) and the control connection (27') of the second circuit breaker (17'). The control device (4) interlocks the control connection (27) of the first circuit breaker (17) with respect to the control connection (27') of the second circuit breaker (17') in such a way that it is impossible for the first circuit breaker (17) to be conductive when the second circuit breaker (17') is conductive.
[0010] The following text of the description of this document further explains the technical environment and the technical content of the invention. Introduction
[0011] The document presented here deals with supply networks in automobiles and the use of electronic fuses in such automotive supply networks.
[0012] The decarbonization of mobile road traffic will require efficient energy distribution within vehicles (power distribution).
[0013] Today, automobile manufacturers use central fuse boxes (switch boxes or fuse boxes) in their vehicles with a car's fuses, which they typically place in an accessible location in the car. Elaborate wiring harnesses distribute the electrical energy centrally from there. Decentralized fuse boxes with supply sub-networks (sub-networks) are to replace this star-shaped structure in the long term.
[0014] A platform concept is in the foreground. As a result, automobile manufacturers can more easily adapt the wiring harnesses to individual customer requirements. A plug&play concept is desirable. A platform with a central supply network is being considered. The goal is a modular system for electrical supply networks in cars. This reduces the supply networks in the car as a result and enables a modular system for the supply networks. According to the concept discussed in this document, the electronic fuses should be placed on the circuit boards of higher-level computer systems, the control units. If necessary, these circuit boards should include slots for the fuse housings of the electronic fuses.
[0015] The new topology of an energy distribution system of the supply networks should preferably have a tree structure instead of the central star shape of the previous system of the previous supply networks with a switch box with the electronic fuses in the star center of the supply network and the energy consumers at the star beam ends of the supply network. In this case, a plurality of electronically controllable electronic fuses are preferably connected in series one behind the other. A tree structure of the supply network branches out from the central starting point of the supply network to the consumers. The branches (supply branches) of the tree of the supply network are the supply lines. The different supply branches or different supply sub-networks have different importance, in particular in terms of functional safety. Each or at least a majority of the line sections of the supply branches or supply sub-networks is preferably provided with electronic fuses, which carry out a method for protecting the respective downstream supply sub-tree of the supply network or the respective downstream supply sub-network, the protection strategy of which depends on the importance of the downstream supply sub-tree or of the downstream sub-grid and its importance for the safety of vehicle operation in terms of condition and availability. Depending on the significance and importance of the connected loads, each electronic fuse carries out a procedure that detects electrical parameters of the current flow in the relevant line section of the relevant supply branch or the relevant supply sub-network and, if applicable, the potential on the supply line side against a reference potential. If necessary, the computer core of the control device of the electronic fuse exchanges data with other computer cores of the control devices of other electronic fuses in subsequent and preceding branches of the proposed supply tree or in subsequent and preceding supply subnetworks of the supply network. This data exchange can take place via a special backup data bus (also referred to below as backup data bus) or another data bus, for example a Lin data bus or a DSI3 data bus or a PSI5 data bus or a CAN data bus or a CAN FD data bus or an Ethernet Data bus or a Flexray data bus or an LVDS data bus or otherwise wired or wireless, for example via Bluetooth or WLAN or the like. Heretofore, the wiring harness of a vehicle's supply network has been manufactured as a monolith that is supplied as one component and assembled into the vehicle. The document presented here now proposes enabling more flexible structures. This flexibility can be achieved firstly through software flags and secondly through plugging in further components and supply subtrees and supply subnetworks.
[0016] An electric vehicle will typically have a first supply tree or a first partial supply network, which the vehicle will then operate at approximately 48V, ie less than 50V.
[0017] An electric vehicle will typically have a second supply tree or a second partial supply network, which the vehicle then operates at approximately 800V, ie at significantly more than 50V.
[0018] One idea of using the electronic fuses (E-Fuses) is to enable the additional booking of the power supply to sub-components and / or sub-devices of the vehicle.
[0019] To this end, the orderer, who is typically a user or driver of the vehicle, preferably transmits a command to a server, for example to the automobile manufacturer's server. The orderer preferably authenticates himself on the server. For example, the customer can provide identification data for his mobile phone or his vehicle or another personalized device that enable a legally secure conclusion of a contract.
[0020] A typical control device for the operation of an electronic fuse also includes the so-called system basis chip functionality. This functionality provides all functions to be able to operate a computer core, for example a microcontroller. This can include, for example, the power supply, the emergency power supply, the provision of a data bus interface in the form of a bus transceiver and a watchdog timer (also referred to as a watchdog for short) for monitoring the correct functioning of the computer core of the fuse control device. These are preferably part of the fuse control device. The watch-dog timer takes on al general monitoring device, possibly further monitoring specifications within the meaning of the document presented here.
[0021] The detection of non-extinguishing arcs in the 48V network is an important function that such an integrated control device for an electronic fuse must fulfill. The computer core of such a control device of a fuse should therefore recognize such a non-extinguishing arc independently and / or in cooperation with the computer cores of the other control devices of the other fuses and / or in cooperation with one or more higher-level computer systems and individually or in cooperation and / or in cooperation with the computer cores of the other control devices of the other fuses and / or in cooperation with one or more higher-level computer systems through countermeasures, such as temporarily switching off energy sources, consumers and / or partial supply networks, contain and preferably combat the identified problem.
[0022] A spectral analysis of the electric current on the line section to be protected, in which the electronic fuse is inserted, is known from the prior art. For this purpose, the electronic fuse uses a current measuring device, for example a shunt resistor 24, to record the time profile of typically successive values of the electric current through the line section to be protected and carries out a spectral analysis of this value profile. If certain structures are present in the frequency spectrum determined in this way, the computer core of the control device of the electronic fuse concludes that there is an arc and, if necessary, switches off the flow of current using the power switch of the fuse, which is typically a fuse transistor. Instead of the computer core of the control device of the security device, a higher-level computer system, for example a control device of the vehicle, or a computer core of a control device of another electronic security device can also carry out this evaluation and initiate, implement and / or coordinate any countermeasures that may be necessary. To do this, the computer core of the control device of the electronic fuse transmits suitable data to this other device, for example the higher-level control device of the vehicle or the other computer core of the control device of the other electronic fuse. Suitable data can be, for example, the raw measured values or further processed measured values, in particular voltage and / or current values.
[0023] However, for the necessary time resolution of the current value profile over time, an increased sampling rate of analog-to-digital converters of the control devices of the relevant fuses is then typically necessary for the application of such a spectral analysis.
[0024] Distributed measurement methods are also preferred and necessary. In this case, the control devices of a plurality of electronic fuses preferably record one or more measured values by means of corresponding measuring devices of these control devices of these fuses. Preferably, the electronic fuses each have a respective timer. The control device of the respective electronic fuse preferably uses the respective timer to determine a time stamp value for preferably each measured value or for a group of measured values that they determine. The control device of the fuse in question preferably transmits these measured values together with the associated time stamps to a higher-level computer unit, e.g. a higher-level control unit, or to the computer core of another electronic fuse. The higher-level computer unit or the computer core of the control device of the other electronic fuse compares the measured values of preferably similar time stamps with one another and can thus, for example, infer energy losses in line sections between two electronic fuses. Such a loss of energy can possibly indicate the said arc. The control devices of the fuses or the superordinate computer system preferably take into account any ground offset of the reference potential connection that may occur. If the measured values or the ratio of the measured values to one another or a difference between such measured values or variables derived from them do not correspond to one or more expected values, the higher-level computer unit or the computer core of the evaluating control device of the evaluating electronic fuse can take countermeasures. These can correspond to the countermeasures already described. The data communication can again take place via the security data bus or one of the data buses mentioned above or via a wireless interface, depending on the requirements.
[0025] Monitoring the current and / or voltage curves enables so-called health management for the vehicle. For example, the system of the supply network can then detect changes in the power consumption or the spectra of the voltage curve, current curve or energy transport, which may not correspond to the expected curves or values. Possibly, the system of the supply network can thereby inform the workshop or the vehicle owner or another person or institution via the Internet etc. or a display about the condition or the wear or potential damage or the impending failure of electrical consumers. Such data is of particular interest to the vehicle manufacturer. It is therefore conceivable that the computer core of a fuse control device sends measured values and / or operating data recorded via the data bus and via a higher-level computer system and the Internet to a server owned by the automobile manufacturer, where the latter collects this data, processes it further and evaluates it, e.g to obtain preventive maintenance work and to obtain indications of future improvements to its vehicles.
[0026] For the purpose of the document presented here, energy-generating components are consumers in which either the direction of current or the direction of voltage is reversed compared to these directions in an energy-dissipating consumer.
[0027] Special states, so-called ECO modes, are known for cars, in which a higher-level computer system in the vehicle switches off individual consumers in a targeted manner. Today, the higher-level computer system switches off these individual consumers by means of a command sent to the consumer via the data bus. According to the proposal, the higher-level computer system can also switch off individual consumers in such a way that the higher-level computer system interrupts the entire supply of a supply tree branch or a supply sub-network using an electronic fuse that opens its circuit breaker on command from the higher-level computer system. As a result, the so-called stand-by currents of the large number of consumers, which this supply sub-branch or this supply sub-network supplies with electrical energy, are eliminated for this supply sub-network.
[0028] If a consumer at another, higher-priority point in the vehicle's supply network requires a larger amount of energy for a short time, the higher-level computer system of a higher-level control device or the computer core of a control device of an electronic fuse can be connected via the data bus to which the computer cores of the control devices of the relevant Fuses are connected, or switch off a functionally equivalent other data transmission path other supply sub-trees of the supply tree or other supply sub-networks of the supply network at times. Incidentally, a supply tree is a supply network in the sense of the document presented here.
[0029] If, at another, higher-priority point in the vehicle's supply network, the supply network is to transport a larger amount of energy over a line section to one or more first consumers for a short time, the higher-level computer system of a higher-level control device or the computer core of a control device of an electronic fuse can use the data bus, to which the computer cores of the control devices of the relevant fuses are connected, or a functionally equivalent other data transmission path other supply sub-trees of the supply tree or other supply sub-networks of the supply network temporarily switch off. This switching off increases the proportion of the current-carrying capacity of the affected line section, which the first consumer uses in the energy supply, in favor of the first consumer. If the short-term additional requirement is over, the higher-level computer system of the higher-level control device or the computer core of the control device of the electronic fuse can restore the original state via the data bus or said data connection. It is therefore a matter of temporarily switching off consumers, e.g. to achieve a kick-down.
[0030] It is known from the prior art that relays, for example, are unsuitable for isolating a high-voltage supply sub-grid (HV grid) by means of such relays. This refers to supply sub-networks that have voltages of more than 400V above the reference potential. With such separations, switch-off currents of 5kA can occur. Today, the relays in electric cars only switch between the operating states “charge mode” (charging) and drive mode (driving).
[0031] In the prior art, the SiC transistors that are customary today are typically switched via smart FETs. These are FET transistors with little integrated logic. There is therefore a need for adequate control of SiC transistors by suitable control devices for the fuses when such SiC transistors are used as power switches in fuses. motivating factors
[0032] The following motivating factors are relevant for the use of an electronic fuse (E-Fuse): • weight reduction of the car, • flexibility of the architecture, • Creative power management, • Functional safety, • Better system reliability.
[0033] The following disadvantages arise when using electronic fuses: • The fuse is always cheaper. To reduce the weight of the car
[0034] Electronic fuses can be manufactured with high precision. A vehicle's computer systems can accurately model the switching behavior of the electronic fuses, in contrast to the switching behavior of conventional fuses. This precise predictability of the switching behavior enables the reduction of the safety margins when designing the conductor cross-sections of the line sections in the supply tree and the reduction of similar tolerances, which can reduce the material used for the cable harness in the vehicle and thus the vehicle weight. A lower vehicle weight leads to reduced energy consumption.
[0035] Workshops and end users can preferably enlarge the supply trees and supply networks in the vehicle using plug-in modules.
[0036] However, this fully modular and non-hierarchical supply network concept is still a long way off. In a first step, the first supply networks, which include electronic fuses, retain the central fuse box (junction box) in the vehicle. The idea is to provide the electronic fuses as pluggable modules. It is possible to install the electronic fuses as plug-in modules instead of the previous fuses in the junction box. These plug-in security modules preferably have a plug-in connection for a data bus plug, which connects the data bus of the computer core of the electronic security control device via a data interface of the electronic security control device to a data bus of the junction box or of the vehicle and thus to a higher-level computer system of the vehicle, for example, a control unit of the vehicle connects.
[0037] It is therefore preferably an evolutionary procedure that further develops the functionality of the junction box in that the junction box becomes more intelligent in a first step. Later, it is conceivable to divide the junction box into various smaller junction boxes within the vehicle and finally, in the last step, to equip the vehicle's consumers and energy sources with individual electronic fuses. An electronic fuse in the sense of the proposal discussed here therefore not only fulfills the security function per se, which interrupts the circuit in which the fuse is inserted when a current passed through is exceeded over a longer period of time. An electronic fuse in the sense of the document presented here also provides a) also measuring devices, for example for the acquisition of measured current values of the relevant line section and / or b) also measuring devices for the acquisition of measured voltage values of the relevant line section and c) actuators for changing the state of the relevant line section and d) communication options with other electronic fuses and d) communication options with higher-level computer systems and e) communication options with other device parts of the vehicle, in particular control devices, and f) time-related data and possibly other advantageous services and device parts.
[0038] The figure 37 shows today's protection of the cable of a supply line section. The safety fuse does not respond adequately, particularly for very high impulse currents. The tolerances require a large safety range, which requires an increase in the cable cross-section and thus more material and vehicle weight.
[0039] The insertion of electronic fuses can cover various needs of the market. The figure 38 is intended to present and illustrate this fact.
[0040] First of all, the electronic fuse can simulate the behavior of a safety fuse precisely compared to a safety fuse, depending on the electric current that flows through the line protected by the electronic fuse, with practically no tolerance. For this purpose, the electronic fuse uses a measuring device within the electronic fuse to continuously and repeatedly determine the value of the electric current through the circuit breaker of the electronic fuse in the relevant supply line section. The computer core of the control device of the electronic fuse preferably calculates an intermediate value with the aid of a polynomial of the zeroth, first, second or third degree. A polynomial of a straight line greater than one is preferred here in order to more precisely model the quadratic dependency of the electrical energy fed into the protected line section on the current value of the electrical current. The variables of this polynomial are typically the current values of the electric current recorded by the measuring means of the electronic fuse. The computer core of the control device of the electronic fuse preferably integrates this intermediate value over time to form a second intermediate value. The polynomial is preferably a second degree polynomial. This second intermediate value can then, for example, emulate the thermal heating of the safety wire of a safety fuse, given correct parameterization with suitable polynomial coefficients. The advantage is that the behavior of the electronic fuse is practically tolerance-free thanks to suitable calibration. If the second intermediate value exceeds a predefinable threshold value, the computer core of the control device of the electronic fuse switches off the circuit breaker of the electronic fuse connected to the protected line of the supply branch of the supply tree in this model. In this variant, the electronic fuse preferably comprises one or more devices that emulate a fuse. It is typically characteristic here that the electronic fuse comprises one or more device parts which preferably square and integrate the values of the electric current. In the sense of the description presented here, this is the case if the device part has a function that corresponds or is functionally equivalent to the processing of the measured values of the current through the circuit breaker of the fuse in the line section to be protected by means of a polynomial of at least a second degree and subsequent integration . This means that an analogue and / or digital circuit and / or an analogue or hybrid computer can explicitly perform this function. This analog and / or digital circuit and / or the analog or hybrid computer can be part of the control device of the electronic fuse. In this case, the electronic safety device preferably has one or more device parts that monitor essential parameters. These are preferably part of a control device for the fuse. It is typically characteristic here that the electronic fuse comprises one or more device parts which process the values of the electric current and / or the voltage of the potential of the line section to be protected against a reference potential only by means of a first-degree polynomial, ie linearly. In the sense of the description presented here, this is the case if the device part has a function that corresponds to the processing of the measured values of the current and / or the voltage in the line section to be protected by means of a polynomial of a degree smaller than the second degree, or is functionally equivalent. That is to say, an analog and / or digital circuit and / or an analog or hybrid computer can explicitly perform this function, and these can be part of the control device of the electronic fuse. Preferably, these parts include temporal filters that temporally filter and / or temporally integrate these signals. Typically, a particularly favorable filter time of 500 ns can be assumed as the filter time constant of a low-pass filter (filtering time).
[0041] In addition to the emulation of a fuse, the proposed electronic fuse preferably also quickly disconnects the circuit breaker of the electronic fuse if the value of the current that the measuring device of the control device of the electronic fuse detects exceeds a permitted maximum value or is not plausible for the usage situation. The plausibility monitoring is preferably carried out by a computer core of the control device of the security device and / or a higher-level computer system outside of the electronic security device. A higher-level computer system of a higher-level control device or the computer core of another electronic fuse can preferably change this maximum value depending on the usage situation and / or the required energy distribution within the vehicle by means of a control command via a wireless and / or wired data transmission path to the electronic fuse. The document presented here only collectively refers to this wireless and / or wired data transmission path as a data bus.
[0042] It is important that the control device of the electronic fuse, i.e. typically the computer core of the control device or a functionally equivalent device part of the electronic fuse, switches the circuit breaker of the fuse off or on and does not limit the electric current through the circuit breaker by changing the internal resistance of the circuit breaker, as this would lead to a high power loss in the circuit breaker. The circuit breaker should preferably be switched off in a few ns in such switch-off situations of the supply network, part of which is the electronic fuse.
[0043] The automobile manufacturers currently pay less attention to this rapid switch-off and typically still assume a switch-off within a period of several ms.
[0044] The car manufacturers and the relevant automotive suppliers typically deal with dynamic loads in the vehicle. They therefore feel the need for the electronic fuse to behave like a fuse in order to avoid unforeseen cross-effects when electronic fuses replace fuses in new, more modern designs. The fuse should therefore also allow the current values to be exceeded within a certain range up to a maximum current value of the electrical current in the electrical line to be protected. This means that the switch-off curve of the electronic fuse should be essentially parabolic in the main area of use.
[0045] An important proposal within the document presented here is therefore an electronic fuse with a rapid tripping of the fuse circuit breaker in a time less than 200ms, better less than 100ms, better less than 50ms, better less than 20ms, better less than 10ms, better less than 5ms, better less than 2ms, better less than 1ms, better less than 500µs, better less than 200µs, better less than 100µs, better less than 50µs, better less than 20µms, better less than 10µs, better less than 5µs, better less than 2µs, preferably less than 1µs, preferably less than 500ns, preferably less than 200ns, preferably less than 100ns, preferably less than 50ns, preferably less than 20ns, preferably less than 10ns, preferably less than 5ns, preferably less than 2ns, preferably less than 1ns. The circuit breaker is inserted into the electrical line to be protected within the electronic fuse as a separating element. This switching off is carried out by the computer core of the control device of the electronic fuse, preferably when a maximum permissible current exceeds a maximum current value and / or when a voltage of the line against a reference potential falls below a minimum voltage value by means of corresponding sub-devices of the control device of the electronic fuse. What is special about the proposal described here is that, at the same time, a switch-off takes place after a permissible time due to the emulation of a fuse characteristic, as described above.
[0046] The computer core of the electronic fuse controller could perform the current measurement by means of a shunt resistor in the line and an analog-to-digital converter of the fuse controller. However, this comes with many disadvantages.
[0047] The computer core of the control device for the electronic fuse preferably uses the analog-to-digital converter of the control device for the fuse to record voltages between the terminals of the circuit breaker and / or voltages between the terminals of an auxiliary circuit breaker which is connected in parallel with the circuit breaker and is equipped with a shunt resistor in Is connected in series, or functionally equivalent values of physical parameters and determines from this a value for an electric current through the circuit breaker of the fuse, which is switched on in the electrical line to be protected.
[0048] When measuring the current through the circuit breaker of the fuse, the computer core of the control device of the electronic fuse can feed an additional test current into the circuit breaker of the electronic fuse using a first test current source. The time course of the current value of this additional test current is preferably modulated with a modulation signal. Preferably the modulation signal has a known amplitude and a known frequency and phase. The modulated additional current thus preferably has a maximum amplitude. The control device of the electronic fuse detects the time profile of the electric current through the circuit breaker and checks whether the signal of the time profile of the measured values of this electric current includes signal components whose modulation correlates with the modulation of the modulation signal. For this purpose, for example, a synchronous demodulator can carry out the correlation between the time profile of the measured values of this electric current on the one hand and the time profile of the modulation signal. This can be done, for example, in such a way that the synchronous demodulator multiplies the modulation signal or a signal derived from it or a signal that has a fixed time relationship with the modulation signal with the signal of the time profile of the measured values of this electrical current or a signal derived from it and the signal resulting from the multiplication is then filtered, preferably low-pass filtered. Instead of a synchronous demodulator, the control device can also include a matched filter optimized for the modulation signal and / or an optimal filter and / or a Kalman filter or another estimation filter. The automotive manufacturers and their suppliers have the following needs 1. There must be no overcurrent in the protected section of supply line. This function is new because a fuse only provides thermal overload protection, but not protection against short-term overcurrents. 2. There must be no overloading of the line in the protected section of the supply line. In this case, the electronic fuse should behave like a fuse from the prior art in order to ensure plug and play functionality and not create any new problems due to side effects. New designs should make maximum use of the SOA (safe operating area) of the line, as the safe operating area, in order to minimize the use of materials in the form of the line diameter of the line to be protected. (Protective function of the electronic fuse i.e. the E-Fuse) 3. The organizations mentioned above have an interest in recording further parameters in the supply network, for example to be able to carry out a current measurement without a temperature sensor and thus, if necessary, to be able to draw conclusions about the temperature of the lines in the supply network. 4. The supply of the device parts of a vehicle should take place in the parked state with the lowest possible quiescent current consumption. For an electronic fuse, this means that this low residual current consumption has to take place with minimal protection and that the consumers following the electronic fuse in the supply part tree should be able to wake up from time to time. 5. Automakers want ideal diodes to control and / or prevent the reverse flow of electrical energy.
[0049] For the realization of ideal diodes, the document presented here proposes that the computer core of the control device of an electronic fuse should measure the electric current through the circuit breaker in the direction from the energy source to the consumers, but also in the opposite direction of the current using suitable measuring devices on the fuse and / or the control device the fuse can capture preferentially. The computer core of the control device of an electronic fuse can, for example, detect the voltage drop across the circuit breaker using an analog-to-digital converter or the like and switch off this circuit breaker when the electric current through the circuit breaker reverses. The proposed electronic fuse and / or the control device of the electronic fuse should therefore include means for registering and detecting a current flowing backwards. Typically, the computer core of the control device of the electronic fuse evaluates the measured values recorded in this way and forwards these or measured values derived from them to other computer cores of other electronic fuses in the supply network via a security data bus or the like or to a higher-level computer system, for example a vehicle control unit. battery
[0050] Electronic fuses are also ideal for monitoring batteries. The document presented here therefore proposes a battery with a diagnostic function. At least one connection of the battery is preferably provided with an electronic fuse, as proposed here. For example, the battery may include a supply tree and / or supply network having one or more supply branches. For example, several electronic fuses within the battery can be connected in series in a supply branch of a supply tree and / or a supply network. For example, a supply tree and / or a supply network can also include only one supply branch with a plurality of electronic fuses that are inserted into the supply branch. A battery preferably comprises one or more battery cell modules. One or more battery cell modules are preferably electrically connected in series. One or more electronic fuses are preferably connected between the battery cell modules of the battery. Exactly one electronic fuse is preferably connected between two battery cell modules that are connected to one another in series. One electronic fuse is very particularly preferably provided for each battery cell module. An electronic fuse is very particularly preferably assigned to each battery cell module or to one or more groups, in particular battery cell modules connected in series. Very particularly preferably, one or more or all of these electronic fuses have a first circuit breaker that is suitable for preventing the flow of current through the battery cell module or the group of battery cell modules in question, i.e. the electrical connection between a first battery cell module and a second battery cell module or a first group of battery cell modules and a second group of battery cell modules connected in series to separate when the first circuit breaker is open. Very particularly preferably, one or more or all of these electronic fuses of the battery have a second circuit breaker that is suitable for bypassing the battery cell module or the group of battery cell modules when the second circuit breaker is closed.
[0051] In this case, the computer core of the control device of the electronic fuse can preferably only close the second circuit breaker when the first circuit breaker is definitely open. For this purpose, the computer core of the control device of the electronic fuse examines the switching state of the first circuit breaker, preferably before the second circuit breaker is closed, for example by feeding a test current into the first circuit breaker and by drawing this test current downstream of the first circuit breaker and by detecting and checking the voltages at the terminals of the circuit breaker.
[0052] In this case, the computer core of the control device of the electronic fuse can preferably only close the first circuit breaker when the second circuit breaker is definitely open. For this purpose, the computer core of the control device of the electronic fuse examines the switching state of the second circuit breaker, preferably before the first circuit breaker is closed, for example by feeding a test current into the second circuit breaker and by drawing this test current downstream of the second circuit breaker and by detecting and checking the voltages at the terminals of the second circuit breaker.
[0053] The interconnection between the battery cell module or the group of battery cell modules and the first circuit breaker and the second circuit breaker preferably has three electrical nodes. In this case, the first circuit breaker is preferably connected to a first node with a first connection of the first circuit breaker. In this case, the first circuit breaker is preferably connected to a second connection of the first circuit breaker with a second node. In this case, the second circuit breaker is preferably connected to a first connection of the second circuit breaker with a third node. In this case, the second circuit breaker is preferably connected to the second node with a second connection of the second circuit breaker. In this case, a first connection of the battery cell or the group of battery cells is preferably connected to the third connection. In this case, a second connection of the battery cell or the group of battery cells is preferably connected to the first connection. The electronic fuses for use in a battery preferably have a housing. Electronic fuses for use in a battery preferably have an optical interface. Preferably, said housing of an electronic security comprises an optical window or an optical subsystem for the entry of electromagnetic radiation for the transport of data to this electronic security. Preferably, said housing of an electronic fuse comprises an optical window or an optical subsystem for the emission of electromagnetic radiation for the transport of data from the computer core of the controller of the electronic fuse to the computer core of the controller of another electronic fuse or to a higher-level computer system. The electromagnetic radiation is preferably laser radiation and / or radiation from an LED. The electronic fuse preferably includes a laser or an LED, in particular for this purpose. The electronic fuse preferably comprises a photodetector, for example a photodiode, for receiving optical signals which transport data. In this case, the optical windows are sub-devices of one or more optical data interfaces of the control device of the relevant electronic security device. Optical waveguides and / or other optical functional elements preferably connect the computer cores of the control devices of one or more electronic fuses to one another via these optical data interfaces of these electronic fuses. One or more electronic fuses are preferably connected to a higher-level computer system via such an optical interface and an optical fiber to an optical interface of the higher-level computer system. One or more electronic fuses can also be connected in terms of data technology to the superordinate computer system by means of another data interface, in particular by means of the ones mentioned above. The battery cell module or the group of battery cell modules preferably supply the control device of the electronic fuse and the other parts of the electronic fuse assigned to this battery cell module or this group of battery cell modules with electrical energy for the operation of the same. A battery cell module or a group of battery cell modules can firstly contain the control device of the electronic fuse and secondly the other parts of the electronic fuse and thirdly those battery cell modules or that group of battery cell modules to which this electronic fuse is assigned and to which this fuse is connected Supply branch follows or precedes, provide electrical energy for the operation of this electronic fuse. The battery thus preferably includes an electronic fuse per battery cell module or per group of battery cell modules. The computer core of the control device of the electronic fuse preferably records voltage values and / or current values by means of measuring means of the control device of the electronic fuse. The electronic safety device preferably performs a safety function.The computer core of the control device of the electronic fuse preferably interrupts the flow of current through the circuit breaker of the electronic fuse by means of the circuit breaker of the electronic fuse if a disconnection condition is met. Such a disconnection condition can be, for example, exceeding a maximum current value of the electrical current through the circuit breaker of the fuse or the like. The computer core of the control device of the electronic fuse preferably interrupts the flow of current using the circuit breaker of the electronic fuse and bypasses the battery cell module or the group of battery cell modules if a disconnection condition is met and a bridging condition is met. The computer cores of the control devices of one or more electronic fuses preferably transmit one or more measured values and / or values derived therefrom and / or status values and / or status information of the respective electronic fuses to a higher-level computer system. One or more control devices for the electronic fuses preferably include one or more temperature sensor evaluation devices, preferably with one or more temperature sensors. The electronic fuse preferably includes one or more temperature sensors. The electronic fuse can additionally include a thermal fuse, which includes a fuse with a tensioned spring that de-energizes the circuit breaker of the electronic fuse when the circuit breaker exceeds a maximum temperature. The computer core of the control device of the safety fuse preferably evaluates measured temperature values of the one or more temperature sensor evaluation devices, which record these using temperature sensors external to the electronic fuse and / or using temperature sensors of the electronic fuse.
[0054] One or more electronic fuses preferably include two data interfaces, which can be optical. The computer cores of the control devices of the electronic fuses in devices with increased requirements for galvanic isolation are preferably connected in terms of data technology by an optical data bus, in which the data interfaces of the control devices of the electronic fuses are respectively inserted.
[0055] Data interfaces of the control devices of the electronic fuses are preferably connected wired and / or wirelessly at least by an electronic single-wire data bus and / or by a two-wire data bus and / or another data bus and / or another data communication means. The data interfaces of the control devices of the electronic fuses are inserted into such a data bus. The interconnection of the data buses can be star-shaped or linear in a chain or a closed ring. Depending on the type of data bus, the data buses may also have branches. A particularly preferred data bus within a battery can be an optical data bus ring of optical data buses connected in a ring. The optical waveguides of the optical data bus are preferably designed to be electrically insulating. The control device of an electronic fuse can preferably comprise a silicon-based LED as an LED. An optical data interface of the control device of an electronic fuse can also include a silicon-based LED as an LED, for example. Such a silicon-based LED can be a silicon avalanche LED. For example, the silicon-based LED can be a SPAD diode, which the control device of the fuse operates as an LED with sufficient blocking voltage in blocking mode in the breakdown range. The control device for the electronic fuse then preferably includes a control device which uses a voltage converter to generate the operating voltage for the silicon LED, in particular the SPAD diode, from the operating voltage of the electronic fuse. The technical teaching presented here also suggests, among other things, that the silicon LED can also be used as a receiver. For this purpose, the computer core of the electronic fuse control device separates the silicon LED from the electrical supply of the voltage converter by means of a circuit breaker in the electronic fuse control device and uses the voltage signal and / or photocurrent signal of the silicon LED as an input signal for an optical data receiver of the electronic fuse control device . Architecture flexibility
[0056] An electronic fuse, as proposed here in the document presented here, can reduce the effort involved in constructing the automotive fuse box (the junction box). Since a higher-level computer system in particular can access the computer cores of the control devices of the electronic fuses via the vehicle's control units via data buses, new designs can position the electronic fuses at different points in the vehicle and thus minimize the wiring effort for the supply network. This enables the electronic fuses to be decentralized. New constructions preferably implement one or more supply branches of the supply network for supplying electrical loads within the vehicle with electrical energy as a ring of a supply line if the body serves as a return ground line, and / or as two rings of two supply lines in the other case. The respective circuit breakers of the respective electronic fuses are preferably inserted into the respective supply line of the supply network. Two fuses are preferably inserted into the respective supply line for each consumer at the respective tapping point of the electrical energy for this consumer in the respective supply line. This means that in the event of a fault in a supply line section, the respective computer cores of the respective control devices of the two electronic fuses assigned to this faulty load typically open their respective circuit breakers, so that this opening of the circuit breakers of the fuses isolates the faulty line section. As a result, in the event of a fault in a consumer, the respective computer cores of the respective control devices of the two electronic fuses assigned to this consumer typically open their respective circuit breakers, so that this opening of the circuit breakers isolates the faulty consumer. Such a fault does not therefore affect the supply of electrical energy to the other consumers. Active Power Generation Configuration and Active Power Management Configuration
[0057] The so-called Active Power Management includes, for example: • Adaptive management of line status, • Adaptive power management using adaptive switch-off thresholds, • Reduction of the quiescent current in HV domains, • Efficient parking system states, • remote recovery, • Preventive Maintenance (AI).
[0058] The respective computer cores of the respective control devices of several electronic fuses particularly preferably record the respective electric current through their respective circuit breaker and, if applicable, the respective potential of one or more connections of this circuit breaker among themselves and / or against a reference potential of a reference potential contact as a reference potential. Depending on the current value of the energization of the respective circuit breaker of the respective fuse, the respective computer core of the respective control device of the respective fuse preferably calculates a theoretical ground offset by means of modeling and, if necessary, corrects the corresponding measured voltage values recorded by it.
[0059] This calculation of the computer core of the control device of the fuse can also be performed by other computer cores of other control devices of other electronic fuses in the overall system or by higher-level computer systems of the vehicle etc.
[0060] One or more computers of the overall system, which can also be computer cores of the control devices of the electronic fuses and / or the higher-level computer system, can, for example, infer status parameters of the supply line sections using the parameters recorded in this way, such as current values and voltage values. This can include, for example, resistance layers and / or temperatures and / or thermal deflections etc. of the supply line sections. The status parameters of a supply line section can include its temperature. The computer cores of the control devices can determine the temperature of copper lines very well, for example, using the known temperature coefficients of copper and the known design data of the supply line section and / or using the energy fed into the supply section and / or using the energy absorbed in the supply line section. The same applies to other materials.
[0061] The use of electronic fuses makes it possible to program equipment variants. In order to prevent improper activation or deactivation of the energy supply option of sub-trees of the supply tree and / or sub-supply networks of the supply network, the communication between the computer core of a control device of an electronic fuse and the computer core of the control device of another electronic fuse is preferably encrypted. In order to prevent improper activation or deactivation of the energy supply option of sub-trees of the supply tree and / or sub-supply networks of the supply network, the communication between the computer core of a control device of an electronic fuse and a higher-level computer system is preferably encrypted. The activation and / or deactivation of an electronic fuse, i.e. the switching on or off of the circuit breaker, preferably requires the transmission of a digital password from the computer core of the control device of another electronic fuse or from the higher-level computer system via a data bus to the computer core of the control device of an electronic fuse . The communication between the computer core of the control device of an electronic security device and its environment is preferably encrypted via such data connections. Such a data connection is preferably encrypted using a PQC method. (PQC=post quantum cryptography). The communication via the data bus can take place, for example, by means of a protocol similar to PSI5 or the like. The electronic fuses, which are sub-devices of a supply network, preferably also communicate with one another by means of power-line communication via the supply network or their possibly separate supply voltage lines.
[0062] After a significant change in the operating state of the vehicle, preferably not all electronic fuses change the switching state of their circuit breakers at the same time. Such a significant change in the operating state of the vehicle can be, for example, the switching-on process when the vehicle is transferred from the parked state to the driving state. Electronic fuses preferably receive a start signal from a central control device, e.g. a higher-level computer system. If necessary, the higher-level computer system distributes beforehand the values of waiting times that the electronic fuses should wait between the arrival of the start signal from the control device and the closing of their respective circuit breaker. These respective values of the respective waiting times can also be programmed into a non-volatile memory of the respective electronic fuse. This programming can be done at the factory or by the higher-level computer system or another computer in the vehicle, and thus also by the computer core of another electronic fuse. As a result, the typically very high starting current of a vehicle's electrical system drops massively. This starting current is also referred to as in-rush current. As the in-rush current decreases, new designs with electronic fuses can in turn make the wiring network for supplying the electrical loads in the vehicle weaker with less thick cables. This reduces the weight of the vehicle. Increase in system reliability
[0063] The document presented here proposes that the computing cores of the control devices of the electronic fuses at the respective terminals of their respective circuit breakers located on the energy source side check the respective voltages between these terminals and a reference node and / or among themselves. If one of these respective voltages falls below a respective minimum value and at the same time the respective electric current through the respective circuit breaker of the respective electronic fuse exceeds a respective predetermined threshold value, the respective power supply delivers more energy than intended into the respective supply sub-network protected by this respective electronic fuse. The respective electronic fuse then preferably switches off the electrical supply of this partial supply network by switching off its respective circuit breaker. This results in a limitation of the respective voltage dip due to the speed of the respective electronic fuse.
[0064] Depending on the security scheme, the computer core of the control device of the electronic fuse can carry out one or more switch-on attempts after it has been switched off. If the number of unsuccessful attempts to switch on exceeds a predetermined number, the computer core of the control device of the electronic fuse preferably transmits an error message to the computer core of the control device of another electronic fuse or to a higher-level computer system.
[0065] Electronic fuses for partial supply networks and supply branches with the highest possible availability should have the option of single or multiple switch-on attempts (retry) in the event of shutdowns as a result of overcurrent or the like. Fuse data bus(Fuse-Bus)
[0066] As already described above, it makes sense if the computer cores of the control devices of the electronic fuses can communicate with other computer cores of the control devices of other fuses in the vehicle's supply network or with higher-level computer systems of the vehicle. There is typically a need for communication here for configuration data (write / read), switching commands (write / read), diagnostic data (write / read), measured values (read), comparison value settings (write / read).
[0067] The computer cores of the control circuits of the electronic fuses preferably use a fuse data bus for communication with one another in the vehicle or within a fuse box. The backup data bus is preferably a two-wire data bus. The backup data bus is preferably a differential data bus, since considerable ground currents and ground etching can occur in the body of a vehicle. The backup data bus is preferably a CAN data bus or a data bus with a physical interface of a CAN data bus, a CAN FD data bus or a Flexray data bus or an LVDS data bus or the like. The backup data bus is preferably bidirectional. Preferably, the control devices of the electronic fuses comprise two data bus interfaces for the fuse data bus, so that new designs can insert the electronic fuses into the fuse data bus using these two data bus interfaces. As a result, the electronic fuses can form a linear chain of electronic fuses along the fuse data bus, so that a higher-level computer system - for example a control unit - which is connected to the beginning of the fuse data bus, uses auto-addressing to use the fuse addresses as bus node addresses for controlling the computer cores of the control devices of the electronic fuses transmitted to the computer cores of the control devices of the electronic fuses.
[0068] The computer cores of the control devices of the electronic fuses preferably transmit parameters of the connected partial supply networks and / or individual accounts of the partial supply networks and / or individual supply line sections of the supply network of the supply lines of the vehicle to other computer cores of the control devices of other electronic fuses and / or one or more higher-level computer systems - e.g. control units of the vehicle. If necessary, such parameters can be directly accessible parameters, such as temperature of a temperature sensor, voltage of a node of the supply network against a reference potential, or the current value of an electrical current in a supply line section of the supply network. A computer core of a control device of an electronic security system can also, by applying Kirchhoff's equations to data that the computer core of the control device of the electronic security system has determined using measuring devices of this electronic security system or that the computer core of the control device of this electronic security system derives from the computer cores of the control devices of other electronic invoices or received from higher-level computer systems (e.g. control units of the vehicle), derived parameters, such as leakage currents to other electrical nodes in the vehicle or electrical resistances of supply voltage line sections.
[0069] In particular, the computer core of a control device of an electronic fuse can estimate the temperature of a subsequent supply voltage section if its ohmic resistance, its heat capacity, thermal discharge resistances and the ambient temperature in the area of the supply line section are approximately known to the computer core, e.g. by estimation. This procedure typically makes use of the fact that the energy fed into the supply line section essentially corresponds to the time integral of the electrical power fed into the supply line section. This is typically proportional to the square of the current magnitude of the electrical current flowing into the supply line section. Other ideas presented in this documentAdding the power supply
[0070] A first idea is for users to add the power supply to consumers of electrical energy in the supply network that have not yet been supplied. The user buys, for example, via a data connection with the server of a service provider, an activation code from a provider who has generated and / or has generated this activation code using authentication data according to a fixed procedure and has it ready and transmits it to the user via a data transmission channel. One or more computer cores of the control devices of one or more electronic fuses preferably record the energy that the battery of an electric car, for example, feeds into a partial supply branch of the supply network. In this model, the battery is owned by the power company. A higher-level computer system, for example a control unit of the vehicle, preferably reads the determined amount of energy from the computer core and / or a memory of the control device of the electronic fuse and / or the underlying measured values and transmits this data to the energy supplier via a data transmission path, which is preferably encrypted or a vicarious agent who then creates an invoice based on this data. It is conceivable that the supply sub-network also enables the services of other service providers who may determine their billing data in a similar way and bill the user. Diagnostic ring
[0071] New constructions preferably provide a supply network that is ring-shaped in parts, in which the consumers preferably draw electrical energy from the supply network at different points of the ring-shaped supply network. The supply line of the ring-shaped supply network is preferably interrupted to the left and right of the tapping point for electrical energy by an electronic fuse, or at least one electronic fuse, which is inserted with its respective circuit breaker in the supply line of the supply line section between two tapping points for electrical consumer energy. If a fault occurs, these fuses can first of all isolate the affected supply line section and / or the affected consumer. A higher-level control unit can determine the status of the electronic fuses by addressing the computer cores of the control devices of the electronic fuses and thus localize the cause of a fault without this fault being able to affect other consumers. Typically, the intervention of the fuses occurs so quickly that the disturbance affects only a few sensor values of sensors and / or measuring devices that are connected to the supply network in such a way that their values are unusable. The electronic fuses preferably record the faults in the form of a log table, which can also include just a few bits. The control devices of the electronic security devices preferably provide the entries in the log table with time stamps from a timer unit of the control device of the electronic security device. In this case, the control device of the electronic safety device preferably also uses a time stamp to record the point at which the fault no longer existed. A higher-level computer system preferably queries this data regularly or in the event of a fault. The higher-level computer system can thus determine when which subnetwork or which supply line was disrupted and how long this disruption lasted. As a result, the higher-level computer system can identify potentially affected sensors and measuring systems and mark the measured values acquired from them in the relevant period of time as potentially faulty or discard them immediately. Another advantage of a ring structure of such a supply network with electronic fuses is improved reliability through redundancy. It is therefore particularly suitable for safety-relevant applications. Satellite with electricity meter
[0072] As already explained, it makes sense in many cases if individual consumers are equipped with a wattmeter or something similar. For this purpose, an electronic fuse uses a voltmeter to detect the voltage of a node on the circuit breaker of the electronic fuse or a node associated with it and preferably the current through the circuit breaker of the electronic fuse and thereby determines the current flowing into the consumer or a subsequent supply tree or a subsequent supply line section electricity. The computer core of the control device of the electronic fuse transmits this data, preferably via a data bus, to the computer core of the control device of another electronic fuse or to a higher-level computer system. Activation of individual consumers
[0073] It is conceivable to activate the electrical supply of individual consumers in the supply network of a vehicle using activation codes as described above. Here, a server of the automobile manufacturer or a service provider transmits authentication data, which can include data from the vehicle, the car key, a SIM card, entering a password, biometric user data, etc., to the vehicle or the user, who then transmits this data in the vehicle a terminal or a data interface transfers it to the vehicle. Depending on the activation code, a higher-level computer system in the vehicle then transmits commands to close the circuit breakers to selected electronic fuses in the supply network, as a result of which the supply network then supplies activation-code-specific partial supply networks with electrical energy. Transmission of energy usage data to electricity providers and / or automobile manufacturers
[0074] As described above, a higher-level computer system in the vehicle can transmit the usage and configuration data of the system determined in this way from electronic fuses and supply subnetworks and supply line sections as a transmission of energy usage data to electricity providers and / or automobile manufacturers and / or other service providers. Detecting a hot-plug event
[0075] An electronic fuse is preferably placed in the vicinity of a plug for supplying electrical energy to an electrical consumer in the vehicle. A problem can arise if users and / or workshops, etc., do not de-energize and / or de-energize the device before removing the device, as prescribed, before the plugging or disconnecting process. In the following, this document refers to such an event as a hot-plug event. This de-energization or de-energization preferably takes place by means of a software command via a data bus from a control device, ie a higher-level computer system, to a computer core of a control device of an electronic fuse, which then opens its circuit breaker. If this has not been done beforehand and an incorrect operation nevertheless triggers a hot-plug event, the control circuit of the associated electronic fuse can be detected by monitoring the transient time profile of the voltage of the potential of a node of the circuit breaker against the potential of a reference node and / or by observing the Such a hot-plug event can be detected by the transient course of the current through the circuit breaker and the circuit breaker can be switched off so quickly that this rapid shutdown minimizes plasma formation. In addition, the electronic fuse can report such an event to the associated control unit, for example a higher-level computer system, via a data line. If necessary, the higher-level computer system can report this event so that it is initially displayed in a terminal (e.g. by means of a man-machine interface) or is transmitted to the automobile manufacturer via a data transmission path. Distributed measurement methods
[0076] It was recognized that it makes sense for the control device of an electronic fuse to exchange the above-mentioned measured values with other control devices of other electronic fuses via a data bus. As a rule, the control device cannot ensure that the data is transmitted very quickly. It is therefore useful if the control device of the fuse also sends a time stamp for one or more measured values in addition to the measured values. The electronic fuses preferably have a clock or a timer for this purpose. A higher-level computer system preferably determines correction factors once for correcting the time stamp values of the non-synchronously running clocks of the various control devices of the various electronic fuses. Another method is the recurring synchronization of these clocks and / or timers. First of all, the synchronization can include resetting to a common start value. On the other hand, the synchronization can include the correction of the frequencies of the oscillators and / or clocks, which the synchronization process can set, for example, by setting the dividers of a base frequency. A higher-level computer system can use a data bus command in broadcasting mode, for example, to cause the various control devices of the various electronic fuses to preferably carry out the same measurements at the same time, with the equality of the clock readings of the respective clocks of the various control devices of the different devices being the same electronic fuses. It is then a question of a distributed measurement method with synchronous measurement using synchronized local clocks within the control devices of the various electronic fuses. This enables the essentially time-synchronous measurement of ohmic resistances of supply line sections. Coupling communication network and supply network
[0077] It is expedient to couple a communication network to a supply network. Reference is made here to the backup data bus described above. Dynamic mapping of current paths
[0078] During the elaboration, it was recognized that, in the case of redundancy, the dynamic allocation of energy and energy transport routes within a vehicle can be useful. For this purpose, a higher-level computer system in the vehicle determines the energy requirements of the vehicle's potential energy consumers. The supply lines are preferably designed as a supply network, with two or more supply lines being routed in parallel at least in sections and / or crossing at at least two points in the vehicle. As an example, we now study the crossing of a first supply line with a second supply line. The supply network preferably includes two electrical nodes at each of these crossing points. The document presented here refers to these two electrical nodes at the crossing point as first node of first crossing point and second node of crossing point for the sake of clarity. The crossing point divides the first supply line into a first part of the first supply line on the energy source side and a part of the first supply line on the consumer side. The crossing point divides the second supply line into a first part of the second supply line on the energy source side and a part of the second supply line on the consumer side.
[0079] In the following, we now describe an electronic crossing safety device that includes four electronic safety devices. In the example that now follows, the electronic safeguards of the electronic crossing safeguard are implemented on the energy source side. It is also conceivable to run the electronic fuses in reverse on the consumer side. The designs can provide load-side and power-side electronic fuses. • A first electronic fuse connects or separates, depending on the switching state of the power switch of the first electronic fuse, the first part of the first supply line on the energy source side with the first node. • A second electronic fuse connects or disconnects the energy source-side first part of the second supply line to the first node, depending on the switching state of the circuit breaker of the second electronic fuse. • The circuit breaker of the first fuse is preferably only closed when the circuit breaker of the second fuse is open. The circuit breaker of the second fuse is preferably only closed when the circuit breaker of the first fuse is open. • A third electronic fuse connects or disconnects the energy source-side first part of the first supply line to the second node, depending on the switching state of the circuit breaker of the third electronic fuse. • A fourth electronic fuse connects or disconnects the energy source-side first part of the second supply line to the second node, depending on the switching state of the circuit breaker of the fourth electronic fuse. • The circuit breaker of the third fuse is preferably only closed when the circuit breaker of the fourth fuse is open. The circuit breaker of the fourth fuse is preferably only closed when the circuit breaker of the third fuse is open. • The consumer-side part of the first supply line is connected to the first node. • The consumer-side part of the second supply line is connected to the second node.
[0080] An alternative version of the crossing safety device carries out the electronic safety devices on the consumer side: • A first electronic fuse connects or separates, depending on the switching state of the circuit breaker of the first electronic fuse, the first part of the first supply line on the consumer side with the first node. • A second electronic fuse connects or separates, depending on the switching state of the circuit breaker of the second electronic fuse, the first part of the second supply line on the consumer side with the first node. • The circuit breaker of the first fuse is preferably only closed when the circuit breaker of the second fuse is open. The circuit breaker of the second fuse is preferably only closed when the circuit breaker of the first fuse is open. • A third electronic fuse connects or separates, depending on the switching state of the circuit breaker of the third electronic fuse, the first part of the first supply line on the consumer side with the second node. • A fourth electronic fuse connects or separates the load-side first part of the second supply line to the second node, depending on the switching state of the circuit breaker of the fourth electronic fuse. • The circuit breaker of the third fuse is preferably only closed when the circuit breaker of the fourth fuse is open. The circuit breaker of the fourth fuse is preferably only closed when the circuit breaker of the third fuse is open. • The power source side part of the first supply line is connected to the first node. • The power source side part of the second supply line is connected to the second node.
[0081] Depending on the determined energy requirements, these crossing safeguards can dynamically allocate alternative and redundant power paths to specific consumers. For this purpose, a vehicle control unit transmits suitable configuration commands to the electronic fuses of the crossing fuses of the supply network, which cause the circuit breakers of the electronic fuses to open and close and thus dynamically adapt the electrically effective topology of the supply network of the supply lines according to the power requirement and current safety requirements. Switching off parts of the supply network within a vehicle
[0082] Another idea is shutting down parts of the network for maintenance and secure access. To do this, the person who wants to carry out maintenance enters a predetermined security code in a higher-level computer system using a terminal or another human-machine interface (HMI). If necessary, the person receives this security code from a server of the automobile manufacturer or a service provider. For this purpose, the person transmits authentication data to the server, which includes, for example, authentication data for the person, the organization for which the person works, or authentication data for the vehicle or car key or the like. A control unit then de-energizes parts of the supply network with the help of electronic fuses. Preferably, at least one electronic fuse is provided in each sub-supply network that can be isolated in this way, which short-circuits the sub-supply network, which is then isolated by opening the circuit breakers of the isolating electronic fuses, by closing the circuit breaker of this one fuse with a reference voltage line, for example ground, and thus discharges it. Dependence of the power of the satellites depending on the supply line
[0083] The reconfiguration of the network topology was described above, for example using differently configurable node protections. For a system emergency it makes sense if the power consumption of a consumer in question is adjusted to the weakest supply line in the path between the energy source and the consumer in question. For this purpose, the higher-level computer system signals that the reconfiguration of the supply network has been initiated by appropriate commands via one or more data buses to the electronic fuses to the consumer in question how much energy this consumer may consume in order not to leave this weakest line. In the simplest case, the consumer can have two states. A state in which it absorbs more energy and a state in which it absorbs less energy. Network with a reduced cross-section of the wiring harness
[0084] According to the proposal, the improved constructions can provide supply lines of the supply network with a smaller cross-section than would normally be possible without electronic fuses due to the optimizations carried out. quick shutdown
[0085] A key idea is the rapid shutdown of a circuit breaker of an electronic fuse when a maximum permissible current through the circuit breaker is exceeded. If this maximum permissible current is not exceeded by the circuit breaker of an electronic fuse, the circuit breaker is preferably only switched off after some time, this time generally depending on the magnitude of the current through the circuit breaker, falling in a parabola shape. Preferably, the controller of the electronic fuse emulates the behavior of a fuse. To do this, the control device of the electronic fuse detects the current value of the electrical current through the circuit breaker. The controller preferably squares the value of the electric current through the circuit breaker and integrates this value over time. As a rule, the integration is low-pass filtering or the like. If the filter output value exceeds a threshold value, the control device opens the power switch of the electronic fuse. It is therefore an electronic fuse with emulation of a fuse characteristic. Fuse with prevention of reverse current flow.
[0086] The electronic fuse preferably prevents electrical energy from flowing back from the consumer to the energy source. For this purpose, the electronic fuse preferably detects the direction of the electric current flowing. If the current does not flow to the consumer, but in the direction of the energy source, the electronic fuse preferably opens the circuit breaker, which stops this flow of current. It is conceivable that in such a case the control device closes a third circuit breaker of the electronic fuse, which is otherwise open in normal operation. The then closed third circuit breaker then preferably short-circuits the load-side supply line by closing the third circuit breaker, for example with the reference potential line, ie the ground, as a result of which the current flowing back is now destroyed in the system ground. Use of silicon LEDs
[0087] The electronic fuse preferably includes one or more silicon LEDs. The silicon LEDs are preferably part of an optical data interface of the computer core of the control device of the electronic fuse. These silicon LEDs are also preferably used as photodetectors in the optical data interface. The use of such silicon LEDs is particularly advantageous for the use of electronic fuses in batteries.
[0088] In this case, the housings of the electronic fuses preferably have optical windows so that the light from the silicon LEDs can escape. Electronic security with authentication
[0089] The electronic safety device preferably has means for verifying the admissibility of a command that the control device of the electronic safety device has received via a data bus. For example, it can involve methods of encryption and decryption, which secures secure communication between a higher-level computer system and the control device of an electronic security device. It is therefore an electronic security with authentication for modern business models such as the connection of components via software against payment. Plausibility check of the configuration for identification
[0090] Another recognized point is the plausibility check of the configuration to identify manipulations in the supply network. Depending on the task, the electrical currents within the supply network on the supply lines lie in more or less known or precalculated ranges. If the current value of a supply line now leaves the expected value range, then there is either an error or manipulation. Detection of the switchability of the electronic fuse
[0091] An electronic fuse preferably also includes means for detecting the switchability of the electronic fuse. This can involve, for example, feeding a test current into a first connection of the circuit breaker from a second connection of the circuit breaker. If the control device of the electronic fuse cannot take this electric current from the other terminal of the circuit breaker, then the circuit breaker is not open or is not present. The control device of the electronic fuse preferably changes the switching state of the circuit breaker one or more times. The current conductivity of the circuit breaker, which the control device of the electronic fuse determines in each case, should correlate with the expected switching state of the circuit breaker.
[0092] If there is no switchability, the control device of the electronic safety device preferably signals an error to a higher-level computer system in the vehicle. Self-configuring fuse with auto-addressing
[0093] The electronic fuses are preferably inserted into a data bus arranged linearly like a string of pearls. As a result, the electronic fuses have an unambiguous physical bus position in relation to this linear data bus that can be counted from the higher-level computer system that drives the data bus. Using an auto-addressing method, the higher-level computer system can now assign a fuse address to each electronic fuse, so that the higher-level computer system can address this fuse in a one-to-one manner. This means that the electronic fuses can now recognize where they are physically located in the data bus. A configuration of threshold values and switch-off thresholds is preferably specified for the electronic fuses for every conceivable physical data bus position within the vehicle. By knowing the physical data bus position, these electronic fuses can now be configured according to their data bus position with the aid of said factory data. It is therefore a matter of self-configuring electronic fuses with auto-addressing, in which the configuration of the electronic fuse depends on the recognized physical data bus position. Electronic fuse with AI
[0094] According to the invention, it was recognized that the large number of values recorded by the electronic fuses enable evaluation by a computer core of the control device of an electronic fuse or by a computer in a higher-level computer system. For this purpose, the evaluating unit uses the values that one or more control devices of one or more electronic fuses determine using appropriate measuring means as input values of a neural network model that the computer of the evaluating unit executes. The neural network model is preferably trained with suitable training data from the development period. For example, it can make sense to use this method to detect a failure of one or more consumers or other defects in the system before they actually manifest themselves. Powerline communication via an electronic fuse (E-Fuse)
[0095] Another idea is communication via the data line, with the power switch of the electronic fuse serving as a transmission transistor. It is therefore a powerline communication via the electronic fuse (E-Fuse). Electronic Fuse (E-Fuse) Load Current Spectral Analysis for Predictive Maintenance
[0096] Another idea is to record the time profile of the electric current through the circuit breaker of an electronic fuse and, if necessary, the time profile of the voltage between a terminal of the circuit breaker and a reference potential. A device preferably carries out a spectral analysis of this data from the electronic security device. In the event of significant deviations from expected values, the evaluating devices can draw conclusions that the user and / or workshops can use, among other things, for preventive maintenance of the vehicle. Check system availability over the spectrum of the electronic fuse (E-Fuse), expected characteristics (positive test)
[0097] In an analogous manner, the evaluating device can use the determined spectra to check the system availability via the spectrum on the electronic fuse. If the characteristics of the spectra agree with the expected values within the permitted bandwidths, then the consumer in question is probably available. It is therefore a positive test. Reduction of the inrush current
[0098] Another idea is not to close the circuit breakers of the electronic fuses at the same time when the system is started, but rather with a time delay. As a result, the electrical devices connected to the respective electronic fuses do not start at the same time. This reduces the so-called inrush currents due to the shifting and desynchronization of the switch-on curves of the supply sub-networks. Limiting the voltage dips
[0099] The electronic fuses preferably measure not only the electric current through their circuit breakers, but also the voltage at a connection of the circuit breaker against a reference potential. A voltage dip caused by a short circuit in a partial supply network, for example, is particularly dangerous. An electronic fuse therefore preferably switches off particularly quickly in the event of a voltage drop in the measured voltage values and a simultaneous current rise. This avoids interference from the vehicle's sensors. Such an electronic fuse is therefore a device for limiting the voltage drop in the event of faults in the voltage system of the individual network. The electronic fuse preferably switches off so quickly that the voltage does not drop too far and thus such an event does not disturb other systems or only slightly. Under such switch-off conditions, an electronic fuse preferably switches off the circuit breaker faster than within 1 μs and thus opens it. Switching off can also depend on the time derivative of the voltage change (du / dt sensitivity.) accident insurance
[0100] The higher-level computer system preferably switches off unneeded or dangerous sub-grids by means of electronic fuses by means of corresponding commands to electronic fuses via the data bus when a higher-level computer system of the vehicle has come to the conclusion that an accident of the vehicle is likely. It is therefore a matter of switching off systems of the vehicle by means of one or more electronic fuses before a predicted accident, in which case the ascertained probability of such an accident should be above a threshold value. Expectation of high power consumption
[0101] In a similar way, a higher-level computer system, for example a control unit, can open one or more power switches of one or more electronic fuses of one or more sub-trees of the supply network via a data bus if, for whatever reason, this higher-level computer system expects an increased current consumption from another device. This eliminates the electrical loads that are switched off and their now unused energy margin in the overall energy budget is then available to this other device with the expected increased power consumption. It is therefore a preventive shutdown of electrical loads preventively when a high power consumption of the other device is expected. Shutdown of systems by voltage level
[0102] The document presented here proposes that the electronic fuses record the voltage between a first connection of the circuit breaker, which is preferably on the energy source side, and a reference potential using suitable measuring means. Since it is usually already known when the vehicle is being constructed which consumers with which function and how important this function is to supply the supply network with electrical energy via which supply line which electronic fuse, it makes sense for the control devices of the electronic fuses to record the measured voltage values Compare the specified threshold values and open the circuit breaker of the electronic fuse if these threshold values are not reached. This results in the vehicle's electrical consumers being switched off depending on the voltage level. The vehicle then preferably operates only the most necessary systems at very low voltage levels. As a result, the vehicle can provide the minimum functionalities up to the last second, in which a minimum of energy is still available. Voltage dip limitation
[0103] An important requirement is the limitation of a voltage dip. This is due to the speed of the switch-off process of the circuit breaker of the electronic fuse. In the case of an electronic fuse with a voltage release, this switch-off takes place in the range of µs. Backup data bus in electric cars
[0104] Electric cars today typically use supply networks with voltages of less than 50V (LV networks) and supply networks with voltages greater than 50V (HV networks). A problem now arises from the fact that the electronic fuses should be able to communicate across the domain boundaries of the LV networks and the HV networks via data buses. If no optical data buses are used, it makes sense to provide a data bus with a galvanic isolation, for example by means of transformers, at the domain boundary between a HV supply network and an LV supply network. It is then a backup data bus with electrical isolation between the LV network and the HV network. cascading
[0105] The cascading of electronic fuses is particularly advantageous. This cascading allows, for example, a supply line to be divided into different sub-supply lines. The more important consumers are preferably arranged in the part of the supply line which is closer to the energy source, while the less important consumers are arranged in the part which is further from the energy source. If one of the less important consumers fails and disrupts the energy distribution over the supply line, an electronic fuse inserted in the supply line can disconnect this defective part of the supply line and thus keep the other devices operational. A number of more than one electronic fuse can reduce the number of consumers unnecessarily discarded. The document presented here thus discloses the concatenation of at least two or more electronic fuses. The advantage of this is that new designs can provide thinner lines than supply lines in different sections of a supply line. This means that the switch-off times required for the electronic fuses can vary depending on the position of the electronic fuse. If the distance to the energy source is greater, the corresponding electronic fuse should switch off more quickly. An adaptation to the switch-off characteristics of the respective electronic fuse to the position of this electronic fuse in the supply network is therefore preferably carried out. Electronic fuse with timer or counter
[0106] The electronic safeguard preferably comprises a timer or counter which, for example, enables measurements to be synchronized, as described above. Furthermore, the electronic fuse preferably also includes elements for debouncing the electronic fuse. Kirchhoff's equations
[0107] Different electronic fuses at different points in the supply network preferably determine current and / or voltage, for example, as described above. The control devices preferably provide these measured values with a time stamp based on the count value of an internal counter or an internal clock. Alternatively, these clocks can be synchronized and a higher-level computer system specifies to the control devices of the electronic fuses when the measurements are to be taken. Such data can be used, for example, to detect small leakage currents from supply lines to other electrical nodes in the vehicle. Electronic fuses without a computer core
[0108] It is conceivable that not all control devices of all electronic fuses have a computer core. This means that the computer core of another electronic fuse generally then controls the control device of such a slimmed-down electronic fuse without a computer core. Since the communication between the computer core of the controlling electronic fuse and the control device of the electronic fuse without a computer core can be lost, this slimmed-down version of an electronic fuse without a computer core preferably has fail-safe properties that allow this electronic fuse to provide at least basic protection for the connected supply line ensure. Functionality signaling (alive signaling)
[0109] As already mentioned, it makes sense if the electronic fuses send a signal to a control device via a fuse data bus that may be present, which signalizes that a) the corresponding electronic fuse is still present and b) it is ready for operation. It is a so-called alive signaling on the backup data bus.
[0110] It is advantageous if the backup data bus is differential. This leads to increased robustness against mass offset. In addition, a polarity reversal protection makes sense in order to ensure robustness against negative voltage at the inputs and outputs of the control device. Exemplary data buses with such a common mode strength would be the PSI5 data bus and the LVDS data bus.
[0111] The safety data bus preferably has a so-called collision detection (bus collision detection) in order to detect bus collisions. The data bus protocol for operating the data bus can also use a time slicing method for bus arbitration. fuse simulation
[0112] The simulation of a safety fuse using the electronic fuse is particularly useful. This simulation is preferably based on a temperature energy simulation.
[0113] In the example of the figure above, an input amplifier detects the voltage drop across a shunt resistor, which converts the current through the supply line into a measurement voltage. A subsequent analogue to digital converter converts this value into a digital signal. This value is then squared and then integrated. Other filters may follow. In the example above, multiple comparators compare the values to thresholds. Temperature estimation of the lines
[0114] As described above, the computer core of the control device of an electronic fuse preferably carries out a temperature estimation of the protected supply line. Quantum Random Number Generator
[0115] The quantum random number generator of the control device of the fuse, which the computer core of the fuse can address via the internal data bus, preferably has at least one first SPAD diode and at least one second SPAD diode and at least one optical waveguide. Such a quantum random number generator can also be located, for example, in the higher-level computer system of the supply network. The quantum random number generator is preferably a quantum process-based true random number generator (QRNG). The quantum process-based true random number generator (QRNG) preferably comprises a first SPAD diode as a light source for a quantum optical signal and a second SPAD diode as a photodetector for the quantum optical signal. Furthermore, the quantum process-based true random number generator (QRNG) preferably comprises at least the processing circuit and the optical fiber. The at least one optical waveguide preferably optically couples the at least one first SPAD diode to the at least one second SPAD diode. An operating circuit, preferably in the form of said voltage supply, supplies the first SPAD diode with electrical energy in such a way that the first SPAD diode emits light. In this case, the emission of light requires that the voltage supply (operating circuit) provides a sufficient electrical bias voltage of the first SPAD diode. A processing circuit detects the signal from the second SPAD diode and forms the random number from it. The processing circuit then preferably makes the random number formed in this way available to one or more of the one or more computer cores of control circuits of fuses in the supply network and / or the higher-level computer system of the supply network and possibly other devices in the supply network and / or in the vehicle via a data bus.
[0116] The control circuit of the fuse is preferably embodied as a monolithic micro-integrated CMOS circuit. A semiconductor crystal, which is preferably a silicon crystal, preferably comprises the control circuit and, if necessary, the shunt resistor for measuring the current through the auxiliary circuit breaker of the fuse.
[0117] The semiconductor crystal preferably has a surface. Typically, the semiconductor crystal has a semiconducting material beneath its surface. In particular when using conventional semiconductor circuit manufacturing processes, such as CMOS processes, bipolar processes and BiCMOS processes, the surface of the semiconductor crystal typically has a metallization stack as structured metal layers and electrical insulation layers. The structured metal layers, for example made of aluminum or copper or the like, typically form the conductor tracks that are electrically separated from one another by the optically transparent insulating layers, for example made of silicon dioxide or the like. The metallization stack thus has one or more typically structured and optically transparent and electrically insulating layers as insulation layers. At least part of these typically structured, transparent and electrically insulating layers and at least parts of these layers of the surface preferably form the optical waveguide for the optical connection of the first SPAD diode to the second SPAD diode. The first SPAD diode typically radiates light from the semiconducting material of the semiconductor substrate into this optical waveguide. i.e. As a rule, in contrast to the prior art, the first SPAD diode radiates perpendicularly to the surface of the semiconductor material essentially upwards and not to the side into the semiconductor substrate of the semiconductor crystal, which has a high level of attenuation. Despite this, the emission of the photons from the first SPAD diode in the optical waveguide is not directed. In particular, the emission via the substrate of the semiconductor material is very attenuated since visible light has a very high absorption in the semiconductor material. The construction with the optical fiber in the metallization stack of the microintegrated circuit allows the device to couple more photons of the first SPAD diode directly to the second SPAD diode and inject into the second SPAD diode. The optical waveguide transports these photons from the first SPAD diode in the light waveguide to the second SPAD diode with practically no loss compared to the prior art. The optical waveguide irradiates the second SPAD diode with these photons from the first SPAD diode in such a way that the light from within the optical waveguide penetrates back into the semiconducting material of the semiconductor substrate from the surface and hits device parts of the second SPAD diode there. The second SPAD diode then generates a received signal as a function of the irradiation with these photons.
[0118] Typically, at least one operating circuit, that is, for example, the voltage supply of the control circuit of the fuse, supplies the at least one first SPAD diode with electrical energy at least temporarily. When supplied with sufficient electrical energy, the at least one first SPAD diode then feeds photons into the at least one optical waveguide. The optical fiber then transports these photons further. The at least one optical waveguide then radiates the transported photons into the second SPAD diode as photons moving essentially vertically. Because this transport of photons from the first SPAD diode 54 to the second SPAD diode loses far fewer photons than in the prior art design using the highly absorptive semiconductor substrate due to the low attenuation in the optical fiber, the quantum efficiency is massively higher. This increases the bit rate at which the device can generate random numbers. Therefore, in the construction presented here, a pair of a single first SPAD diode and a single second SPAD diode is sufficient. The prior art always uses multiple SPAD diodes. Safe software download
[0119] The document presented here also describes a system for a vehicle that enables SW programs, in particular third-party SW programs, to be executed in a secure manner in the vehicle's supply network, namely in the electronic fuses of the supply network. Furthermore, the invention relates to a method for executing SW programs in these electronic fuses.
[0120] When integrating a SW program in the control device for securing a supply network and / or in the higher-level computer system of the supply network of a vehicle, it must be ensured that the security of the supply network is not impaired by the SW program. On the other hand, it may be necessary to protect at least parts of the SW program (e.g. parts with confidential information such as billing data, activation codes, encrypted program commands and encrypted configuration and access data) from unauthorized reading and / or writing access. These requirements can lead to a relatively high integration effort.
[0121] The present document therefore also deals with the technical task of providing a system and a method that enable flexible and secure integration of software programs in control devices for fuses in a supply network and / or a higher-level computer system in a vehicle supply network.
[0122] The document presented here describes a system for providing an application by means of a SW (software) program in a supply network. For example, the application can be designed to network the vehicle with a server 710 of a service provider and / or with an electronic device (e.g. a smartphone) outside the vehicle via the higher-level computer system of the supply network or another data interface in the supply network. Furthermore, the application can be designed to automatically integrate the supply network and / or supply sub-networks into a service (e.g. activation of special consumers, etc.). The SW program can be made available by a server 710 of a service provider for the respective service / equipment variant of the vehicle.
[0123] The system includes a first HW (hardware) platform and a second HW platform. In this case, the first HW platform and the second HW platform can comprise separate computers in order to provide particularly reliable isolation between the two HW platforms. For example, the first HW platform can be part of a higher-level computer system of the vehicle's supply network. On the other hand, the second HW platform can be separate from the higher-level computer system of the vehicle, in particular from an operating system of the higher-level computer system of the supply network. Typically, the second HW platform is a control device of a backup of the supply network.
[0124] Alternatively or additionally, the second HW platform can include a non-volatile memory (e.g. for storing data) and / or a volatile memory (e.g. for operating a SW module), which is separate from the first HW platform. Furthermore, the memory of the second HW platform, ie the control device of the backup, can be protected by one or more security measures. In this case, the memory of the control device of the fuse can be protected with one or more security measures that are not used to protect the first HW platform. The memory (both the “runtime” memory and the “storage” memory) of the second control device of the backup can be protected by one or more security measures in such a way that the memory cannot be manipulated from outside (or by an insecure application).
[0125] The security control device is subject to one or more security measures to which the first HW platform is not subject. For example, the one or more security measures may include a verification of SW code of a SW module executed on the controller of the backup by the controller's core. In particular, the SW code can be checked by a manufacturer of the vehicle and / or by a unit of the control device of the fuse that is separate from the provider of the SW program. In this way it can be ensured that no safety-relevant data is released and / or no safety-relevant function (of the supply network) is impaired by a software module on the control device of the fuse. Alternatively or additionally, the one or more security measures may include a restriction of data that can be passed to or from a SW module running on the control device of the backup. The flow of data to and / or away from the fuse control device can thus be restricted.
[0126] The SW program includes at least one basic module and at least one safety-related module. The safety-relevant module accesses safety-relevant data and / or a safety-relevant function. On the other hand, the base module typically does not access security-related data and / or a security-related function, or only via defined interfaces. The SW program can thus be divided into one or more safety-critical parts and one or more safety-uncritical parts.
[0127] The basic module (i.e. the one or more safety-non-critical parts) can then be executed on the first HW platform, and the safety-relevant module (i.e. the one or more safety-critical parts) can be executed on the control device of the fuse.
[0128] The system thus makes it possible to provide SW programs for applications in a supply network of a vehicle in a reliable, safe and efficient manner.
[0129] The at least one safety-relevant module (i.e. the one or more safety-critical parts) preferably comprises 20%, 10% or less of the SW code of the SW program and the at least one basic module (i.e. the one or more safety-uncritical parts ) preferably comprises 80%, 90% or more of the SW code of the SW program. In this way, the one or more security measures relating to the control device of the security can be implemented in an efficient manner.
[0130] The first HW platform is preferably designed in such a way that a SW module running on the first HW platform (i.e. a basic module) has no access or only access via a defined interface to a safety-related function of the supply network. On the other hand, the control device of the fuse is preferably designed in such a way that a software module running on the control device of the fuse has access to a safety-relevant function of the supply network. In this way, safe execution of SW programs in a supply network can be made possible in a reliable manner.
[0131] The base module can be set up to call up the safety-relevant module when the SW program is executed and to cause the safety-relevant module to be executed on the control device of the fuse. When executing the SW program, data can be transferred from the base module to the safety-relevant module. Furthermore, data can be transferred from the safety-relevant module to the base module. The safety-relevant module can have a standardized interface via which the data can be transferred to the safety-relevant module or from the safety-relevant module. In this way, a secure execution of SW programs from external SW providers can be made possible in a control device of the security. In particular, this makes it possible to mix fuses from different manufacturers in the supply network of a vehicle.
[0132] According to a further aspect, a method for executing a SW program in a supply network is described. The method includes running a basic module of the SW program on a first HW platform, for example the higher-level computer system of the vehicle. The method also includes calling a safety-related module of the software program from the base module, with the safety-related module accessing safety-related data and / or a safety-related function. The method further includes executing the security-relevant module on a security control device of the vehicle, wherein the security control device is subject to one or more security measures to which the first HW platform is not subject.
[0133] According to a further aspect, a vehicle (in particular a road motor vehicle, e.g. a passenger car, a truck or a motorcycle) is described which comprises the supply network described in this document.
[0134] As explained at the beginning, this document deals with the flexible and secure integration of software programs for different applications on a HW platform of a vehicle.
[0135] For example, a SW program for an application can be installed on a user's smartphone, and the smartphone can be connected to the vehicle via a data connection. On the other hand, a SW program can be installed and executed directly on a control unit (e.g. the head unit) of a vehicle. Both of these options come with disadvantages. For example, it may be undesirable for a user to install software from possibly unknown providers on a personal smartphone. On the other hand, the direct integration of SW programs on the higher-level computer system of a vehicle typically requires high integration costs. A complete control and / or verification of the software installed may not be possible due to the high level of complexity. Furthermore, the security of data from a SW program within a head unit may not be adequately guaranteed.
[0136] It is therefore proposed to provide a trusted environment (i.e. a secure ecosystem) for third-party software in a vehicle. By providing such a trustworthy environment, an external provider of a SW program can be guaranteed that security-relevant parts of the SW program (e.g. cryptographic keys) are protected against access. Furthermore, it can be ensured in an efficient manner that a software program from an external provider does not impair the safety of the vehicle. Fire protection
[0137] If the power transistor 17 breaks down, the power transistor 17 can no longer be switched and can continue to be conductive with a not insignificant residual resistance. If the load is, for example, an ohmic load which, for whatever reason, does not switch off or does not switch off yet in the event of a voltage drop, then a large amount of power can be converted in the circuit breaker 17 . This can lead to plasma generation and / or fire. This is possible in particular when, for whatever reason, combustible dirt is in contact with the circuit breaker and / or the fuse housing 535, which is then typically heated.
[0138] The document presented here therefore proposes an electronic fuse 1 with a first connection 18 and a second connection 19 and with a circuit breaker 17) with a first connection (26) of the circuit breaker 17 and with a second connection 28 of the circuit breaker 17. The circuit breaker 17 is electrically connected with its first connection 26 to the first connection 18 of the electronic fuse 1 and with its second connection 28 to the second connection 19 of the electronic fuse 1 . A thermal fuse 5710, 5740 is now inserted into the current path between the first connection 18 of the fuse 1 and the second connection 19 of the fuse 1 for additional protection. According to the proposal, the thermal fuse 5710, 5740 interrupts the current path between the first terminal 18 of the fuse 1 and the second terminal 19 of the fuse 1 if the temperature of the circuit breaker 17 and / or the temperature inside the housing 535 of the fuse 1 and / or the temperature of the housing 535 of the fuse 1 exceeds a switch-off temperature. The fuse can be a temperature fuse 5740) or a temperature switch 5710, with a temperature fuse 5740 being preferred because it no longer switches on after it has tripped. The fuse has a thermal path 5720 between the power switch 17 and the fuse 5710, 5740 with a preferably low thermal resistance, so that the temperature of the power switch 17 can change a switching state of the fuse 5710, 5740, so that an overtemperature to switch off the fuse 5710, 5740 leads. This temperature path can be, for example, a direct thermal contact between the circuit breaker 17 and the temperature switch 5710 and / or a thermal bridge in the form of a shared heat sink or the like.
[0139] The proposed fuse 1 preferably includes a control device 4, which detects the switching state of the fuse 5710, 5740, for example by means of a temperature switch / thermal fuse monitoring device 5750 of the control device 4.
[0140] The control device 4 preferably signals a detected status of the safeguard 5710, 5740 (e.g. closed / open) and / or data derived from this data, in particular alarms, to a higher-level computer system 12 and / or the server 710 of a service provider and / or the server 710 of an automobile manufacturer or the like or to a terminal 740 of a user 730 and / or to a terminal 740 of the fire brigade or a server 710 the fire brigade or similar rescue services via a data bus of the supply network 200, part of which is the electronic fuse 1, with this signaling from others Computers in the signaling path can be modified if necessary.
[0141] The supply network 200 and / or the fuse can be part of a vehicle, for example based on this idea of fire protection, by means of an additional fuse 5710, 5740.
[0142] For example, a computer core 2 of the control device 4 of a fuse 1 in the supply network 200 and / or a higher-level computer system 12 in the supply network 200 and / or another computer in said vehicle by means of a position detection system, for example by means of a GPS sensor, and / or another determine the position of the supply network or the vehicle from the information available in the supply network. This computer core 2 of the control device 4 of that fuse 1 in the supply network 200 and / or the higher-level computer system 12 in the supply network 200 and / or the other computer mentioned in the vehicle in question can then transmit this position information to the higher-level computer system 12 and / or the server 710 of a service provider and / or the server 710 of the automobile manufacturer or the like or to the terminal 740 of the user 730 and / or to the terminal 740 of the fire brigade or the server 710 of the fire brigade or similar rescue forces according to claim 6. character list figure1 shows a simplified and schematic system 50 made up of electronic fuse 1, data bus 9 and higher-level computer system 12. According to the proposal, electronic fuse 1 preferably includes a circuit breaker 17 and a control device 4, which controls this circuit breaker 17. figure 2 shows a supply network 200 with electronic fuses in a simplified manner and by way of example. figure 3 shows a data bus system with a dashed data bus 9 for the exemplary supply network 200 of FIG figure 2. figure 4 shows a schematically simplified example of a fuse box 400 with slots 410 and 420 for accommodating electronic fuses 405 and fuses 415. figure 5 is based on the figure 1 and represents a modification of figure 1, with fuse 1 being the figure 5 additionally includes a first test current source 505, which feeds an electrical test current 515 into the first connection 26 of the circuit breaker 17 of the fuse 1. figure 6 essentially corresponds to the figure 1, wherein the control device 4 of the fuse 1 of figure 4 has an additional second data interface 610. figure 7 corresponds in essential parts to figure 3, the data bus 9 being designed as a ring-shaped data bus ring 9'. figure 8 corresponds in the most important parts to the figure 4, where the supply subnetwork of figure 8 comprises a further fuse 805, a second further fuse 810, a first connected distribution tree 815, a second connected distribution tree 820, an electronic fuse 825, consumers 830 and further consumers 835. figure 9 shows a fuse 1 that is opposite to fuse 1 of the figure 5 has a second test current source 905 in addition to the first test current source 505, the test current 915 of which is modulated by the control signal 910 with a modulation signal {505} of a second signal generator 920. figure 10 shows a proposed power source-side intersection protection 1000. figure 11 shows a proposed supply network 1100 with a higher-level computer system 12 and with a multiplicity of supply lines and with a multiplicity of crossing safeguards 1110 to 1118, which enable flexible load and supply-dependent reconfiguration of the supply network 1100. figure 12 shows the basic sequence of a method 1200 for operating a supply network. figure 13 outlines a method 1300 for operating a vehicle (consumer-side feature version). figure 14 also shows a further method 1400, described in simplified form, for operating a vehicle by activating energy sources in the vehicle. figure 15 largely corresponds to the figure 8, but now the supply network is divided into a first supply sub-network and a second supply sub-network. figure 16 shows a method 1600 for detecting arcs 1510 that do not go out in the wiring harness 1515 of a vehicle in a schematically simplified manner and by way of example. The figure 17 essentially corresponds to the figure 7, the third supply line section 245 being separated here into the third supply line section 245 and the fourth supply line section 246. figure 18 schematically illustrates an exemplary method 1800 for operating a supply network 1700 of the figure 17 figure 19 corresponds in essential parts to figure 15 and the figure 10, while being figure 10 shows a fuse box 1000. figure 19 shows two lines 1915 and 1505 to be protected, which are parts of a cable harness 1515. figure 20 describes, schematically and in simplified form, a distributed measurement method 2000 for detecting the state of a wiring harness 1515 of a vehicle based on the illustration in FIG figure 19 figure21 shows, in a schematically simplified manner, a proposed battery 2100 with a diagnostic function for a vehicle using supply networks 200 as described in the preceding figures in the document presented here. figure 22 corresponds to the figure 21 with the difference that the first electronic fuse 825 has an additional contact 2210 in order to conduct this current past the electrochemical battery cell 2145 in the event of an incorrect sign of the current 2121 through the first fuse 825 . figure 23 shows a battery cell module 2300, which has at least one battery cell 2145 and / or an interconnection of battery cells, a first circuit breaker 17, a second circuit breaker 17', a first electrical node 2120, a second electrical node 2135, a third electrical node 2140, a first Battery cell connector 2305 and a second battery cell connector 2310 includes. figure 24 corresponds to the figure 6, with fuse 1 being the figure 24 has a second circuit breaker 17'. The figure 25 corresponds to the battery of figure 22, where the figure 25 shows a battery cell module 2500 with a plurality of battery cells 2145, 2185. figure 26 shows a housed battery cell module 2600 with a common housing 2605 of the battery cell module 2600 for an electronic fuse 825 and an inner battery cell module 2105. figure 27 shows a battery 2700, in which an electronic fuse 825 of the battery 2200 has a second circuit breaker 17', which is suitable for bridging the battery cell module 2105 assigned to the fuse when the second circuit breaker 17' is closed, and in which the control device consists of the battery cell 2145 is supplied, but only when the circuit breaker 17 is closed. figure 28 shows a battery 2800 in which an electronic fuse 825 of the battery 2200 has a second circuit breaker 17' which is suitable for bridging the battery cell module 2105 assigned to the fuse when the second circuit breaker 17' is closed and in which the control device 4 from Battery cell 2145 continues to be supplied, even if the circuit breaker 17 is open. figure 29 shows a supply network 2900, one or more supply branches of the supply network 2900 for supplying electrical consumers 2930 to 2933 with electrical energy as a ring of a supply line 2910 to 2915, in particular when a body is used as a return ground line, and / or as two rings of two supply lines are executed. figure 30 corresponds to the figure 29 with the difference that energy sources and consumers are pluggable. figure 31 shows a schematic and simplified representation of a supply network 3100, which essentially corresponds to the supply network 3000 of figure 30 corresponds, with the plug connections now being secured with their own fuses. figure 32 corresponds in large parts to the figure 11, wherein the supply network 3200 of figure 32 has a first sub-supply network 3201 and a second sub-supply network 3202. figure 33 shows a supply network 3300 similarly figure 31 to explain the prioritization of consumers and energy sources and a favorable topology of the supply network 3300 to support this prioritization. figure 34 exemplifies and simplifies a method 3400 for active power management in a supply network 1100 (see figure 11) with electrical fuses 1110 to 1118 for supplying electrical consumers 1121 to 1125 in this supply network 1100 with electrical energy from one or more electrical energy sources 1150 to 1155. figure 35 illustrates, in a simplified and schematic manner, a method 3500 for operating a vehicle with equipment variants, the activation and deactivation of the equipment variants of the vehicle preferably being carried out at least in part by means of the supply network and by means of the electronic fuses and their circuit breakers 17. figure36 is intended to represent possible levels of a data protocol on the data bus 9 of the supply network 200. figure 37 shows today's protection of the cable of a supply line section. figure Figure 38 shows the benefits of securing a section of utility line with an electronic fuse; figure 39 shows the combination of two proposed SPAD diodes in cross section. figure 40 shows the combination of two proposed SPAD diodes in cross section, multiple insulation layers now forming the optical waveguide 44 . figure 41 shows the integration of the SPAD diodes and the optical waveguide in an evaluation and operating circuit figure 42 corresponds to the figure 41, which is now supplemented by monitoring circuits. figure 43 shows a typical output signal of the second SPAD diode. figure 44 shows an exemplary oscillogram of the voltage signal 4104 of the entropy source 4101. figure 45 shows the schematic sequence of a server-client communication using a proposed quantum random number generator. figure 46 shows the schematic sequence of the KeyExchangeServer() and KeyExchangeClient() functions. figure 47 shows a schematic sequence of the setPrimes() function. The figure 48 shows the schematic sequence of the setE() function. figure 49 shows the schematic flow of the findD() function. figure 50 shows the schematic sequence of a secure transmission of quantum-based random numbers between a computer core 2 of the control device 4 of the fuse 1 (server) and a computer core 2 of the control device 4 of the other fuse 1 (client). figure 51 schematically shows the proposed method 5200 for generating a quantum random number. figure 52 provides a general quadruple backup with only one control device 4. figure 53 shows the general quadruple backup of the figure 52 as a general triple fuse, the three circuit breakers 17, 17 'and 17' 'are interconnected in the star, so that they z. B. as a triple fuse 3010 'of figure 31 can be used. figure 54 shows the general quadruple backup of the figure 52, the four circuit breakers 17, 17', 17'' and 17''' being connected to form a cross fuse 1000. figure 55a shows an exemplary system for integrating SW programs. figure 55b shows an exemplary structure of a SW program. figure 56 shows a flowchart of an exemplary method for executing a SW program in a vehicle. Description of the other figuresFigure 1
[0143] figure 1 shows a simplified and schematic system 50 made up of electronic fuse 1, data bus 9 and higher-level computer system 12. According to the proposal, electronic fuse 1 preferably includes a circuit breaker 17 and a control device 4, which controls this circuit breaker 17. The power switch 17 is preferably a MOS transistor or the like. Other semiconductor components such as thyristors, bipolar transistors, thyristors, etc. are conceivable but are currently less common.
[0144] The power transistor 17 can be integrated with device parts of the control device 4 in a semiconductor substrate. However, different technologies are preferably used for the circuit breaker 17 and the control device 4 . The control device 4 is preferably manufactured using CMOS technology. The power switch 17 is preferably manufactured using MOS technology for power transistors or another semiconductor technology for power transistors. The shunt resistor 24 can be integrated both with the control device 4 on a common semiconductor substrate and can be integrated together with the power switch 17 on a common substrate.
[0145] In the figure1, for the sake of clarity, not all useful and possibly customary device components are shown. Next device components that the reader as possibly in the figure 1 can assume that there are, for example, in the figure 5, figure 6, figure 9, figure 24, figure 41, figure 42, figure 52, figure 53, figure 54, figure 55, figure 57, figure 58. The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.
[0146] The higher-level computer system 12 exchanges data with the control device 4 via the data bus 9 . The superordinate computer system 4 typically requests status data of the electronic fuse 1 from a computer core 2 of the control device 4 of the electronic fuse 1 via the data bus 9 and a data bus interface 10 . In this case, the computer core 2 preferably accesses the peripheral components of the control device 4 via an internal data bus 11 . These peripheral components can act, for example but not limited to, the data bus interface 10, a watchdog 13, non-volatile memory 14, volatile read-write memory 15 and a gate drive circuit 16 for driving and monitoring the circuit breaker 17.
[0147] The one gate drive circuit 16 preferably monitors and controls the power switch 17. A control line 20 for controlling the power switch 17 preferably connects the gate drive circuit 16 to the first terminal of the power switch 17. The gate drive circuit 16 preferably controls the switching state by means of the control line 20 of power switch 17. Gate drive circuit 16 preferably detects one or more voltages between first connection 26 of power switch 17 and / or second connection 28 of power switch 17 and / or control connection 27 of power switch 17 on the one hand and a reference potential 201 on the other. The gate drive circuit 16 preferably detects one or more voltages between the first terminal 26 of the power switch 17 and / or the second terminal 28 of the power switch 17 and / or the control terminal 27 of the power switch 17 with one another. The electronic fuse 1 preferably comprises an auxiliary circuit breaker 23. The auxiliary circuit breaker 23 is preferably used to detect a current which is proportional to the current through the circuit breaker 17 or corresponds in some other way. The electronic fuse 1 preferably comprises a shunt resistor 24. The magnitude of the value of the electric current 36 through the shunt resistor 24 and the auxiliary circuit breaker 23 is typically proportional to the magnitude of the electric current 29 through the circuit breaker 17. A measuring line 25 is used for Detection of the voltage drop across the shunt resistor 24. A monitoring line 21 is used to detect the voltage between the second terminal 19 of the power switch 17 and the control line 20 of the power switch 17. The gate drive circuit 16 preferably uses the measuring line 25 and a monitoring line 21 to detect the Voltage drop across the shunt resistor 24. Typically, the computer 2 of the control device 4 of the electronic fuse 1 controls the circuit breaker 17 depending on the values of these voltages recorded in this way and depending on commands that the computer 2 of the control device 4, for example, from a higher-level computer system 12 for example via said data bus 9.
[0148] In terms of the document presented here, the first connection 18 of the electronic fuse 1 is preferably the connection of the electronic fuse on the energy source side. In terms of the document presented here, the second connection 19 of the electronic fuse 1 is preferably the consumer-side connection of the electronic fuse. Since consumers, such as motors, often do not consume energy in certain operating situations, for example braking, but rather recover it, this assignment can possibly be reversed during operation. In this respect, it is only an idea of the predominant use of the first connection 18 of fuse 1 and the second connection 19 of fuse 1.
[0149] One watchdog 13 is preferably used to monitor the microcontroller, ie the computer 2. In the simplest case, the watchdog is a timer that counts with the system clock of the control device 4, for example. Typically, the computer 2 signals to the watchdog 13 at more or less regular intervals that it is still functional. Watchdog 13 preferably resets its counter reading to a predetermined start value with each signal from computer 2 . However, if watchdog 13 reaches a predetermined watchdog threshold value, watchdog 13 typically assumes that computer 2 is disrupting the processing of the operating program. The watchdog 13 then typically takes countermeasures. A countermeasure can be, for example, resetting the program execution of the computer 2 to a specified program start address. Another countermeasure can be stopping the computer 2. Another countermeasure can be to open the circuit breaker 17. Another countermeasure can be, for example, a signaling of the watchdog 13 to a higher-level computer system 12 via the internal data bus 11, the data interface 10 and the external data bus 9 to a higher-level computer system 12. Typically, the computer 2 of the control device 4 of the electronic fuse 1 can configure the watchdog 13 via the internal data bus 11 using registers of the watchdog 13 and can read out the status of the watchdog 13 via the watchdog register.
[0150] For example, the non-volatile memory 14 may comprise a flash memory or an EEPROM or a ROM or the like. The non-volatile memory 14 preferably includes data and / or program code. The computer 2 of the electronic fuse 1 preferably accesses this data and the program code via the internal data bus 11 . In particular, the data in non-volatile memory 14 preferably also includes configuration data for electronic fuse 2.
[0151] Furthermore, the proposed electronic fuse 1 preferably includes a volatile read / write memory 15. The volatile read / write memory 15 can be, for example, a RAM or an SRAM or a DRAM or an FRAM or an MRAM or the like. The computer 2 of the electronic fuse 1 preferably uses this volatile read / write memory 15 for temporarily storing intermediate results.
[0152] An oscillator 30 with a clock supply preferably generates the system clock of the control device 4 of the electronic fuse 1. The higher-level computer system 12 can preferably access the configuration register of the oscillator 30 and the clock supply via the internal data bus 11 and the data bus interface 10 and the data bus 9 and configure them and read their status. Likewise, the computer 2 can preferably access the internal data bus 11 and configure these configuration registers for the oscillator 30 and the clock supply and read their status from status registers.
[0153] The control device 4 preferably includes a timer and / or a clock of the control device 4. The computer 2 can then store measured values of the gate control circuit 16 for the control and monitoring of the circuit breaker 17 with a time stamp from a time value of the timer 16 and measured values of voltages and / or or other physical parameters etc. combine.
[0154] For example, a temperature measuring device 40 can determine the temperature of the control device 4 and / or the temperature of device parts of the control device 4 . The control device 4 of the fuse 1 can also include an analog-to-digital converter 570, which is shown by way of example in a following figure. For example, such an analog-to-digital converter can provide a measuring line to a temperature sensor, not shown here for the sake of clarity, via which analog-to-digital converter 570 can determine the temperature of circuit breaker 17 or other device parts of fuse 1 and Computer 2 can make available via the data bus 11. For this purpose, this temperature sensor is preferably thermally closely coupled to the circuit breaker 17 . The temperature sensor is preferably a part of the circuit breaker 17. The electronic fuse can have a number of temperature sensors, the measured value signals of which can be recorded by the analog-to-digital converter 570 and made available to the computer 2. For example, the temperature sensor can also determine the temperature of the line at the first connection 18 or at the second connection 19 of the electronic fuse 1 .
[0155] The electronic fuse 1 preferably has a voltage supply 5 for the control device 4 and for the operation of any other device parts of the electronic fuse 1 that may be present. A line for the operating voltage 6 and a line for the reference potential 201 preferably supply the electronic fuse 1 with electrical energy. It is also conceivable that the electronic fuse draws its energy from the first connection 18 and / or the second connection 19 on the one hand and the reference potential line 201 . In normal operation, the power supply 5 preferably charges an energy reserve 8. This is typically a capacitor and / or an accumulator and the like.
[0156] In the event of a failure of the energy supply via the operating voltage 6, the energy reserve 8 supplies the control device 4 and thus the circuit breaker 17 with the necessary energy via an emergency energy supply 7. In the event of such a failure, the power supply 5 preferably disconnects the operating voltage 6 and possibly also the reference potential 201 by means of isolating switches in order not to discharge the energy reserve 8 .
[0157] The voltage supply 5 preferably includes the necessary voltage regulators and / or voltage converters in order to provide the voltages required by the control device 4 from the energy reserve 8 or from the operating voltage 6 for the operation of the control device 4 .
[0158] The control device 4 presented here for the operation of an electronic fuse 1 of a vehicle preferably has a system-based chip functionality. This system basis chip functionality provides all the functions to be able to operate a microcontroller as a computer core 2 in the control device 4 of the electronic fuse 1 and at least one data interface 1, so that the computer core 2 has at least errors and / or faults in the control device 4 and / or or other device parts of the backup can be securely transmitted to a higher-level computer system 12 via the data bus 9. This system basis chip functionality includes a boost converter 5 for the voltage supply 5 of the safety-relevant device parts of the control device 4 of the fuse 1 and for charging and possibly discharging an internal or external energy reserve 8. The energy reserve 8 can be an accumulator and / or a capacity include. In normal operation, the boost converter 5 preferably prepares an externally provided operating voltage 6 from one or more external energy sources and makes the necessary internal operating voltages available to the device parts of the control device 4 and / or other device parts of the fuse 1 . The computer core 2 of the control device 4 of the fuse 1 monitors the operating voltage 6 of the boost converter 5 by means of an analog-to-digital converter 570, for example . In such an emergency operation mode, the boost converter 5 preferably supplies the control device 4 and / or other device parts of the fuse with electrical energy from the energy reserve 8, insofar as this is absolutely necessary. In normal operation, the boost converter 5 charges the energy reserve 8 with electrical energy. In emergency operation, the energy reserve 8 takes over the energy supply of the control device 4 of the fuse 1. Thus, in the emergency operation, the boost converter 5 and / or a functionally equivalent second voltage control device provide an emergency energy supply 7 for the safety-relevant device parts of the control device 4 of the fuse 1 and / or the fuse 1 . figure 2
[0159] figure 2 shows a supply network 200 with electronic fuses in a simplified manner and by way of example. The supply network shows the reference potential node 201 only symbolically. The reference potential node can be, for example, the body ground of a vehicle body made of metal or the like. The proposed supply network thus uses, for example, an electrically conductive vehicle body as an electrical return line. This electrical return is in the example figure 2 the reference potential node 201. The reference potential node 201 is typically the ground of the vehicle. In the figures of the document presented here, the reference potential node 201 is not always drawn in for better clarity and is also not always denoted by the reference symbol. The circuit symbol for ground designates the reference potential node 2021 in the figures of this document when it is drawn in a figure. The supply network 200 has in the example of FIG figure 2 different device parts (210 to 213). These typically consume electrical energy.
[0160] A first fuse 214 of the first device part 210 of the supply network 200 protects the first line section 240 and the consumers connected to it in the form of further, dependent device parts (220 to 223) of the supply network 200. The first fuse 214 preferably corresponds in terms of its internal structure to an electrical fuse figure 1. In the example of figure 2, the first fuse 214 can electrically connect the third line section 245 to the first line section 240 by means of its circuit breaker 17 or locally disconnect the third line section (245) from the first line section 240 by means of its circuit breaker 17. Typically, the first fuse 214 is connected to a data bus 9 which, for simplicity in FIG figure 1 is not shown. figure3 shows an exemplary wiring of the data bus 9, which is also shown in the form in figure 1 would be applicable.
[0161] A second fuse 215 of the second device part 211 of the supply network 200 protects the first line section 240 and the loads connected to it in the form of further dependent device parts (220 to 223) of the supply network 200 . The second fuse 215 preferably corresponds in terms of its internal structure to an electrical fuse figure 1. In the example of figure 2, the second fuse 215 can electrically connect the third line section 245 to the first line section 240 by means of its circuit breaker 17 or locally disconnect the third line section 245 from the first line section 240 by means of its circuit breaker 17. Typically, the second fuse 215 is connected to a data bus 9 which, for simplicity in FIG figure 1 is not shown. figure 3 shows an exemplary wiring of the data bus 9, which is also shown in the form in figure 1 would be applicable.
[0162] A third fuse 216 of the third device part 212 of the supply network 200 protects the second line section 241 and the consumers connected to it in the form of further dependent device parts (230 to 233) of the supply network 200 . The third fuse 216 preferably corresponds in terms of its internal structure to an electrical fuse figure 1. In the example of figure 2, the third fuse 216 can electrically connect the third line section 245 to the second line section 241 by means of its circuit breaker 17 or locally disconnect the third line section 245 from the second line section 241 by means of its circuit breaker 17. Typically, the third fuse 216 is connected to a data bus 9 which, for simplicity in FIG figure 1 is not shown. figure 3 shows an exemplary wiring of the data bus 9, which is also shown in the form in figure 1 would be applicable.
[0163] A fourth fuse 217 of the fourth device part 213 of the supply network 200 protects the second line section 241 and the loads connected to it in the form of further dependent device parts (230 to 233) of the supply network 200 . The fourth fuse 217 preferably corresponds in terms of its internal structure to an electrical fuse figure 1. In the example of figure 2, the fourth fuse 217 can electrically connect the third line section 245 to the second line section 241 by means of its circuit breaker 17 or locally disconnect the third line section 245 from the second line section 241 by means of its circuit breaker 17. Typically, the fourth fuse 217 is connected to a data bus 9 which, for simplicity in FIG figure 1 is not shown. figure 3 shows an exemplary wiring of the data bus 9, which is also shown in the form in figure 1 would be applicable.
[0164] When the first fuse 214 is connected in parallel with the second fuse 215, as in the example of FIG figure 1, the circuit breakers 17 of both fuses (214, 215) must be open in order to separate the first line section 240 from the third line section 245. If the first line section 240 is separated from the third line section 245 by open circuit breakers 17, the first energy source 250 and the second energy source 251 no longer supply the other device parts (220 to 223) with electrical energy. If the first line section 240 is electrically connected to the third line section 245 via closed circuit breakers 17, the first energy source 250 and the second energy source 251 supply the other device parts (220 to 223) with electrical energy if these energy sources (250, 251) supply energy in feed the third line section 245 .
[0165] When the third fuse 216 is connected in parallel with the fourth fuse 217, as in the example of FIG figure1, the circuit breakers 17 of both fuses (216, 217) must be open in order to separate 245 the first line section 240 from the third line section. If the second line section 241 is separated from the third line section 245 by open circuit breakers 17, the first energy source 250 and the second energy source 251 no longer supply the other device parts (230 to 233) with electrical energy. If the second line section 241 is electrically connected to the third line section 245 via closed circuit breakers 17, the first energy source 250 and the second energy source 251 supply the other device parts (230 to 233) with electrical energy if these energy sources (250, 251) supply energy in feed the third line section 245 .
[0166] A fifth fuse 225 can separate the fifth device part 220 of the supply network 200 from the first line section 240 by means of its circuit breaker 17 and thus prevent an energy supply to the fifth device part 220 or connect the fifth device part 220 of the supply network 200 to the first line section 240 by means of its circuit breaker 17 and thus connect it enable the fifth device part 220 to be supplied with energy.
[0167] A sixth fuse 226 can isolate the sixth device part 221 of the supply network 200 from the first line section 240 by means of its circuit breaker 17 and thus prevent an energy supply to the sixth device part 221 or connect the sixth device part 221 of the supply network 200 to the first line section 240 by means of its circuit breaker 17 and thus connect it enable the sixth device part 221 to be supplied with energy.
[0168] A seventh fuse 227 can separate the seventh device part 222 of the supply network 200 from the first line section 240 by means of its circuit breaker 17 and thus prevent an energy supply to the seventh device part 222 or connect the seventh device part 222 of the supply network 200 to the first line section 240 by means of its circuit breaker 17 and thus connect it enable the seventh device part 222 to be supplied with energy.
[0169] An eighth fuse 228 can separate the eighth device part 223 of the supply network 200 from the first line section 240 by means of its circuit breaker 17 and thus prevent an energy supply to the eighth device part 223 or connect the eighth device part 223 of the supply network 200 to the first line section 240 by means of its circuit breaker 17 and thus connect it enable the eighth device part 223 to be supplied with energy.
[0170] A ninth fuse 235 can isolate the ninth device part 230 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent an energy supply to the ninth device part 230 or connect the ninth device part 230 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus connect it enable the ninth device part 230 to be supplied with energy.
[0171] A tenth fuse 236 can isolate the tenth device part 231 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent an energy supply to the tenth device part 231 or connect the tenth device part 231 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus connect it enable the tenth device part 231 to be supplied with energy.
[0172] An eleventh fuse 237 can separate the eleventh device part 232 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent an energy supply to the eleventh device part 232 or connect the eleventh device part 232 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus connect it enable the eleventh device part 232 to be supplied with energy.
[0173] A twelfth fuse 238 can isolate the twelfth device part 233 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent an energy supply to the twelfth device part 232 or connect the twelfth device part 233 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus connect it enable the twelfth device part 233 to be supplied with energy.
[0174] A thirteenth fuse 255 can isolate the twelfth device part 233 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent an energy supply to the twelfth device part 232 or connect the twelfth device part 233 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus connect it enable the twelfth device part 233 to be supplied with energy.
[0175] A thirteenth fuse 255 can isolate the first energy source 250 of the supply network 200 from the third line section 245 by means of its circuit breaker 17 or connect the first energy source 250 of the supply network 200 to the third line section 245 by means of its circuit breaker 17 . As a result, the thirteenth fuse 255 can prevent the power supply to the sub-networks connected to the first energy source 250, here the device parts 210 to 213 and 220 to 223 and 230 to 233, by the first energy source 250 by opening the first circuit breaker 17 of the thirteenth fuse 255 or the Enabling the power supply of the sub-networks connected to the first energy source 250, here the device parts 210 to 213 and 220 to 223 and 230 to 233, through the first energy source 250 by closing the first circuit breaker 17 of the thirteenth fuse 255.
[0176] A fourteenth fuse 256 can isolate the second energy source 251 of the supply network 200 from the third line section 245 by means of its circuit breaker 17 or connect the first energy source 251 of the supply network 200 to the third line section 245 by means of its circuit breaker 17 . As a result, the fourteenth fuse 256 can prevent the power supply to the sub-networks connected to the second energy source 251, here the device parts 210 to 213 and 220 to 223 and 230 to 233, by the second energy source 251 by opening the first circuit breaker 17 of the fourteenth fuse 256 or the Enabling the power supply of the sub-networks connected to the second power source 251, here the device parts 210 to 213 and 220 to 223 and 230 to 233, through the second power source 251 by closing the first circuit breaker 17 of the fourteenth fuse 256.
[0177] In the figure 2, the third device part 212 is provided, for example, with a plug-in option 262 for the third electronic fuse 216 of the third device part 212. In this way, for example, a workshop can replace the third electronic fuse 216 manually, for example in the event of a fuse failure. If the plug-in option is designed to be compatible with fuses, a workshop, for example, can replace the third electronic fuse 216 with a fuse. Conversely, for example, the workshop can replace a fuse located in the plug-in facility 262 with a third electronic fuse 216 .
[0178] All devices 210 to 213 and 220 to 223 and 230 to 233 would preferably be provided with a plug-in option for an electronic fuse such as the plug-in option 262 for the electronic fuse 216 of the third device part 212 . The downside is that such connectors typically result in reduced reliability. figure 3
[0179] figure 3 shows a data bus system with a dashed data bus 9 for the exemplary supply network 200 of FIG figure 2. Each of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 preferably corresponds to an electronic fuse according to the figure1. Therefore, each of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 typically has a control device 4 with a data interface 10 . These control devices 4 are in the figure 3 are provided with separate reference numbers 280 to 293 for each electronic fuse 214 to 217 and 225 to 228 and 235 to 238 as an example. The higher-level computer system 12 preferably communicates via the respective data interface 10 of the respective control device 4 of the respective electronic fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 with the respective computer core 2 of the respective fuse. This respective computer core 2 of the respective fuse can open or close the circuit breaker 17 of the respective fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 by means of the gate control circuit 16 . The higher-level computer system 12 can preferably use a data message to a computer core 2 of a control device 4 of a fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 to cause this computer core 2 to send control signals to the gate control circuit 16 of the relevant electronic fuse to open or close the circuit breaker 17 of this electronic fuse. The computer cores 2 of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 of the supply network 200 preferably record operating parameters using tools (16, 520, 530, 525, 23, 24, 21, 25, 505, 905, 920 etc.). the associated electronic fuse. A first particularly important parameter is typically the electric current 29 through the circuit breaker 17 of the relevant electronic fuse. Preferably, some electronic fuse sub-devices sense a current reading of this electrical current or model an electrical current that is proportional to this electrical current 29 through the circuit breaker 17 . Another important parameter, which the computer cores 2 of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 preferably determine with additional auxiliary devices of these fuses in each fuse-specific manner, is preferably the voltage between the first connection 18 of the relevant electronic fuse and the reference potential 201 and / or the voltage between the second terminal 19 of the relevant electronic fuse and the reference potential and / or other voltages between internal electrical nodes and / or external electrical nodes of the respective electronic fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238. The computer cores 2 of the control devices 4 preferably transmit some or better all electronic fuses of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 some or all of these measured values to the higher-level computer system 2 via the data bus 9. The higher-level computer system 12 can do this then evaluate the data. For example, the higher-level computer system is then able to determine the voltage drop across a line section of line sections 240 to 245 by using Kirchhoff's mesh and node rules. In order to avoid a ground offset when the body is used as a return line for the electrical current, it is advantageous if the reference potential line is essentially current-free. However, such an additional reference potential line cannot usually be implemented for cost reasons. It therefore makes sense if one or more or better each of the fuses are set up to detect a ground offset of the reference potential line 201, for example by detecting a rest potential of the data bus 9 at times when the data bus is not being used. It is obvious that a control device 4 of a fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 with its computer core 2 can assume the role of the superordinate computer system 12 . In that case would be different than in the figure 3 no longer requires a separate higher-level computer system 12.
[0180] In exemplary contrast to figure2, the first device part 210 now feeds the first line section 240, which only supplies the fifth device part 220 and the sixth device part 221 with electrical energy from the energy sources 250 and 251 via the first fuse 214 of the first device part 210.
[0181] In exemplary contrast to figure 2, the second device part 211 now feeds a fourth line section 242, which instead of the first line section 240 now supplies the seventh device part 222 and the eighth device part 223 with electrical energy from the energy sources 250 and 251 via the second fuse 215 of the second device part 211.
[0182] In exemplary contrast to figure 2, the third device part 212 now feeds the second line section 241, which only supplies the ninth device part 230 and the tenth device part 231 with electrical energy from the energy sources 250 and 251 via the third fuse 216 of the third device part 212.
[0183] In exemplary contrast to figure 2, the fourth device part 213 now feeds a fifth line section 243, which instead of the second line section 241 now supplies the eleventh device part 232 and the twelfth device part 233 with electrical energy from the energy sources 250 and 251 via the fourth fuse 217 of the fourth device part 213.
[0184] If one of the circuit breakers 17 of one of the fuses 214 to 217 is opened by its computer core 2 of its control device 4, the energy sources 250 and 251 no longer supply the partial network downstream of this fuse with electrical energy. Preferably, the fuses have a stand-by capability that continues to allow a limited supply of electrical energy for the purpose of stand-by operation. figure 4
[0185] figure 4 shows a schematically simplified example fuse box 400 with slots 410 and 420 for accommodating electronic fuses 405 and fuses 415. A slot 410 for an electronic fuse 405 preferably has a first contact 430 for the first connection 18 of the circuit breaker 17 of the electronic pluggable there Fuse 405 open. Furthermore, the slot 410 for an electronic fuse 405 preferably has a second contact 435 for the operating voltage connection 6 of the electronic fuse 405 . The prerequisite here is that the electronic fuse 405 does not derive the operating voltage for its operation from the potential at its first connection 18 of its circuit breaker 17 . In this case, there is no need for the second contact 435, since the first contact 430 can then assume this function. Furthermore, the slot 410 for an electronic fuse 405 preferably has a third contact 475 for the reference potential connection 201 of the electronic fuse 405 . Furthermore, the slot 410 for an electronic fuse 405 preferably has a fourth contact 440 for connecting the external data bus 9 of the electronic fuse 405 . In the example of figure 9, the data bus 9 is a so-called single-wire data bus, in which the return line of the data bus is typically identical to the reference potential line 201. The data bus 9 presented here is therefore typically a backup data bus 9 or a fuse data bus 9. In the automotive sector, the data bus 9 is, for example, a Lin data bus 9 or a DSI3 data bus 9 or a PSI5 data bus 9 or a CAN data bus 9 or a CAN FD data bus 9 or an Ethernet data bus or a Flexray data bus 9 or an LVDS data bus 9 or some other wired or wireless data transmission route, for example via a Bluetooth or WLAN data connection or an optical data connection (540). The data communication of the computer core 2 of the control device 4 of the fuse 1 takes place via a wired or wireless interface (610, 10, 551, 550).
[0186] In particular, it is conceivable that the data bus 9 is a differential data bus 9 . In that case, the contact 440 of the data bus 9 in reality comprises a first electrical contact for the first line of the differential two-wire data bus and a second electrical contact for the second line of the differential two-wire data bus. Such a differential two-wire data bus can be, for example, a CAN data bus and / or a CAN FD data bus, which is used as data bus 9 . Since the CAN data bus protocol or the CAN FD data bus protocol requires a very good local oscillator, the use of a CAN data bus or a CAN FD data bus would lead to an increased effort for clock generation in each individual fuse, which would cause the costs of such a data bus system to explode. The document presented here therefore proposes the use of a CAN physical layer with a special security data protocol for such a case of a differential security data bus 9 . For this purpose, the higher-level computer system 12 signals a synchronization signal to the oscillators 30 of the control devices 4 of the electronic fuses 405 via the data bus 9 . The synchronization signal is preferably a so-called clock run-in in which, for example, a higher-level computer system sends a predefined alternating 1-0 bit sequence from the higher-level computer system 12, for example, to one or more or all control devices 4 of electronic fuses 405 of the supply network 200 sends. (In the figure 2 and figure 3 these would be the electronic fuses 214 to 217 and 225 to 225 and 235 to 238 and 255 and 256). The control devices 4 synchronize their oscillators 30 to this synchronization signal, preferably in terms of frequency and phase position. A data packet preferably has a start signal. The start signal is typically designed in such a way that it is recognized by the data interface 10 of the control device 4 of an electronic fuse 405 even if the local oscillator 30 of the electronic fuse concerned in the control device 4 is not synchronous with the oscillator of the higher-level computer system 12 . The oscillators 30 of the control devices 4 of the fuses 405 each provide the control devices 4 of which these oscillators 30 are part, at least one respective clock for the operation of this respective control device 4 .
[0187] Typically, the data interface 10 or another sub-device of the control device 4 of an electronic fuse 405 generates a sampling clock from this clock, with which the data interface 10 scans the logical values on the data bus 9 when it receives data via the data bus from the higher-level computer system or from the control device 4 of another fuse or other device connected to the data bus 9 receives. The sending bus user preferably sends the data over the data bus as a data packet with m data bits. Such a data packet preferably begins with a start signal. The synchronization phase for the oscillator 30 of this fuse 405 begins when the start signal is detected by a data interface 10 of a fuse 405. After the synchronization of the oscillator 30, the control device 4 preferably freezes the frequency and phase regulation of its oscillator 30. The data interface 10 then samples the following bits up to the end of the data packet with a constant frequency and phase of the clock of the oscillator 30 of the control device 4 . The end of the data packet is recognized by the data interface 10 of the control device 4 of a fuse 405, preferably with the aid of a stop symbol at the end of the data packet. The data interface preferably recognizes the end of the synchronization phase from a start symbol. This is preferably a predefined bit sequence. The data interface preferably only allows such a start symbol to be recognized a predetermined time after the start of the synchronization phase. The regulation of the frequency and phase of the oscillator 30 of a control device 4 of an electronic fuse 405 preferably ends with this time elapse. The generation of the sampling clock of the data interface 10 from this clock of the oscillator 30. The document presented here accordingly discloses a device for controlling electrical and / or electronic data interfaces 10 of control devices 4 of fuses of a supply network 200 with a serial, bidirectional, differential data bus 9 and with n data interfaces 10 of n control devices 4 of n fuses with n being a positive integer greater than 1 and with a higher-level computer system 12. The serial, bidirectional, differential data bus 9 has a first single-wire data bus and a second single-wire data bus. The voltage value between the first single-wire data bus and the second single-wire data bus typically represents the logical information that may be transmitted—the data that may be present. Each of the n fuses preferably has at least one differential, serial data bus interface 10 as part of its respective control device 4 . Each control device 4 of each of these fuses preferably includes an oscillator 30 which generates a fuse-specific clock CLKj for operating the control device 4 of this fuse—called the jth fuse here. The respective data interface 10 of a control device 4 of a fuse preferably includes a scanning device which scans the data bus 9 with a sampling clock which is preferably derived from the clock of the oscillator 30 of the control device 4 of this fuse. The control device 4 of a fuse preferably includes an address recognition unit and a fuse address register. In this case, for example, the data bus interface 10 or the computer core 2 can include the backup address register. The serial, bidirectional, differential data bus 9 can preferably be at least in a first differential logic state (high, z1) and in a second differential logic state (low, z2). The serial data bus interface 10 of the control device 4 of the at least one fuse of the n fuses is connected to the serial, bidirectional, differential data bus 9 in each case in order to send data via this serial, bidirectional, differential data bus 9 and / or via this data bus 9 from other computer cores 2 other control devices 4 other fuses or a higher-level computer system 12 to receive. Typically, the higher-level control device 12 also receives external control commands for controlling the n fuses.Typically, the higher-level control device 12 converts these externally initiated control commands into bit streams and bus stream packets BP to be sent via the serial, bidirectional, differential data bus 9 to the computer cores 2 of the control devices 4 of the fuses via their data bus interfaces 10 . The higher-level computer system 12 then typically sends the bits of the bit streams and bit-stream packets to be sent by the higher-level computer system 12 as a function of a clock CLK within the higher-level computer system 12 via the serial, bidirectional, differential data bus 9. The higher-level computer system 12 receives from the computer cores 2 the Control devices 4 of the electronic fuses generated bit streams and / or bit stream packets BP via the serial, bidirectional, differential data bus 9. The respective oscillator 30 of the respective control device 4 of the respective fuse typically generates from the respective clock of the respective oscillator 30 of the respective control device 4 of the respective fuse preferably a respective scanning signal CLKAj for the respective data bus interface 10 control device 4 of the respective fuse. The sampling device ATj of the respective data bus interface 10 of the respective control device 4 of the respective fuse then samples the bit streams and / or bit stream packets BP sent via the serial, bidirectional, differential data bus 9, preferably as a function of its respective sampling signal CLKAj of the oscillator 30 of the control device 4 of this fuse , in order to obtain a local bit stream from the received bit stream and / or bit stream packet BP in the respective control device 4 of the respective electronic fuse. The higher-level computer system 12 preferably sends the bit streams to be sent as sequences of bits in bit stream packets (frames, BP). According to the technical teaching of the document presented here, the bit stream packets BP include a time sequence of m individual bits of the bit stream packet BP with the same time length t. B . Here m is a positive integer. The time length t B of the individual bits does not vary by more than a factor of + / - (0.4 / m)*t B within a bit stream packet BP. After the end of the synchronization phase for a bit stream packet, the scanning device of the data bus interface 10 of a control device 4 of a fuse preferably scans the individual bits on the data bus 9 in their middle. Thereafter, the regulation of the frequency and phase position of the clock signal generated by the oscillator 10 and / or of the sampling signal CLKj is frozen for the remainder of the reception of the bit stream packet BP. The time length of m periods of the scanning signal CLKj preferably deviates by no more than + / -(0.4 / m)*t B of length m*t B of m individual bits of a received bit stream packet, so that the scanning device of the data bus interface 10 of the control device 4 of the electronic fuse also scans the last individual bit correctly and a double sampling of a single bit or a non-sampling of a single bit does not take place. In order for this to be possible, at least some of the bit stream packets BP sent by the higher-level computer system 12 preferably have the following contents (see also figure 36): • A start signal START in the form of i bits with i as a positive integer with i−1>m of the m bits of the respective bit stream packet BP with a second differential logic state z2 on the serial, bidirectional, differential data bus 9; • synchronization information SYNC from k synchronization bits, with k as a positive integer and k<m / 3, for synchronizing the respective scanning signal CLKAj of the respective scanning device of the respective data bus interface 10 of the respective control device 4 of the respective electronic fuse and / or of the respective oscillator 30 of the respective control device 4 of the respective fuse with the clock CLK of the higher-level computer system 12; • Data information DATA from the remaining bits of the m-i-k bits of the m bits of the respective bit stream packet BP, the data information preferably comprising DATA address information ADRD and useful information INFO and check information CHKD.
[0188] The check information CHKD can be CRC checksums and / or parity bits, for example. At least part of the useful information INFO preferably includes configuration information ILD. This configuration information ILD can include, for example, threshold values and values of switch-off thresholds, which can possibly determine, for example, when the computer core 2 of a control device 4 of an electronic fuse opens or closes the circuit breaker 17 of this electronic fuse. The higher-level computer system 12 preferably transmits configuration commands via the fuse data bus 9 to the computer cores 2 of the control devices 4 of the fuses using this configuration information ILD 200 hang out. Such configuration commands in this configuration information ILD can cause circuit breakers 17 of electronic fuses of supply network 200 to be opened and closed by computer cores 2 of these electronic fuses, for example. Preferably, the higher-level computer system 12 dynamically adapts the electrically effective topology of the supply network 200 to the supply lines by means of such configuration commands via the fuse data bus 9 to the fuses of the supply network 200 according to the determined energy requirement and / or according to the determined energy supply capability and / or according to the current safety requirement. The computer cores 2 of the control devices 4 of electronic fuses receive and thus send data via the data bus via their respective data interface 10 of the respective control device 4 of the respective electronic fuse, with this data containing configuration information ILD such as configuration data (write / read) and / or switching commands (write / read), but also diagnostic data (write / read), measured values (read), comparison value settings (write / read). The data bus 9 is preferably connected directly or indirectly, e.g. via gateways or the like, to a terminal (740) for an input for reconfiguration of the supply network 200 by means of the electronic fuses. In the event of a system emergency operation scenario, the higher-level computer system 12 adapts the power consumption of a consumer of the consumers of the supply network 300 to the weakest supply line in the path between one or more energy sources of the energy sources of the supply network 200 on the one hand and this consumer of the consumer on the other by reconfiguration or changing the operating parameters of this consumer. In addition, in the event of a system emergency operation scenario, the higher-level computer system 12 adapts the power supply capability of an energy source from the energy sources of the supply network 200 to the weakest supply line in the path between this energy source from the energy sources in the supply network 200 on the one hand and consumers from the consumers in the supply network 200 by reconfiguring or changing the operating parameters of this energy source from the energy sources of the supply network 200 on. The higher-level computer system 12 initiates a configuration change in the supply network 200 by corresponding commands via one or more data buses 9 to electronic fuses in the supply network 200. The higher-level computer system 12 preferably firstly determines how much a consumer of the consumer in the supply network 200 who benefits from the configuration change of the Supply network 200 is affected, may consume energy in order to overload the supply network 200 at any point. The superordinate computer system 12 then preferably communicates to this consumer in question, the consumer of the supply network 200 , how much energy this consumer the consumer of the supply network 200 may consume from the supply network 200 .Secondly, the higher-level computer system 12 preferably determines how much energy an energy source of the energy sources of the supply network 200 that is affected by the configuration change of the supply network 200 may supply in order to not overload the supply network 200 at any point. The higher-level computer system 12 preferably communicates to this relevant energy source of the energy sources of the supply network 200 how much energy this energy source of the energy sources of the supply network 200 may deliver.
[0189] Thus, the configuration information ILD is preferably used to control the power supply of the device parts and to control the power consumption from the energy sources and to control the load on the supply lines of the supply network 200. This control is carried out according to the technical teaching of the document presented here by the computer core 2 of a control device 4 an electronic fuse of the supply network 200 preferably depending on this configuration information ILD of a bit stream packet BP if the logical content of the address information ADRD of this bit stream packet BP with the content of the security address register of the computer core 2 or the data bus interface 10 of the control device 4 of the fuse matches. The respective address recognition units of the respective data bus interfaces 10 or the computer cores 2 of the control devices 4 of the electronic fuses evaluate the address information ADRD of the bit stream packets BP and only then allow the useful information INFO contained in the relevant bit stream packet BP to be used by the respective computer core 2 of the respective control device 4 of the respective fuse if the content of the address information ADRD of the bit stream packet BP corresponds to the current content of the fuse address register of the relevant fuse. The control devices 4 of the electronic fuses and their data interfaces 10 preferably have means for carrying out an auto-addressing process in order to fill the fuse address register with a logical fuse address which corresponds to the physical position of this fuse within the serial, bidirectional, differential data bus 9. The higher-level computer system 12 and / or computer cores 2 of control devices 4 of fuses based on the evaluation of the received test information CHKD preferably conclude that an oscillator 30 of one or more fuses is not running correctly. If necessary, these fuses then readjust their oscillators 30 . Preferably, the oscillators 30 of the control devices 4 of the fuses 405 of a supply network 200 each have a frequency stability after the synchronization of these oscillators 30 with the synchronization signal SYNC in the synchronization phase, which is so great that such an error should not occur in the CRC check.
[0190] The slot 410 of an electronic fuse 405 of the fuse box 400 preferably has a first contact 430 for the first connection 18 of the circuit breaker 17 of the electronic fuse 405 . This first contact 430 is preferably connected to the energy source 250 via the third supply line section 245 for supplying energy to the corresponding supply line 485 protected by this fuse 405 . The first contact 430 of the slot 410 for the electronic fuse 405 is preferably used to connect the first connection 18 of the electronic fuse 405. The first contact 450 of the fuse body 425 corresponds to the first contact 430 of the slot 410 of the electronic fuse 405 of the fuse box 400. The The first contact 450 of the fuse body 425 is used to connect the first terminal 18 of the electronic fuse 405.
[0191] The slot 410 of an electronic fuse 405 of the fuse box 400 preferably has a second contact 445 for the second connection 19 of the circuit breaker 17 of the electronic fuse 405 . This second contact 445 is preferably electrically connected to the corresponding output 485 of the fuse box 400 for supplying a load of the supply network 200 via a subsequent supply line section of the supply line sections (240 to 243) of the supply network 200. The second contact 445 of the slot 410 for the electronic fuse 405 is preferably used to connect the second terminal 19 of the electronic fuse 405. The second contact 470 of the fuse body 425 corresponds to the second contact 445 of the slot 410 of the electronic fuse 405 of the fuse box 400. The second contact 470 of fuse body 425 is used to connect second terminal 19 of electronic fuse 405.
[0192] The slot 410 of an electronic fuse 405 of the fuse box 400 preferably has a third contact 440 for connecting the data bus 9 of the data bus interface 10 of the control device 4 of the electronic fuse 405 . This third contact 440 is preferably connected in terms of data technology to the data bus 9 of the fuse box 400 and the supply network 200 . The third contact 440 of the slot 410 for the electronic fuse 405 is preferably used to connect the data bus 9 to the data bus interface 10 of the control device 4 of the electronic fuse 405. The third contact 465 of the fuse body 425 corresponds to the third contact 440 of the slot 410 of the electronic fuse 405 of the fuse box 400. The third contact 465 of the fuse body 425 is used to connect the data bus 9 of the supply network 200 to the data interface 10 of the control device 4 of the electronic fuse 405.
[0193] The slot 410 of an electronic fuse 405 of the fuse box 400 preferably has a fourth contact 435 for connecting a supply voltage line for supplying energy to the control device 4 of the electronic fuse 405 . This fourth contact 435 is preferably electrically connected to the supply voltage line for supplying energy to the control device 4 of the electronic fuse 405 . The supply voltage line is connected to an energy source 250 via a third supply line section 245, for example. The fourth contact 435 of the slot 410 for the electronic fuse 405 is preferably used to connect the supply voltage line for supplying power to the control device 4 of the electronic fuse 405. The fourth contact 455 of the fuse body 425 corresponds to the fourth contact 435 of the slot 410 of the electronic fuse 405 of the fuse box 400. The fourth contact 455 of the fuse body 425 is used to connect the energy source 250 by means of the exemplary, third supply line section 245 to the supply voltage line for supplying energy to the control device 4 of the electronic fuse 405.
[0194] The slot 410 of an electronic fuse 405 of the fuse box 400 preferably has a fifth contact 475 for connecting a supply voltage line 201—here the reference potential line 201—to supply the control device 4 of the electronic fuse 405 with energy. This fifth contact 475 is preferably electrically connected to the supply voltage line 201 for supplying energy to the control device 4 of the electronic fuse 405 . The supply voltage line—here the reference potential line 201—is connected to the energy source 250 via the body of the vehicle, for example. The fifth contact 475 of the slot 410 for the electronic fuse 405 is preferably used to connect the second supply voltage line - here the reference potential line 201 - for supplying power to the control device 4 of the electronic fuse 405. The fifth contact 460 of the fuse body 425 corresponds to the fifth contact 475 of the slot 410 of the electronic fuse 405 of the fuse box 400. The fifth contact 460 of the fuse body 425 is used to connect the reference potential line 201 of the energy source 250 to the supply voltage line - here the reference potential line 201 - for the power supply of the control device 4 of the electronic fuse 405. The fifth contact 460 of the fuse body 425 is preferably used by the control device 4 of the electronic fuse 405 as a reference potential point.
[0195] An operating voltage source 480 for operating the control devices 4 of the electronic fuses 405 feeds the electrical energy for operating the control devices 4 of the fuses 405 into the supply voltage line for the operating voltage 6 . The body ground of the reference potential line 201 is preferably used here again as the return line.
[0196] The slots 420 for the fuses 415 are preferably designed in such a way that they are at least mechanically compatible with the slots 410 . The slots 410 for the electronic fuses 405 are preferably designed in such a way that the production and / or maintenance and / or repair work can also alternatively equip them with conventional fuses 415. The safety fuses 415 are preferably designed mechanically in such a way that they fit into a slot 410 for an electronic fuse 405 mechanically and preferably also electrically.
[0197] The electronic fuses 405 are preferably designed in such a way that they also fit mechanically into a slot 420 for a conventional fuse. In the event that such a slot 420 for a conventional fuse 415 does not have any contacts 435, 475 for supplying the electronic fuse 405 with electrical energy, the electronic fuse 405 must have an energy reserve 8, which before the installation of the electronic fuse 405 must be provided with power in the connector 420. In this case, for example, the energy reserve 8 can be a battery or an accumulator. Such an electronic fuse 405 then preferably includes a signaling means, for example an LED, in order to be able to query the state of charge at least on request via a—preferably optical—data interface 550.
[0198] The technical teaching of the document presented here proposes a fuse box 400 for a supply network 200 of a vehicle. The proposed fuse box 400 includes electronic fuses 405 and / or slots 410 for electronic fuses 405. The proposed fuse box has fuses 415 and / or slots 420 for fuses 415. At least one electronic fuse 405 of the electronic fuses of the proposed fuse box 400 preferably has a first connection 18 and a second connection 19, with this at least one electronic fuse 405 being set up to emulate the behavior of a fuse 415. For this purpose, this electronic fuse preferably detects the value of the electrical current 29 through its circuit breaker 17 and determines the time integral of a polynomial of at least the second order of this current value. The electronic fuse 405 is preferably set up to detect the current value of the amount of the electric current 29 flowing through this electronic fuse 405 from the first connection 18 to the second connection 19 or vice versa. This electronic fuse 405 is preferably set up to determine an intermediate value from this detected current value by means of a polynomial of at least the second degree and to integrate it over time to form an integrated intermediate value. The electronic fuse is preferably set up to prevent the flow of current 29 between the first connection 18 and the second connection 19 by opening its circuit breaker 17 when the integrated intermediate value exceeds a maximum value. This corresponds to the blowing of a conventional thermal fuse. The electronic fuse 405 is preferably housed in a fuse body 425 with connectors that fits mechanically and preferably also electrically in one of the slots 410 for electronic fuses 405 . The fuse box 400 preferably also includes at least sections of the fuse data bus 9.
[0199] A slot 410 for an electronic fuse 405 preferably has a first contact 430 of slot 410 and a second contact 445 of slot 410 . The first contact 430 of the slot 410 is preferably set up to establish an electrical connection between this first contact 410 of the slot 410 and a first contact 450 of a connector of a fuse body 425 in order to connect the first terminal 18, 450 of the fuse 405 of the fuse body 425 to the to connect first contact 430 of slot 410 electrically.
[0200] The second contact 445 of the slot 410 is preferably set up to establish an electrical connection between this second contact 445 of the slot 410 and a second contact 470 of the plug connector 410 of the fuse body 425 in order to connect the second terminal 19, 470 of the fuse 405 of the fuse body 425 with to connect the second contact (445) of the slot 405 electrically.
[0201] In the proposed fuse box 400, a slot 410 for an electronic fuse 405 preferably has a third contact 440 of slot 410, the third contact 440 of slot 405 being set up to establish an electrical connection between this third contact 440 of slot 405 and a third Make contact 465 of the connector 410 of the fuse body 425 in order to electrically connect the data line 9 of the data interface 10 of a control circuit 4 of the electronic fuse 405 of the fuse body 425 to the third contact 440 of the slot 405.
[0202] The proposed fuse box 400 preferably has a slot 410 for an electronic fuse 405 with a fourth contact 435 of the slot 410 . The fourth contact 435 of the slot 410 is preferably intended to establish an electrical connection between this fourth contact 435 of the slot 410 and a fourth contact 455 of the connector of the fuse body 425 in order to supply power to the control device 4 of the electronic fuse 405 with the fourth contact 455 of slot 410 to be electrically connected.
[0203] The document presented here proposes a fuse body 425 of an electronic fuse 405 for a proposed fuse box 400, in which the connector of the fuse body 425 has a first contact 450 for the first connection 18 of the electronic fuse 405 and a second contact 470 for the second connection 19 of the electronic fuse 405 has. The connector preferably fits mechanically into at least one of the slots 410 for electronic fuses 405.
[0204] The plug connector of the fuse body 425 preferably has a third contact 465 for a fuse data bus 9 , the third contact 465 being electrically connected to the data line 9 of a data interface 10 for the control circuit 4 of the electronic fuse 405 of the fuse body 425 .
[0205] The plug connector of the fuse body 425 preferably has at least one fourth contact 455 for a voltage supply 6 of the control device 4 of the electronic fuse 405.
[0206] The document presented here proposes a fuse 415 for a fuse box 400, in which the connector 410 of the fuse body 425 has a first contact 455 for the first connection 18 of the fuse 415 and a second contact 470 for the second connection 19 of the fuse 415. The connector of the fuse 415 is preferably configured to mechanically mate with at least one of the slots 410 for electronic fuses 405 and to mechanically mate with at least one of the slots 420 for fuses 415 . figure 5
[0207] The figure 5 is based on the figure 1 and represents a modification of figure 1 represent. Fuse 1 of figure 5 additionally includes a first test current source 505, which feeds an electrical test current 515 into the first terminal 26 of the circuit breaker 17 of the fuse 1. The additional first electrical test current 515 is preferably provided with a first modulation signal {505} of a first signal generator 520 by means of the first control signal 510 . The curly brackets are intended to indicate that {505} is the first modulation signal with which the first current 515 of the first test current source 505 is modulated.
[0208] In the figure 5, for the sake of clarity, not all useful and possibly customary device components are shown. Next device components that the reader as possibly in the figure 1 can assume that there are, for example, in the figure 1, figure 6, figure 9, figure 24, figure 41, figure 42, figure 52, figure 53, figure 54, figure 55, figure 57, figure 58. The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.
[0209] The control device 4 preferably comprises a first gate drive 530 of the control contact 27 of the first power switch 17 and a first control signal generator for the control signal of the control line 20 of the first power switch 17 for controlling the first power switch 17. The computer core 2 preferably controls the first gate drive 530 via the internal data bus 11.
[0210] The proposed fuse 1 preferably includes a first correlator 525. The computer core 2 of the control device 4 of the fuse 1 preferably controls the first correlator 525 via the internal data bus 11. The first correlator 525 preferably includes one or more input amplifiers, which the voltages between the first measuring contacts (21, 25, 27, 28, 22) record, filter and process. The first correlator 525 preferably includes a first synchronous demodulator, for example, which examines one of the measurable voltages for first components of the first modulation signal {505} of the first current 515 of the first test current source 505 .
[0211] In this case, the first synchronous demodulator of the first correlator preferably uses a correlation in the form of a scalar product, for example in accordance with the form A=〈{505}|Vxy(t)〉=∫0T{505}×Vxy(t)dt
[0212] where A is the value of the first share and V xy for a voltage between the first measuring contacts (21, 25, 27, 28, 22). Preferably, the first correlator 525 uses a voltage V xy between the second terminal 28 of the first circuit breaker 17 and the first control terminal 27 of the first circuit breaker 17. The proposed fuse 1 preferably has a housing 535 of the fuse 1. The housing 535 of the fuse 1 preferably has one or more optical windows 545, via which the control device 4 of the fuse 1 can signal other devices and / or people.
[0213] The document presented here proposes an electronic fuse 1 which has a first connection 18 and a second connection 19 . The proposed electronic fuse 1 also has a circuit breaker 17 and a control device 4 . According to the proposal, the circuit breaker 17 has a first connection 26 , a control connection 27 and a second connection 28 . It is preferably a MOS transistor. The first terminal 26 of the circuit breaker 17 is preferably electrically connected to the first terminal 18 of the fuse 1 and the second terminal 28 of the circuit breaker 17 is preferably electrically connected to the second terminal 19 of the fuse 1 . The control connection 27 of the circuit breaker 17 is typically electrically connected to the control device 4 . According to the proposal, the control device 4 of the electronic fuse 1 detects electrical voltages between the terminals (26, 27, 28) of the circuit breaker 17 and / or functionally equivalent values of physical parameters within the fuse 1 and uses this to determine a value for an electrical current 29 through the circuit breaker 17 between the first connection 26 of the circuit breaker 17 and the second connection 28 of the circuit breaker 17.
[0214] The electronic fuse 1 has an electronic test current source 505, which is connected to the circuit breaker 17 in such a way that it injects an additional current 515 into the circuit breaker 17 between the first connection 26 of the circuit breaker 17 and the second connection 28 of the circuit breaker 17 depending on a first control signal 510 of the control device 4 can feed. The control device 4 preferably modulates the control signal 510 with a first modulation signal {505}. This modulation signal {505} in turn modulates the time profile of the current value of the additional current 515. The control device 4 preferably detects or determines the time profile of the current value of the electric current 29 through the circuit breaker 17. The control device 4 preferably checks whether the time profile of the current value of the electric current comprises 29 signal components whose modulation correlates with the modulation of the modulation signal. In order to be able to detect the proportion of the test current 515 modulated in this way in the current 29 through the circuit breaker 17, the control device 4 of a proposed fuse 1 preferably includes a synchronous demodulator 525 or a functionally equivalent device, such as an optimum filter or matched filter. The synchronous demodulator 525 typically determines the correlation between the signal of the time profile of the electric current 29 through the power switch 17 on the one hand and the time profile of the modulation signal {505} on the other hand. For example, a synchronous demodulator 525 can calculate the value of the function C 29m = ∫ I 29 (t) × M(t)dt, where I 29 (t) for the value profile of the electric current 29 through the power switch 17 and M(t) for the time value profile of the modulation signal {505} and C 29m stands for the correlation value that the synchronous demodulator 525 determines. Other correlation methods are conceivable. In the system proposed here, the synchronous demodulator 525 multiplies the modulation signal {505} or a signal derived from it or a signal that has a fixed time relationship with the modulation signal {505}, on the one hand preferably by the time value profile I 29(t) of the electric current 29 or a signal derived therefrom on the other hand. The synchronous demodulator 525 then filters the signal resulting from the multiplication to form a correlation signal. This filtering is preferably low-pass filtering, so that the synchronous demodulator 525 then uses the function C 29m = ∫ I 29 (t) × M(t)dt. At the very least, the synchronous demodulator should show the integrating effect of a low-pass filter, at least in terms of frequency ranges. The synchronous demodulator 525 or the control device 4 can be used to determine the correlation signal C 29m (t) include a matched filter optimized for the modulation signal {505} and / or an optimal filter and / or a Kalman filter or another estimation filter that uses the time course of values I 29 (t) of the electric current 29 to the correlation signal C 29m (t) converts.
[0215] Typically, the control device 4 switches the circuit breaker 17 off when the sign of the electrical voltage between the first terminal 18 of the fuse 1 and the second terminal 19 of the fuse 1 does not correspond to a default value. For this purpose, the control device 4 detects the electrical voltage between the first connection 18 of the fuse 1 and the second connection 19 of the fuse 1. For example, the computer core 2 of the control device 4 can use an analog-to-digital converter 570 in order, via corresponding measuring lines 22, 21, 25 to detect the potentials at the circuit breaker 17 or at an auxiliary circuit breaker 23. The auxiliary circuit breaker 23 preferably serves to detect an auxiliary current which is proportional to the current through the circuit breaker (17) or corresponds in some other way. A shunt resistor 24 then enables the computer core 2 of the control device 4 of the fuse 1 to measure this auxiliary current by means of the corresponding measuring lines 25, 21 and by means of the analog-to-digital converter 570. In FIG figure 5, the connections between the analog-to-digital converter 570 and the measuring lines 20, 21, 22, 25 are not shown for a better overview. The reader is to accept them as existing and revealed. The computer core 2 of the control device 4 of the fuse 1 preferably switches the circuit breaker 17 off when the electrical voltage between the first connection 18 of the fuse 1 and the second connection 19 of the fuse 1 falls below a first preset value. The computer core 2 of the control device 4 of the fuse 1 preferably switches the circuit breaker 17 off when the electrical voltage between the first connection 18 of the fuse 1 and the second connection 19 of the fuse 1 exceeds a second preset value. The electronic fuse 1 typically has a reference potential connection 201 . The computer core 2 of the control device 4 of the fuse 1 preferably switches the circuit breaker 17 off when the electrical voltage between the first connection 19 of the fuse 1 and the reference potential connection 201 of the fuse 1 falls below a third preset value. The computer core 2 of the control device 4 of the fuse 1 preferably switches the circuit breaker 17 off when the electrical voltage between the second connection 19 of the fuse 1 and the reference potential connection 201 of the fuse 1 falls below a fourth preset value. The computer core 2 of the control device 4 of the fuse 1 preferably switches the circuit breaker 17 off when the electrical voltage between the first connection 18 of the fuse 1 and the reference potential connection 201 of the fuse exceeds a fifth preset value. The computer core 2 of the control device 4 of the fuse 1 preferably switches the circuit breaker 17 off when the electrical voltage between the second connection 19 of the fuse 1 and the reference potential connection 201 of the fuse 1 exceeds a sixth preset value. In this way, the control device 4 of the electronic fuse 1 ensures that the subsequent partial supply network is only operated in a predetermined voltage range.
[0216] The circuit breaker 17 and the control device 4 are preferably accommodated in a common housing 535 . This has the advantage that the EMC compatibility is increased.
[0217] The control device 4 of the electronic fuse can have an optical data interface 550, for example, in order to achieve good electrical isolation between the protected supply line at the first connection 18 of the fuse 1 and / or at the second connection 19 of the fuse 1. In order to be able to control this optical data interface 550, the housing 535 preferably has an optical window 545, which allows electromagnetic radiation to enter the housing 535 and thus allows the optical data interface 550 to interact with this electromagnetic radiation that has entered, so that the optical data interface 550 can receive an optically transmitted signal 540 in this way. Conversely, the optical data interface 550 can emit electromagnetic radiation 540 which can then exit the housing 535 via this optical window 545 in the housing 535 of the fuse 1 . Thus, such optical windows 545 are preferably sub-devices of one or more optical data interfaces 550 of the control device 4 of the relevant electronic security device 1. Such an optical window 545 thus allows electromagnetic radiation to enter and / or exit for the transport of data from and to the control device 4 of the security device and thus enables an optical interface 550 of the control device 4 of the fuse 1 within the housing 535 to be connected via this optical window 545 to an optical interface 555 of another device 12, for example a higher-level computer system 12, outside the housing 535 via an optical data connection 540 can communicate. Optical functional elements 580 can guide and / or shape the optical data connection 540 . Such optical functional elements can be deflecting functional elements such as mirrors and / or prisms and the like and / or cross-section-modifying functional elements such as diaphragms and / or focusing functional elements such as lenses and / or concave mirrors and / or light-guiding optical functional elements such as optical fibers and the like. Such a fuse with an optical data interface 550 preferably has an optical plug-in connection that allows the optical connection to be produced mechanically between the optical data bus interface 550 and the optical data connection 540 . Such an optical window 545 also allows the computer core 4 of the control device 4 or the control device 4 of the fuse 1 to signal a person by means of a visible optical signal. For example, the fuse may emit a red light through optical window 545 when circuit breaker 17 is open. Likewise, the fuse 1 can emit an optical signal recognizable to a person via such an optical window 545 that indicates the state of charge of the energy reserve 8 . The electromagnetic radiation for the transport of data, which the optical interface 550 emits and / or receives, is preferably laser radiation from a laser 560 or radiation from an LED 560 . The document presented here therefore proposes that the proposed fuse 1 preferably comprises a laser 560 or an LED 560. The computer core 2 of the control device 4 of the fuse 1 preferably uses this laser or this LED as a transmitter of data from the optical data interface 550 of the control device 4 of the fuse 1. In certain implementation cases, there may be a need to not have a separate laser or separate LED in the body 545 of the fuse 1, but to manufacture the LED monolithically with the rest of the control circuit 4 of the fuse in one semiconductor crystal. In that case, it is particularly favorable if the control circuit 4 of the electronic fuse 1 has a silicon-based LED 560 as the LED. Typically, the control circuit then includes a drive device 565 for operating the silicon-based LED, which provides the operating voltage for the silicon-based LED. The silicon-based LED 560 is preferably a silicon avalanche LED 560, in particular a SPAD diode 560 operated as an LED. The control device 656 preferably operates this above the breakdown voltage in the reverse direction.The control device 565 generates the necessary operating voltage for the silicon-based LED 560 from the operating voltage of the electronic fuse 1 between the terminals 6, 201 by means of a voltage converter of a voltage supply 5.
[0218] Preferably, the optical data bus interface 550 also includes an optical receiver. This optical receiver of the data bus interface 550 is preferably a photodiode. In order to achieve maximum synergy, it can be useful if the control device of the electronic fuse 1 operates the silicon-based LED 560 at least temporarily as a receiver of the optical data bus interface 550. The computer core 2 of the control device 4 of the electronic fuse 4 can preferably disconnect the silicon LED 560 from the electrical supply of the voltage converter of the voltage supply 5, for example by means of an isolating switch of the control device 4 of the electronic fuse 1, and thus the emitted light signal of the silicon LED 560 for the purpose of data transmission modulate or switch the silicon LED from transmit mode to receive mode. In the receiving mode, the computer core 2 detects the voltage signal 575 of the silicon LED 560, preferably by means of the analog-to-digital converter 570 of the control device 4 of the electronic fuse 1, and thus generates a digitized input data signal. The computer core 2 of the control device 4 of the fuse 1 uses the value recorded in this way as the input data signal of the optical data interface 550 and extracts the data transmitted to it from this input data signal data stream. Of course, the control device 4 of the electronic fuse 1 can also include a separate photodetector, for example a photodiode 560, and evaluation electronics of the photodetector 560. The electronic fuse 1 is preferably set up so that optical waveguides 580 and / or other optical functional means connect the electronic fuse 1 to one or more other electronic fuses (214 to 217, 225 to 223, 230 to 235, 225 to 256) via the respective optical Connect data interface 550 of these electronic fuses. A supply network 200 preferably comprises an optical data network as a data bus 9, with which the optical data interface 555 of a higher-level computer system 12 and / or the data interfaces 550 of the control devices 4 of the fuses of the supply network 200 can communicate with one another. The proposed electronic fuse 1 is, in particular if there is an increased requirement for electrical isolation, preferably via its optical interface 550 and an optical fiber 580 with an optical interface 555 of a higher-level computer system 12, for example a higher-level computer system (12), and possibly with one or more further electronic fuses (214 to 217, 225 to 223, 230 to 235, 225 to 256). In addition to data communication via this optical data interface 550 or the wired data interface 10, the control device 4 of the fuse 1 can be connected via a further, different optical data interface 551 or other data interface 610 to a higher-level control device and / or a higher-level computer system 12 and, if necessary, to the control devices 4 be connected to one or more further electronic fuses (1, 214 to 217, 225 to 223, 230 to 235, 225 to 256). A typical error that occurs is overheating of the fuse 1. In this case, both the power switch 17 and the control device 4 can overheat. The control device 4 of the electronic fuse preferably comprises one or more temperature sensor evaluation devices 585. The control device 4 of the fuse 1 preferably comprises a temperature sensor 586, for example a PN junction or a PTC resistor or an NTC resistor, which measures the temperature of the control device 4 of the fuse 1 and convert it into an electrical signal that the temperature sensor evaluation device 585 and / or the analog-to-digital converter 570 convert into a measured variable for the computer core 2 of the control device 4 of the electronic fuse 1.Circuit breaker 17 of fuse 1 preferably includes a temperature sensor 586, for example a PN junction or a PTC resistor or an NTC resistor, which detects the temperature of circuit breaker 17 of fuse 1 and converts it into an electrical signal that temperature sensor evaluation device 585 and / or convert the analog-to-digital converter 570 into a measured variable for the computer core 2 of the control device 4 of the electronic fuse 1. In this way, the computer core 2 of the control device 4 of the fuse 1 can detect a thermal overload of the circuit breaker 17 and / or the control device 4 and open the circuit breaker 17 before damage occurs and / or notify the higher-level computer system 12 via the data bus 9 of an imminent overload of the Circuit breaker 17 and / or the control device 4 of the fuse 1 transmit. The electronic fuse 1 thus preferably includes one or more temperature sensors 586 for monitoring the safe operation of the fuse 1. The control device 4 of the fuse 1 evaluates measured temperature values from the one or more temperature sensor evaluation devices 585 that measure the temperature sensors 586. The temperature sensor evaluation devices 585 record these measured temperature values with the aid of temperature sensors external to the electronic control device 4 and / or with the aid of temperature sensors 586 of the electronic fuse 1 .
[0219] In many applications it makes sense for the fuse 1 to have a first connection 18 on the energy source side and a second connection 18 on the load side. In many applications, feedback of electrical energy in the direction of the energy source is not desired. The electric current 29 through the circuit breaker 17 should therefore preferably only flow from the first connection 18 of the fuse 1 to the second connection 19 of the fuse 1 in such applications. In this case, the electronic fuse 1 comprises means (20, 21, 22, 23, 24, 25, 525, 570) for detecting a current 29 flowing backwards. For example, the analog-to-digital converter 570 can record the voltages of the measuring lines (20, 21, 22, 25) among one another and / or with respect to the reference potential 201 and transmit the recorded values to the computer core 2 of the control device 4 of the fuse 1 via the internal data bus 11 submit. The computer core 2 of the control device 4 of the fuse 1 can then, for example, infer the value of the auxiliary current 36 through the shunt resistor 24, which the auxiliary circuit breaker 23 generates proportionally to the current 29 and thus infer the sign of the current 29. For example, the computer core 2 of the control device 4 of the fuse 1 can open the circuit breaker 1 if the estimated and / or determined sign of the electric current 29 does not correspond to an expected sign. This can be the case, for example, when energy is illegally transported from the second connection 19 of the fuse 1 to the first connection 18 of the fuse, although the opposite energy transport direction is the expected energy transport direction.
[0220] The computer core 2 of the control device 4 of the electronic fuse 1 then evaluates the measured values of the voltages of the measuring lines (20, 21, 22, 25) recorded in this way and preferably transmits the measured values and / or measured values derived therefrom to other computer cores 2 of other electronic fuses ( 1, 214 to 217, 225 to 223, 230 to 235, 225 to 256) via a backup data bus (9, 540) or the like or to a higher-level computer system 12, for example to a higher-level computer system 12.
[0221] In many cases it makes sense if the electronic fuse 1 includes two data interfaces 10 and 610 . The data interfaces can also be multiple optical data interfaces 550 and 551 . It is also conceivable that the electronic fuse 1 includes one or more wired data interfaces 10, 610 and / or one or more optical data interfaces 550, 551 at the same time. An optical waveguide 580 can, for example, connect one electronic fuse 1 or several electronic fuses (1, 214 to 217, 225 to 223, 230 to 235, 225 to 256) via the optical data interfaces 551, 550 of one electronic fuse 1 or several electronic Connect fuses to another device 12, for example to a higher-level computer system 12, or to the computer cores 2 of the control devices 4 of other electronic fuses and / or to one another.
[0222] The electronic fuse 1 disclosed in the document presented here preferably has a control device 4 and a power switch 17 as the power switch of the electronic fuse 1 . The computer core 2 of the control device 4 uses a gate control circuit 16 for controlling and monitoring the circuit breaker 17 to control whether the circuit breaker 17 is conducting and thus operates as a closed circuit breaker, or whether the circuit breaker 17 is not conducting and therefore operates as an open circuit breaker. The control device 4 of the electronic security device preferably has a data interface 10 for a security data bus 9 . The computer core 2 of the control device 4 of the fuse 1 receives and / or sends data messages via the fuse data bus 9 and the data interface 10 . Whether the computer core 2 of the control device 4 of the fuse 1 closes or opens the circuit breaker 17 by means of the gate control circuit 16 depends at least partially and at least temporarily on the content of these data messages. In order to prevent the circuit breaker 17 from being opened and / or closed undesirably, the computer core 2 of the control device 4 of the electronic fuse 1 changes the switching state of the circuit breaker 17 based on a data message only if the control device 4 receives a data message with a password. For this purpose, the bit stream packet BP includes that the data message includes in the data part INFO preferably firstly the configuration data ILD and secondly a password for authentication of this command. In a specified method, the computer core 2 compares the received password with an expected password or verifies the validity of the received password in some other way. If the result of this verification is such that the password is valid, the computer core 2 of the control device 4 of the fuse 2 executes the received command and, depending on the content of the command, opens or closes the circuit breaker 17 of the electronic fuse 1.
[0223] The document presented here thus describes an electronic fuse 1 with a circuit breaker 17, the electronic fuse 1 detecting and checking the voltage between this terminal 26 and a reference node 201 at the terminal 26 of its circuit breaker 17, which is on the energy source side, and wherein the electronic fuse 1 detects the current 29 through the circuit breaker 17 and / or determines and checks. The electronic fuse 1 preferably switches off the electrical supply of the subsequent subtree of the supply network 200 by switching off its circuit breaker 17 if the amount of the detected value of the voltage falls below a minimum value and if at the same time the amount of the detected value of the electric current 23 through the circuit breaker 17 of the electronic fuse 1 exceeds a predetermined threshold value. This is a clear indication of a short circuit, which fuse 1 is supposed to absorb.
[0224] Since the fault may be temporary, for example as a result of the commutation of an inductive load, it may make sense to attempt to switch on again. The computer core 2 of the control device 4 of the electronic fuse 1 then preferably carries out one or more attempts to switch on the circuit breaker 17 after a short-circuit event has occurred, as described above. It could be a real short circuit. It is therefore useful if the computer core 2 of the control device 4 of the fuse 1 precisely controls the number of reclosing attempts and the implementation of the reclosing attempts and, if necessary, also logs their implementation and result. The computer core 2 of the control device 4 of the electronic fuse 1 therefore preferably increases a switch-on attempt counter of the control device 4, in particular a register value of the computer core 2, by a switch-on attempt count step size, which can also be negative and is different from 0, when a short-circuit event occurs when the circuit breaker 17 is attempted to be switched on . The computer core 2 of the control device 4 of the electronic fuse 1 preferably transmits an error message to the computer core 2 of the control device 4 of another electronic fuse or to a higher-level computer system 12 via the data bus 9 if the number of unsuccessful switch-on attempts in the form of the counter reading of the switch-on attempt counter exceeds a predetermined number crosses or reaches the maximum number of switch-on attempts. The computer core 2 of the control device 4 of the proposed electronic fuse 1 sends and receives data such as configuration data (write / read), switching commands (write / read), diagnostic data ( Write / read), measured values (read), comparison value settings (write / read). The corresponding data bus 9 can be, for example, partially or entirely a two-wire data bus, in particular a bidirectional and / or differential two-wire data bus 9 . It is particularly advantageous if the data bus 9 is a standard automotive data bus such as a CAN data bus or a data bus with a physical interface of a CAN data bus, a CAN FD data bus or a Flexray data bus or an LVDS data bus or the like . The fuses can be daisy chained together. For this purpose, for example, control devices 4 of fuses 1 of the supply network 200 can include two data interfaces 610, 10 for the fuse data bus (9). The plug connectors 410 and the fuse bodies 425 of the fuses 405, 1 should then have corresponding additional plugs and contacts. The computer cores 2 of the control devices 4 of the electronic fuses (1, 214 to 217, 225 to 223, 230 to 235, 225 to 256) of a supply network 200 and the higher-level computer system 12, which are connected to the data bus 9, preferably carry out an auto-addressing method , in order to allocate a unique fuse address to each data interface 10 of each control device 4 of each fuse on the data bus 9 . A possible exemplary auto-addressing method is described in EP 1 490 772 B1. The document presented here describes for the first time the use of an auto-addressing method for assigning unique fuse addresses to the electronic fuses of a supply network 200 which are connected to a fuse data bus 9 .
[0225] The data interfaces 10, 610 of the control device 4 of the electronic fuses 1 are preferably set up to carry out an auto-addressing method for determining a fuse address or to take part in such an auto-addressing method.
[0226] The figure5 shows, among other things, the optical data connection 540 between the first optical data interface 550 of the control device 4 of the fuse 1 and the optical interface 555 of the higher-level computer system 12. An optical fiber 580 carries the electromagnetic radiation of the optical data connection 540. The housing 535 of the electronic fuse 1 an optical connector that allows the mechanical and optical connection of the electronic fuse 1 with the optical fiber 580. As a result, an LED 560 can feed electromagnetic radiation into the optical waveguide 580 as an optical data connection 540 . As a result, a photodetector of the optical data interface 550 can receive electromagnetic radiation as a data connection 540 from the optical waveguide 580 . The optical connector preferably includes an optical window 545, whereby the housing 535 of the fuse 1 includes such an optical window 545. The optical data interface 550 preferably includes a control device 565 for controlling the LED 560. If the LED 560 is not supplied with electrical energy by the control device 565, the control device 4 can also use it as a photodetector for receiving the optical data connection 540 of the optical data interface 555 of the higher-level computer system 12 use. In that case, for example, an analog-to-digital converter 570 of the control device 4 of the fuse can detect the voltage signal 575 of the silicon LED 560 and feed it to the computer core 2 via the internal data bus 11 for evaluation. Of course, this evaluation and an analog-to-digital converter can also be part of the optical data interface 550 .
[0227] The figure 5 shows, among other things, a second optical data connection 540 between the second optical data interface 552 of the control device 4 of the fuse 1 and an optical interface (not shown) of another higher-level computer system or another control device 4 of another fuse 1. The housing 535 of the electronic fuse 1 preferably has a further optical connector that allows the mechanical and optical connection of the electronic fuse 1 with a second, non-illustrated optical fiber. As a result, an LED 561 can feed electromagnetic radiation into the further optical waveguide as an optical data connection 540 of the second optical data interface 551 . A photodetector of the second optical data interface 551 can thereby receive electromagnetic radiation as a data connection 540 from the further optical waveguide (not shown). The second optical connector preferably also includes a second optical window 545, as a result of which the housing 535 of the fuse 1 includes such a second optical window 545. The second optical data interface 552 preferably includes a control device 565 for controlling the second LED 561. If the second LED 561 is not supplied with electrical energy by the control device 565 of the second optical data interface 551, the control device 4 can also use it as a photodetector for receiving the use the second optical data connection 540 of the optical data interface of the further higher-level computer system or the optical data interface of the other electronic fuse 1. In this case, for example, an analog-to-digital converter 570 of the control device 4 of the fuse can detect the voltage signal 576 of the second silicon LED 561 and feed it to the computer core 2 via the internal data bus 11 for evaluation. Of course, this evaluation and an analog-to-digital converter can also be part of the second optical data interface 551 . The second laser or the second LED 561 can, for example, again be a silicon-based LED, in particular a silicon avalanche LED, in particular a SPAD diode operated as an LED.
[0228] The control device 4 of the fuse 1 preferably has temperature sensor evaluation devices 585 which, for example, determine measured temperature values using temperature sensors 586 and make them available to the computer core 2 of the control device 4 of the fuse 1 via the internal data bus 11 .
[0229] The control device 4 of the fuse 1 preferably includes a random number generator 60 random number generator (RNG=random number generator). The computer core 2 of the control device 4 of the fuse 1 can read the random value of the random number generator 60 via the internal data bus 11 of the control device 4 of the fuse 1 . Computer core 2 of the control device then preferably uses this random number for encrypting data communication via data interface 10 or optical data interface 550 with other computer cores 2 of other control devices 4 of other fuses 1 in supply network 200 and / or for encrypting data communication with a higher-level computer system 12. The random number generator 60 is preferably a so-called true random number generator (TRNG). Most preferably, the random number generator 60 is a quantum random number generator (QRNG). According to the proposal, the quantum random number generator 60 has a first SPAD diode which is reverse-biased with a voltage above the reverse voltage. The blocking voltage is preferably supplied by the voltage supply 5 or a device part thereof. As a result, the first SPAD diode begins to emit individual light pulses. An optical fiber of the control device preferably forwards these light pulses from the first SPAD diode to a second SPAD diode. The two SPAD diodes are preferably manufactured monolithically in a silicon semiconductor crystal using CMOS technology. The optical waveguide is preferably manufactured in the metallization stack of the CMOS circuit, which comprises the first SPAD diode and the second SPAD diode. The metallization stack preferably includes a plurality of structured metallic wiring levels and a plurality of isolating insulation levels. The metallic wiring planes can be made of an aluminum alloy, for example, which can be structured in conductor tracks etc. by means of photolithography. The optically transparent insulation levels between these line levels of the metallization stack can be made of silicon dioxide or another optically transparent and suitable insulator, for example. The insulation levels are also typically structured photolithographically and are provided with vias for connecting lines of different line levels. The metallization stack is preferably structured and constructed in the area of the two SPAD diodes in such a way that a larger quantity of the photons that the first SPAD diode emits in the direction of the metallization stack can reach the second SPAD diode and the photons cannot reach the conductor tracks of the metallization stack prevent. Conductor tracks of the metallization stack preferably shield the optical waveguide upwards and to the sides in such a way that these conductor tracks reflect at least some of the photons that want to escape in this direction back in the direction of the second SPAD diode. The interior of the optical waveguide therefore preferably comprises only material from the insulation layers and preferably no material from the conductor tracks. The optical fiber of the quantum random number generator 60 preferably optically connects the first SPAD diode to the second SPAD diode. The optical waveguide of the quantum random number generator 60 preferably covers both the first SPAD diode and the second SPAD diode in order to capture a maximum number of photons from the first SPAD diode and to feed them to the second SPAD diode. This construction allows for a maximum bit rate per second for the generated random bits. The second SPAD diode is preferably also reverse biased with a detection voltage. The detection voltage is preferably supplied again by the power supply 5 and / or a sub-device thereof. The second SPAD diode also generates current pulses of a first maximum level by spontaneously emitting individual photons. If a photon from the first SPAD diode reaches the second SPAD diode, stimulated emission occurs. The resulting current pulse of the SPAD diode current of the second SPAD diode then has a second level. Typically, the first elevation is approximately twice the height of the second elevation. A transimpedance amplifier preferably amplifies the SPAD diode current of the second SPAD diode and thus the current pulses of the second SPAD diode.A comparator compares the amplified SPAD output signal with a threshold. The threshold value is preferably set in such a way that the comparator supplies a logical 1 at its output for current pulses of the second magnitude and supplies a logical 0 at its output for current pulses of the first magnitude and in the case of no current pulses. A counter, which preferably runs with the clock of the oscillator 30 or a clock of the clock system of the control device, preferably counts the time between the occurrence of two ones at the output of the comparator. The counter represents a time-to-digital converter. This is referred to below as a time-to-digital converter. Since the second SPAD diode has a dead time for the detection of photons, the time-to-digital converter of the quantum random number generator preferably discards all pulse pairs of one pulses at the output of the comparator that follow one another too closely, i.e. shorter than this dead time. In this way, the time-to-digital converter of the quantum random number generator 60 generates a first number, which is already substantially dependent on a quantum event, namely the spontaneous emission of the first SPAD diode and a second quantum event, namely the stimulated emission of the second SPAD diode. depends. The subsequent entropy extraction device now uses a first number of the time-to-digital converter and a second number of the time-to-digital converter if the first number of the time-to-digital converter and the second number of the time-to-digital converter Digital converters are different. If the first number of the time-to-digital converter is greater than the second number of the time-to-digital converter, then the entropy extraction generates a random bit with a first logical value and otherwise a random bit with a second logical value, the is different from the first value. The entropy extraction device of the quantum random number generator then generates a random number from several of these random bits, which the entropy extraction device then makes available to the computer core 2 of the control device 4 of the fuse 1 in a register of the quantum random number generator 60 .
[0230] The computer core 2 of the control device 4 of the fuse 1 preferably generates a private key and a public key using a random number generated in this way.
[0231] The computer core 2 of the control device 4 of the electronic security device 1 then transmits this public key via the data bus 9 to one or more computer cores 2 of other control devices 4 of other security devices and / or to a higher-level computer system 12. These can then use this public key to encrypt data messages in Use bit stream packets BP to the computer core 2 of the control device 4 of the fuse 1 via the data bus interface (10, 610, 550, 551) and send encrypted data to the computer core 2 of the control device 4 of the fuse 1 in this way.
[0232] The computer core 2 of the control device 4 of the backup preferably generates a new pair of keys from time to time, preferably regularly, using the random number generator 30 and then distributes the public key again via the data bus 9 to one or more computer cores 2 of other control devices 4 of other backups and / or or to a higher-level computer system 12. The computer core 2 of the control device 4 of the fuse 1 can then use its private key to decrypt the encrypted data messages received.
[0233] The higher-level computer system 12 of the supply network 200 preferably also includes one or more such random number generators 60. Here, too, these can be RNGs or QRNGs (quantum random number generators), which provide the higher-level computer system 12 with random numbers for key pair generation.
[0234] The higher-level computer system 12 preferably generates a private key and a public key using a random number generated in this way from such a random number generator.
[0235] D the higher-level computer system 12 then transmits this public key via the data bus 9 to one or more computer cores 2 of other control devices 4 of other fuses and / or to another higher-level computer system 12 that may be present. These can then use this public key to encrypt data messages in a bit stream Use packets BP to the higher-level computer system 12 and send encrypted data to the higher-level computer system 12 in this way.
[0236] The higher-level computer system 12 preferably generates a new pair of keys from time to time, preferably regularly, using its own random number generator and then distributes the public key again via the data bus 9 to one or more computer cores 2 of other control devices 4 of other fuses and / or to the other higher-level computer system 12. The higher-level computer system 12 can then use its private key to decrypt the received encrypted data messages. figure 6
[0237] The figure 6 essentially corresponds to the figure 1, wherein the control device 4 of the fuse 1 of figure 4 has an additional second data interface 610. What has already been written about the first data interface 10 should also apply to the second data interface 610 . in particular, it can be a data interface for a single-wire data bus and / or a differential bidirectional data bus. In the automotive field, the data bus 9 of the second data bus interface 610 can, for example, be a Lin data bus 9 or a DSl3 data bus 9 or a PSI5 data bus 9 or a CAN data bus 9 or a CAN FD data bus 9 or an Ethernet data bus or a Flexray -Data bus 9 or an LVDS data bus 9 or some other wired or wireless data transmission path, for example via a Bluetooth or WLAN data connection or an optical data connection 540. The data communication of the computer core 2 of the control device 4 of the fuse 1 runs in addition to the data communication via the first data bus interface 10, 550 via a wired or wireless second interface 610, 551.
[0238] In the figure 6, for the sake of clarity, not all useful and possibly customary device components are shown. Next device components that the reader as possibly in the figure 1 can assume that there are, for example, in the figure 1, figure 5, figure 9, figure 24, figure 41, figure 42, figure 52, figure 53, figure 54, figure 55, figure 57, figure 58. The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.
[0239] In many cases it is desirable for the control device 4 of a fuse 1 to have more than a single data interface 10 . This can be the case, for example, if increased communication security is required due to redundancy or, for example, secure addressing is to take place using a daisy chain. The computer core 2 of the control device 4 can access this second data interface 610 via the internal data bus 11 and communicate with other computer systems 12 and / or other computer cores 2 of other control devices 4 of other fuses 1 in the supply network 200 . The document presented here therefore proposes electronic fuses 1 with control devices 4 which include two data bus interfaces (610, 10) for the fuse data bus 9. Some of these second data bus interfaces 10, 610 can be optical data interfaces 550, 551. A number of such fuses 1 are preferably connected to this fuse data bus 9 with two data interfaces 10, 610 or inserted into the fuse data bus 9 by means of two such data interfaces (10, 551, 550, 610). This results in a supply network 200 in which one or more electronic fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) each have two data interfaces (214 to 217, 225 to 228, 235 to 238, 250 , 251, 610, 10) for each electronic fuse (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) and which are preferably inserted into the data bus 9. (See also figure7). The computer cores 2 of the control devices (4) of the electronic fuses of the fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) of such a supply network 200 receive and transmit via a data interface (10, 610, 550, 551) via this data bus 9 then data such as configuration data (write / read), switching commands (write / read), diagnostic data (write / read), measured values (read), comparison value settings (write / read). For example, it is conceivable that the computer core 2 of the control device 4 of a fuse 1 receives data via the first data interface 10 from a computer core 2 of the control device 4 of another fuse 1 or from a higher-level computer system 12 and then sends this data directly or after modifying the data via the second data interface 610 sends on to a computer core 2 of another control device 4 of another fuse 1 and / or to a higher-level computer system 12 . In this way, the higher-level computer system 12 can, for example, check the functionality of the computer core 2 of the control device 4 of the fuse 1 . For example, electronic fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) of such a supply network 200 can include two such data interfaces 10 and 610 for the data bus 9 and be inserted into the data bus 9. In this way, the fuses then form a linear chain of fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) of such a supply network 200 along at least part of the data bus 9. As a result, the fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) of such a supply network 200 then a unique physical position, which the computer core 2 of a control device 4 of a fuse 1 can then determine for its fuse 1 as part of an auto-addressing method and into a can convert logical fuse address of its fuse 1 for addressing data messages in bit stream packets BP to this fuse. The computer core 2 preferably transmits the security address determined by it to the higher-level computer system 12 after the auto-addressing method has been completed at the start of operation of the supply network 200. The higher-level computer system 12 then preferably checks whether the transmitted security addresses correspond to the expected values. If this is not the case, the higher-level computer system 12 preferably repeats the auto-addressing method, which typically means that the computer cores 2 of the control devices 4 of the fuses of the supply network 200 discard the fuse addresses already determined in favor of the fuse addresses to be newly determined. A higher-level computer system 12, which is preferably connected to the start of this part of the data bus 9, preferably uses auto-addressing in cooperation with the computer cores 2 of the control devices 4 of the electronic fuses to determine a security address for each of the computer cores 2 of the control devices 4 of the electronic fuses in order to activate the computer cores 2 of the control devices 4 of the fuses of the supply network 200 and transmits them, if necessary, to the computer cores 2 of the control devices 4 of the electronic fuses of the supply network 200. The data communication of the computer core 2 of the control device 4 of the fuse 1 takes place via a wired or wireless interface 610, 10. figure 7
[0240] The figure 7 corresponds in essential parts to figure 3, the data bus 9 being designed as a ring-shaped data bus ring 9'. The data interfaces 280 to 293 of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 256) include the two data interfaces 10, 610 of the figure 6. The higher-level computer system 12 controls the supply network 200 again.
[0241] The superordinate computer system 12 is connected to the first data bus interface of the data bus interfaces 284 of the fuse 225 of the load 220 via the data bus ring 9 ′ with a second data bus interface.
[0242] The second data bus interface of the data bus interfaces 284 of the fuse 225 of the load 220 is connected to the first data bus interface 285 of the fuse 226 of the load 221 via the data bus ring 9 ′.
[0243] The second data bus interface of the data bus interfaces 285 of the fuse 226 of the consumer 221 is connected to the first data bus interface 286 of the fuse 227 of the consumer 222 via the data bus ring 9 ′.
[0244] The second data bus interface of the data bus interfaces 286 of the fuse 227 of the load 222 is connected to the first data bus interface 287 of the fuse 228 of the load 223 via the data bus ring 9 ′.
[0245] The second data bus interface of the data bus interfaces 287 of the fuse 228 of the consumer 223 is connected to the first data bus interface 288 of the fuse 235 of the consumer 230 via the data bus ring 9 ′.
[0246] The second data bus interface of the data bus interfaces 288 of the fuse 235 of the load 230 is connected to the first data bus interface 289 of the fuse 236 of the load 231 via the data bus ring 9 ′.
[0247] The second data bus interface of the data bus interfaces 289 of the fuse 236 of the consumer 231 is connected to the first data bus interface 290 of the fuse 237 of the consumer 232 via the data bus ring 9 ′.
[0248] The second data bus interface of the data bus interfaces 290 of the fuse 237 of the consumer 232 is connected to the first data bus interface 291 of the fuse 238 of the consumer 233 via the data bus ring 9 ′.
[0249] The second data bus interface of the data bus interfaces 291 of the fuse 238 of the consumer 233 is connected to the first data bus interface 283 of the fuse 217 of the consumer 213 via the data bus ring 9'.
[0250] The second data bus interface of the data bus interfaces 283 of the fuse 217 of the consumer 213 is connected to the first data bus interface 282 of the fuse 216 of the consumer 212 via the data bus ring 9'.
[0251] The second data bus interface of the data bus interfaces 282 of the fuse 216 of the consumer 212 is connected to the first data bus interface 281 of the fuse 215 of the consumer 211 via the data bus ring 9'.
[0252] The second data bus interface of the data bus interfaces 281 of the fuse 215 of the consumer 211 is connected to the first data bus interface 280 of the fuse 214 of the consumer 210 via the data bus ring 9'.
[0253] The second data bus interface of the data bus interfaces 280 of the fuse 214 of the load 210 is connected to the first data bus interface 292 of the fuse 255 of the energy source 250 via the data bus ring 9 ′.
[0254] The second data bus interface of the data bus interfaces 292 of the fuse 255 of the energy source 250 is connected to the first data bus interface 293 of the fuse 256 of the energy source 251 via the data bus ring 9 ′.
[0255] The second data bus interface of the data bus interfaces 293 of the fuse 256 of the energy source 251 is connected to the first data bus interface of the superordinate computer system 12 via the data bus ring 9'.
[0256] As a result, the data bus ring 9' is closed. A supply network 200 with a data bus ring 9' as data bus 9 has the advantage that if the data bus ring 9' is interrupted at one point by a fault or an accident, all bus users can still communicate with all other bus users. This is of particular importance because supply networks 200 are typically safety-relevant.
[0257] The document presented here also refers to the description of the figure 6, which essentially fuses the figure 7 reflects.
[0258] The document presented here explains using the example of figure7 the targeted shedding of supply subnets. The supply network 200 of the vehicle includes device parts 210, a cable harness with line sections 240, 241, 245, at least one energy source 250, 251, at least one control computer 12 - for example a higher-level computer system 12 - and at least two electronic fuses 214, 225. Typically, the Device parts 220 electrical consumers. At least one or more energy sources 250, 251 of the supply network 200 supply at least two of the device parts 210, 220 with electrical energy via the wiring harness with the line sections 240, 241, 245. The electronic fuses 214, 225 are integrated into the wiring harness with line sections 240, 241, 245 inserted. Each of the electrical fuses 214, 225 is preferably assigned to at least one electrical consumer (210, 225), number 1, which is referred to below as the electrical consumer assigned to the respective electronic fuse. A fuse for the fuses 214, 215 can enable or prevent the energy supply to the electrical consumer assigned to this fuse, depending on a control signal from the control computer, ie the higher-level computer system 12. The computer core of the control device of the relevant fuse typically receives such a control signal via the data bus 9, here via the data ring bus 9'. A fuse associated with this consumer can then prevent the power supply of the electrical consumer associated with this fuse by means of the corresponding fuse associated with this consumer. Preferably, control computer 12, i.e. higher-level computer system 12, for example, establishes an encrypted data connection 720 between control computer 12 of the vehicle, i.e. higher-level computer system 12, for example, and a computer 710 of a service provider, in particular a computer system of the automobile manufacturer of the vehicle. The control computer 12 of the vehicle, for example the higher-level computer system 12, preferably authenticates the vehicle with the computer 710 of the service provider. The authentication data of the vehicle can include, for example, the data of the vehicle and / or the car key and / or a SIM card in the vehicle and / or a vehicle-specific password entry or password generation and / or biometric user data of a vehicle owner etc. In return, the computer 710 of the service provider typically authenticates itself with the control computer 12 of the vehicle, for example with a higher-level computer system 12 of the vehicle. If necessary, the requesting person 730 authenticates himself by means of inputs and / or biometric sensor data such as fingerprint recognition via the control computer 12 of the vehicle, for example via the higher-level computer system 12, at the computer 710 of the service provider. The authentication data can include, for example, the data of the vehicle and / or the personalized car key, a personalized SIM card, a personalized password entry, biometric user data, etc. The service provider's computer 710 then preferably generates or provides an activation code. The service provider's computer 710 transmits the activation code via the secure data connection 720 to the vehicle's control computer 12, for example to the higher-level computer system 12. The vehicle's control computer 12, ie the higher-level computer system 12, preferably verifies the admissibility and / or the syntactical correctness and / or or the situational admissibility of the activation code. If this verification was successful, the control computer 12 of the vehicle, i.e. the higher-level computer system 12 of the vehicle, enables the power supply to an electrical consumer 220 assigned to the fuse by means of the corresponding fuse 225 if the activation code is permissible and / or syntactically correct and / or the situation is permissible is. For this purpose, the higher-level control computer 12 of the vehicle, as the higher-level computer system 12, sends a command via the data bus 9 to the computer core 2 of the control device 4 of the corresponding fuse.This command is preferably encrypted so that the computer core 2 of the control device 4 of the backup can verify whether the command was issued by a reliable higher-level computer system 12 . If the computer core 2 of the control device 4 of the corresponding fuse receives such a protected command, the computer core 12 of the control device 4 of the corresponding fuse closes the circuit breaker 17 of this fuse and thus allows the power supply of the subsequent partial supply network via this circuit breaker 17. The higher-level computer system 12 preferably transmits via the data connection 720 billing data to a computer 710 of a service provider, in particular to a computer system of the automobile manufacturer, with memory information in the service provider's computer 710 preferably marking that the bill has not yet been paid. The computer 710 of the service provider or of the automobile manufacturer preferably creates an invoice depending on the billing data transmitted. The service provider's computer 710 then preferably transmits the bill to a computer system 740 of the ordering person 730, or to the ordering person 730. The ordering person 730 or a computer (710) of a service provider then preferably settles this bill. The service provider computer 740 then marks the storage information in the service provider computer (740) that the bill is paid.
[0259] A proposed vehicle includes device parts 210, at least one cable harness 1515 with line sections 240, 241, 245, at least one energy source 250, 251, at least one control computer 12 - for example a higher-level computer system 12 - at least two electronic fuses 214, 225. The device parts (220) are typically electrical consumers. The at least two energy sources 250, 251 of the supply network 200 of the vehicle supply one or more of the device parts 210, 220 with electrical energy via the wiring harness with line sections 240, 241, 245. The electronic fuses 255, 256 are in the wiring harness of the supply network, the line sections 240, 241, 245 included. Each of the electrical fuses 255, 256 is preferably assigned at least one, number 1, electrical energy source 250, 251, which is referred to below as the assigned electrical energy source 250, 251. The word "inserted" here can mean that the electronic fuse 255, 256 can connect a line section 240, 241, 241 to the electrical energy source 250, 251 associated with this fuse 255, 256 or the electrical energy source 250 associated with this fuse 255, 256, 251 can separate from this line section 240, 241, 241. A respective fuse of the fuses 255, 256 can enable or prevent the supply of energy from the respectively associated electrical energy source 250, 251 depending on a control signal from the control computer 12—for example from the higher-level computer system 12. The corresponding associated fuse 255, 260 can prevent the supply of energy from an associated electrical energy source 250, 251. The control computer 12 creates an encrypted connection 720 between the control computer 12 of the vehicle, for example the higher-level computer system 12, and a computer 710 of a service provider, in particular a computer system 710 of the automobile manufacturer. The vehicle's control computer 12 - for example the higher-level computer system 12 - authenticates the vehicle to the service provider's computer 710, the vehicle's authentication data being, for example, the data of the vehicle and / or the car key and / or a SIM card in the vehicle and / or a vehicle-specific Password entry or password generation and / or biometric user data of a vehicle owner, etc. may include. The service provider's computer 710 also authenticates itself to the vehicle's control computer 12, for example to the higher-level computer system 12. If necessary, the requesting person 730 authenticates using the vehicle's control computer 12, for example using the higher-level computer system 12, to the service provider's computer 710, wherein the authentication data can include, for example, the data of the vehicle and / or the personalized car key, a personalized SIM card, a personalized password input, biometric user data, etc. The service provider's computer 710 generates an unlock code or provides this unlock code. The service provider's computer 710 then transmits the activation code to the vehicle's control computer 12, for example to the higher-level computer system 12. The vehicle's control computer 12, for example the higher-level computer system 12, then verifies the admissibility and / or syntactic correctness and / or the situational Eligibility of Unlock Code. If the verification of the activation code is successful, the control computer 12 of the vehicle enables energy to be supplied to an assigned electrical energy source (250, 251) by means of the corresponding, assigned fuse 255, 260. For this purpose, the control computer 12 of the vehicle sends a corresponding command via the data bus 9 to the relevant fuse 255, 260. The communication between the control computer 12 and the fuse 255, 260 is preferably encrypted. The communication is preferably PQC encrypted. The control computer 12 of the vehicle has preferably previously authenticated itself at least once with the computer core 2 of the control device 4 of the fuse 250, 260 in question.The computer core 2 of the control device 4 of the relevant fuse 250, 260 has preferably previously authenticated itself with the control computer 12 of the vehicle, ie the higher-level computer system 12. The control computer 12 of the vehicle preferably transmits billing data to a computer 710 of a service provider, in particular to a computer system of the automobile manufacturer, with storage information in the service provider's computer 710 marking that the bill has not been paid. A computer 710 or the computer 710 of a service provider or the service provider, in particular to a computer system of the automobile manufacturer or the computer system of the automobile manufacturer, then preferably creates an invoice depending on the billing data transmitted. The billing data can relate, for example, to the duration of use of certain consumers or energy sources or certain line sections or the determination of certain operating parameters or the provision of certain methods for operating the vehicle or its device parts. A computer 710 or the computer 710 of a service provider or the service provider then transmits the invoice created in this way, preferably to a computer 750 or the computer 750 of a service provider or the service provider, in particular to a computer system or the computer system of the ordering person, or to the ordering person 730 A computer 750 or the computer 750 of a service provider or the service provider and / or the requesting person 730 preferably settles the bill. An input from the requesting person 730 is preferably required for this. Preferably, the service provider computer 710 marks the storage information in the service provider computer 710 that the bill is paid.
[0260] For example, a computer 710 of a service provider or the automobile manufacturer can use the transmitted billing data to create a forecast of the probability of failure of a device part of the vehicle using the vehicle data and / or operating data and / or measured values and / or damage data. This computer 710 can then transmit these forecast results to a server 1985 and / or a workshop terminal and / or a terminal 740 and / or a vehicle owner's computer 730 and / or a terminal 740 and / or a vehicle driver's computer 730 or a terminal and / or a server 710 of an automobile manufacturer and / or a terminal and / or server of a logistics company and / or a terminal and / or server of another user of this data and possibly display it there.
[0261] The vehicle can also use such a system to detect operating errors. For example, the computer core 2 of a control device 4 of an electronic fuse can send a message to a computer 710, 750 of a service provider in the event of a hot-plug event in the supply network 3100, i.e. the unauthorized disconnection or connection of an electrical plug connection under current and / or voltage and / or the automobile manufacturer. In the event of a hot-plug event in the supply network 200 of a vehicle, the computer core 2 of the control device 4 of an electronic fuse can transmit a message to a computer 710 of a vehicle manufacturer or a service provider directly or with a time delay, or can provide such information, for example, in a memory of a higher-level computer 12 .
[0262] The computers in the supply network 200 preferably exchange security codes encrypted using data messages in the bit stream packets BP exchanged via the data bus 9 . These security codes are special activation codes that enable individual circuit breakers 17 of individual fuses in the supply network 200 to be switched on or off. The computer core 2 of the control device 4 of a fuse preferably checks a switch-on or switch-off command received for the circuit breaker 17 of its fuse for admissibility using a security code that is also transmitted to this computer core 2 of the control device 4 of the fuse. The computer core 2 of the control device 4 of the fuse can take into account factors such as the time of transmission, the current strength flowing through the circuit breaker 17, the voltage of connections 18, 19 of the circuit breaker 17 against a reference potential, the state of other fuses in the supply network 200, the priority of the downstream partial supply network and / or consumers contained therein and / or energy sources contained therein and / or originating computer of the security code and / or transmitting computer of the security code, user inputs, messages from other computers 710, 750 etc.
[0263] For example, a service provider or the automobile manufacturer or a vicarious agent of the automobile manufacturer can use a server 710 to transmit the security code or data for generating the security code through the higher-level computer system 12 or through computer cores 2 of the control devices 4 of the electronic security devices to the higher-level computer system 12 or a computer core 2 of a control device 4 transmit to the electronic fuse.
[0264] For example, the security data bus 9 can be provided directly or indirectly, e.g. via gateways or the like, with a terminal 740 for manual user input for reconfiguration of the supply network 200 by means of the electronic fuses of the supply network.
[0265] The terminal 740 can be set up to also serve to transmit authentication data to a server 710 of the automobile manufacturer or to a vicarious agent of the automobile manufacturer, the authentication data being in particular authentication data of the operating person 730 and / or authentication data of the organization for which the person 730 and / or authentication data of the vehicle and / or authentication data of the vehicle's car key and / or similar authentication data. In particular, the authentication data can be data from a signature card or the like and / or biometric data such as data from a fingerprint scanner and / or a retina scanner or the like or data derived from such data. The terminal 740 is then preferably set up to receive the security code from the server 710 of the automobile manufacturer or one of the automobile manufacturer's vicarious agents as a function of the authentication data ascertained in this way.
[0266] One or more computer cores 2 of control devices 4 of electronic fuses of the electronic fuses in the supply network 200 are preferably set up to determine measured values using measuring means for these electronic fuses and to transmit these measured values to a higher-level computer system 12 via the fuse data bus 9 .
[0267] The higher-level computer system 12 is preferably set up to execute a neural network model and to use the measured values determined and / or values dependent thereon as input values of the neural network model. At least the switching state of a circuit breaker 17 of an electronic fuse in supply network 200 and / or the switching states of a plurality of circuit breakers 17 of a plurality of electronic fuses in supply network 200 and / or at least one data message from the higher-level computer system 12 are then preferably linked to another computer system 710, 750, 740) or signaling from the higher-level computer system 12 to a user 730 based on an output signal and / or output value of the neural network model.
[0268] The higher-level computer system 12 can also be set up to carry out spectral analyzes of the data of the curves of measured values of the measuring devices of the fuses in the supply network, for example by Fourier or Laplace transformation or wavelet transformation, and to determine values of the spectra. The superordinate computer system 12 can then be set up to conclude that preventive maintenance is necessary for the values of the spectra in the event of significant deviations in the values of the spectra from expected value intervals or to signal another computer system 750, 710 or a display 740. The higher-level computer system 12 can also be set up to carry out spectral analyzes of the data of the curves, for example by Fourier or Laplace transformation or wavelet transformation, and to determine values of the spectra and the system availability of device parts of the supply network and / or the supply network 200 itself to evaluate using determined spectra and, if necessary, to signal the evaluation result to other computer systems 710, 750, 740, 4 and / or to change parameters of the vehicle depending on this evaluation. The other computer systems can be terminals 740 of a user 730 and / or computers 710 of a vehicle manufacturer or computers 710, 750 of one or more service providers and / or a workshop or a higher-level computer system 12 of the vehicle or a computer core 2 of a control device 4 of a backup of the supply network 200 .
[0269] The supply network presented preferably includes at least part of the time a computer (server) 710 of a service provider, in particular a computer system of an automobile manufacturer and thus possibly also of a workshop. A preferably encrypted data connection 720 between the control computer of the vehicle -. B. a higher-level computer system 12 and a computer 710) of a service provider, in particular a computer system of the automobile manufacturer of the vehicle, ensures the communication. A requesting / operating person or user 730 can access the computers 4, 12 of the supply network 200 and thus the switching state of the circuit breakers 17 of the fuses via a data input device and / or data output device—for example a terminal 740. In addition to the computer 710 of the vehicle manufacturer or a service provider, other computers 750 of other service providers or other computers of the service provider that controls computer 710 can communicate with the computers of the supply network 200 via the data bus 9 and the higher-level computer system 12 via wired and / or wireless data connections in connect.; figure 8
[0270] The figure 8 corresponds in the most important parts to the figure 4.
[0271] The supply network of the figure 8 includes a further fuse 805, a second further fuse 810, a first connected distribution tree 815, a second connected distribution tree 820, an electronic fuse 825, consumer 830 and further consumer 835. The other parts of the figure 8 have already been linked to the figure 4 explained.
[0272] A computer core 2 of a control device 4 of an electronic fuse 825 preferably transmits parameters of the partial supply trees 815 connected to the electronic fuse 825 and / or individual nodes of the connected partial supply trees 815 and / or individually connected supply line sections of the supply tree of the supply lines of the vehicle to a computer core 2 of a control device 4 another electronic fuse 805 and / or one or more control units of the vehicle and / or a higher-level computer system 12. Such parameters can in particular be measured values that the computer core 2 of the control device 4 of a fuse records using measuring devices of the control device 4 of the fuse. Such parameters can be, for example, a directly accessible parameter, such as the temperature of a temperature sensor 40, the voltage of a node 26, 27, 28 within the fuse to a reference potential 201 and / or the voltage of a node of the supply tree to a reference potential 201, and / or the current value of an electric current in a umbilical section of the umbilical tree 820 connected.
[0273] By means of this exchange of recorded measured values and / or parameters, the computer core 2 of the control device 4 of an electronic fuse 825, 805 can, in particular by applying Kirchhoff's equations to data that the computer core 2 of the control device 4 of the electronic fuse 825, 805 use measuring devices of the control device 4 of this electronic fuse 825, 805 or which the computer core 2 of the control device 4 of this electronic fuse 825 has received from the computer cores 2 of the control devices 4 of other electronic fuses 805 or from higher-level computer systems 12, for example a higher-level computer system 12, derived parameters, such as for example leakage currents against other electrical nodes in the vehicle or electrical resistances of supply voltage line sections.
[0274] The computer core 2 of the control device 4 of the electronic fuse 825 preferably estimates the temperature of a subsequent supply line section, which is increased as a result of the electric current 29 in this supply line section and the voltage drop across this supply line section. Such an estimate is also possible if its ohmic resistance and its heat capacity and its thermal discharge resistances and the ambient temperature in the area of the supply line section are approximately, e.g. by estimation by the computer core 2 of the control device 4 of the electronic fuse 825 and / or by data transmission from the higher-level computer system 12 are known to the computer core 2 of the control device 4 of the fuse 825 and / or by data transmission from the higher-level computer system 12 .
[0275] Preferably, the computer core 2 of the control device 4 of the electronic fuse 825 uses a voltage measuring device 16 to determine the voltage value of the voltage of a node 22, 25, 21 at the circuit breaker 17 of the electronic fuse 825 or of a node associated therewith in relation to a reference potential 201 in order to make such estimates, to enable such as the above and / or to be able to detect overvoltages or undervoltages and to be able to report them to a higher-level computer system 12 via the data bus 9. The computer core of control device 4 of electronic fuse 825 preferably determines the current value of current 29 through circuit breaker 17 of electronic fuse 825. Computer core 2 of control device 4 of electronic fuse 825 and / or a higher-level computer system 12 preferably determine this from the current value and / or the voltage value the power value of the electrical power fed into the load or into a subsequent supply tree 815, 820 or into a subsequent supply line section. If this power feed-in exceeds a power feed-in threshold value, computer core 2 of control device 4 of fuse 825 preferably opens circuit breaker 17 of fuse 825 and signals this opening of circuit breaker 17 to higher-level computer system 12, preferably via data bus 9.
[0276] Typically, the computer core 2 of the control device 4 of the electronic fuse 825 uses a voltage measuring device to determine the voltage value of the voltage of a node 22, 25, 21 at the circuit breaker 17 of the electronic fuse 805 or a node associated therewith in relation to a reference potential 201 and the current value of the current 29 through the circuit breaker 17 of the electronic fuse. The computer core 2 of the control device 4 of the electronic fuse 825 and / or a higher-level computer system 12 determine the power value of the electrical power flowing from the energy source or from a preceding supply tree or from a preceding supply line section from the current value and the voltage value. If this power consumption exceeds a power consumption threshold value, computer core 2 of control device 4 of fuse 825 preferably opens circuit breaker 17 of fuse 825 and signals this opening of circuit breaker 17 to higher-level computer system 12, preferably via data bus 9.
[0277] The computer core 2 of the control device 4 of the electronic fuse 805 preferably transmits this power value via the fuse data bus 9 to the control device 4 of another electronic fuse 825 or the higher-level computer system 12 of the supply network 200. The higher-level computer system 12 can also be a server 710, 750 of an energy provider or one of the vicarious agents of an energy worshiper or the vehicle manufacturer or another service provider.
[0278] A proposed electronic fuse 825, 1 preferably comprises a control device 4 with a clock or a timer 35. The computer core 2 of the control device 4 of the fuse 1, 85 preferably uses this timer 35 to generate time stamps in a log table, which the computer core 2 of control device 4 of backup 825 preferably creates in a memory of control device 4 of backup 825 or that the higher-level computer system 12 preferably creates in a memory of the higher-level computer system 12 or that the computer core 2 of a control device 4 of another backup 805 in the memory of this control device 4 the other fuse 805 applies.
[0279] The clock or the timer 35 of the control device 4 of the electronic fuse 1, 825 preferably has a synchronization option with the clocks and timers 35 of the control devices 4 of other electronic fuses 805, 810 and / or with the clocks and / or timers 1970 of a higher-level computer system 12 having.
[0280] In a proposed electronic fuse 825, the computer core 2 of the control device 4 of this electronic fuse 825 preferably switches off the circuit breaker 17 after receiving a switch-off signal and / or a switch-off command via the fuse data bus 9 only after a switch-off delay time has elapsed. The computer core 2 of the control device 4 of the electronic fuse 825 preferably determines the time since the receipt of the switch-off signal or switch-off command using the timer 35 of the control device 4 of the electronic fuse 825. The computer core 2 of the control device 4 of the electronic fuse 825 preferably switches off the Circuit breaker 9 goes off immediately if the amount of the value of the electric current 29 through the circuit breaker 17 of the electronic fuse 825 exceeds a threshold value and / or if the amount of the power feed into the subsequent partial supply network and / or into the subsequent supply line section or into a subsequent consumer exceeds a power feed threshold value exceeds and / or when the amount of power drawn from the preceding utility sub-network and / or in the preceding utility line section or from a preceding energy source exceeds a threshold power draw. Immediately means that the computer core 2 switches off in less than 100 µs, better in less than 50 µs, better in less than 20 µs, better in less than 10 µs, better in less than 5 µs, better in less than 2 µs, better in less than 1 µs , better in less than 500ns, better in less than 200ns, better in less than 100ns.
[0281] The switch-off delay time preferably depends on the magnitude of the value of the electric current 29 through the circuit breaker 17 and / or on which the magnitude of the power feed into the subsequent partial supply network and / or into the subsequent supply line section or into a subsequent consumer exceeds a power feed threshold value and / or from the Amount of power drawn from the preceding supply part network and / or in the preceding supply line section or from a preceding energy source.
[0282] Preferably, the turn-off delay time also depends on the magnitude of the value of the electrical current 29 through the circuit breaker 17 , falling parabolically as the magnitude of the value of the electrical current 29 through the circuit breaker 17 increases.
[0283] The computer core 2 of the control device 4 of the electronic fuse 825 preferably integrates the square of the absolute value of the electric current 29 through the circuit breaker 17 of the electronic fuse 825 over time and in this way emulates the behavior of a fuse. The computer core 2 of the control device 4 of the electronic fuse 825 preferably opens the power switch 17 of the electronic fuse 825 when the amount of the time integral of the square of the amount of the current 29 through the power transistor 17 exceeds a square current threshold value. Instead of the square of the amount of electric current 29 through power switch 17 of electronic fuse 825, computer core 2 of control device 4 of the electronic fuse can also form the integral of a polynomial of at least the second degree of the value of current 29 through power switch 17 of electronic fuse 825 and then use this value for the comparison with the current squared threshold value for switching off the power switch 17 when the current squared threshold value is exceeded.
[0284] The computer core 2 of the control device 4 of the electronic fuse 825 preferably uses corresponding measuring means 16 to record the amount of the value of the electric current 29 through the circuit breaker 17, squares it or applies a polynomial of at least the second degree to it and integrates the result over time. This integration can also be a filter, in particular a low-pass filter. The computer core 2 of the control device 4 of the electronic fuse then compares the recorded, squared and filtered magnitude of the value of the electric current 29 with a threshold value, in particular the current squared threshold value. The switching state of the circuit breaker 17 of the electronic fuse 825 then depends at least temporarily on the result of this comparison. However, it is possible, for example, for the circuit breaker 17 of the electronic fuse 825 to be opened independently of this by a command via the data bus 9 by the superordinate computer system 12 .
[0285] As already indicated, the computer core 2 of the control device 4 of the electronic fuse 825 can detect the amount of the value of the electric current 29 through the circuit breaker 17 by appropriate means 16, the detected amount of the value of the electric current 29 through the circuit breaker 17 by means of a polynomial with a Order of the polynomial greater than one into a mapped value and integrate this mapped value of the electric current 29 through the power switch 17 over time, filtering this time-integrated value of the electric current 29, in particular low-pass filtering. The computer core 2 of the control device 4 of the electronic fuse 825 preferably compares the mapped and filtered value of the electric current 29 with a threshold value, in particular the square current threshold value, with the switching state of the circuit breaker 17 of the electronic fuse 825 preferably, as before, at least temporarily depending on the result of this comparison .
[0286] The computer core 2 of the control device 4 of the electronic fuse 825 preferably allows the transport of electrical energy from one or more energy sources 250 to the consumer 835, 830 at least temporarily, in that the computer core 2 of the control device 4 of the fuse 825 closes its circuit breaker 17. Typically, the computer core 2 of the control device 4 of the electronic fuse 825 prevents the transport of electrical energy from the consumer 835, 830 to one or more or all of the energy sources 250.
[0287] The electronic fuse 825 and / or the control device 4 of the electronic fuse 825 preferably includes means 24, 23 for detecting the direction of the electric current 29 through the circuit breaker 17. The computer core 2 of the control device 4 of the electronic fuse 825 preferably detects the direction of the flowing electrical current Current 29 with the help of these means 24, 23. If a return flow of energy in the direction of energy source 250 is not desired, the computer core 2 of the control device 4 of the electronic fuse 825 opens the circuit breaker 17 of the electronic fuse 825 when the electric current 29 from the consumer 830 to a or several energy sources 250 flows through the circuit breaker 17 of the electronic fuse 825.
[0288] The control device 4 of the electronic fuse or fuse 825 preferably comprises a third power switch 615 distinct from the power switch 17 of the electronic fuse 825. The computer core 2 of the control device 4 of the fuse 825 typically closes this third circuit breaker 615 when the electric current 29 flows from the consumer 835 to one or more energy sources 250 through the circuit breaker 17 of the electronic fuse 825 . In this case, when the third power switch 615 is closed, this third power switch 615 diverts the electrical current 29 from the load 835 into a current sink, in particular a reference potential line 201 . figure 9
[0289] The electronic fuse 1, and in particular the control device 4 of the electronic fuse 1, preferably includes means 505, 905 for detecting the switchability of the circuit breaker 17 of the electronic fuse 1.
[0290] In the figure 9, for the sake of clarity, not all useful and possibly customary device components are shown. Next device components that the reader as possibly in the figure 1 can assume that there are, for example, in the figure 1, figure 5, figure 6, figure 24, figure 41, figure 42, figure 52, figure 53, figure 54, figure 55, figure 57, figure 58. The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.
[0291] Fuse 1 of figure 9 points to the fuse 1 of figure 5, in addition to the first test current source 505, a second test current source 905, the test current 915 of which is modulated by the control signal 910 with a modulation signal {505} of a second signal generator 920. The second test current 915 preferably corresponds to the first test current 515. As a result, the control device 4 can feed the test current 515 into the circuit breaker 17 and, after passing through the circuit breaker 17, remove it from the current path again as the second test current 915. If the circuit breaker 17 is not, for example, open or closed in the expected state, then the second test current 915 and / or the first test current 515 and / or the voltage drops between the terminals 26, 27, 28 of the circuit breaker 17 do not correspond to the expected values. From this, the computer core 2 of the control device 4 of the electronic fuse 1 can conclude that there is a fault in the circuit breaker 1 . In such an error situation, the computer core 2 of the control device 4 of the electronic fuse 1 can signal such a fault to a higher-level computer system 12 or to the computer cores 2 of the control devices 4 of other electronic fuses, for example. To control the second test current source 905, a second signal generator 920 preferably generates a second control signal 910 of the second electronic test current source 905, which ensures that the second test current 915, which the second test current source (910) draws from the circuit breaker (17), with the modulation signal {505} is modulated.
[0292] The document presented here proposes that the control device 4 of the electronic fuse 1 comprises a first test current source 505 and a second test current source 905 . The control device 4 of the electronic fuse 1 controls the first test current source 505 and the second test current source 905. The first test current source 505 feeds the test current 515 into the first connection 26 of the circuit breaker 17 at the instigation of the control device 4. The second test current source 905 then draws this test current 915 from the second connection 28 of the circuit breaker 17. The second test current source 905 preferably includes means for detecting the drawing of the test current. The computer core 2 of the control device 4 concludes that there is a fault in the circuit breaker 17 of the electronic fuse 1 if, contrary to the respective expectation, the second current source 905 does not or does not detect a drawing of a test current 915 . In this case, for example, the control device 4 can also evaluate a deviation in the absolute value of the second test current 915 outside of an expected value interval as an error. The computer core 2 of the control device 4 of the electronic fuse 1 preferably changes the switching state of the circuit breaker 17 one or more times and checks the switching state of the circuit breaker 17.
[0293] For this purpose, the computer core 2 of the control device 4 of the electronic fuse 1 preferably determines measured values using measuring means of the electronic fuse 1 and / or the control device 4 of the electronic fuse 1. The computer core 2 of the control device 4 and / or the higher-level computer system 2 preferably execute a neural network model . The computer core 2 of the control device 4 and / or the higher-level computer system 2 use the measured values determined as input values of the neural network model they execute. In order to make this possible, the computer cores 2 of the control devices 4 of one or more fuses and / or the higher-level computer system 12 preferably transmit the necessary data for the input signals of the neural network to the computer core 2 of the control device 4 of the fuse 1 and / or the higher-level computer system 12, depending on which computer is currently running the neural network model.
[0294] The switching status of circuit breaker 17 of electronic fuse 1 and / or at least one data message from computer core 2 of control device 4 of electronic fuse 1 to a higher-level computer system 12 or a computer core 2 of another control device 4 of another electronic fuse 805 then preferably depends on an output signal of the neural network model.
[0295] The neural network model is preferably trained with suitable training data from the development period.
[0296] For example, the computer core 2 of the control device 4 of the electronic fuse 825 can detect a failure of one or more consumers 835 or a failure of one or more energy sources 250 or another defect in the system of the overall device using an output signal from the neural network model.
[0297] The computer core 2 of the control device 4 of the electronic fuse 825 can also exchange data using power-line communication with another computer system 12 and / or with the control device 4 of another electronic fuse 805, for example via a supply voltage line (6, 241, 242, 245). .
[0298] To implement power line communication, the computer core 2 of the control device 4 of the electronic fuse 1 can use the circuit breaker 17 of the electronic fuse 825 as a transmission transistor for data communication via the supply voltage line (6, 241, 242, 245).
[0299] The computer core 2 of the control device 4 of the electronic fuse 1 can, for example, open the circuit breaker 17 of the electronic fuse 1 in order to transmit a bit of a first logical value. The computer core 2 of the control device 4 of the electronic fuse 1 can, for example, close the circuit breaker 17 of the electronic fuse 1 in order to transmit a bit of a second logical value, which differs from the first logical value.
[0300] Instead of this modeling via complete opening and closing, communication via different internal resistances of the circuit breaker 17 is possible.
[0301] The computer core 2 of the control device 4 of the electronic fuse 1 can, for example, set the circuit breaker 17 of the electronic fuse 1 to a first state with a first electrical resistance value between the first connection 26 of the circuit breaker 17 and the second connection 28 of the Bring circuit breaker 17. The computer core 2 of the control device 4 of the electronic fuse 1 can, for example, in order to transmit a bit of a second logical value that differs from the first logical value, switch the circuit breaker 17 of the electronic fuse 1 into a second state with a second electrical resistance value between the first terminal 26 of the power switch 17 and the second terminal 28 of the power switch 17, which is different from the second resistance value.
[0302] In order to be able to receive data via the supply voltage line, the control device 4 of the electronic fuse 1 preferably has means for detecting the time profile of the electric current 29 through the circuit breaker 17 of the electronic fuse 1 . These means preferably at least temporarily record the course over time of the electric current 29 through the circuit breaker 17 of the electronic fuse 1. These means can, in particular, include an analog-to-digital converter 570 and / or a memory of the computer core 2 of the control device 4 of the electronic fuse 1 or the control device 4 of the electronic fuse 1 include.
[0303] The control device 4 of the electronic fuse 1 preferably includes means for detecting the time profile of the voltage between a connection (26, 27, 28) of the circuit breaker 17 of the electronic fuse 1 and a reference potential 201. These means typically at least temporarily record the time profile of the voltage between a connection (26, 27, 28) of the circuit breaker 17 of the electronic fuse 1 and a reference potential 201.
[0304] The computer core 2 of the control device 4 of the electronic fuse 1 preferably carries out a spectral analysis of the data of the time curves, for example by Fourier or Laplace transformation or wavelet transformation, and determines values of the spectrum. In the event of significant deviations in the values of these spectra from associated expected value intervals for these values of these spectra, the computer core 2 of the control device 4 of the electronic fuse 1 preferably concludes that preventive maintenance is necessary and / or signals this deviation to a higher-level computer system 12.
[0305] The electronic fuse 1 preferably includes means for detecting the value of the electric current 29 through the circuit breaker 17 of the electronic fuse 1 and for detecting a voltage at a connection (26, 27, 28) of the circuit breaker 17 of the electronic fuse 1 against a reference potential 201. According to the proposal, the computer core 2 of the control device 4 of the electronic fuse 1 switches off the power switch 17 of the electronic fuse 1 in the event of a voltage drop in the measured voltage values below a minimum voltage value AND a simultaneous increase in the value of the current 29 through the power switch 17 above a maximum current value, and opens the line switch 17 in this case. So this is the case if a) the measured voltage value falls below a voltage threshold AND at the same time the measured current value exceeds a current threshold and / or if b) the amount of a speed of a measured change over time in the voltage value drop exceeds a voltage drop speed threshold AND at the same time the amount of the speed of a measured change over time in the amount of the electric current 29 through the circuit breaker 17, i.e. the current increase, exceeds a current increase speed threshold.
[0306] Under such switch-off conditions, the computer core 2 of the control device 4 of the electronic fuse 1 preferably switches off the circuit breaker 17 of the electronic fuse 1 faster than within 1 μs. This has the advantage that in many cases this very short time is sufficient to avoid damage.
[0307] The proposed electronic fuse 1 preferably has an emergency operation control 925. The emergency operation control 925 can preferably send data via a data bus 540, 9 and receive data via this data bus 9, 540. The control device 4 of the electronic fuse 1, 825 can, for example, be the control device 4 of another electronic fuse 805 in emergency operation, which, by means of data communication via the data bus 9, 540 and by means of the emergency operation control 925 of the other electronic fuse 805, switches the other electronic fuse 805 on at a Failure of the control device 4 of the other electronic fuse 805 controls. (See also figure8) The emergency operation control 925 preferably monitors the data communication between the control device 4 and the emergency operation control 925 of the other fuse 805. In the event of a failure of the data communication of the fuse 1, the emergency operation control 925 preferably emulates simple functions of the control device 4 and thus preferably provides at least basic protection of the connected supply line 19, 815, 820 and / or partial supply networks and / or consumers and / or energy sources.
[0308] The computer core 2 of the control device 4 of the electronic fuse 1 sends a signal via the fuse data bus 9, 540 to a higher-level computer system 12, which signals that a) the corresponding electronic fuse 1 is still available and / or that b) the corresponding electronic fuse 1 is ready for operation and / or which fuse identification information the fuse 1 has and / or which operating parameters the electronic fuse 1 has. figure 10
[0309] figure10 shows a proposed power source-side crossing fuse 1000. The exemplary crossing fuse 1000 includes a power source-side first supply line section 1005 of a first supply line, a load-side second supply line section 1010 of a first supply line, a power source-side first supply line section 1015 of a second supply line, a load-side second supply line section 1020 of a second supply line, one first electrical node 1025, a second electrical node 1030, a first electronic fuse 1035 as previously described, a second electronic fuse 1040 as previously described, a third electronic fuse 1045 as previously described, and a fourth electronic fuse 1050 as previously described described. Depending on the switching state of circuit breaker 17 of first electronic fuse 1035, first electronic fuse 1035 connects energy source-side first supply line section 1005 of the first supply line to first node 1025 or separates energy source-side first supply line section 1005 of the first supply line from first node 1025. The second electronic fuse 1040 connects depending on the switching state of the circuit breaker 17 of the second electronic fuse 1040 the energy source-side first supply line section 1015 of the second supply line to the first node 1025 or separates the energy source-side first supply line section 1015 of the second supply line from the first node 1025. The second electronic fuse 1040 connects the energy source-side first supply line section 1015 of the second supply line does not connect to the first node 1025 when the first electronic fuse 1035 connects the power source-side first supply line section 1005 of the first supply line to the first node 1025. The first electronic fuse 1040 does not connect the power source side first supply line section 1005 of the first supply line to the first node 1025 when the second electronic fuse 1040 connects the power source side first supply line section 1015 of the second supply line to the first node 1025. Depending on the switching state of circuit breaker 17 of third electronic fuse 1045, third electronic fuse 1045 connects energy source-side first supply line section 1005 of the first supply line to second node 1030 or separates energy source-side first supply line section 1005 of the first supply line from second node 1030. The fourth electronic fuse Depending on the switching state of circuit breaker 17 of fourth electronic fuse 1050, 1050 separates energy-source-side first supply line section 1015 of the second supply line from second node 1030 or separates energy-source-side first supply line section 1030 of the second supply line from second node 1030. Fourth electronic fuse 1050 connects the energy-source-side first supply line section 1015 of the second supply line does not connect to the second node 1030 when the third electronic fuse 1045 connects the power source-side first supply line section 1005 of the first supply line to the second node. The third electronic fuse 1045 does not connect the power source side first supply line section of the first supply line to the second node 1030 when the fourth electronic fuse 1050 connects the power source side first supply line section 1015 of the second supply line to the second node 1030 . The load-side second supply line section 1055 of the first supply line is connected to the first node 1025 . The load-side second supply line section 1060 of the second supply line is connected to the second node 1030 .
[0310] A proposed load-side crossing fuse 1000 includes a power-source-side first supply line section 1005 of a first supply line, a load-side second supply line section 1015 of a first supply line, a power-source-side first supply line section 1055 of a second supply line, a load-side second supply line section 1060 of a second supply line, a third electrical node 1065, a fourth electrical nodes 1070, a first electronic fuse 1035 as previously described, a second electronic fuse 1040 as previously described, a third electronic fuse 1045 as previously described, and a fourth electronic fuse 1050 as previously described. Depending on the switching state of the circuit breaker 17 of the first electronic fuse 1035, the first electronic fuse 1035 connects the load-side second supply line section 1055 of the first supply line to the third node 1065 or separates the load-side second supply line section 1055 of the first supply line from the third node 1065. The second electronic fuse 1040 connects depending on the switching state of the circuit breaker 17 of the second electronic fuse 1040 the load-side second supply line section 1055 of the first supply line to the fourth node 1070 or separates the load-side second supply line section 1055 of the first supply line 1055 from the fourth node 1070. The second electronic fuse 1040 connects the load-side second supply line section 1055 of the first supply line does not connect to the fourth node 1070 if the first electronic fuse 1035 connects the load-side second supply line section 1055 of the first supply line to the third node 1065. The first electronic fuse 1035 does not connect the load-side second supply line section 1055 of the first supply line to the third node 1055 when the second electronic fuse 1040 connects the load-side second supply line section of the first supply line 1055 to the fourth node 1070 . Depending on the switching state of the circuit breaker 17 of the third electronic fuse 1045, the third electronic fuse 1045 connects the load-side second supply line section 1060 of the second supply line to the third node 1065 or separates the load-side second supply line section 1060 of the second supply line from the third node 1065. The fourth electronic fuse Depending on the switching state of circuit breaker 17 of fourth electronic fuse 1050, 1050 connects the load-side second supply line section of second supply line 1060 to fourth node 1070 or separates load-side second supply line section 1060 of the second supply line from fourth node 1070. Fourth electronic fuse 1050 connects the load-side second supply line section 1060 of the second supply line does not connect to the fourth node 1070 when the third electronic fuse 1045 connects the load-side second supply line section 1060 of the second supply line to the third node 1065. The third electronic fuse 1045 does not connect the load-side second supply line section 1060 of the second supply line to the third node 1065 when the fourth electronic fuse 1050 connects the load-side second supply line section 1060 of the second supply line to the fourth node 1070 . The power source side first power line portion 1005 of the first power line is connected to the third node 1065 . The power source side first power line portion 1015 of the second power line is connected to the fourth node 1070 .
[0311] In the crossing fuses described above, the switching state of the circuit breakers 17 of the electronic fuses (1035, 1040, 1045, 1050) of the crossing fuse 1000 depends on a determined energy requirement of one or more consumers (830, 835) and / or on a determined energy supply capability of one or more energy sources (250, 251). The computer cores 2 of the control devices 4 of the electronic safety devices (1035, 1040, 1045, 1050) of the intersection safety device 1000 are preferably connected to one another and to a higher-level computer system 12 via a safety data bus 9 . The higher-level computer system 12 preferably determines the energy requirement of one or more consumers 835, 830, which can supply the supply lines (1005, 1010: 1015, 1020, 1055, 1060) of the intersection safety device 1000 with electrical energy. The higher-level computer system 12 determines the ability to supply energy from one or more energy sources 250, 251, which can supply electrical energy to the crossing safety device 1000 via the supply lines (1005, 1010: 1015, 1020, 1055, 1060). The computer system 12 transmits to the computer cores 2 of the control devices 4 of the fuses (1035, 1040, 1045, 1050) of the intersection fuse 1000 configuration commands via the fuse data bus 9, which depend on the determined energy requirements of these consumers 830, 831 and / or the determined energy supply capability of these Energy sources 250, 251 depend. These configuration commands from the higher-level computer system 12 preferably cause the opening and closing of circuit breakers 17 of the electronic fuses (1035, 1040, 1045, 1050) of the crossing fuse 1000. figure 11
[0312] figure 11 shows a proposed supply network 1100 with a higher-level computer system 12 and with a multiplicity of supply lines and with a multiplicity of crossing safeguards 1110 to 1118, which enable flexible load and supply-dependent reconfiguration of the supply network 1100.
[0313] The crossing fuses 1110 to 1118 are inserted into supply line pairs of the supply lines of the supply network 1100, respectively. The higher-level computer system 12 is connected to the computer cores 2 of the control devices 4 of the electronic fuses of the cross fuses 1110 to 1118 by means of a fuse data bus 9 .
[0314] The electronic fuses of the cross fuses 1110 to 1118 each have control devices 4 with a respective computer core. These fuses are preferably electronic fuses of the type described above.
[0315] To simplify the structure, the example four electronic fuses of a respective cross fuse of the cross fuses 1110 to 1118 can also have a common control device (4) so that this individual control device 4 controls four circuit breakers 17 of the four fuses simultaneously.
[0316] The higher-level computer system 12 preferably determines the energy requirements of electrical energy consumers 1121 to 1124 in the supply network 1100. The higher-level computer system 12 preferably also determines the energy supply capability of electrical energy sources 1150 to 1155 in the supply network 1100.
[0317] The higher-level computer system 12 preferably determines the current safety requirement based on the current driving situation of the vehicle, which means that the higher-level computer system uses measurement data, which can include measurement data from electronic fuses in the supply network 1100 in particular, to conclude, for example, the future energy supply capability and future energy consumption.
[0318] The higher-level computer system 12 adjusts the electrically effective topology of the supply network of the supply lines dynamically according to the determined energy requirement and / or according to the determined energy supply capability and / or according to current security requirements. figure 12
[0319] figure12 shows the basic sequence of a method 1200 for operating a supply network. The procedure includes the steps: Step 1: Providing 1210 a supply network (250, 251, 210 to 213, 245) with a device part of the vehicle, hereinafter referred to as energy-supplying device part 210, wherein the energy-supplying supply part 210 has a control device 280, 4 and a memory in a first logical state includes; Step 2: Supplying 1220 the power-supplying device part 210 with electric power from a power source 251, 250 of the vehicle; Step 3: connecting 1230 a first connection of a further line section 240 to the energy-supplying device part 210 of the vehicle; Step 4: connecting 1240 a second connection of the further line section 240 to a further device part 220, 221 of the vehicle; Step 5: signaling 1250 of a switch-on signal to the control device 280, 4 of the energy-supplying device part 210; Step 6: changing 1260 the logic state of the memory to a second logic state depending on the logic state of the memory; Step 7: Supplying 1270 the further device part 220 to 221 of the vehicle with electrical energy via the further line section 240 depending on the logic state of the memory.
[0320] The switch-on signal is preferably signaled 1250 via a safety data bus 9.
[0321] The power-supplying device part 210 preferably has an electronic fuse 215 of the power-supplying device part 250, 251. The supply 1270 of the further device part 220, 221 of the vehicle with electrical energy is preferably carried out via the further line section 240 by switching on the electronic fuse 215 of the energy-supplying device part 210 depending on the logic state of the memory.
[0322] A variant of the method 1200 for operating a supply network 200 comprises the steps: Step 1: Providing 1210 a supply network 200 with a device part 210 of the vehicle, hereinafter referred to as device part 210 supplying energy. Step 2: Supplying 1220 the power-supplying device part 210 with electric power from a power source 250, 251 of the vehicle; Step 3: connecting 1230 a first connection of a further line section 240 to the energy-supplying device part 210 of the vehicle; Step 4: Connecting 1240 a second connection of a further line section 240 to a further device part of the device parts 220 to 221 of the vehicle, wherein the further supply part of the device parts 220 to 221 of the vehicle comprises a control device 280, 4 and wherein the further supply part of the device parts 220 to 221 of the vehicle includes a memory in a first logic state; Step 5: signaling 1250 of a switch-on signal to the control device 280, 4 of the further device part of the device parts (220 to 221) of the vehicle; Step 6: changing 1260 the logic state of the memory to a second logic state depending on the logic state of the memory; Step 7: Supplying 1270 the further device part of the device parts 220 to 221 of the vehicle with electrical energy via the further line section 240 depending on the logic state of the memory. Here too, the switch-on signal is preferably signaled via a safety data bus 9 . The additional device part 220 of the vehicle is preferably supplied with electrical energy via the additional line...
Claims
[1] Battery cell module (2300), in particular of a vehicle, wherein the battery cell module (2300) comprises at least one battery cell (2145) and / or an interconnection of battery cells and wherein the battery cell module (2300) includes a first power switch (17) and wherein the battery cell module (2300) includes a second power switch (17') and wherein the battery cell module (2300) comprises a first electrical node (2120) and wherein the battery cell module (2300) includes a second electrical node (2135) and wherein the battery cell module (2300) includes a third electrical node (2140) and wherein the battery cell (2300) comprises a first battery cell terminal (2305) and wherein the battery cell (2300) includes a second battery cell terminal (2310) and wherein the first battery cell terminal (2305) is connected to the second node (2135) and wherein the second battery cell connection (2310) is connected to the third node (2140) and wherein the first circuit breaker (17) comprises a first terminal (26) and a second terminal (28) and a control terminal (27) and wherein the second circuit breaker (17') comprises a first terminal (26') and a second terminal (28') and a control terminal (27') and wherein the battery cell (2105) and / or the interconnection of battery cells comprises a first terminal (2125) and a second terminal (2130) and wherein the first circuit breaker (17) is connected to the first node (2120) via its first terminal (26) of the first circuit breaker (17) and wherein the first circuit breaker (17) is connected to the second node (2135) via its second terminal (28) of the first circuit breaker (17) and wherein the second circuit breaker (17') is connected to the first node (2120) with its first terminal (26') of the second circuit breaker (17') and wherein the second circuit breaker (17') is connected to the third node (2140) via its second terminal (28') of the second circuit breaker (17') and wherein a first terminal (2305) of the battery cell (2145) or group of battery cells is connected to the second node (2135) and wherein a second terminal (2310) of the battery cell (2145) or group of battery cells is connected to the third node (2140), characterized by that the battery cell module (2105) includes or is connected to a control device (4) and that the control device (4) is configured to control the control terminal (27) of the first circuit breaker (17), and that the control device (4) is configured to control the control terminal (27') of the second circuit breaker (17'), and that the control device (4) is configured to interlock the control terminal (27) of the first circuit breaker (17) with respect to the control terminal (27') of the second circuit breaker (17') in such a way that it is impossible for the first circuit breaker (17) to be conductive when the second circuit breaker (17') is conductive. [2] Battery cell module (2300) according to claim 1 ( Fig. 23, Fig. 24) wherein the control device (4) comprises means (16, 525, 520, 920, 530, 21, 22, 28, 26, 27, 915, 515, 510, 910, 905 and 16', 525', 520', 920', 530', 21', 22', 28', 26', 27', 915', 515', 510', 910', 905') for detecting the switching state of the circuit breakers (17, 17') and wherein the control device (4) is configured to detect the switching state of at least one of the circuit breakers (17, 17'), in particular as "On" or "Off", by means of these means (16, 525, 520, 920, 530, 21, 22, 28, 26, 27, 915, 515, 510, 910, 905 and 16', 525', 520', 920', 530', 21', 22', 28', 26', 27', 915', 515', 510', 910', 905'). [3] Battery cell module (2300) according to claim 2 wherein the control device (4) for bridging the battery cell module (2105) is configured to - first to open the first circuit breaker (17) and thus prevent a current flow (2121) through the battery cell (2145) and - then, in particular, by means of the means (16, 525, 520, 920, 530, 21, 22, 28, 26, 27, 915, 515, 510, 910, 905) for detecting the switching state of the first circuit breaker (17), to check whether the first circuit breaker (17) is open, and - then, when the second circuit breaker is open, close the second circuit breaker (17') and - then the means (16', 525', 520', 920', 530', 21', 22', 28', 26', 27', 915', 515', 510', 910', 905') to check the switching state of the second circuit breaker (17') to see if the second circuit breaker (17') is closed. [4] Battery cell module (2200), wherein the battery cell module (2200) itself comprises at least one first battery cell module (2105) according to one of claims 1 to 3 and wherein the battery cell module (2200) itself comprises at least a second battery cell module (2155) according to one of claims 1 to 3 and wherein the second terminal (2130) of the first battery cell module (2105) is connected to the first terminal (2165) of the second battery cell module (2155). [5] Battery cell module (2600) according to one of claims 1 to 4, wherein the power switch (17) and the control device (4) of the fuse (825) and the fuse (825) are housed together with the actual battery cell module (2105) in a housing (2605). [6] Battery cell module (2600) according to one of claims 1 to 5, wherein the control device (4) of the fuse (825) has an optical data interface (550, 551). [7] Battery cell module (2300) according to claim 5 and claim 6, wherein the housing (2605) has an optical window (545) which allows the entry of electromagnetic radiation (540) for the optical transport of data from the optical data interface (550, 551) of the control device (4) away from and towards the optical data interface (550, 551) of the control device (4) and can communicate via the optical interface (550, 551) of the control device (4) inside the housing (2605) with an optical interface (555) of another device, for example a higher-level computer system (12) outside the housing (2665). [8] Battery cell module (2600) according to one or more of claims 4 to 7 wherein the housing (2605) has an optical window (545) and / or an optical connector (2640) which allows the emission of electromagnetic radiation (540) for the transport of data from the optical data interface (550, 551) of the control device (4) to a device (555, 12) outside the housing (2605) and / or from a device (555, 12) outside the housing (2605) to the optical data interface (550, 551) of the control device (4), and so that, in particular, the optical interface (510) of the control device (4) inside the housing (2605) can communicate with an optical interface (555) of another device (12), in particular of a higher-level computer system (12), outside the housing (2605). [9] Battery cell module (2600) according to claim 7 and / or 8, wherein the electromagnetic radiation (540) is laser radiation or radiation from an LED.