Supply network with topology control via authenticated commands

Abstract

Supply network (200) for supplying electrical consumers (210 to 213 and 220 to 223 and 230 to 233) of a vehicle with electrical energy with one or more energy sources (250, 251) and with multiple consumers (210 to 213 and 220 to 223 and 230 to 233) and with multiple electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256), wherein the consumers (210 to 213 and 220 to 223 and 230 to 233) are connected to one or more energy sources (250, 251) via supply lines (245, 240, 241, 242, 243), wherein the consumers (210 to 213 and 220 to 223 and 230 to 233) and the one or more energy sources (250, 251) together with the supply lines (245, 240 to 243) are connected to each other in a tree structure or a network, where the tree structure or network comprises subtrees or subnetworks, wherein the electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256) are inserted into supply lines so that these subtrees of the tree structure can disconnect from or connect to the rest of the tree structure, or wherein the electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256) are inserted into supply lines so that these subnetworks of the network can disconnect from or connect to the rest of the network, wherein one or more of the electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256) each have at least one data interface (280 to 293), which may be optical, wherein the supply network (200) includes a higher-level computer system (12) and wherein the higher-level computer system (12) is configured to switch off subtrees or subnetworks of the supply network (200) by means of the electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256) which have at least one data interface, by means of data messages via a data bus (9), where at least one of the data messages includes a security code that makes the shutdown possible in the first place.

Description

Subject of the invention

[0001] The invention relates to a supply network (200) for supplying electrical consumers (210 to 213 and 220 to 223 and 230 to 233) with electrical energy, comprising one or more energy sources (250, 251) and a plurality of consumers (210 to 213 and 220 to 223 and 230 to 233) and a plurality of electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256). The consumers (210 to 213 and 220 to 223 and 230 to 233) are connected to the one or more energy sources (250, 251) by means of supply lines (245, 240, 241, 242, 243). The loads (210 to 213 and 220 to 223 and 230 to 233) and the one or more energy sources (250, 251) are interconnected together with the supply lines (245, 240 to 243) in a tree structure or network. The tree structure or network comprises subtrees or subnetworks (e.g., 240, 220, 221).Electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256) are inserted into supply lines so that these subtrees of the tree structure can be separated from the remaining tree structure or connected to this remaining tree structure, or so that these subnetworks of the network can be separated from the remaining network or connected to this remaining network. One or more electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256) each have at least one data interface (280 to 293), which can be optical.

[0002] The supply network (200, 1100) comprises a higher-level computer system (12) which switches off subtrees or subnetworks of the supply network (200, 1100) by means of the electronic fuses (1110 to 1118) having at least one data interface by means of data messages via the data bus (9), in particular for maintenance purposes. At least one of the data messages comprises a security code which enables the switch-off in the first place.

[0003] The following text of the description of this document further explains the technical background and technical content of the invention. Introduction

[0004] This document deals with automotive power supply networks and the use of electronic fuses in such automotive power supply networks.

[0005] The decarbonization of mobile road transport will require efficient energy distribution within vehicles (power distribution).

[0006] Today, car manufacturers use centralized fuse boxes (switch boxes or fuse boxes) in their vehicles, typically located in an accessible location within the vehicle. From there, complex wiring harnesses distribute the electrical power. Decentralized fuse boxes with supply subnetworks are intended to replace this star-shaped structure in the long term.

[0007] The focus here is on a platform concept. This allows automobile manufacturers to more easily adapt wiring harnesses to individual customer requirements. A plug-and-play concept is desirable. The idea is a platform with a central supply network. The goal is a modular system for electrical supply networks in cars. This will subsequently reduce the size of the supply networks in the car and enable a modular system for the supply networks. According to the concept discussed in this document, the electronic fuses are to be installed on the circuit boards of higher-level computer systems, the control units. These circuit boards should, if necessary, include slots for the fuse housings of the electronic fuses.

[0008] The new topology of an energy distribution system for supply networks should preferably have a tree structure instead of the central star structure of the previous system of supply networks with a switch box with the electronic fuses in the star center of the supply network and the energy consumers at the star ends of the supply network. Preferably, several electronically controllable electronic fuses are connected in series. A tree structure of the supply network branches out from the central starting point of the supply network to the consumers. The branches (supply branches) of the tree of the supply network are the supply lines. The different supply branches or different supply sub-networks have different levels of importance, particularly with regard to functional safety. Preferably, each or at least a majority of the line sections of the supply branches orSupply sub-networks are equipped with electronic fuses that carry out a process to protect the respective downstream supply sub-tree of the supply network or the respective downstream supply sub-network. The protection strategy of these fuses is based on the importance of the downstream supply sub-tree or the downstream supply sub-network and its significance for the safe operation of the vehicle in terms of condition and availability. Depending on the significance and importance of the connected consumers, each electronic fuse carries out a process that records electrical parameters of the current flow in the relevant line section of the relevant supply branch or the relevant supply sub-network and, if applicable, the potential on the supply side against a reference potential.The computer core of the electronic fuse control device exchanges data with other computer cores of the control devices of other electronic fuses in subsequent and preceding branches of the proposed supply tree or in subsequent and preceding supply subnetworks of the supply network. This data exchange can take place via a special fuse data bus (hereinafter also referred to as the fuse data bus) or another data bus, for example a LIN data bus or a DSI3 data bus or a PSI5 data bus or a CAN data bus or a CAN-FD data bus or an Ethernet data bus or a Flexray data bus or an LVDS data bus, or in some other way, wired or wireless, for example via Bluetooth or WLAN or the like. Until now, the wiring harness of a vehicle's supply network was manufactured as a monolith, delivered as a single component and installed in the vehicle.The document presented here proposes enabling more flexible structures. This flexibility can be achieved, firstly, through software flags and, secondly, by adding additional components and supply subtrees and subnetworks.

[0009] An electric vehicle will typically have a first supply tree or a first supply sub-network, which the vehicle will then operate at approximately 48V, i.e. less than 50V.

[0010] An electric vehicle will typically have a second supply tree or a second supply sub-network, which the vehicle then operates at approximately 800V, i.e. at significantly more than 50V.

[0011] One idea of ​​using electronic fuses (E-Fuses) is to enable the additional booking of power supply to subcomponents and / or sub-devices of the vehicle.

[0012] To do this, the purchaser, who would typically be a user or driver of the vehicle, preferably transmits a command to a server, for example, the car manufacturer's server. The purchaser preferably authenticates himself with the server. For example, the purchaser can provide identification data from his mobile phone, his vehicle, or another personalized device, which enables the legally secure conclusion of a contract.

[0013] A typical control device for operating an electronic fuse also includes the so-called system basis chip functionality. This functionality provides all the functions required to operate a computer core, such as a microcontroller. This can include, for example, the voltage supply, the emergency power supply, the provision of a data bus interface in the form of a bus transceiver, and a watchdog timer (also referred to as a watchdog for short) for monitoring the correct functioning of the computer core of the fuse control device. These are preferably part of the fuse control device. The watchdog timer acts as a general monitoring device and, if necessary, performs further monitoring specifications within the meaning of the document presented here.

[0014] The detection of non-extinguishing arcs in the 48V network is an important function that such an integrated control device for an electronic fuse must fulfill. The computer core of such a fuse control device should therefore independently detect such a non-extinguishing arc, individually and / or in cooperation with the computer cores of the other control devices of the other fuses and / or in cooperation with one or more higher-level computer systems, and contain and preferably combat the detected problem, individually or in cooperation and / or in cooperation with the computer cores of the other control devices of the other fuses and / or in cooperation with one or more higher-level computer systems, through countermeasures such as temporarily switching off energy sources, consumers and / or supply sub-grids.

[0015] A spectral analysis of the electrical current on the line section to be protected, in which the electronic fuse is inserted, is known from the prior art. For this purpose, the electronic fuse uses a current measuring device, for example a shunt resistor 24, to record the temporal progression of typically successive values ​​of the electrical current through the line section to be protected and carries out a spectral analysis of this value progression. If certain structures are present in the frequency spectrum determined in this way, the computer core of the control device of the electronic fuse concludes that there is an arc and, if necessary, switches off the current flow using the circuit breaker of the fuse, which is typically a fuse transistor. Instead of the computer core of the control device of the fuse, aA higher-level computer system, for example, a vehicle control unit or a computer core of a control device of another electronic fuse, can also perform this assessment and initiate, implement, and / or coordinate any necessary countermeasures. To this end, the computer core of the control device of the electronic fuse transmits suitable data to this other device, for example, the higher-level vehicle control unit or the other computer core of the control device of the other electronic fuse. Suitable data can be, for example, the raw measured values ​​or further processed measured values, in particular voltage and / or current values.

[0016] However, for the necessary temporal resolution of the temporal current value curve, an increased sampling rate of analog-to-digital converters of the control devices of the fuses in question is typically necessary for the application of such a spectral analysis.

[0017] Distributed measuring methods are also preferably useful and necessary. In this case, the control devices of several electronic fuses preferably record one or more measured values ​​using corresponding measuring devices of these control devices of these fuses. Preferably, the electronic fuses each have a respective timer. The control device of the respective electronic fuse preferably determines a time stamp value for preferably each measured value or for a group of measured values ​​that it determines with the aid of the respective timer. The control device of the respective fuse transmits these measured values ​​together with the associated time stamps, preferably to a higher-level computer unit, e.g. a higher-level control unit, or to the computer core of another electronic fuse.The higher-level computer unit or the computer core of the control device of the other electronic fuse compares the measured values, preferably with similar time stamps, and can thus, for example, infer energy losses in line sections between two electronic fuses. Such energy loss may indicate the aforementioned arc. The control devices of the fuses or the higher-level computer system preferably take into account any ground offset of the reference potential connection that may occur. If the measured values ​​or the relationship between the measured values ​​or a difference between such measured values ​​or variables derived therefrom do not correspond to one or more expected values, the higher-level computer unit or the computer core of the evaluating control device of the evaluating electronic fuse can take countermeasures. These countermeasures may correspond to the countermeasures already described.Data communication can again take place via the backup data bus or one of the data buses mentioned above or via a wireless interface, depending on requirements.

[0018] Monitoring current and / or voltage waveforms enables what is known as health management for the vehicle. For example, the power grid system can then detect changes in current consumption or in the voltage waveform, current waveform, or energy transport spectra that may not correspond to the expected waveforms or values. If necessary, the power grid system can then inform the workshop, the vehicle owner, or another person or institution via the internet, etc., or display a message about the condition, wear, potential damage, or impending failure of electrical consumers. Such data is of particular interest to the vehicle manufacturer.It is therefore conceivable that the computer core of a control device of a fuse sends recorded measured values ​​and / or operating data via the data bus and via a higher-level computer system and the Internet to a server of the automobile manufacturer, where the latter collects, further processes and evaluates this data in order, for example, to obtain data for preventive maintenance work and to obtain information on future improvements to its vehicles.

[0019] For the purposes of this document, energy-generating components are consumers in which either the current direction or the voltage direction is reversed compared to those directions in an energy-dissipating consumer.

[0020] Cars have special modes known as ECO modes, in which a higher-level computer system in the vehicle specifically switches off individual consumers. Today, the higher-level computer system switches off these individual consumers by sending a command to the consumer via the data bus. It is proposed that the higher-level computer system also switch off individual consumers by interrupting the entire supply of a supply tree branch or supply sub-network using an electronic fuse that opens its circuit breaker on command from the higher-level computer system. This eliminates the so-called standby currents of the numerous consumers that this supply sub-branch or supply sub-network supplies with electrical energy.

[0021] If a consumer at another, higher-priority location in the vehicle's supply network requires a larger amount of energy for a short period of time, the higher-level computer system of a higher-level control unit or the computer core of a control device of an electronic fuse can temporarily shut down other supply subtrees of the supply tree or other supply subnetworks of the supply network via the data bus to which the computer cores of the control devices of the respective fuses are connected, or via another functionally equivalent data transmission path. Incidentally, a supply tree is a supply network within the meaning of this document.

[0022] If, at another, higher-priority location in the vehicle's supply network, the supply network is required to temporarily transport a larger amount of energy via a line section to one or more first consumers, the higher-level computer system of a higher-level control unit or the computer core of a control device of an electronic fuse can temporarily deactivate other supply subtrees of the supply tree or other supply subnetworks of the supply network via the data bus to which the computer cores of the control devices of the respective fuses are connected, or via another functionally equivalent data transmission path. This deactivation increases the proportion of the current-carrying capacity of the affected line section used by the first consumers for energy supply, to the benefit of the first consumers.Once the temporary increase in demand has passed, the higher-level computer system of the higher-level control unit or the computer core of the electronic fuse control device can restore the original state via the data bus or the aforementioned data connection. This involves temporarily switching off consumers, for example, to achieve a kickdown.

[0023] It is known from the state of the art that relays are unsuitable for isolating a high-voltage supply network (HV network), for example. This refers to supply networks with voltages above 400V above the reference potential. Such disconnections can result in interruption currents of 5kA. Currently, relays in electric cars only switch between "charge mode" and "drive mode."

[0024] Today's common SiC transistors are typically switched via smart FETs. These are FET transistors with little integrated logic. Therefore, there is a need for adequate control of SiC transistors by suitable fuse control devices when using such SiC transistors as power switches in fuses.

[0025] DE 10 2018 208 754 A1 discloses a motor vehicle electrical system, a method for operating it, and an associated safety device. The motor vehicle electrical system of DE 10 2018 208 754 A1 comprises a battery, several consumers, a primary fuse, and several paths via which the primary fuse, which is electrically coupled to the battery, is electrically coupled in series to one of the consumers. According to the technical teaching of DE 10 2018 208 754 A1, each path comprises at least one of several secondary fuses. According to the technical teaching of DE 10 2018 208 754 A1, the primary fuse and the secondary fuses are reversible fuses, and a control device of the motor vehicle electrical system of DE 10 2018 208 754 A1 is configured to access these fuses.The control device of DE 10 2018 208 754 A1 is designed to determine whether a fault has occurred in the motor vehicle electrical system which meets a triggering criterion for at least one of the fuses comprised by at least two of the paths, and in this case to selectively control the fuses in such a way that the fault-free paths are identified and subsequently the fuses of the fault-free paths are switched on again.

[0026] From DE 10 2015 215 783 A1 a method for configuring a control device in a motor vehicle is known. According to the technical teaching of DE 10 2015 215 783 A1, the control device has a voltage source; at least two essentially identical processor devices, to each of which at least one electrical consumer can be connected, and at least one power supply line that extends between the voltage source and the processor devices. The processor devices of DE 10 2015 215 783 A1 use a current measuring device to detect predetermined data of at least one current and / or voltage characteristic curve of the consumer after connection and / or when switching on the processor device. Furthermore, the processor devices of DE 10 2015 215 783 A1 are adjusted to the respective electrical consumer according to the technical teaching of DE 10 2015 215 783 A1 based on the detected data of the current and / or voltage characteristic curve.

[0027] None of these documents solves the problem of securely authenticating the admissibility of access. Motivational factors

[0028] The following motivational factors are relevant for the use of an electronic fuse (E-Fuse): • Weight reduction of the car, • Flexibility of architecture, • Creative power management, • Functional safety, • Better system reliability.

[0029] The following disadvantages arise when using electronic fuses: • The fuse is always cheaper. To reduce the weight of the car

[0030] The manufacturing of electronic fuses is possible with high precision. A vehicle's computer systems can precisely model the switching behavior of electronic fuses, unlike the switching behavior of conventional fuses. This precise predictability of switching behavior enables reduced safety margins in the design of the conductor cross-sections of the cable sections in the supply harness and a reduction in similar tolerances, which can reduce the material used for the vehicle's wiring harness and thus the vehicle's weight. A lower vehicle weight leads to reduced energy consumption.

[0031] Workshops and end users can preferably expand the supply trees and supply networks in the vehicle using plug-in modules.

[0032] However, this fully modular and non-hierarchical supply network concept is still a thing of the future. In a first step, the first supply networks that include electronic fuses will retain the central fuse box (junction box) in the vehicle. The idea is to provide the electronic fuses as plug-in modules. It is possible to install the electronic fuses as plug-in modules in place of the current fuses in the junction box. These plug-in fuse modules preferably have a plug-in connection for a data bus connector, which connects the data bus of the computer core of the electronic fuse control device via a data interface of the electronic fuse control device to a data bus of the junction box or the vehicle and thus to a higher-level computer system of the vehicle, for example a vehicle control unit.

[0033] This is therefore preferably an evolutionary approach that further develops the functionality of the junction box by initially making it more intelligent. Later, it is conceivable to divide the junction box into various smaller junction boxes within the vehicle and, finally, in the final step, to equip the vehicle's consumers and energy sources with individual electronic fuses. An electronic fuse in the sense of the proposal discussed here therefore not only fulfills the safety function itself, interrupting the circuit in which the fuse is inserted if the current flowing through it exceeds a certain threshold over a longer period of time.An electronic fuse within the meaning of the document presented here also provides a) measuring devices, for example for recording current measured values ​​of the relevant line section and / or b) measuring devices for recording voltage measured values ​​of the relevant line section and c) actuators for changing the state of the relevant line section and d) communication options with other electronic fuses and d) communication options with higher-level computer systems and e) communication options with other device components of the vehicle, in particular control units, and f) time-related data and, where applicable, other advantageous services and device components.

[0034] The Fig. Figure 37 shows the current protection of a cable in a supply line section. The fuse does not respond adequately, especially for very high impulse currents. The tolerances require a large safety margin, which requires an increase in the cable cross-section and thus more material and vehicle weight.

[0035] The insertion of electronic fuses can meet various market needs. Fig. 38 is intended to present and illustrate this fact.

[0036] Firstly, depending on the electrical current flowing through the line protected by the electronic fuse, the electronic fuse can precisely simulate the behavior of a fuse with virtually no tolerances compared to the fuse. To do this, the electronic fuse continuously records or determines the value of the electrical current through the circuit breaker of the electronic fuse in the relevant supply line section using a measuring aid within the electronic fuse. The computer core of the control device of the electronic fuse preferably calculates an intermediate value using a zeroth, first, second, or third degree polynomial. A straight line polynomial greater than one is preferred in this case in order to more precisely model the quadratic dependence of the electrical energy fed into the protected line section on the current value of the electrical current.The variables of this polynomial are typically the electrical current values ​​measured by the measuring devices of the electronic fuse. Preferably, the computer core of the electronic fuse control device integrates this intermediate value over time to form a second intermediate value. The polynomial is preferably a second-degree polynomial. This second intermediate value can then, for example, with correct parameterization using suitable polynomial coefficients, emulate the thermal heating of the fuse wire of a fuse. The advantage is that, with suitable calibration, the behavior of the electronic fuse is practically tolerance-free. If the second intermediate value exceeds a predefined threshold, the computer core of the electronic fuse control device switches off the circuit breaker of the electronic fuse connected to the line to be protected in the supply branch of the supply tree in this model.In this variant, the electronic fuse preferably comprises one or more devices that emulate a fuse. Typically, the electronic fuse comprises one or more device components that preferably square and integrate the electrical current values. This is the case within the meaning of the description presented here if the device component has a function that corresponds to, or is functionally equivalent to, processing the measured current values ​​through the circuit breaker of the fuse in the line section to be protected using a polynomial of at least second degree and subsequent integration. This means that an analog and / or digital circuit and / or an analog or hybrid computer can explicitly perform this function.This analog and / or digital circuit and / or the analog or hybrid computer can be part of the control device of the electronic fuse. The electronic fuse preferably has one or more device components that monitor essential parameters. These components are preferably part of a control device of the fuse. Typically, the electronic fuse comprises one or more device components that process the values ​​of the electrical current and / or the voltage of the potential of the line section to be protected against a reference potential using only a first-degree polynomial, i.e., linearly.This is the case in the sense of the description presented here if the device part has a function that corresponds to, or is functionally equivalent to, processing the measured values ​​of the current and / or voltage in the line section to be protected using a polynomial of a degree less than the second degree. This means that an analog and / or digital circuit and / or an analog or hybrid computer can explicitly perform this function, and these can be part of the control device of the electronic fuse. Preferably, these parts comprise temporal filters that filter and / or integrate these signals over time. Typically, a particularly favorable filter time of 500 ns can be assumed as the filter time constant of a low-pass filter (filtering time).

[0037] In addition to emulating a fuse, the proposed electronic fuse preferably also quickly disconnects the circuit breaker of the electronic fuse if the current value detected by the measuring device of the electronic fuse control device exceeds a permitted maximum value or is not plausible for the usage situation. Plausibility monitoring is preferably performed by a computer core of the fuse control device and / or a higher-level computer system outside the electronic fuse. Preferably, a higher-level computer system of a higher-level control unit or the computer core of another electronic fuse can change this maximum value depending on the usage situation and / or the required power distribution within the vehicle by means of a control command to the electronic fuse via a wireless and / or wired data transmission link.The document presented here refers to this wireless and / or wired data transmission path only collectively as a data bus.

[0038] It is important that the control device of the electronic fuse, typically the control device's computer core or a functionally equivalent component of the electronic fuse, switches the circuit breaker of the fuse off or on, and does not limit the electrical current through the circuit breaker by changing the internal resistance of the circuit breaker, as this would lead to high power dissipation in the circuit breaker. Preferably, the circuit breaker should switch off in a few ns in such shutdown situations of the supply network, of which the electronic fuse is a part.

[0039] Car manufacturers are currently paying less attention to this rapid shutdown and typically still assume that shutdown occurs within a period of several milliseconds.

[0040] Car manufacturers and relevant automotive suppliers typically deal with dynamic loads in vehicles. They therefore require the electronic fuse to behave like a fuse to avoid unforeseen cross-effects when electronic fuses replace fuses in new, more modern designs. Therefore, the fuse should also allow for current values ​​to be exceeded within certain limits, up to a maximum current value of the electrical current in the electrical line to be protected. This means that the cut-off curve of the electronic fuse should be essentially parabolic in its intended use.

[0041] An important proposal within the document presented here is therefore an electronic fuse with a rapid tripping of the circuit breaker of the fuse in a time less than 200ms, better, less than 100ms, better less than 50ms, better less than 20ms, better less than 10ms, better less than 5ms, better less than 2ms, better less than 1ms, better less than 500µs, better less than 200µs, better less than 100µs, better less than 50µs, better less than 20µms, better less than 10µs, better less than 5µs, better less than 2µs, better less than 1µs, better less than 500ns, better less than 200ns, better less than 100ns, better less than 50ns, better less than 20ns, better less than 10 ns, preferably less than 5 ns, preferably less than 2 ns, preferably less than 1 ns. The circuit breaker is inserted into the electrical line to be protected within the electronic fuse as a separating element.The computer core of the electronic fuse control device preferably performs this switching off when a maximum permissible current is exceeded and / or when the voltage of the line against a reference potential falls below a minimum voltage value, using corresponding sub-devices of the electronic fuse control device. The special feature of the proposal described here is that, at the same time as otherwise, switching off occurs after a permissible time based on the emulation of a fuse characteristic, as described above.

[0042] The computer core of the electronic fuse control unit could perform the current measurement using a shunt resistor in the line and an analog-to-digital converter in the fuse control unit. However, this is associated with many disadvantages.

[0043] Preferably, the computer core of the control device of the electronic fuse detects, by means of the analog-to-digital converter of the control device of the fuse, voltages between the terminals of the circuit breaker and / or voltages between the terminals of an auxiliary circuit breaker connected in parallel to the circuit breaker and in series with a shunt resistor, or functionally equivalent values ​​of physical parameters and determines therefrom a value for an electric current through the circuit breaker of the fuse that is switched into the electrical line to be protected.

[0044] When measuring the current through the circuit breaker of the fuse, the computer core of the control device of the electronic fuse can feed an additional test current into the circuit breaker of the electronic fuse using a first test current source. The temporal profile of the current value of this additional test current is preferably modulated with a modulation signal. The modulation signal preferably has a known amplitude and a known frequency and phase. Thus, the modulated additional current preferably has a maximum amplitude. The control device of the electronic fuse records the temporal profile of the electrical current through the circuit breaker and checks whether the signal of the temporal profile of the measured values ​​of this electrical current includes signal components whose modulation correlates with the modulation of the modulation signal.For this purpose, for example, a synchronous demodulator can perform the correlation between the temporal profile of the measured values ​​of this electrical current, on the one hand, and the temporal profile of the modulation signal. This can be done, for example, by the synchronous demodulator multiplying the modulation signal, or a signal derived therefrom, or a signal that has a fixed temporal relationship with the modulation signal, with the signal of the temporal profile of the measured values ​​of this electrical current, or a signal derived therefrom, on the other hand, and then filtering the signal resulting from the multiplication, preferably by low-pass filtering. Instead of a synchronous demodulator, the control device can also comprise a matched filter optimized for the modulation signal, and / or an optimal filter, and / or a Kalman filter, or another estimation filter. The following needs exist among automobile manufacturers and their suppliers 1. Overcurrents must not occur in the protected supply line section. This function is new, as a fuse only provides thermal overload protection, not protection against short-term overcurrents. 2. Overloading of the line in the protected supply line section must not occur. The electronic fuse should behave like a state-of-the-art fuse to ensure plug-and-play functionality and avoid creating new problems due to side effects. New designs should maximize the SOA (safe operating area) of the line to minimize material usage in the form of the cable diameter of the line to be protected. (Protective function of the electronic fuse, i.e., the E-fuse) 3. The above-mentioned organisations are interested in recording additional parameters in the supply network, for example to be able to carry out a current measurement without a temperature sensor and thus possibly be able to draw conclusions about the temperature of the lines in the supply network. 4. The supply of the device components of a vehicle should be ensured with the lowest possible quiescent current consumption when parked. For an electronic fuse, this means that this low residual current consumption must be achieved with minimal protection, and that the loads downstream of the electronic fuse in the supply subtree must be able to wake up from time to time. 5. Car manufacturers want ideal diodes to control and / or prevent the reverse flow of electrical energy.

[0045] The document presented here proposes, for the realization of ideal diodes, that the computer core of the control device of an electronic fuse can preferably detect the electrical current through the circuit breaker in the direction from the energy source to the load, but also in the reverse current direction, using suitable measuring means of the fuse and / or the control device of the fuse. For this purpose, the computer core of the control device of an electronic fuse can, for example, detect the voltage drop across the circuit breaker using an analog-to-digital converter or the like, and switch off this circuit breaker if the electrical current through the circuit breaker is reversed. The proposed electronic fuse and / or the control device of the electronic fuse should therefore comprise means for detecting and sensing a reverse current flow.Typically, the computer core of the control device of the electronic fuse evaluates the measured values ​​thus acquired and forwards these or measured values ​​derived therefrom to other computer cores of other electronic fuses in the supply network via a fuse data bus or the like or to a higher-level computer system, for example a control unit of the vehicle. battery

[0046] Electronic fuses are also excellently suited for monitoring batteries. The document presented here therefore proposes a battery with a diagnostic function. Preferably, at least one terminal of the battery is provided with an electronic fuse, as proposed here. For example, the battery can comprise a supply tree and / or a supply network with one or more supply branches. For example, several electronic fuses within the battery can be connected in series in a supply branch of a supply tree and / or a supply network. For example, a supply tree and / or a supply network can also comprise only one supply branch with a plurality of electronic fuses inserted into the supply branch. Preferably, a battery comprises one or more battery cell modules. Preferably, one or more battery cell modules are electrically connected in series.Preferably, one or more electronic fuses are connected between battery cell modules of the battery. Preferably, exactly one electronic fuse is connected between two battery cell modules that are connected in series. Very particularly preferably, one electronic fuse is provided for each battery cell module. Very particularly preferably, an electronic fuse is assigned to each battery cell module or to one or more groups, in particular battery cell modules connected in series. Very particularly preferably, one or more or all of these electronic fuses have a first circuit breaker that is suitable for interrupting the current flow through the battery cell module orto prevent the relevant group of battery cell modules from being interrupted, i.e., to break the electrical connection between a first battery cell module and a second battery cell module or a first group of battery cell modules and a second group of battery cell modules that are connected in series with one another, when the first circuit breaker is open. Very particularly preferably, one or more or all of these electronic fuses of the battery have a second circuit breaker that is suitable for bridging the battery cell module or the group of battery cell modules when the second circuit breaker is closed.

[0047] In this case, the computer core of the electronic fuse control device can preferably only close the second circuit breaker when the first circuit breaker is safely open. For this purpose, the computer core of the electronic fuse control device preferably examines the switching state of the first circuit breaker before closing the second circuit breaker, for example by feeding a test current into the first circuit breaker and withdrawing this test current downstream of the first circuit breaker, and by detecting and checking the voltages at the circuit breaker terminals.

[0048] In this case, the computer core of the electronic fuse control device can preferably only close the first circuit breaker if the second circuit breaker is safely open. For this purpose, the computer core of the electronic fuse control device preferably examines the switching state of the second circuit breaker before closing the first circuit breaker, for example by feeding a test current into the second circuit breaker and withdrawing this test current downstream of the second circuit breaker, and by detecting and checking the voltages at the terminals of the second circuit breaker.

[0049] The interconnection between the battery cell module or the group of battery cell modules and the first circuit breaker and the second circuit breaker preferably has three electrical nodes. In this case, the first circuit breaker is preferably connected to a first terminal of the first circuit breaker with a first node. In this case, the first circuit breaker is preferably connected to a second terminal of the first circuit breaker with a second node. In this case, the second circuit breaker is preferably connected to a first terminal of the second circuit breaker with a third node. In this case, the second circuit breaker is preferably connected to a second terminal of the second circuit breaker with the second node. In this case, a first terminal of the battery cell or the group of battery cells is preferably connected to the third terminal. In this case, a second terminal of the battery cell orthe group of battery cells is connected to the first terminal. The electronic fuses for use in a battery preferably have a housing. Electronic fuses for use in a battery preferably have an optical interface. The said housing of an electronic fuse preferably comprises an optical window or an optical subsystem for the access of electromagnetic radiation for the transport of data to this electronic fuse. The said housing of an electronic fuse preferably comprises an optical window or an optical subsystem for the exit of electromagnetic radiation for the transport of data from the computer core of the control device of the electronic fuse to the computer core of the control device of another electronic fuse or to a higher-level computer system.The electromagnetic radiation is preferably laser radiation and / or radiation from an LED. Preferably, the electronic fuse comprises a laser or an LED, particularly for this purpose. Preferably, the electronic fuse comprises a photodetector, for example a photodiode, for receiving optical signals that transport data. The optical windows are sub-devices of one or more optical data interfaces of the control device of the respective electronic fuse. Preferably, optical fibers and / or other optical functional elements connect the computer cores of the control devices of one or more electronic fuses to one another via these optical data interfaces of these electronic fuses.Preferably, one or more electronic fuses are connected to a higher-level computer system via such an optical interface and an optical fiber to an optical interface of the higher-level computer system. One or more electronic fuses can also be connected to the higher-level computer system for data purposes by means of another data interface, in particular by means of the one mentioned above. Preferably, the battery cell module or the group of battery cell modules supplies the control device of the electronic fuse and the other parts of the electronic fuse that are assigned to this battery cell module or this group of battery cell modules with electrical energy for the operation of the same. Preferably, a battery cell module ora group of battery cell modules firstly supplies the control device of the electronic fuse and secondly the other parts of the electronic fuse and thirdly supplies those battery cell modules or that group of battery cell modules to which this electronic fuse is assigned and which this fuse follows or precedes in the supply branch with electrical energy for the operation of this electronic fuse. The battery therefore preferably comprises one electronic fuse per battery cell module or per group of battery cell modules. The computer core of the control device of the electronic fuse preferably records voltage values ​​and / or current values ​​using measuring means of the control device of the electronic fuse. The electronic fuse preferably performs a fuse function.The computer core of the electronic fuse control device preferably interrupts the current flow through the electronic fuse's power switch by means of the electronic fuse's power switch when a disconnection condition is met. Such a disconnection condition can be, for example, the exceeding of a maximum current value of the electrical current through the fuse's power switch or the like. The computer core of the electronic fuse control device preferably interrupts the current flow by means of the electronic fuse's power switch and bridges the battery cell module or the group of battery cell modules when a disconnection condition is met and a bridging condition is met.Preferably, the computer cores of the control devices of one or more electronic fuses transmit one or more measured values ​​and / or values ​​derived therefrom and / or status values ​​and / or status information of the respective electronic fuses to a higher-level computer system. Preferably, one or more control devices of the electronic fuses comprise one or more temperature sensor evaluation devices, preferably with one or more temperature sensors. The electronic fuse preferably comprises one or more temperature sensors. The electronic fuse can additionally comprise a thermal fuse, which comprises a fuse with a tensioned spring that de-energizes the circuit breaker of the electronic fuse when the circuit breaker exceeds a maximum temperature.Preferably, the computer core of the control device of the fuse evaluates temperature measurement values ​​of the one or more temperature sensor evaluation devices, which record these with the aid of temperature sensors external to the electronic fuse and / or with the aid of temperature sensors of the electronic fuse.

[0050] Preferably, one or more electronic fuses comprise two data interfaces, which may be optical. Preferably, the processor cores of the control devices of the electronic fuses in devices with increased requirements for galvanic isolation are connected for data purposes via an optical data bus, into which the data interfaces of the control devices of the electronic fuses are respectively inserted.

[0051] Preferably, data interfaces of the control devices of the electronic fuses are connected for data purposes, wired and / or wirelessly, at least by an electronic single-wire data bus and / or by a two-wire data bus and / or another data bus and / or another data communication means. The data interfaces of the control devices of the electronic fuses are inserted into such a data bus. The data buses can be interconnected in a star-shaped or linear manner, in a chain or a closed ring. Depending on the data bus type, the data buses can also have branches, if necessary. A particularly preferred data bus within a battery can be an optical data bus ring of optical data buses interconnected in a ring. The optical fibers of the optical data bus are preferably designed to be electrically insulating.The control device of an electronic fuse can preferably comprise a silicon-based LED as the LED. An optical data interface of the control device of an electronic fuse can also comprise a silicon-based LED, for example as the LED. Such a silicon-based LED can be a silicon avalanche LED. For example, the silicon-based LED can be a SPAD diode, which operates the control device of the fuse as an LED with sufficient blocking voltage in blocking operation in the breakdown region. The control device of the electronic fuse then preferably comprises a control device which generates the operating voltage for the silicon LED, in particular the SPAD diode, from the operating voltage of the electronic fuse by means of a voltage converter. The technical teaching presented here also proposes, among other things, that the silicon LED can also be operated temporarily as a receiver.For this purpose, the computer core of the control device of the electronic fuse separates the silicon LED from the electrical supply of the voltage converter by means of a circuit breaker of the control device of the electronic fuse and uses the voltage signal and / or photocurrent signal of the silicon LED as an input signal for an optical data receiver of the control device of the electronic fuse. Flexibility of architecture

[0052] An electronic fuse, as proposed in this document, can reduce the complexity of designing the automotive fuse box (junction box). Because a higher-level computer system, in particular, can access the computer cores of the electronic fuse control devices via data buses through the vehicle's control units, new designs can position the electronic fuses at various locations in the vehicle, thus minimizing the wiring effort for the supply network. This enables decentralization of the electronic fuses.Preferably, new designs implement one or more supply branches of the supply network for supplying electrical consumers within the vehicle with electrical energy as a ring of one supply line when the body serves as the return ground line, and / or, in the other case, as two rings of two supply lines. Preferably, the respective circuit breakers of the respective electronic fuses are incorporated into the respective supply line of the supply network. Preferably, two fuses are incorporated for each consumer into the respective supply line at the respective electrical energy tapping point for that consumer in the respective supply line.This means that in the event of a fault in a supply line section, the respective computer cores of the respective control devices of the two electronic fuses assigned to this faulty consumer typically open their respective circuit breakers, so that this opening of the circuit breakers of the fuses isolates the faulty line section. This means that in the event of a fault in a consumer, the respective computer cores of the respective control devices of the two electronic fuses assigned to this consumer typically open their respective circuit breakers, so that this opening of the circuit breakers isolates the faulty consumer. Thus, such a fault does not affect the supply of electrical energy to the other consumers. Active power generation configuration and active power distribution configuration (Active Power Management)

[0053] The so-called Active Power Management includes, for example: • Adaptive management of the line condition, • Adaptive power management using adaptive shutdown thresholds, • Reduction of the quiescent current in HV domains, • Efficient parking system states, • Remote recovery, • Preventive Maintenance (Kl).

[0054] Particularly preferably, the respective computer cores of the respective control devices of a plurality of electronic fuses record the respective electrical current through their respective circuit breaker and, if applicable, the respective potential of one or more terminals of this circuit breaker with each other and / or with respect to a reference potential of a reference potential contact as a reference potential. Depending on the current value of the current supply to the respective circuit breaker of the respective fuse, the respective computer core of the respective control device of the respective fuse preferably calculates a theoretical ground offset by means of modeling and, if necessary, corrects the corresponding voltage measurement values ​​recorded by it.

[0055] This calculation of the computer core of the fuse control device can also be carried out by other computer cores of other control devices of other electronic fuses in the overall system or by higher-level computer systems of the vehicle, etc.

[0056] Individual or multiple computers in the overall system, which may also be computer cores of the control devices for the electronic fuses and / or the higher-level computer system, can, for example, infer status parameters of the supply line sections using the parameters thus recorded, such as current and voltage values. These may include, for example, resistance values ​​and / or temperatures and / or thermal deflections, etc. of the supply line sections. The status parameters of a supply line section may include its temperature. The computer cores of the control devices can, for example, very accurately determine the temperature of copper lines using the known temperature coefficients of copper and the known design data of the supply line section and / or using the energy fed into the supply section and / or using the energy absorbed in the supply line section.The same applies to other materials.

[0057] The use of electronic fuses enables the programming of equipment variants. To prevent unauthorized activation or deactivation of the power supply option for subtrees of the supply tree and / or sub-supply networks of the supply network, communication between the computer core of a control device of an electronic fuse and the computer core of the control device of another electronic fuse is preferably encrypted. To prevent unauthorized activation or deactivation of the power supply option for subtrees of the supply tree and / or sub-supply networks of the supply network, communication between the computer core of a control device of an electronic fuse and a higher-level computer system is preferably encrypted.Preferably, the activation and / or deactivation of an electronic fuse, i.e., the switching on or off of the circuit breaker, requires the transmission of a digital password from the computer core of the control device of another electronic fuse or from the higher-level computer system via a data bus to the computer core of the control device of an electronic fuse. Preferably, communication between the computer core of the control device of an electronic fuse and its environment via such data connections is encrypted. Preferably, such a data connection is encrypted using a PQC method (PQC = post quantum cryptography). Communication via the data bus can be carried out, for example, using a PSI5-like protocol or the like.Preferably, the electronic fuses which are sub-devices of a supply network also communicate with each other by means of power line communication via the supply network or their possibly separate supply voltage lines.

[0058] After a significant change in the vehicle's operating state, it is preferable that not all electronic fuses change the switching state of their circuit breakers at the same time. Such a significant change in the vehicle's operating state can be, for example, the switch-on process when the vehicle is transferred from the parked state to the drive state. Electronic fuses preferably receive a start signal from a central control unit, e.g. a higher-level computer system. If necessary, the higher-level computer system distributes in advance the values ​​of the waiting times that the electronic fuses should wait between the arrival of the start signal from the control unit and the closing of their respective circuit breaker. These respective values ​​of the respective waiting times can also be programmed into a non-volatile memory of the respective electronic fuse.This programming can be performed at the factory or by the higher-level computer system or another computer in the vehicle, thus also by the computer core of another electronic fuse. This significantly reduces the typically very high starting current of a vehicle's electrical system. This starting current is also referred to as the in-rush current. As the in-rush current decreases, new designs with electronic fuses can, in turn, make the wiring network supplying the vehicle's electrical consumers more slender and use thinner cables. This reduces the vehicle's weight. Increasing system reliability

[0059] The document presented here proposes that the computer cores of the control devices of the electronic fuses check the respective voltages between these terminals and a reference node and / or between each other at the respective terminals of their respective circuit breakers located on the energy source side. If one of these respective voltages falls below a respective minimum value and simultaneously the respective electrical current through the respective circuit breaker of the respective electronic fuse exceeds a respective predetermined threshold, the respective power supply supplies more energy than intended to the respective supply sub-network protected by this respective electronic fuse. The respective electronic fuse then preferably shuts off the electrical supply to this supply sub-network by switching off its respective circuit breaker.This results in a limitation of the respective voltage drop due to the speed of the respective electronic fuse.

[0060] Depending on the security scheme, the computer core of the electronic security control device can perform one or more switch-on attempts after a switch-off. If the number of unsuccessful switch-on attempts exceeds a specified number, the computer core of the electronic security control device preferably transmits an error message to the computer core of the control device of another electronic security device or to a higher-level computer system.

[0061] Electronic fuses for supply sub-networks and supply branches with the highest possible availability should have the option of single or multiple retry attempts in the event of shutdowns due to overcurrent or similar. Fuse data bus (fuse bus)

[0062] As previously described, it is useful for the computer cores of the electronic fuse control units to be able to communicate with other computer cores of the control units of other fuses in the vehicle's power supply network or with higher-level computer systems of the vehicle. Typically, communication is required for configuration data (read / write), switching commands (read / write), diagnostic data (read / write), measured values ​​(read), and comparison value settings (read / write).

[0063] The computer cores of the control circuits of the electronic fuses preferably use a fuse data bus to communicate with each other in the vehicle or within a fuse box. The fuse data bus is preferably a two-wire data bus. The fuse data bus is preferably a differential data bus, since significant ground currents and ground corrosion can occur in the body of a vehicle. The fuse data bus is preferably a CAN data bus or a data bus with a physical interface of a CAN data bus, a CAN-FD data bus, a Flexray data bus, an LVDS data bus, or the like. The fuse data bus is preferably bidirectional. The control devices of the electronic fuses preferably comprise two data bus interfaces for the fuse data bus, so that new designs can integrate the electronic fuses into the fuse data bus using these two data bus interfaces.As a result, the electronic fuses can form a linear chain of electronic fuses along the fuse data bus, so that a higher-level computer system - for example a control unit - which is connected at the beginning of the fuse data bus, transmits the fuse addresses as bus node addresses to the computer cores of the control devices of the electronic fuses by means of auto-addressing.

[0064] Preferably, the computer cores of the control devices of the electronic fuses transmit parameters of the connected supply subnetworks and / or individual nodes of the supply subnetworks and / or individual supply line sections of the supply network of the vehicle's supply lines to other computer cores of the control devices of other electronic fuses and / or one or more higher-level computer systems—e.g., control units of the vehicle. Such parameters can be directly accessible parameters, such as the temperature of a temperature sensor, the voltage of a node of the supply network relative to a reference potential, or the current value of an electric current in a supply line section of the supply network.A computer core of a control device of an electronic fuse can also detect derived parameters, such as leakage currents against other electrical nodes in the vehicle or electrical resistances of supply voltage line sections, by applying Kirchhoff's equations to data which the computer core of the control device of the electronic fuse has determined by means of measuring devices of this electronic fuse or which the computer core of the control device of this electronic fuse has received from the computer cores of the control devices of other electronic invoices or from higher-level computer systems (e.g. control units of the vehicle).

[0065] In particular, the computer core of a control device of an electronic fuse can estimate the temperature of a subsequent supply voltage section if its ohmic resistance, its heat capacity, thermal leakage resistance, and the ambient temperature in the region of the supply line section are approximately known to the computer core, e.g., by estimation. This approach typically takes advantage of the fact that the energy fed into the supply line section essentially corresponds to the time integral of the electrical power fed into the supply line section. This is typically proportional to the square of the magnitude of the electrical current flowing into the supply line section. Other ideas presented in this document: Power supply

[0066] A first idea is for users to add power to previously unpowered electrical energy consumers in the supply network. The user purchases an activation code from a provider, for example, via a data connection to a service provider's server. The provider generates and / or has generated this activation code using authentication data according to a fixed procedure and keeps it available, and transmits it to the user via a data transmission channel. Preferably, one or more processor cores of the control devices of one or more electronic fuses record the energy that, for example, the battery of an electric car feeds into a supply branch of the supply network. In this model, the battery is the property of the energy supplier.Preferably, a higher-level computer system, for example, a vehicle control unit, reads the determined energy quantity from the computer core and / or a memory of the electronic security control device and / or the underlying measured values ​​and transmits this data via a preferably encrypted data transmission path to the energy supplier or a vicarious agent, who then generates an invoice based on this data. It is conceivable that the supply sub-grid also enables services from other service providers, who may determine their invoice data in a similar manner and bill the user. Diagnosable ring

[0067] Preferably, new designs provide a partially ring-shaped supply network, in which consumers preferably draw electrical energy from the supply network at different points within the ring-shaped supply network. Preferably, the supply line of the ring-shaped supply network is interrupted to the left and right of the electrical energy draw-off point by an electronic fuse, or at least by an electronic fuse, which is inserted with its respective circuit breaker into the supply line of the supply line section between two electrical consumer energy draw-off points. If a fault occurs, these fuses can firstly isolate the affected supply line section and / or the affected consumer.A higher-level control unit can determine the status of the electronic fuses by addressing the computer cores of the control devices of the electronic fuses and thus narrow down the cause of a fault without this fault being able to affect other consumers. Typically, the fuses intervene so quickly that the fault only affects a few sensor values ​​from sensors and / or measuring devices connected to the supply network to such an extent that their values ​​are unusable. The electronic fuses preferably record the faults in the form of a log table, which can also only contain a few bits. The control devices of the electronic fuses preferably provide the entries in the log table with time stamps from a timer unit of the control device of the electronic fuse.The control device of the electronic fuse preferably also records with a timestamp when the fault no longer existed. A higher-level computer system preferably queries this data regularly or when a fault occurs. The higher-level computer system can thus determine when which supply sub-network or which supply line was faulty, how, and for how long this fault lasted. This allows the higher-level computer system to identify potentially affected sensors and measuring systems and mark the measured values ​​acquired by them during the relevant period as potentially faulty or to reject them immediately. A further advantage of a ring structure for such a supply network with electronic fuses is improved reliability through redundancy. It is therefore particularly suitable for safety-relevant applications. Satellites with electricity meters

[0068] As already explained, it is often useful for individual consumers to be equipped with a wattmeter or similar device. For this purpose, an electronic fuse uses a voltmeter to measure the voltage at a node on the circuit breaker of the electronic fuse or a node connected to it, and preferably the current through the circuit breaker of the electronic fuse, thereby determining the electrical current flowing into the consumer or a subsequent supply tree or section of supply line. The computer core of the control device of the electronic fuse transmits this data, preferably via a data bus, to the computer core of the control device of another electronic fuse or to a higher-level computer system. Activation of individual consumers

[0069] It is conceivable to activate the electrical supply to individual consumers in a vehicle's supply network using activation codes as described above. A server of the automobile manufacturer or a service provider transmits authentication data, which may include data from the vehicle, the car key, a SIM card, a password entry, biometric user data, etc., to the vehicle or the user, who then transmits this data to the vehicle via a terminal or data interface. Depending on the activation code, a higher-level computer system in the vehicle then transmits commands to close the circuit breakers to selected electronic fuses in the supply network, whereby the supply network then supplies electrical energy to the activation code-specific supply sub-networks. Transmission of energy usage data to electricity providers and / or automobile manufacturers

[0070] As described above, a higher-level computer system of the vehicle can transmit the usage and configuration data of the system thus determined from electronic fuses and supply sub-networks and supply line sections as transmission of energy usage data to electricity providers and / or automobile manufacturers and / or other service providers. Detecting a hot-plug event

[0071] Preferably, an electronic fuse is located near a connector for supplying electrical power to an electrical consumer in the vehicle. A problem can arise if users and / or workshops, etc., fail to de-energize and / or de-energize the device as required before plugging or unplugging the device. This document refers to such an event as a hot-plug event. This de-energization or de-energization is preferably performed using a software command via a data bus from a control unit, i.e., a higher-level computer system, to a computer core of a control device of an electronic fuse, which then opens its circuit breaker.If this has not been done beforehand and incorrect operation nevertheless triggers a hot-plug event, the control circuit of the associated electronic fuse can detect such a hot-plug event by monitoring the transient time curve of the voltage of the potential of a node of the circuit breaker against the potential of a reference node and / or by observing the transient current curve through the circuit breaker and switch off the circuit breaker so quickly that this rapid shutdown minimizes plasma formation. In addition, the electronic fuse can report such an event to the associated control unit, e.g. a higher-level computer system, via a data line. The higher-level computer system can then report this event if necessary, so that it is first displayed on a terminal (e.g. via a human-machine interface) or transmitted to the automobile manufacturer via a data transmission link. Distributed measurement methods

[0072] It was recognized that it is sensible for the control device of an electronic fuse to exchange the above-mentioned measured values ​​with other control devices of other electronic fuses via a data bus. In doing so, the control device cannot usually guarantee that the data transmission is very fast. It is therefore sensible for the control device of the fuse to send not only the measured values ​​but also a time stamp for one or more measured values. The electronic fuses preferably have a clock or timer for this purpose. A higher-level computer system preferably determines one-off correction factors for correcting the time stamp values ​​of the non-synchronous clocks of the various control devices of the various electronic fuses. Another method is the recurring synchronization of these clocks and / or timers.Firstly, synchronization can comprise a reset to a common start value. Secondly, synchronization can comprise the correction of the frequencies of the oscillators and / or clocks, which the synchronization process can set, for example, by adjusting the divisors of a base frequency. In this case, a higher-level computer system can, for example, use a data bus command in broadcasting mode to cause the various control devices of the various electronic fuses to preferably carry out identical measurements at the same times, where "equal" refers to the identical clock states of the respective clocks of the various control devices of the various electronic fuses. This then represents a distributed measurement method with synchronous measurement using synchronized local clocks within the control devices of the various electronic fuses.This enables the essentially time-synchronous measurement of ohmic resistances of supply line sections. Coupling communication network and supply network

[0073] It is advisable to couple a communications network with a power supply network. Reference is made here to the backup data bus described above. Dynamic assignment of current paths

[0074] During the development process, it was recognized that the dynamic allocation of energy and energy transport networks within a vehicle can be useful in the case of redundancy. For this purpose, a higher-level computer system in the vehicle determines the energy requirements of the vehicle's potential energy consumers. The supply lines are preferably designed as a supply network, with two or more supply lines running parallel at least in some sections and / or intersecting at at least two points in the vehicle. As an example, we will now study the intersection of a first supply line and a second supply line. The supply network preferably comprises two electrical nodes at each of these intersection points. For greater clarity, this document refers to these two electrical nodes at the intersection point as the first node of the first intersection point and the second node of the intersection point.The intersection point divides the first supply line into a first part of the first supply line on the energy source side and a part of the first supply line on the consumer side. The intersection point divides the second supply line into a first part of the second supply line on the energy source side and a part of the second supply line on the consumer side.

[0075] Below, we describe an electronic intersection protection system comprising four electronic fuses. In the following example, the electronic fuses of the electronic intersection protection system are located on the power source side. Conversely, it is also conceivable to locate the electronic fuses on the load side. The designs can provide electronic fuses on both the load side and the power source side. • A first electronic fuse connects or disconnects the energy source-side first part of the first supply line with the first node, depending on the switching state of the circuit breaker of the first electronic fuse. • A second electronic fuse connects or disconnects the energy source-side first part of the second supply line with the first node, depending on the switching state of the circuit breaker of the second electronic fuse. • The circuit breaker of the first fuse is preferably only closed when the circuit breaker of the second fuse is open. The circuit breaker of the second fuse is preferably only closed when the circuit breaker of the first fuse is open. • A third electronic fuse connects or disconnects the energy source-side first part of the first supply line with the second node, depending on the switching state of the circuit breaker of the third electronic fuse. • A fourth electronic fuse connects or disconnects the energy source-side first part of the second supply line with the second node, depending on the switching state of the circuit breaker of the fourth electronic fuse. • The circuit breaker of the third fuse is preferably only closed when the circuit breaker of the fourth fuse is open. The circuit breaker of the fourth fuse is preferably only closed when the circuit breaker of the third fuse is open. • The consumer-side part of the first supply line is connected to the first node. • The consumer-side part of the second supply line is connected to the second node.

[0076] An alternative version of the crossing protection implements the electronic fuses on the consumer side: • A first electronic fuse connects or disconnects the consumer-side first part of the first supply line with the first node, depending on the switching state of the circuit breaker of the first electronic fuse. • A second electronic fuse connects or disconnects the consumer-side first part of the second supply line with the first node, depending on the switching state of the circuit breaker of the second electronic fuse. • The circuit breaker of the first fuse is preferably only closed when the circuit breaker of the second fuse is open. The circuit breaker of the second fuse is preferably only closed when the circuit breaker of the first fuse is open. • A third electronic fuse connects or disconnects the consumer-side first part of the first supply line with the second node, depending on the switching state of the circuit breaker of the third electronic fuse. • A fourth electronic fuse connects or disconnects the consumer-side first part of the second supply line with the second node, depending on the switching state of the circuit breaker of the fourth electronic fuse. • The circuit breaker of the third fuse is preferably only closed when the circuit breaker of the fourth fuse is open. The circuit breaker of the fourth fuse is preferably only closed when the circuit breaker of the third fuse is open. • The energy source side part of the first supply line is connected to the first node. • The energy source side part of the second supply line is connected to the second node.

[0077] These intersection fuses can dynamically assign alternative and redundant power paths to specific consumers based on the determined energy demand. To this end, a vehicle control unit transmits suitable configuration commands to the electronic fuses of the intersection fuses of the supply network. These commands cause the opening and closing of the circuit breakers of the electronic fuses, thus dynamically adapting the electrically effective topology of the supply network's supply lines according to the power demand and current safety requirements. Switching off parts of the supply network within a vehicle

[0078] Another idea is to shut down sections of the network for maintenance and secure access. To do this, the person performing maintenance enters a predetermined security code into a higher-level computer system using a terminal or other human-machine interface (HMI). The person may receive this security code from a server of the automobile manufacturer or a service provider. To do this, the person transmits authentication data to the server, which may include, for example, authentication data for the person, the organization for which the person works, or authentication data for the vehicle or car key, or similar. A control unit then deactivates parts of the supply network using electronic fuses.Preferably, at least one electronic fuse is provided in each partial supply network that can be isolated in this way, which then short-circuits the partial supply network isolated by opening the circuit breakers of the isolating electronic fuses to a reference voltage line, for example ground, by closing the circuit breaker of this one fuse, thus discharging it. Dependence of the satellite power depending on the supply line

[0079] The reconfiguration of the network topology was described above, for example, using differently configurable node fuses. For a system emergency operation, it is now useful if the power consumption of a particular consumer is adapted to the weakest supply line in the path between the energy source and the particular consumer. To do this, the higher-level computer system that has initiated the reconfiguration of the supply network by sending appropriate commands to the electronic fuses via one or more data buses signals to the particular consumer how much energy this consumer is allowed to consume in order not to lose this weakest line. In the simplest case, the consumer can have two states: one state in which it consumes more energy and one state in which it consumes less energy. Network with reduced cross-section of the cable harness

[0080] It is proposed that the improved designs, due to the optimizations made, can provide supply network lines with a smaller cross-section than would normally be possible without electronic fuses. Rapid shutdown

[0081] A key idea is the rapid shutdown of a circuit breaker of an electronic fuse when a maximum permissible current through the circuit breaker is exceeded. If this maximum permissible current is not exceeded by the circuit breaker of an electronic fuse, the circuit breaker is preferably only switched off after a certain time, whereby this time generally depends on the current through the circuit breaker in a parabolic manner and decreases. The control device of the electronic fuse preferably emulates the behavior of a fuse. To do this, the control device of the electronic fuse records the current value of the electrical current through the circuit breaker. The control device preferably squares the value of the electrical current through the circuit breaker and integrates this value over time. The integration is usually a low-pass filter or similar.If the filter output value exceeds a threshold, the control device opens the circuit breaker of the electronic fuse. This is an electronic fuse with emulation of a fuse characteristic. Fuse with prevention of reverse current flow.

[0082] The electronic fuse preferably prevents the backflow of electrical energy from the consumer to the energy source. To do this, the electronic fuse preferably detects the direction of the flowing electrical current. If the current does not flow to the consumer but towards the energy source, the electronic fuse preferably opens the circuit breaker, thereby preventing this current flow. It is conceivable that in such a case the control device closes a third circuit breaker of the electronic fuse, which is otherwise open during normal operation. The then closed third circuit breaker then preferably short-circuits the consumer-side supply line by closing the third circuit breaker, for example to the reference potential line, i.e. to ground, whereby the returning current is now dissipated in the system ground. Use of silicon LEDs

[0083] The electronic fuse preferably comprises one or more silicon LEDs. The silicon LEDs are preferably part of an optical data interface of the computer core of the control device of the electronic fuse. These silicon LEDs are preferably also used as photodetectors of the optical data interface. The use of such silicon LEDs is particularly advantageous for the use of electronic fuses in batteries.

[0084] In this case, the housings of the electronic fuses preferably have optical windows so that the light from the silicon LEDs can escape. Electronic security with authentication

[0085] The electronic security device preferably has means for verifying the legitimacy of a command received by the electronic security control device via a data bus. For example, these can be encryption and decryption methods that ensure secure communication between a higher-level computer system and the electronic security control device. This is therefore an electronic security device with authentication for modern business models such as the activation of components via software for a fee. Plausibility check of the configuration for identification

[0086] Another identified issue is the plausibility check of the configuration to identify tampering with the supply network. Depending on the task, the electrical currents on the supply lines within the supply network lie within more or less known or predictable ranges. If the current value of a supply line deviates from the expected range, either an error or tampering has occurred. Detection of the switchability of the electronic fuse

[0087] An electronic fuse preferably also comprises means for detecting the switchability of the electronic fuse. This can, for example, involve feeding a test current into a first terminal of the circuit breaker from a second terminal of the circuit breaker. If the control device of the electronic fuse cannot draw this electrical current from the other terminal of the circuit breaker, the circuit breaker is not open or is not present. The control device of the electronic fuse preferably changes the switching state of the circuit breaker one or more times. The current conductivity of the circuit breaker, which the control device of the electronic fuse determines in each case, should correlate with the expected switching state of the circuit breaker.

[0088] If the switch is not possible, the control device of the electronic fuse signals an error to a higher-level computer system of the vehicle. Self-configuring fuse with auto-addressing

[0089] Preferably, the electronic fuses are inserted into a data bus arranged linearly like a string of pearls. This gives the electronic fuses a unique physical bus position relative to this linear data bus, which can be counted by the higher-level computer system that drives the data bus. Using an auto-addressing process, the higher-level computer system can then assign a fuse address to each electronic fuse, so that the higher-level computer system can address each fuse uniquely. This allows the electronic fuses to recognize their physical location within the data bus. Preferably, the electronic fuses are pre-defined with a configuration of threshold values ​​and shutdown thresholds for each conceivable physical data bus position within the vehicle.By knowing the physical data bus position, these electronic fuses can now configure themselves according to their data bus position using the factory data. These are thus self-configuring electronic fuses with auto-addressing, where the configuration of the electronic fuse depends on the detected physical data bus position. Electronic security with AI

[0090] According to the invention, it was recognized that the multitude of values ​​recorded by the electronic fuses enable evaluation by a computer core of the control device of an electronic fuse or a computer of a higher-level computer system. For this purpose, the evaluating unit uses the values ​​determined by one or more control devices of one or more electronic fuses using appropriate measuring equipment as input values ​​for a neural network model, which is executed by the computer of the evaluating unit. The neural network model is preferably trained using suitable training data from the development phase. For example, it can be useful to use this method to detect a failure of one or more consumers or other defects in the system before they actually become apparent. Powerline communication via an electronic fuse (E-Fuse)

[0091] Another idea is communication via the data line, with the circuit breaker of the electronic fuse serving as the transmitting transistor. This is power line communication via the electronic fuse (E-Fuse). Spectral analysis of the load current of an electronic fuse (E-Fuse) for predictive maintenance

[0092] Another idea is to record the temporal variation of the electrical current through the circuit breaker of an electronic fuse and, if applicable, the temporal variation of the voltage between a terminal of the circuit breaker and a reference potential. Preferably, a device performs a spectral analysis of this data from the electronic fuse. In the event of significant deviations from expected values, the evaluating device can draw conclusions that can be used, among other things, by the user and / or workshops for preventive maintenance of the vehicle. Check system availability across the spectrum at the electronic fuse (E-Fuse), expected characteristics (positive test)

[0093] Similarly, using the determined spectra, the evaluating device can check system availability across the spectrum at the electronic fuse. If the spectral characteristics match the expected values ​​within the permitted bandwidths, the load in question is likely available. This is therefore a positive test. Reduction of the inrush current

[0094] Another idea is to stagger the closing of the circuit breakers of the electronic fuses during system startup, rather than simultaneously. This ensures that the electrical devices connected to the respective electronic fuses do not start simultaneously. This reduces the so-called inrush current by shifting and desynchronizing the startup curves of the supply sub-grids. Limiting voltage drops

[0095] Preferably, the electronic fuses not only measure the electrical current through their circuit breakers, but also the voltage at a terminal of the circuit breaker against a reference potential. A voltage drop caused by a short circuit in a supply sub-network, for example, is particularly dangerous. Therefore, an electronic fuse preferably switches off particularly quickly in the event of a voltage drop in the measured voltage values ​​and a simultaneous current increase. This prevents interference with the vehicle's sensors. Such an electronic fuse is therefore a device for limiting the voltage drop in the event of faults in the voltage system of the individual network. The electronic fuse preferably switches off quickly enough that the voltage does not drop too far, so that such an event does not disrupt other systems or only minimally.Under such tripping conditions, an electronic fuse preferably trips the circuit breaker faster than 1 µs, thus opening it. The tripping can also depend on the time derivative of the voltage change (dU / dt sensitivity). Accident insurance

[0096] Preferably, the higher-level computer system uses electronic fuses to shut down unused or dangerous power subsystems by sending corresponding commands to electronic fuses via the data bus if a higher-level computer system of the vehicle has concluded that an accident involving the vehicle is likely. This involves shutting down vehicle systems using one or more electronic fuses before a predicted accident occurs, whereby the determined probability of such an accident should be above a threshold. Expectation of high electricity consumption

[0097] Similarly, a higher-level computer system, such as a control unit, can open one or more circuit breakers, one or more electronic fuses, or one or more subtrees of the supply network via a data bus if, for whatever reason, this higher-level computer system expects increased power consumption from another device. This eliminates the disconnected electrical loads, and their now unused energy margin in the overall energy budget is then available to this other device with the expected increased power consumption. This is therefore a preventative shutdown of electrical loads when high power consumption from the other device is expected. Shutdown of systems according to voltage level

[0098] The document presented here proposes that the electronic fuses measure the voltage between a first terminal of the circuit breaker, which is preferably located on the power source side, and a reference potential using suitable measuring equipment. Since it is usually already known during vehicle design which consumers, with which function and with what importance this function, supply the supply network with electrical energy via which supply line to which electronic fuse, it is sensible for the control devices of the electronic fuses to compare the measured voltage values ​​with predetermined thresholds and open the circuit breaker of the electronic fuse if these thresholds are undershot. This results in the vehicle's electrical consumers being switched off depending on the voltage level. At very low voltage levels, the vehicle then preferably only operates the most necessary systems.This allows the vehicle to provide the minimum functionalities until the last second when a minimum amount of energy is still available. Limiting the voltage drop

[0099] A key requirement is limiting voltage drops. This is achieved by the speed of the circuit breaker's tripping action. For an electronic fuse with a voltage trip, this tripping occurs in the range of µs. Backup data bus in electric cars

[0100] Today's electric cars typically use supply networks with voltages below 50V (low-voltage networks) and supply networks with voltages above 50V (high-voltage networks). A problem arises because the electronic fuses must be able to communicate across the domain boundaries of the low-voltage and high-voltage networks via data buses. If optical data buses are not used, it is advisable to provide a data bus with galvanic isolation, for example, through transformers, at the domain boundary between an high-voltage supply network and a low-voltage supply network. This then constitutes a fuse data bus with potential isolation between the low-voltage and high-voltage networks. Cascading

[0101] Cascading electronic fuses is particularly advantageous. This cascading allows, for example, the division of a supply line into different sub-supply lines. Preferably, the more important consumers are located in the part of the supply line closer to the power source, while the less important consumers are located in the part farther from the power source. If one of the less important consumers fails and disrupts the power distribution via the supply line, an electronic fuse inserted into the supply line can disconnect this active part of the supply line and thus keep the other devices operational. Using more than one electronic fuse can reduce the number of unnecessarily disconnected consumers. The document presented here thus discloses the chaining of at least two or more electronic fuses.The advantage of this is that new designs can provide thinner cables than supply lines in different sections of a supply line. This means that the required tripping times of the electronic fuses can vary depending on the position of the electronic fuse. If the distance to the power source is greater, the corresponding electronic fuse should trip more quickly. Therefore, the tripping characteristics of the respective electronic fuse should preferably be adapted to the position of this electronic fuse in the supply network. Electronic fuse with timer or counter

[0102] The electronic fuse preferably comprises a timer or counter, which, for example, enables the synchronization of measurements as described above. Furthermore, the electronic fuse preferably also comprises elements for debouncing the electronic fuse. Kirchhoff's equations

[0103] Preferably, various electronic fuses at different points in the supply network determine, for example, current and / or voltage, as described above. The control devices preferably time-stamp these measured values ​​based on the reading of an internal counter or an internal clock. Alternatively, these clocks can be synchronized, and a higher-level computer system tells the control devices of the electronic fuses when the measurements should be taken. Such data can be used, for example, to detect small leakage currents from supply lines to other electrical nodes in the vehicle. Electronic fuses without a computer core

[0104] It is conceivable that not all control devices of all electronic fuses have a processor core. This means that, as a rule, the processor core of another electronic fuse controls the control device of such a slimmed-down electronic fuse without a processor core. Since communication between the processor core of the controlling electronic fuse and the control device of the electronic fuse without a processor core can be lost, this slimmed-down version of an electronic fuse without a processor core preferably has fail-safe properties that allow this electronic fuse to ensure at least basic protection of the connected supply line. Functionality signaling (alive signaling)

[0105] As already mentioned, it is useful for the electronic fuses to send a signal to a control device via a fuse data bus, if present, indicating that a) the corresponding electronic fuse is still present and b) is operational. This is called "alive" signaling on the fuse data bus.

[0106] It is advantageous if the backup data bus is differential. This results in increased robustness against ground offset. Reverse polarity protection is also useful to ensure robustness against negative voltages at the inputs and outputs of the control device. Examples of data buses with such common-mode robustness are the PSI5 data bus and the LVDS data bus.

[0107] The backup data bus preferably has a collision detection feature to detect bus collisions. The data bus protocol for operating the data bus can also use a time-slicing method for bus arbitration. Fuse simulation

[0108] Simulating a fuse using an electronic fuse is particularly useful. This simulation is preferably based on a temperature-energy simulation.

[0109] In the example shown in the figure above, an input amplifier measures the voltage drop across a shunt resistor, which converts the current through the supply line into a measurement voltage. A subsequent analog-to-digital converter converts this value into a digital signal. This value is then squared and integrated. Additional filters may follow. In the example above, several comparators compare the values ​​against thresholds. Temperature estimation of the pipes

[0110] As described above, the computer core of the control device of an electronic fuse preferably performs a temperature estimation of the protected supply line. Quantum random number generator

[0111] The quantum random number generator of the fuse control device, which the fuse's computer core can address via the internal data bus, preferably has at least one first SPAD diode and at least one second SPAD diode, and at least one optical fiber. Such a quantum random number generator can, for example, also be located in the higher-level computer system of the supply network. The quantum random number generator is preferably a quantum process-based true random number generator (QRNG). The quantum process-based true random number generator (QRNG) preferably comprises a first SPAD diode as a light source for an optical quantum signal and a second SPAD diode as a photodetector for the optical quantum signal. Furthermore, the quantum process-based true random number generator (QRNG) preferably comprises at least the processing circuit and the optical fiber.Preferably, the at least one optical waveguide optically couples the at least one first SPAD diode to the at least one second SPAD diode. An operating circuit, preferably in the form of said power supply, supplies the first SPAD diode with electrical energy such that the first SPAD diode emits light. The emission of light requires that the power supply (operating circuit) provides a sufficient electrical bias to the first SPAD diode. A processing circuit detects the signal from the second SPAD diode and generates the random number therefrom. The processing circuit then preferably makes the random number thus generated available to one or more of the one or more computer cores of control circuits of fuses in the supply network and / or the higher-level computer system of the supply network and optionally to other devices in the supply network and / or in the vehicle via a data bus.

[0112] The fuse control circuit is preferably implemented monolithically as a microintegrated CMOS circuit. A semiconductor crystal, preferably a silicon crystal, preferably comprises the control circuit and, if appropriate, the shunt resistor for measuring the current through the fuse's auxiliary circuit breaker.

[0113] The semiconductor crystal preferably has a surface. Typically, the semiconductor crystal has a semiconducting material beneath its surface. Particularly when using conventional semiconductor circuit manufacturing processes, such as CMOS processes, bipolar processes, and BiCMOS processes, the surface of the semiconductor crystal typically has a metallization stack as structured metal layers and electrical insulation layers. The structured metal layers, for example made of aluminum or copper or the like, typically form the conductor tracks, which are electrically separated from one another by the optically transparent insulation layers, for example made of silicon dioxide or the like. Thus, the metallization stack has one or more typically structured and optically transparent and electrically insulating layers as insulation layers.At least some of these typically structured, transparent, and electrically insulating layers, and at least parts of these surface layers, preferably form the optical waveguide for optically connecting the first SPAD diode to the second SPAD diode. The first SPAD diode typically radiates light from the semiconducting material of the semiconductor substrate into this optical waveguide. This means that, in contrast to the prior art, the first SPAD diode generally radiates perpendicular to the surface of the semiconductor material, essentially upwards, rather than sideways into the semiconductor substrate of the semiconductor crystal, which exhibits high attenuation. Nevertheless, the emission of photons from the first SPAD diode is not directed in the optical waveguide. In particular, the emission via the substrate of the semiconductor material is very attenuated, since visible light has a very high absorption in the semiconductor material.By designing the optical waveguide within the metallization stack of the microintegrated circuit, the device can couple more photons from the first SPAD diode directly to the second SPAD diode and radiate them into the second SPAD diode. The optical waveguide transports these photons from the first SPAD diode to the second SPAD diode with virtually no loss compared to the prior art. The optical waveguide irradiates the second SPAD diode with these photons from the first SPAD diode in such a way that the light from within the optical waveguide re-penetrates the semiconducting material of the semiconductor substrate from the surface and strikes device components of the second SPAD diode. The second SPAD diode then generates a receive signal depending on the irradiation with these photons.

[0114] Typically, at least one operating circuit, for example the voltage supply of the fuse control circuit, supplies the at least one first SPAD diode with electrical energy at least temporarily. When supplied with sufficient electrical energy, the at least one first SPAD diode then feeds photons into the at least one optical fiber. The optical fiber then transports these photons further. The at least one optical fiber then radiates the transported photons as essentially perpendicularly moving photons into the second SPAD diode. Since this transport of photons from the first SPAD diode 54 to the second SPAD diode loses significantly fewer photons due to the low attenuation in the optical fiber than in the prior art design that uses the highly absorbing semiconductor substrate, the quantum efficiency is massively higher.This increases the bit rate at which the device can generate random numbers. Therefore, in the design presented here, a pair consisting of a single first SPAD diode and a single second SPAD diode is sufficient. The state of the art always uses multiple SPAD diodes. Secure software download

[0115] The document presented here also describes a system for a vehicle that enables software programs, in particular third-party software programs, to be securely executed in the vehicle's power network, specifically in the power network's electronic fuses. Furthermore, the invention relates to a method for executing software programs in these electronic fuses.

[0116] When integrating a software program into the control device for securing a power network and / or into the higher-level computer system of a vehicle's power network, it must be ensured that the software program does not compromise the security of the power network. On the other hand, it may be necessary to protect at least parts of the software program (e.g., parts containing confidential information, such as billing data, activation codes, encrypted program commands, and encrypted configuration and access data) from unauthorized read and / or write access. These requirements can lead to a relatively high integration effort.

[0117] This document therefore also deals with the technical task of providing a system and a method that enable a flexible and secure integration of software programs into control devices of fuses of a power supply network and / or a higher-level computer system of a power supply network of a vehicle.

[0118] The document presented here describes a system for providing an application using a software program in a supply network. The application can, for example, be designed to network the vehicle with a server 710 of a service provider and / or with an electronic device (e.g., a smartphone) outside the vehicle via the higher-level computer system of the supply network or another data interface in the supply network. Furthermore, the application can be designed to automatically integrate the supply network and / or supply subnetworks into a service (e.g., activation of specific consumers, etc.). The software program can be provided by a server 710 of a service provider for the respective service / equipment variant of the vehicle.

[0119] The system comprises a first hardware platform and a second hardware platform. The first hardware platform and the second hardware platform may comprise separate computers to provide particularly reliable isolation between the two hardware platforms. For example, the first hardware platform may be part of a higher-level computer system of the vehicle's power network. Alternatively, the second hardware platform may be separate from the vehicle's higher-level computer system, in particular from an operating system of the higher-level computer system of the power network. Typically, the second hardware platform is a control device for a backup of the power network.

[0120] Alternatively or additionally, the second hardware platform can comprise a non-volatile memory (e.g., for storing data) and / or a volatile memory (e.g., for operating a software module) that is separate from the first hardware platform. Furthermore, the memory of the second hardware platform, i.e., the backup control device, can be protected by one or more security measures. The memory of the backup control device can be protected by one or more security measures that are not used to protect the first hardware platform. The memory (both the runtime memory and the storage memory) of the second backup control device can be protected by one or more security measures in such a way that the memory cannot be manipulated from the outside (or by an insecure application).

[0121] The fuse control device is subject to one or more security measures to which the first hardware platform is not subject. The one or more security measures can, for example, include a review of the software code of a software module executed on the fuse control device by the control device's processor core. In particular, the software code can be reviewed by a vehicle manufacturer and / or by a unit of the fuse control device that is separate from the provider of the software program. This ensures that no safety-relevant data is released by a software module on the fuse control device and / or no safety-relevant function (of the supply network) is compromised.Alternatively or additionally, the one or more security measures may include a restriction of data that can be transferred to or from a software module running on the security control device. Thus, the flow of data to and / or from the security control device can be restricted.

[0122] The software program comprises at least one basic module and at least one safety-relevant module. The safety-relevant module accesses safety-relevant data and / or a safety-relevant function. On the other hand, the basic module typically does not access safety-relevant data and / or a safety-relevant function, or only does so via defined interfaces. The software program can thus be divided into one or more safety-critical parts and one or more non-safety-critical parts.

[0123] The base module (i.e., the one or more non-safety-critical parts) can then be executed on the first HW platform, and the safety-relevant module (i.e., the one or more safety-critical parts) can be executed on the control device of the fuse.

[0124] The system thus makes it possible to provide software programs for applications in a vehicle's supply network in a reliable, safe and efficient manner.

[0125] The at least one safety-relevant module (i.e., the one or more safety-critical parts) preferably comprises 20%, 10%, or less of the software code of the software program, and the at least one basic module (i.e., the one or more non-safety-critical parts) preferably comprises 80%, 90%, or more of the software code of the software program. Thus, the one or more safety measures relating to the control device of the security system can be implemented efficiently.

[0126] The first hardware platform is preferably designed such that a software module (i.e., a base module) running on the first hardware platform has no access to a safety-relevant function of the supply network, or only has access via a defined interface. On the other hand, the control device of the fuse is preferably designed such that a software module running on the control device of the fuse has access to a safety-relevant function of the supply network. This enables reliable, secure execution of software programs in the supply network.

[0127] The base module can be configured to call the safety-relevant module when the software program is executed and to initiate execution of the safety-relevant module on the fuse control device. During the execution of the software program, data can be transferred from the base module to the safety-relevant module. Furthermore, data can be transferred from the safety-relevant module to the base module. The safety-relevant module can have a standardized interface via which the data can be transferred to or from the safety-relevant module. This enables secure execution of software programs from external software providers in a fuse control device. In particular, this makes it possible to mix fuses from different manufacturers in a vehicle's power supply network.

[0128] According to a further aspect, a method for executing a software program in a supply network is described. The method comprises executing a basic module of the software program on a first hardware platform, for example, the higher-level computer system of the vehicle. Furthermore, the method comprises calling, from the basic module, a safety-relevant module of the software program, wherein the safety-relevant module accesses safety-relevant data and / or a safety-relevant function. The method further comprises executing the safety-relevant module on a control device for the vehicle's security system, wherein the control device for the security system is subject to one or more security measures to which the first hardware platform is not subject.

[0129] According to a further aspect, a vehicle (in particular a road vehicle, e.g. a passenger car, a truck or a motorcycle) is described which comprises the supply network described in this document.

[0130] As stated at the beginning, this document deals with the flexible and secure integration of software programs for different applications on a vehicle's hardware platform.

[0131] A software program for an application can, for example, be installed on a user's smartphone, and the smartphone can be connected to the vehicle via a data connection. Alternatively, a software program can be installed and executed directly on a vehicle's control unit (e.g. the head unit). Both of these options have disadvantages. For example, a user may not want to install software from possibly unknown providers on a personal smartphone. On the other hand, the direct integration of software programs on the higher-level computer system of a vehicle typically requires high integration effort. In this case, complete control and / or verification of the installed software may not be possible due to the high complexity. Furthermore, the security of data from a software program within a head unit may not be sufficiently guaranteed.

[0132] It is therefore proposed to provide a trusted environment (i.e., a secure ecosystem) for third-party software in a vehicle. By providing such a trusted environment, an external provider of a software program can be assured that security-relevant parts of the software program (e.g., cryptographic keys) are protected from access. Furthermore, it can be efficiently ensured that a software program from an external provider does not compromise the security of the vehicle. Fire protection

[0133] If the power transistor 17 undergoes a breakdown, the power transistor 17 is no longer switchable and may remain conductive with a significant residual resistance. For example, if the load is a resistive load that, for whatever reason, does not switch off or is not yet switched off even when the voltage is reduced, a large amount of power can be dissipated in the power switch 17. This can lead to plasma development and / or a fire. This is particularly possible if, for whatever reason, flammable contaminants come into contact with the power switch and / or the fuse housing 535, which is typically heated up.

[0134] The document presented here therefore proposes an electronic fuse 1 with a first terminal 18 and a second terminal 19 and with a circuit breaker 17 with a first terminal (26) of the circuit breaker 17 and with a second terminal 28 of the circuit breaker 17. The circuit breaker 17 is electrically connected with its first terminal 26 to the first terminal 18 of the electronic fuse 1 and with its second terminal 28 to the second terminal 19 of the electronic fuse 1. A thermal fuse 5710, 5740 is then inserted into the current path between the first terminal 18 of the fuse 1 and the second terminal 19 of the fuse 1 for additional protection.The thermal fuse 5710, 5740 interrupts the current path between the first terminal 18 of the fuse 1 and the second terminal 19 of the fuse 1 when the temperature of the circuit breaker 17 and / or the temperature within the housing 535 of the fuse 1 and / or the temperature of the housing 535 of the fuse 1 exceeds a cut-off temperature. The fuse can be a thermal fuse 5740 or a temperature switch 5710, with a thermal fuse 5740 being preferred because it does not switch on again after tripping. The fuse has a temperature effective path 5720 between the circuit breaker 17 and the fuse 5710, 5740 with a preferably low thermal resistance, so that the temperature of the circuit breaker 17 can change a switching state of the fuse 5710, 5740, so that an excess temperature leads to the switching off of the fuse 5710, 5740.This temperature effect path can, for example, be a direct thermal contact between the power switch 17 and the temperature switch 5710 and / or a thermal bridge in the form of a common heat sink or the like.

[0135] The proposed fuse 1 preferably comprises a control device 4 which detects the switching state of the fuse 5710, 5740, for example by means of a temperature switch / thermal fuse monitoring device 5750 of the control device 4.

[0136] The control device 4 preferably signals a detected state of the fuse 5710, 5740 (e.g. closed / open) and / or data derived from this data, in particular alarms, to a higher-level computer system 12 and / or the server 710 of a service provider and / or the server 710 of an automobile manufacturer or the like or to a terminal 740 of a user 730 and / or to a terminal 740 of the fire department or a server 710 of the fire department or similar rescue services via a data bus of the supply network 200, of which the electronic fuse 1 is a part, wherein this signaling can be modified by other computers in the signaling path if necessary.

[0137] The supply network 200 and / or the fuse can, for example, be part of a vehicle with regard to this idea of ​​fire protection by means of an additional fuse 5710, 5740.

[0138] For example, a computer core 2 of the control device 4 of a fuse 1 in the supply network 200 and / or a higher-level computer system 12 in the supply network 200 and / or another computer in the said vehicle can determine the position of the supply network or the vehicle by means of a position detection system, for example by means of a GPS sensor, and / or other information present in the supply network.This computer core 2 of the control device 4 of that fuse 1 in the supply network 200 and / or the higher-level computer system 12 in the supply network 200 and / or the mentioned other computer in the said vehicle can then signal this position information to the higher-level computer system 12 and / or the server 710 of a service provider and / or the server 710 of the automobile manufacturer or the like or to the terminal 740 of the user 730 and / or to the terminal 740 of the fire department or the server 710 of the fire department or similar rescue forces according to claim 6. List of characters Fig. 1 shows a simplified and schematic system 50 comprising electronic fuse 1, data bus 9 and higher-level computer system 12. According to the proposal, the electronic fuse 1 preferably comprises a circuit breaker 17 and a control device 4 which controls this circuit breaker 17. Fig. 2 shows a simplified and exemplary supply network 200 with electronic fuses. Fig. 3 shows a data bus system with a dashed data bus 9 for the exemplary supply network 200 of the Fig. 2. Fig. 4 shows a simplified schematic of an exemplary fuse box 400 with slots 410 and 420 for accommodating electronic fuses 405 and fusible links 415. Fig. 5 is based on the Fig. 1 and represents a modification of the Fig. 1, where fuse 1 of the Fig. 5 additionally comprises a first test current source 505 which feeds an electrical test current 515 into the first terminal 26 of the circuit breaker 17 of the fuse 1. Fig. 6 essentially corresponds to the Fig. 1, wherein the control device 4 of the fuse 1 of the Fig. 4 has an additional second data interface 610. Fig. 7 corresponds in essential parts to the Fig. 3, wherein the data bus 9 is designed as an annular data bus ring 9'. Fig. 8 corresponds in the most important parts of the Fig. 4, where the supply sub-network of the Fig. 8 comprises a further fuse 805, a second further fuse 810, a first connected distribution tree 815, a second connected distribution tree 820, an electronic fuse 825, consumers 830 and further consumers 835. Fig. 9 time a fuse 1, which is opposite to the fuse 1 of the Fig. 5 in addition to the first test current source 505, a second test current source 905, the test current 915 of which is modulated by means of the control signal 910 with a modulation signal {505} of a second signal generator 920. Fig. 10 shows a proposed energy source-side crossing protection 1000. Fig. 11 shows a proposed supply network 1100 with a higher-level computer system 12 and with a plurality of supply lines and with a plurality of intersection protection devices 1110 to 1118, which enable a flexible load- and supply-dependent reconfiguration of the supply network 1100. Fig. 12 shows the basic flow of a method 1200 for operating a supply network. Fig. 13 outlines a method 1300 for operating a vehicle (consumer-side feature version). Fig. 14 also shows a further simplified method 1400 for operating a vehicle by activating energy sources in the vehicle. Fig. 15 largely corresponds to the Fig. 8, but now the supply network is divided into a first supply sub-network and a second supply sub-network. Fig. 16 shows a simplified schematic and exemplary method 1600 for detecting non-extinguishing arcs 1510 in the wiring harness 1515 of a vehicle. The Fig. 17 essentially corresponds to the Fig. 7, wherein here the third supply line section 245 is separated into the third supply line section 245 and the fourth supply line section 246. Fig. 18 schematically illustrates an exemplary method 1800 for operating a supply network 1700 of the Fig. 17. Fig. 19 corresponds in essential parts to the Fig. 15 and the Fig. 10, whereby during Fig. 10 shows a fuse box 1000, Fig. 19 shows two wires 1915 and 1505 to be protected, which are parts of a wiring harness 1515. Fig. 20 schematically and simplified describes a distributed measuring method 2000 for detecting the condition of a wiring harness 1515 of a vehicle in accordance with the representation of the Fig. 19. Fig. 21 shows a simplified schematic of a proposed battery 2100 with diagnostic function for a vehicle using supply networks 200 as described in the document presented here in the preceding figures. Fig. 22 corresponds to the Fig. 21 with the difference that the first electronic fuse 825 has an additional contact 2210 in order to bypass the current 2121 through the first fuse 825 in the event of an incorrect sign of the current 2121 to the electrochemical battery cell 2145. Fig. 23 shows a battery cell module 2300 comprising at least one battery cell 2145 and / or an interconnection of battery cells, a first power switch 17, a second power switch 17', a first electrical node 2120, a second electrical node 2135, a third electrical node 2140, a first battery cell terminal 2305 and a second battery cell terminal 2310. Fig. 24 corresponds to the Fig. 6, whereby fuse 1 of the Fig. 24 has a second circuit breaker 17'. The Fig. 25 corresponds to the battery of Fig. 22, where the Fig. 25 shows a battery cell module 2500 with several battery cells 2145, 2185. Fig. 26 shows a packaged battery cell module 2600 with a common housing 2605 of the battery cell module 2600 for an electronic fuse 825 and an inner battery cell module 2105. Fig. 27 shows a battery 2700 in which an electronic fuse 825 of the battery 2200 has a second power switch 17' which is suitable for bridging the battery cell module 2105 associated with the fuse when the second power switch 17' is closed and in which the control device is supplied from the battery cell 2145, but only when the power switch 17 is closed. Fig. 28 shows a battery 2800 in which an electronic fuse 825 of the battery 2200 has a second power switch 17' which is suitable for bridging the battery cell module 2105 associated with the fuse when the second power switch 17' is closed and in which the control device 4 continues to be supplied from the battery cell 2145 even when the power switch 17 is open. Fig. 29 shows a supply network 2900, wherein one or more supply branches of the supply network 2900 for supplying electrical consumers 2930 to 2933 with electrical energy are designed as a ring of a supply line 2910 to 2915, in particular when a body serves as a return ground line, and / or as two rings of two supply lines. Fig. 30 corresponds to the Fig. 29 with the difference that energy sources and consumers are pluggable. Fig. Figure 31 shows a schematic and simplified representation of a supply network 3100, which essentially corresponds to the supply network 3000 of the Fig. 30, whereby the plug connections are now protected with their own fuses. Fig. 32 corresponds in large part to the Fig. 11, with the supply network 3200 of the Fig. 32 has a first partial supply network 3201 and a second partial supply network 3202. Fig. 33 shows a supply network 3300 similar Fig. 31 to explain the prioritization of consumers and energy sources and a favorable topology of the supply network 3300 to support this prioritization. Fig. 34 illustrates, by way of example and in a simplified manner, a method 3400 for active power management in a supply network 1100 (see Fig. 11) with electrical fuses 1110 to 1118 for supplying electrical consumers 1121 to 1125 in this supply network 1100 with electrical energy from one or more electrical energy sources 1150 to 1155. Fig. 35 illustrates in a simplified and schematic manner a method 3500 for operating a vehicle with equipment variants, wherein the activation and deactivation of the equipment variants of the vehicle is preferably carried out at least in part by means of the supply network and by means of the electronic fuses and their circuit breakers 17. Fig. 36 is intended to represent possible levels of a data protocol on the data bus 9 of the supply network 200. Fig. 37 shows the current protection of the cable of a supply line section. Fig. Figure 38 shows the advantages of protecting a section of supply line with an electronic fuse; Fig. Figure 39 shows the combination of two proposed SPAD diodes in cross section. Fig. 40 shows the combination of two proposed SPAD diodes in cross section, with several insulation layers now forming the optical waveguide 44. Fig. 41 shows the integration of the SPAD diodes and the optical fiber into an evaluation and operating circuit Fig. 42 corresponds to the Fig. 41, which is now supplemented by monitoring circuits. Fig. 43 shows a typical output signal of the second SPAD diode. Fig. 44 shows an exemplary oscillogram of the voltage signal 4104 of the entropy source 4101. Fig. Figure 45 shows the schematic flow of a server-client communication using a proposed quantum random number generator. Fig. 46 shows the schematic flow of the functions KeyExchangeServer() and KeyExchangeClient(). Fig. 47 shows the schematic flow of the function setPrimes(). The Fig. 48 shows the schematic flow of the function setE(). Fig. 49 shows the schematic flow of the findD() function. Fig. 50 shows the schematic sequence of a secure transmission of quantum-based random numbers between a computer core 2 of the control device 4 of the backup 1 (server) and a computer core 2 of the control device 4 of the other backup 1 (client). Fig. 51 schematically shows the proposed method 5200 for generating a quantum random number. Fig. 52 time a general quadruple fuse with only one control device 4. Fig. 53 shows the general quadruple fuse of the Fig. 52 as a general triple fuse, whereby the three circuit breakers 17, 17' and 17'' are connected in star, so that they can be used, for example, as triple fuse 3010' of the Fig. 31 can be used. Fig. 54 shows the general quadruple fuse of the Fig. 52 where the four circuit breakers 17, 17', 17'' and 17''' are connected to the cross fuse 1000. Fig. Figure 55a shows an exemplary system for integrating software programs. Fig. Figure 55b shows an example structure of a software program. Fig. 56 shows a flowchart of an exemplary method for executing a SW program in a vehicle. Fig. 57 corresponds to the Fig. 24, whereby for a better overview the test current sources and their controls are not shown and whereby in Fig. 57 a temperature switch 5710 is inserted into the current path between the first terminal 18 of the fuse 1 and the second terminal of the fuse 1. Fig. 58 corresponds to the Fig. 24, whereby for a better overview the test current sources and their controls are not shown and whereby, unlike in the Fig. 57 fuse 1 uses a thermal fuse 5740 instead of a thermal switch 5710. Fig. 59 corresponds to an application of the multiple protection 1 of the Fig. 52 to protect the three motor phases of an example three-phase motor. Description of the other figuresFigure 1

[0139] Fig. Figure 1 shows a simplified and schematic system 50 comprising electronic fuse 1, data bus 9, and higher-level computer system 12. According to the proposal, electronic fuse 1 preferably comprises a power switch 17 and a control device 4 that controls this power switch 17. The power switch 17 is preferably a MOS transistor or the like. Other semiconductor components such as thyristors, bipolar transistors, thyristors, etc. are conceivable, but are currently less common.

[0140] The power transistor 17 can be integrated with device components of the control device 4 in a semiconductor substrate. However, different technologies are preferably used for the power switch 17 and the control device 4. The control device 4 is preferably manufactured using CMOS technology. The power switch 17 is preferably manufactured using MOS technology for power transistors or another semiconductor technology for power transistors. The shunt resistor 24 can be integrated both with the control device 4 on a common semiconductor substrate and with the power switch 17 on a common substrate.

[0141] In the Fig. 1 For the sake of clarity, not all useful and possibly common device components are shown. Further device components that the reader may consider to be potentially Fig. 1 can be found, for example, in the Fig. 5, Fig. 6, Fig. 9, Fig. 24, Fig. 41, Fig. 42, Fig. 52, Fig. 53, Fig. 54, Fig. 55, Fig. 57, Fig. 58. The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

[0142] The higher-level computer system 12 exchanges data with the control device 4 via the data bus 9. Typically, the higher-level computer system 4 queries status data of the electronic fuse 1 via the data bus 9 and a data bus interface 10 from a computer core 2 of the control device 4 of the electronic fuse 1. In doing so, the computer core 2 preferably accesses the peripheral components of the control device 4 via an internal data bus 11. These peripheral components can include, for example, but are not limited to, the data bus interface 10, a watchdog 13, non-volatile memory 14, volatile read / write memory 15, and a gate control circuit 16 for controlling and monitoring the circuit breaker 17.

[0143] The one gate control circuit 16 preferably monitors and controls the power switch 17. A control line 20 for controlling the power switch 17 preferably connects the gate control circuit 16 to the first terminal of the power switch 17. The gate control circuit 16 preferably controls the switching state of the power switch 17 by means of the control line 20. The gate control circuit 16 preferably detects one or more voltages between the first terminal 26 of the power switch 17 and / or the second terminal 28 of the power switch 17 and / or the control terminal 27 of the power switch 17 on the one hand and a reference potential 201 on the other hand. The gate control circuit 16 preferably detects one or more voltages between the first terminal 26 of the power switch 17 and / or the second terminal 28 of the power switch 17 and / or the control terminal 27 of the power switch 17 among one another.The electronic fuse 1 preferably comprises an auxiliary circuit breaker 23. The auxiliary circuit breaker 23 preferably serves to detect a current that is proportional to the current through the circuit breaker 17 or otherwise corresponds. The electronic fuse 1 preferably comprises a shunt resistor 24. The magnitude of the value of the electrical current 36 through the shunt resistor 24 and the auxiliary circuit breaker 23 is typically proportional to the magnitude of the electrical current 29 through the circuit breaker 17. A measuring line 25 serves to detect the voltage drop across the shunt resistor 24. A monitoring line 21 serves to detect the voltage between the second terminal 19 of the circuit breaker 17 and the control line 20 of the circuit breaker 17. The gate drive circuit 16 preferably detects the voltage drop across the shunt resistor 24 using the measuring line 25 and a monitoring line 21.Typically, the computer 2 of the control device 4 of the electronic fuse 1 controls the circuit breaker 17 as a function of the values ​​of these voltages thus detected and as a function of commands which the computer 2 of the control device 4 receives, for example, from a higher-level computer system 12, for example via the said data bus 9.

[0144] For the purposes of this document, the first terminal 18 of the electronic fuse 1 is preferably the energy source-side terminal of the electronic fuse. For the purposes of this document, the second terminal 19 of the electronic fuse 1 is preferably the load-side terminal of the electronic fuse. Since loads such as motors often recover energy rather than consume it in certain operating situations, such as braking, this assignment may be reversed during operation. Therefore, it is only an idea of ​​the predominant use of the first terminal 18 of the fuse 1 and the second terminal 19 of the fuse 1.

[0145] A watchdog 13 is preferably used to monitor the microcontroller, i.e., the computer 2. In the simplest case, the watchdog is a timer that counts, for example, with the system clock of the control device 4. Typically, the computer 2 signals the watchdog 13 at more or less regular intervals that it is still functional. Preferably, with each signal from the computer 2, the watchdog 13 resets its counter reading to a predetermined start value. However, if the watchdog 13 reaches a predetermined watchdog threshold, the watchdog 13 typically assumes that the computer 2 is interfering with the execution of the operating program. The watchdog 13 then typically takes countermeasures. One countermeasure can, for example, be resetting the program execution of the computer 2 to a predetermined program start address. Another countermeasure can be stopping the computer 2.Another countermeasure may be opening the circuit breaker 17. Another countermeasure may, for example, be signaling the watchdog 13 to a higher-level computer system 12 via the internal data bus 11, the data interface 10, and the external data bus 9. Typically, the computer 2 of the control device 4 of the electronic fuse 1 can configure the watchdog 13 via the internal data bus 11 using registers of the watchdog 13 and read the status of the watchdog 13 via watchdog registers.

[0146] The non-volatile memory 14 can comprise, for example, a flash memory, an EEPROM, a ROM, or the like. The non-volatile memory 14 preferably comprises data and / or program code. The computer 2 of the electronic security device 1 preferably accesses this data and the program code via the internal data bus 11. In particular, the data in the non-volatile memory 14 preferably also comprises configuration data of the electronic security device 2.

[0147] Furthermore, the proposed electronic security device 1 preferably comprises a volatile random access memory 15. The volatile random access memory 15 can be, for example, a RAM, an SRAM, a DRAM, an FRAM, an MRAM, or the like. The computer 2 of the electronic security device 1 preferably uses this volatile random access memory 15 for buffering intermediate results.

[0148] An oscillator 30 with a clock supply preferably generates the system clock of the control device 4 of the electronic fuse 1. Preferably, the higher-level computer system 12 can access the configuration registers of the oscillator 30 and the clock supply via the internal data bus 11 and the data bus interface 10 and the data bus 9, configure them, and read out their status. Likewise, the computer 2 can preferably access these configuration registers of the oscillator 30 and the clock supply via the internal data bus 11, configure them, and read out their status from status registers.

[0149] Preferably, the control device 4 comprises a timer and / or a clock of the control device 4. The computer 2 can then combine measured values ​​of the gate control circuit 16 for controlling and monitoring the power switch 17 with a time stamp from a time value of the timer 16 and measured values ​​of voltages and / or other physical parameters, etc.

[0150] For example, a temperature measuring device 40 can determine the temperature of the control device 4 and / or the temperature of device parts of the control device 4. The control device 4 of the fuse 1 can also comprise an analog-to-digital converter 570, which is illustrated by way of example in a subsequent figure. For example, such an analog-to-digital converter can provide a measuring line to a temperature sensor (not illustrated here for clarity), via which the analog-to-digital converter 570 can determine the temperature of the circuit breaker 17 or other device parts of the fuse 1 and make it available to the computer 2 via the data bus 11. For this purpose, this temperature sensor is preferably thermally closely coupled to the circuit breaker 17. The temperature sensor is preferably a sub-device of the circuit breaker 17.The electronic fuse may have multiple temperature sensors, whose measured value signals can be detected by the analog-to-digital converter 570 and made available to the computer 2. For example, the temperature sensor can also detect the temperature of the line at the first terminal 18 or the second terminal 19 of the electronic fuse 1.

[0151] The electronic fuse 1 preferably has a power supply 5 for the control device 4 and the operation of any other device components of the electronic fuse 1. A line for the operating voltage 6 and a line for the reference potential 201 preferably supply the electronic fuse 1 with electrical energy. It is also conceivable for the electronic fuse to draw its energy from the first terminal 18 and / or the second terminal 19 on the one hand and the reference potential line 201 on the other. During normal operation, the power supply 5 preferably charges an energy reserve 8. This is typically a capacitor and / or an accumulator or the like.

[0152] In the event of a power failure via the operating voltage 6, the energy reserve 8 supplies the control device 4 and thus the circuit breaker 17 with the necessary power via an emergency power supply 7. In the event of such a failure, the power supply 5 preferably disconnects the operating voltage 6 and, if applicable, also the reference potential 201 using isolating switches to prevent the energy reserve 8 from discharging.

[0153] Preferably, the voltage supply 5 comprises the necessary voltage regulators and / or voltage converters in order to provide the voltages required by the control device 4 from the energy reserve 8 or from the operating voltage 6 for the operation of the control device 4.

[0154] The control device 4 presented here for operating an electronic fuse 1 of a vehicle preferably has a system-based chip functionality. This system-based chip functionality provides all the functions required to operate a microcontroller as the computer core 2 in the control device 4 of the electronic fuse 1 and at least one data interface 1, so that the computer core 2 can reliably transmit at least errors and / or malfunctions of the control device 4 and / or other device components of the fuse to a higher-level computer system 12 via the data bus 9. This system-based chip functionality includes a boost converter 5 for supplying voltage to the safety-relevant device components of the control device 4 of the fuse 1 and for charging and, if necessary, discharging an internal or external energy reserve 8. The energy reserve 8 can comprise an accumulator and / or a capacitor.In normal operation, the boost converter 5 preferably prepares an externally provided operating voltage 6 from one or more external energy sources and makes the necessary internal operating voltages available to the device components of the control device 4 and / or other device components of the fuse 1. The computer core 2 of the control device 4 of the fuse 1 monitors the operating voltage 6 of the boost converter 5, for example by means of an analog-to-digital converter 570. The computer core 2 of the control device 4 of the fuse 1 switches to emergency operation in the event of a failure of the externally provided operating voltage 6. In such emergency operation, the boost converter 5 preferably supplies the control device 4 and / or other device components of the fuse, insofar as this is absolutely necessary, with electrical energy from the energy reserve 8. In normal operation, the boost converter 5 charges the energy reserve 8 with electrical energy.In emergency operation, the energy reserve 8 takes over the energy supply of the control device 4 of the fuse 1. Thus, in emergency operation, the boost converter 5 and / or a functionally equivalent second voltage control device provide an emergency energy supply 7 of the safety-relevant device parts of the control device 4 of the fuse 1 and / or the fuse 1. Figure 2

[0155] Fig. Figure 2 shows a simplified and exemplary supply network 200 with electronic fuses. The supply network shows the reference potential node 201 only symbolically. The reference potential node can be, for example, the body ground of a metal vehicle body or the like. The proposed supply network therefore uses, for example, an electrically conductive vehicle body as an electrical return line. This electrical return line is in the example of the Fig. 2 the reference potential node 201. The reference potential node 201 is typically the ground of the vehicle. In the figures of this document, the reference potential node 201 is not always shown for clarity and is not always designated by the reference symbol. The circuit symbol for ground designates the reference potential node 2021 in the figures of this document when it is shown in a figure. The supply network 200 has, in the example of Fig. Two different device parts (210 to 213) are used. These typically consume electrical energy.

[0156] A first fuse 214 of the first device part 210 of the supply network 200 protects the first line section 240 and the consumers connected to it in the form of further, dependent device parts (220 to 223) of the supply network 200. The first fuse 214 preferably corresponds in its internal structure to an electrical fuse of the Fig. 1. In the example of Fig. 2, the first fuse 214 can electrically connect the third line section 245 to the first line section 240 by means of its power switch 17 or can locally separate the third line section (245) from the first line section 240 by means of its power switch 17. Typically, the first fuse 214 is connected to a data bus 9, which for simplification in the Fig. 1 is not shown. Fig. 3 shows an example wiring of the data bus 9, which is also shown in Fig. 1 would be applicable.

[0157] A second fuse 215 of the second device part 211 of the supply network 200 protects the first line section 240 and the consumers connected to it in the form of further, dependent device parts (220 to 223) of the supply network 200. The second fuse 215 preferably corresponds in its internal structure to an electrical fuse of the Fig. 1. In the example of Fig. 2, the second fuse 215 can electrically connect the third line section 245 to the first line section 240 by means of its power switch 17 or locally disconnect the third line section 245 from the first line section 240 by means of its power switch 17. Typically, the second fuse 215 is connected to a data bus 9, which for simplification in the Fig. 1 is not shown. Fig. 3 shows an example wiring of the data bus 9, which is also shown in Fig. 1 would be applicable.

[0158] A third fuse 216 of the third device part 212 of the supply network 200 protects the second line section 241 and the consumers connected to it in the form of further, dependent device parts (230 to 233) of the supply network 200. The third fuse 216 preferably corresponds in its internal structure to an electrical fuse of the Fig. 1. In the example of Fig. 2, the third fuse 216 can electrically connect the third line section 245 to the second line section 241 by means of its power switch 17 or locally separate the third line section 245 from the second line section 241 by means of its power switch 17. Typically, the third fuse 216 is connected to a data bus 9, which for simplification in the Fig. 1 is not shown. Fig. 3 shows an example wiring of the data bus 9, which is also shown in Fig. 1 would be applicable.

[0159] A fourth fuse 217 of the fourth device part 213 of the supply network 200 protects the second line section 241 and the consumers connected to it in the form of further, dependent device parts (230 to 233) of the supply network 200. The fourth fuse 217 preferably corresponds in its internal structure to an electrical fuse of the Fig. 1. In the example of Fig. 2, the fourth fuse 217 can electrically connect the third line section 245 to the second line section 241 by means of its power switch 17 or locally disconnect the third line section 245 from the second line section 241 by means of its power switch 17. Typically, the fourth fuse 217 is connected to a data bus 9, which for simplification in the Fig. 1 is not shown. Fig. 3 shows an example wiring of the data bus 9, which is also shown in Fig. 1 would be applicable.

[0160] When connecting the first fuse 214 in parallel with the second fuse 215, as in the example of Fig. 1, the circuit breakers 17 of both fuses (214, 215) must be open to separate the first line section 240 from the third line section 245. If the first line section 240 is separated from the third line section 245 by open circuit breakers 17, the first energy source 250 and the second energy source 251 no longer supply the other device parts (220 to 223) with electrical energy. If the first line section 240 is electrically connected to the third line section 245 via closed circuit breakers 17, the first energy source 250 and the second energy source 251 supply the other device parts (220 to 223) with electrical energy when these energy sources (250, 251) feed energy into the third line section 245.

[0161] When connecting the third fuse 216 in parallel with the fourth fuse 217, as in the example of Fig. 1, the circuit breakers 17 of both fuses (216, 217) must be open to separate the first line section 240 from the third line section 245. If the second line section 241 is separated from the third line section 245 by open circuit breakers 17, the first energy source 250 and the second energy source 251 no longer supply the other device parts (230 to 233) with electrical energy. If the second line section 241 is electrically connected to the third line section 245 via closed circuit breakers 17, the first energy source 250 and the second energy source 251 supply the other device parts (230 to 233) with electrical energy when these energy sources (250, 251) feed energy into the third line section 245.

[0162] A fifth fuse 225 can separate the fifth device part 220 of the supply network 200 from the first line section 240 by means of its circuit breaker 17 and thus prevent a power supply to the fifth device part 220 or connect the fifth device part 220 of the supply network 200 to the first line section 240 by means of its circuit breaker 17 and thus enable a power supply to the fifth device part 220.

[0163] A sixth fuse 226 can separate the sixth device part 221 of the supply network 200 from the first line section 240 by means of its circuit breaker 17 and thus prevent a power supply to the sixth device part 221 or connect the sixth device part 221 of the supply network 200 to the first line section 240 by means of its circuit breaker 17 and thus enable a power supply to the sixth device part 221.

[0164] A seventh fuse 227 can separate the seventh device part 222 of the supply network 200 from the first line section 240 by means of its circuit breaker 17 and thus prevent a power supply to the seventh device part 222 or connect the seventh device part 222 of the supply network 200 to the first line section 240 by means of its circuit breaker 17 and thus enable a power supply to the seventh device part 222.

[0165] An eighth fuse 228 can separate the eighth device part 223 of the supply network 200 from the first line section 240 by means of its circuit breaker 17 and thus prevent a power supply to the eighth device part 223 or connect the eighth device part 223 of the supply network 200 to the first line section 240 by means of its circuit breaker 17 and thus enable a power supply to the eighth device part 223.

[0166] A ninth fuse 235 can separate the ninth device part 230 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent a power supply to the ninth device part 230 or connect the ninth device part 230 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus enable a power supply to the ninth device part 230.

[0167] A tenth fuse 236 can separate the tenth device part 231 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent a power supply to the tenth device part 231 or connect the tenth device part 231 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus enable a power supply to the tenth device part 231.

[0168] An eleventh fuse 237 can separate the eleventh device part 232 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent a power supply to the eleventh device part 232 or connect the eleventh device part 232 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus enable a power supply to the eleventh device part 232.

[0169] A twelfth fuse 238 can separate the twelfth device part 233 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent a power supply to the twelfth device part 232 or connect the twelfth device part 233 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus enable a power supply to the twelfth device part 233.

[0170] A thirteenth fuse 255 can separate the twelfth device part 233 of the supply network 200 from the second line section 241 by means of its circuit breaker 17 and thus prevent a power supply to the twelfth device part 232 or connect the twelfth device part 233 of the supply network 200 to the second line section 241 by means of its circuit breaker 17 and thus enable a power supply to the twelfth device part 233.

[0171] A thirteenth fuse 255 can disconnect the first energy source 250 of the supply network 200 from the third line section 245 by means of its circuit breaker 17 or connect the first energy source 250 of the supply network 200 to the third line section 245 by means of its circuit breaker 17. As a result, the thirteenth fuse 255 can prevent the energy supply of the sub-networks connected to the first energy source 250, here the device parts 210 to 213 and 220 to 223 and 230 to 233, by the first energy source 250 by opening the first circuit breaker 17 of the thirteenth fuse 255 or enable the energy supply of the sub-networks connected to the first energy source 250, here the device parts 210 to 213 and 220 to 223 and 230 to 233, by the first energy source 250 by closing the first circuit breaker 17 of the thirteenth fuse 255.

[0172] A fourteenth fuse 256 can disconnect the second energy source 251 of the supply network 200 from the third line section 245 by means of its circuit breaker 17 or connect the first energy source 251 of the supply network 200 to the third line section 245 by means of its circuit breaker 17. As a result, the fourteenth fuse 256 can prevent the energy supply of the sub-networks connected to the second energy source 251, here the device parts 210 to 213 and 220 to 223 and 230 to 233, by the second energy source 251 by opening the first circuit breaker 17 of the fourteenth fuse 256 or enable the energy supply of the sub-networks connected to the second energy source 251, here the device parts 210 to 213 and 220 to 223 and 230 to 233, by the second energy source 251 by closing the first circuit breaker 17 of the fourteenth fuse 256.

[0173] In the Fig. 2, the third device part 212 is provided with a plug-in option 262 for the third electronic fuse 216 of the third device part 212. This allows, for example, a workshop to manually replace the third electronic fuse 216, for example, in the event of a fuse failure. If the plug-in option is designed to be compatible with fuses, a workshop can, for example, replace the third electronic fuse 216 with a fuse. Conversely, the workshop can, for example, replace a fuse located in the plug-in option 262 with a third electronic fuse 216.

[0174] Preferably, all devices 210 to 213 and 220 to 223 and 230 to 233 would be provided with a plug-in option for an electronic fuse, such as the plug-in option 262 for the electronic fuse 216 of the third device part 212. The disadvantage is that such plug-in connections typically lead to reduced reliability. Figure 3

[0175] Fig. 3 shows a data bus system with a dashed data bus 9 for the exemplary supply network 200 of the Fig. 2. Each of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 preferably corresponds to an electronic fuse according to the Fig. 1. Therefore, each of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 typically comprises a control device 4 with a data interface 10. These control devices 4 are shown in the Fig. 3, for example, are provided with separate reference numerals 280 to 293 for each electronic fuse 214 to 217 and 225 to 228 and 235 to 238. The higher-level computer system 12 preferably communicates via the respective data interface 10 of the respective control device 4 of the respective electronic fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 with the respective computer core 2 of the respective fuse. This respective computer core 2 of the respective fuse can open or close the power switch 17 of the respective fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 by means of the gate control circuit 16.Preferably, the higher-level computer system 12 can, by means of a data message to a computer core 2 of a control device 4 of a fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238, cause this computer core 2 to open or close the circuit breaker 17 of this electronic fuse by means of control signals to the gate control circuit 16 of the respective electronic fuse. Preferably, the computer cores 2 of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 of the supply network 200 record operating parameters of the associated electronic fuse using aids (16, 520, 530, 525, 23, 24, 21, 25, 505, 905, 920, etc.). A first particularly important parameter is typically the electrical current 29 through the circuit breaker 17 of the respective electronic fuse.Preferably, some sub-devices of the electronic fuse record a current measurement value of this electrical current or model an electrical current that is proportional to this electrical current 29 through the circuit breaker 17. Another important parameter that the computer cores 2 of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 determine, preferably with further auxiliary devices of these fuses, in each case in a fuse-specific manner is preferably the voltage between the first terminal 18 of the respective electronic fuse and the reference potential 201 and / or the voltage between the second terminal 19 of the respective electronic fuse and the reference potential and / or further voltages between internal electrical nodes and / or external electrical nodes of the respective electronic fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238.Preferably, the computer cores 2 of the control devices 4 of some or, better, all of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238 transmit some or all of these measured values ​​to the higher-level computer system 2 via the data bus 9. The higher-level computer system 12 can then evaluate this data. For example, the higher-level computer system is then able to determine the voltage drop across a line section of the line sections 240 to 245 by applying Kirchhoff's meshes and node rules. To avoid a ground offset when the body is used as a return line for the electrical current, it is advantageous if the reference potential line is essentially current-free. However, such an additional reference potential line cannot usually be implemented for cost reasons.It is therefore useful if one or more, or better yet, each of the fuses is configured to detect a ground offset of the reference potential line 201, for example, by detecting a resting potential of the data bus 9 at times when the data bus is not in use. It is obvious that a control device 4 of a fuse of the electronic fuses 214 to 217 and 225 to 228 and 235 to 238, with its computer core 2, can assume the role of the higher-level computer system 12. In this case, it would be different from the . Fig. 3, a separate higher-level computer system 12 is no longer necessary.

[0176] In contrast to the exemplary Fig. 2, the first device part 210 now feeds the first line section 240, which only supplies the fifth device part 220 and the sixth device part 221 with electrical energy from the energy sources 250 and 251 via the first fuse 214 of the first device part 210.

[0177] In contrast to the exemplary Fig. 2, the second device part 211 now feeds a fourth line section 242, which, instead of the first line section 240, now supplies the seventh device part 222 and the eighth device part 223 with electrical energy from the energy sources 250 and 251 via the second fuse 215 of the second device part 211.

[0178] In contrast to the exemplary Fig. 2, the third device part 212 now feeds the second line section 241, which now only supplies the ninth device part 230 and the tenth device part 231 with electrical energy from the energy sources 250 and 251 via the third fuse 216 of the third device part 212.

[0179] In contrast to the exemplary Fig. 2, the fourth device part 213 now feeds a fifth line section 243, which, instead of the second line section 241, now supplies the eleventh device part 232 and the twelfth device part 233 with electrical energy from the energy sources 250 and 251 via the fourth fuse 217 of the fourth device part 213.

[0180] If a single circuit breaker 17 of a single circuit breaker of the fuses 214 to 217 is opened by its computer core 2 of its control device 4, the energy sources 250 and 251 no longer supply electrical energy to the subnetwork downstream of this fuse. Preferably, the fuses have a standby capability that allows a limited supply of electrical energy for the purpose of standby operation. Figure 4

[0181] Fig. 4 shows a simplified schematic of an exemplary fuse box 400 with slots 410 and 420 for accommodating electronic fuses 405 and fusible links 415. A slot 410 for an electronic fuse 405 preferably has a first contact 430 for the first terminal 18 of the circuit breaker 17 of the electronic fuse 405 that can be plugged in there. The slot 410 for an electronic fuse 405 further preferably has a second contact 435 for the operating voltage terminal 6 of the electronic fuse 405. The prerequisite here is that the electronic fuse 405 does not derive the operating voltage for its operation from the potential at its first terminal 18 of its circuit breaker 17. In this case, the second contact 435 is not necessary, since this function can then be performed by the first contact 430.The slot 410 for an electronic fuse 405 preferably further comprises a third contact 475 for the reference potential connection 201 of the electronic fuse 405. The slot 410 for an electronic fuse 405 preferably further comprises a fourth contact 440 for connecting the external data bus 9 of the electronic fuse 405. In the example of the . Fig. 9, the data bus 9 is a so-called single-wire data bus, in which the return line of the data bus is typically identical to the reference potential line 201. The data bus 9 presented here is therefore typically a fuse data bus 9 or a fuse data bus 9. In the automotive sector, the data bus 9 is, for example, a LIN data bus 9 or a DSI3 data bus 9 or a PSI5 data bus 9 or a CAN data bus 9 or a CAN-FD data bus 9 or an Ethernet data bus or a Flexray data bus 9 or an LVDS data bus 9 or some other wired or wireless data transmission path, for example via a Bluetooth or WLAN data connection or an optical data connection (540). The data communication of the computer core 2 of the control device 4 of the fuse 1 takes place via a wired or wireless interface (610, 10, 551, 550).

[0182] It is particularly conceivable that the data bus 9 is a differential data bus 9. In this case, the contact 440 of the data bus 9 actually comprises a first electrical contact for the first line of the differential two-wire data bus and a second electrical contact for the second line of the differential two-wire data bus. Such a differential two-wire data bus can, for example, be a CAN data bus and / or a CAN-FD data bus, which is used as the data bus 9. Since the CAN data bus protocol or the CAN-FD data bus protocol requires a very good local oscillator, the use of a CAN data bus or a CAN-FD data bus would lead to increased effort for clock generation in each individual fuse, which would cause the costs of such a data bus system to explode.The document presented here therefore proposes the use of a CAN physical layer with a special backup data protocol for such a case of a differential backup data bus 9. For this purpose, the higher-level computer system 12 signals a synchronization signal to the oscillators 30 of the control devices 4 of the electronic fuses 405 via the data bus 9. The synchronization signal is preferably a so-called clock run-in, in which, for example, a higher-level computer system sends a predefined alternating 1-0 bit sequence from the higher-level computer system 12, for example, to one or more or all of the control devices 4 of the electronic fuses 405 of the supply network 200 for a short time. (In the . Fig. 2 and Fig. 3, these would be the electronic fuses 214 to 217 and 225 to 225 and 235 to 238 and 255 and 256). The control devices 4 synchronize their oscillators 30, preferably in terms of frequency and phase position, to this synchronization signal. A data packet preferably has a start signal. Typically, the start signal is designed such that it is recognized by the data interface 10 of the control device 4 of an electronic fuse 405 even if the local oscillator 30 of the electronic fuse concerned by the control device 4 is not synchronous with the oscillator of the higher-level computer system 12. The oscillators 30 of the control devices 4 of the fuses 405 each provide the control devices 4, of which these oscillators 30 are a part, with at least one respective clock for operating this respective control device 4.

[0183] Typically, the data interface 10 or another sub-device of the control device 4 of an electronic fuse 405 generates a sampling clock from this clock, which the data interface 10 uses to sample the logical values ​​on the data bus 9 when it receives data via the data bus from the higher-level computer system or from the control device 4 of another fuse or another device connected to the data bus 9. The transmitting bus participant preferably sends the data via the data bus as a data packet with m data bits. Such a data packet preferably begins with a start signal. With the detection of the start signal by a data interface 10 of a fuse 405, the synchronization phase for the oscillator 30 of this fuse 405 begins. After synchronization of the oscillator 30, the control device 4 preferably freezes the frequency and phase control of its oscillator 30.The data interface 10 then samples the following bits until the end of the data packet at a constant frequency and phase of the clock of the oscillator 30 of the control device 4. The data interface 10 of the control device 4 of a fuse 405 preferably detects the end of the data packet using a stop symbol at the end of the data packet. The data interface preferably detects the end of the synchronization phase using a start symbol. This is preferably a predefined bit sequence. The data interface preferably allows the detection of such a start symbol only a predetermined time after the start of the synchronization phase. The control of the frequency and phase of the oscillator 30 of a control device 4 of an electronic fuse 405 preferably ends with this time elapse. The generation of the sampling clock of the data interface 10 is based on this clock of the oscillator 30.The document presented here accordingly discloses a device for controlling electrical and / or electronic data interfaces 10 of control devices 4 of fuses of a supply network 200, comprising a serial, bidirectional, differential data bus 9 and n data interfaces 10 of n control devices 4 of n fuses, where n is a positive integer greater than 1, and a higher-level computer system 12. The serial, bidirectional, differential data bus 9 comprises a first single-wire data bus and a second single-wire data bus. The voltage value between the first single-wire data bus and the second single-wire data bus typically represents any logical information transmitted—the datum present, if any. Preferably, each of the n fuses comprises at least one differential, serial data bus interface 10 as part of its respective control device 4.Each control device 4 of each of these fuses preferably comprises an oscillator 30 that generates a fuse-specific clock CLKj for operating the control device 4 of this fuse—here referred to as the jth fuse. Preferably, the respective data interface 10 of a control device 4 of a fuse comprises a sampling device that samples the data bus 9 with a sampling clock, which is preferably derived from the clock of the oscillator 30 of the control device 4 of this fuse. Preferably, the control device 4 of a fuse comprises an address recognition unit and a fuse address register. For example, the data bus interface 10 or the computer core 2 can comprise the fuse address register. The serial, bidirectional, differential data bus 9 can preferably be in at least a first differential logical state (high, z1) and a second differential logical state (low, z2).The serial data bus interface 10 of the control device 4 of the at least one of the n fuses is connected to the serial, bidirectional, differential data bus 9 in order to send data via this serial, bidirectional, differential data bus 9 and / or to receive data via this data bus 9 from other computer cores 2 of other control devices 4 of other fuses or a higher-level computer system 12. Typically, the higher-level control device 12 also receives control commands for controlling the n fuses from external sources. Typically, the higher-level control device 12 converts these externally initiated control commands into bit streams and bus stream packets BP to be sent via the serial, bidirectional, differential data bus 9 to the computer cores 2 of the control devices 4 of the fuses via their data bus interfaces 10.The higher-level computer system 12 then typically sends the bits of the bit streams and bit stream packets to be sent by the higher-level computer system 12 via the serial, bidirectional, differential data bus 9 as a function of a clock CLK within the higher-level computer system 12. The higher-level computer system 12 receives bit streams and / or bit stream packets BP generated by the computer cores 2 of the control devices 4 of the electronic fuses via the serial, bidirectional, differential data bus 9. The respective oscillator 30 of the respective control device 4 of the respective fuse typically generates a respective sampling signal CLKAj for the respective data bus interface 10 of the control device 4 of the respective fuse from the respective clock of the respective oscillator 30 of the respective control device 4 of the respective fuse.The sampling device ATj of the respective data bus interface 10 of the respective control device 4 of the respective fuse then samples the bit streams and / or bit stream packets BP sent via the serial, bidirectional, differential data bus 9, preferably as a function of its respective sampling signal CLKAj of the oscillator 30 of the control device 4 of this fuse, in order to obtain a local bit stream from the received bit stream and / or bit stream packet BP in the respective control device 4 of the respective electronic fuse. The higher-level computer system 12 preferably sends the bit streams to be sent as sequences of bits in bit stream packets (frames, BP). According to the technical teaching of the document presented here, the bit stream packets BP comprise a temporal sequence of m individual bits of the bit stream packet BP with the same temporal length t. B . Here, m is a positive integer. The time length t Bthe individual bits varies by no more than a factor of + / - (0.4 / m)*t B within a bit stream packet BP. After the end of the synchronization phase for a bit stream packet, the sampling device of the data bus interface 10 of a control device 4 of a fuse samples the individual bits on the data bus 9, preferably at their temporal center. Thereafter, the control of the frequency and phase position of the clock signal generated by the oscillator 10 and / or of the sampling signal CLKj is frozen for the remainder of the reception of the bit stream packet BP. Preferably, the temporal length of m periods of the sampling signal CLKj deviates by no more than + / - (0.4 / m)*t B of length m*t Bof m individual bits of a received bit stream packet, so that the sampling device of the data bus interface 10 of the control device 4 of the electronic security also samples the last individual bit in accordance with the assignment and a double sampling of an individual bit or a non-sampling of an individual bit does not occur. To make this possible, preferably at least some of the bit stream packets BP sent by the higher-level computer system 12 have the following contents (see also Fig. 36): • A start signal START in the form of i bits with i as an integer positive with i-1>m of the m bits of the respective bit stream packet BP with a second differential logic state z2 on the serial, bidirectional, differential data bus 9; • a synchronization information SYNC consisting of k synchronization bits, with k as a positive integer and k <m / 3, zur Synchronisation des jeweiligen Abtastsignals CLKAj der jeweiligen Abtastvorrichtung der jeweiligen Datenbusschnittstelle 10 der jeweiligen Steuervorrichtung 4 der jeweiligen elektronischen Sicherung und / oder des jeweiligen Oszillators 30 der jeweiligen Steuervorrichtung 4 der jeweiligen Sicherung mit dem Takt CLK des übergeordneten Rechnersystems 12; • Data information DATA from the remaining bits of the mik bits of the m bits of the respective bit stream packet BP, wherein the data information preferably comprises DATA address information ADRD and payload information INFO and check information CHKD.

[0184] The check information CHKD can, for example, be CRC checksums and / or parity bits. At least part of the payload information INFO preferably includes configuration information ILD. This configuration information ILD can, for example, include threshold values ​​and values ​​of shutdown thresholds, which can, for example, determine when the computer core 2 of a control device 4 of an electronic fuse opens or closes the circuit breaker 17 of this electronic fuse. The higher-level computer system 12 preferably transmits configuration commands to the computer cores 2 of the control devices 4 of the fuses via the fuse data bus 9 using this configuration information ILD.For example, such configuration commands can depend on a determined energy demand of consumers in subnetworks of the supply network 200 and on a determined energy delivery capacity of energy sources in subnetworks of the supply network 200. Such configuration commands in this configuration information ILD can, for example, cause the opening and closing of circuit breakers 17 of electronic fuses of the supply network 200 by the computer cores 2 of these electronic fuses. Preferably, the higher-level computer system 12 dynamically adapts the electrically effective topology of the supply network 200 of the supply lines according to the determined energy demand and / or the determined energy delivery capacity and / or the current safety requirement by means of such configuration commands via the fuse data bus 9 to the fuses of the supply network 200.The computer cores 2 of the control devices 4 of electronic fuses thus receive and transmit data via the data bus via their respective data interface 10 of the respective control device 4 of the respective electronic fuse. This data can include configuration information ILD, such as configuration data (write / read) and / or switching commands (write / read), but also diagnostic data (write / read), measured values ​​(read), and comparison value settings (write / read). Preferably, the data bus 9 is connected directly or indirectly, e.g., via gateways or the like, to a terminal (740) for input for reconfiguring the supply network 200 by means of the electronic fuses.In the event of a system emergency operation scenario, the higher-level computer system 12 adapts the power consumption of a load of the loads of the supply network 300 to the weakest supply line in the path between one or more energy sources of the energy sources of the supply network 200, on the one hand, and this load of the loads, on the other hand, by reconfiguring or changing the operating parameters of this load. Furthermore, in the event of a system emergency operation scenario, the higher-level computer system 12 adapts the power delivery capacity of an energy source of the energy sources of the supply network 200 to the weakest supply line in the path between this energy source of the energy sources of the supply network 200, on the one hand, and loads of the loads of the supply network 200, on the other hand, by reconfiguring or changing the operating parameters of this energy source of the energy sources of the supply network 200.The higher-level computer system 12 initiates a configuration change of the supply network 200 by sending corresponding commands via one or more data buses 9 to electronic fuses of the supply network 200. The higher-level computer system 12 preferably first determines how much energy a consumer of the supply network 200 affected by the configuration change of the supply network 200 may consume in order to avoid overloading the supply network 200 at any point. The higher-level computer system 12 then preferably informs this consumer of the supply network 200 how much energy this consumer of the supply network 200 may consume from the supply network 200.Second, the higher-level computer system 12 preferably determines how much energy a power source of the power source of the power sources of the supply network 200 that is affected by the configuration change of the supply network 200 is allowed to supply in order to avoid overloading the supply network 200 at any point. The higher-level computer system 12 preferably informs this respective power source of the power sources of the supply network 200 how much energy this power source of the power sources of the supply network 200 is allowed to supply.

[0185] Thus, the configuration information ILD is preferably used to control the energy supply to the device parts and to control the energy consumption from the energy sources and to control the load on the supply lines of the supply network 200. This control is carried out in accordance with the technical teaching of the document presented here by the computer core 2 of a control device 4 of an electronic fuse of the supply network 200, preferably as a function of this configuration information ILD of a bit stream packet BP, if the logical content of the address information ADRD of this bit stream packet BP matches the content of the fuse address register of the computer core 2 or the data bus interface 10 of the control device 4 of the fuse. In this case, the respective address recognition units of the respective data bus interfaces 10 orThe processor cores 2 of the control devices 4 of the electronic fuses read the address information ADRD of the bit stream packets BP and only allow the respective processor core 2 of the respective control device 4 of the respective fuse to use the payload information INFO contained in the respective bit stream packet BP if the content of the address information ADRD of the bit stream packet BP corresponds to the current content of the fuse address register of the respective fuse. Preferably, the control devices 4 of the electronic fuses and their data interfaces 10 comprise means for performing an auto-addressing method to fill the fuse address register with a logical fuse address that corresponds to the physical position of this fuse within the serial, bidirectional, differential data bus 9.Preferably, the higher-level computer system 12 and / or computer cores 2 of fuse control devices 4 conclude that an oscillator 30 of one or more fuses is not operating correctly based on the evaluation of the received CHKD test information. These fuses then adjust their oscillators 30 if necessary. Preferably, the oscillators 30 of the control devices 4 of the fuses 405 of a supply network 200 each exhibit a frequency stability after synchronization of these oscillators 30 with the synchronization signal SYNC in the synchronization phase that is sufficiently high that such an error should not occur in the CRC check.

[0186] Preferably, the slot 410 of an electronic fuse 405 of the fuse box 400 has a first contact 430 for the first terminal 18 of the circuit breaker 17 of the electronic fuse 405. This first contact 430 is preferably connected to the energy source 250 via the third supply line section 245 for supplying energy to the corresponding supply line 485 protected by this fuse 405. The first contact 430 of the slot 410 for the electronic fuse 405 preferably serves to connect the first terminal 18 of the electronic fuse 405. The first contact 450 of the fuse body 425 corresponds to the first contact 430 of the slot 410 of the electronic fuse 405 of the fuse box 400. The first contact 450 of the fuse body 425 serves to connect the first terminal 18 of the electronic fuse 405.

[0187] Preferably, the slot 410 of an electronic fuse 405 of the fuse box 400 has a second contact 445 for the second terminal 19 of the circuit breaker 17 of the electronic fuse 405. This second contact 445 is preferably electrically connected to the corresponding output 485 of the fuse box 400 for supplying a consumer of the supply network 200 via a subsequent supply line section of the supply line sections (240 to 243) of the supply network 200. The second contact 445 of the slot 410 for the electronic fuse 405 preferably serves to connect the second terminal 19 of the electronic fuse 405. The second contact 470 of the fuse body 425 corresponds to the second contact 445 of the slot 410 of the electronic fuse 405 of the fuse box 400. The second contact 470 of the fuse body 425 serves to connect the second terminal 19 of the electronic fuse 405.

[0188] Preferably, the slot 410 of an electronic fuse 405 of the fuse box 400 has a third contact 440 for connecting the data bus 9 of the data bus interface 10 of the control device 4 of the electronic fuse 405. This third contact 440 is preferably connected to the data bus 9 of the fuse box 400 and the supply network 200. The third contact 440 of the slot 410 for the electronic fuse 405 preferably serves to connect the data bus 9 to the data bus interface 10 of the control device 4 of the electronic fuse 405. The third contact 465 of the fuse body 425 corresponds to the third contact 440 of the slot 410 of the electronic fuse 405 of the fuse box 400. The third contact 465 of the fuse body 425 serves to connect the data bus 9 of the supply network 200 to the data interface 10 of the control device 4 of the electronic fuse 405.

[0189] Preferably, the slot 410 of an electronic fuse 405 of the fuse box 400 has a fourth contact 435 for connecting a supply voltage line for supplying power to the control device 4 of the electronic fuse 405. This fourth contact 435 is preferably electrically connected to the supply voltage line for supplying power to the control device 4 of the electronic fuse 405. The supply voltage line is connected, for example, to a power source 250 via a third supply line section 245. The fourth contact 435 of the slot 410 for the electronic fuse 405 preferably serves to connect the supply voltage line for supplying power to the control device 4 of the electronic fuse 405. The fourth contact 455 of the fuse body 425 corresponds to the fourth contact 435 of the slot 410 of the electronic fuse 405 of the fuse box 400.The fourth contact 455 of the fuse body 425 serves to connect the energy source 250 by means of the exemplary third supply line section 245 to the supply voltage line for supplying energy to the control device 4 of the electronic fuse 405.

[0190] Preferably, the slot 410 of an electronic fuse 405 of the fuse box 400 has a fifth contact 475 for connecting a supply voltage line 201—here, the reference potential line 201—for supplying power to the control device 4 of the electronic fuse 405. This fifth contact 475 is preferably electrically connected to the supply voltage line 201 for supplying power to the control device 4 of the electronic fuse 405. The supply voltage line—here, the reference potential line 201—is connected, for example, via the vehicle body to the power source 250. The fifth contact 475 of the slot 410 for the electronic fuse 405 preferably serves to connect the second supply voltage line—here, the reference potential line 201—for supplying power to the control device 4 of the electronic fuse 405.The fifth contact 460 of the fuse body 425 corresponds to the fifth contact 475 of the slot 410 of the electronic fuse 405 of the fuse box 400. The fifth contact 460 of the fuse body 425 serves to connect the reference potential line 201 of the energy source 250 to the supply voltage line - here the reference potential line 201 - for supplying energy to the control device 4 of the electronic fuse 405. The fifth contact 460 of the fuse body 425 preferably serves as a reference potential point for the control device 4 of the electronic fuse 405.

[0191] An operating voltage source 480 for operating the control devices 4 of the electronic fuses 405 feeds the electrical energy for operating the control devices 4 of the fuses 405 into the supply voltage line for the operating voltage 6. The body ground of the reference potential line 201 preferably serves as the return line here.

[0192] Preferably, the slots 420 for the fuses 415 are designed such that they are at least mechanically compatible with the slots 410. Preferably, the slots 410 for the electronic fuses 405 are designed such that manufacturing and / or maintenance and / or repair work can alternatively equip them with conventional fuses 415. Preferably, the fuses 415 are designed such that they fit mechanically and preferably also electrically into a slot 410 for an electronic fuse 405.

[0193] The electronic fuses 405 are preferably designed such that they also fit mechanically into a slot 420 for a conventional fuse. In the event that such a slot 420 for a conventional fuse 415 does not have contacts 435, 475 for supplying the electronic fuse 405 with electrical energy, the electronic fuse 405 must have an energy reserve 8, which must be provided with energy before the electronic fuse 405 is installed in the plug connection 420. For example, in this case, the energy reserve 8 can be a battery or an accumulator. Such an electronic fuse 405 then preferably comprises a signaling means, for example an LED, in order to be able to query the charge state at least on request via a - preferably optical - data interface 550.

[0194] The technical teaching of the document presented here proposes a fuse box 400 for a supply network 200 of a vehicle. The proposed fuse box 400 comprises electronic fuses 405 and / or slots 410 for electronic fuses 405. The proposed fuse box has fuses 415 and / or slots 420 for fuses 415. Preferably, at least one electronic fuse 405 of the electronic fuses of the proposed fuse box 400 has a first terminal 18 and a second terminal 19, wherein this at least one electronic fuse 405 is configured to emulate the behavior of a fuse 415. For this purpose, this electronic fuse preferably detects the value of the electrical current 29 through its circuit breaker 17 and determines the time integral of a polynomial of at least the second degree of this current value.The electronic fuse 405 is preferably configured to detect the current value of the magnitude of the electrical current 29 flowing through this electronic fuse 405 from the first terminal 18 to the second terminal 19 or vice versa. This electronic fuse 405 is preferably configured to determine an intermediate value from this detected current value using a polynomial of at least second degree and to integrate it over time to form an integrated intermediate value. The electronic fuse is preferably configured to prevent the flow of the current 29 between the first terminal 18 and the second terminal 19 by opening its circuit breaker 17 if the integrated intermediate value exceeds a maximum value. This corresponds to the melting of a conventional thermal fuse.The electronic fuse 405 is preferably housed in a fuse body 425 with connectors, which fits mechanically and preferably also electrically into one of the slots 410 for electronic fuses 405. Preferably, the fuse box 400 additionally comprises at least sections of the fuse data bus 9.

[0195] Preferably, a slot 410 for an electronic fuse 405 has a first contact 430 of the slot 410 and a second contact 445 of the slot 410. The first contact 430 of the slot 410 is preferably configured to establish an electrical connection between this first contact 410 of the slot 410 and a first contact 450 of a connector of a fuse body 425 in order to electrically connect the first terminal 18, 450 of the fuse 405 of the fuse body 425 to the first contact 430 of the slot 410.

[0196] The second contact 445 of the slot 410 is preferably configured to establish an electrical connection between this second contact 445 of the slot 410 and a second contact 470 of the connector 410 of the fuse body 425 in order to electrically connect the second terminal 19, 470 of the fuse 405 of the fuse body 425 to the second contact (445) of the slot 405.

[0197] Preferably, in the proposed fuse box 400, a slot 410 for an electronic fuse 405 has a third contact 440 of the slot 410, wherein the third contact 440 of the slot 405 is configured to establish an electrical connection between this third contact 440 of the slot 405 and a third contact 465 of the connector 410 of the fuse body 425 in order to electrically connect the data line 9 of the data interface 10 of a control circuit 4 of the electronic fuse 405 of the fuse body 425 to the third contact 440 of the slot 405.

[0198] The proposed fuse box 400 preferably has a slot 410 for an electronic fuse 405 with a fourth contact 435 of the slot 410. The fourth contact 435 of the slot 410 is preferably intended to establish an electrical connection between this fourth contact 435 of the slot 410 and a fourth contact 455 of the connector of the fuse body 425 in order to electrically connect a power supply of the control device 4 of the electronic fuse 405 to the fourth contact 455 of the slot 410.

[0199] The document presented here proposes a fuse body 425 of an electronic fuse 405 for a proposed fuse box 400, in which the connector of the fuse body 425 has a first contact 450 for the first terminal 18 of the electronic fuse 405 and a second contact 470 for the second terminal 19 of the electronic fuse 405. Preferably, the connector fits mechanically into at least one of the slots 410 for electronic fuses 405.

[0200] Preferably, the connector of the fuse body 425 has a third contact 465 for a fuse data bus 9, wherein the third contact 465 is electrically connected to the data line 9 of a data interface 10 for the control circuit 4 of the electronic fuse 405 of the fuse body 425.

[0201] Preferably, the connector of the fuse body 425 has at least a fourth contact 455 for a voltage supply 6 of the control device 4 of the electronic fuse 405.

[0202] The document presented here proposes a fuse 415 for a fuse box 400, in which the connector 410 of the fuse body 425 has a first contact 455 for the first terminal 18 of the fuse 415 and a second contact 470 for the second terminal 19 of the fuse 415. The connector of the fuse 415 is preferably configured to mechanically fit into at least one of the slots 410 for electronic fuses 405 and to mechanically fit into at least one of the slots 420 for fuses 415. Figure 5

[0203] The Fig. 5 is based on the Fig. 1 and represents a modification of the Fig. 1. The fuse 1 of the Fig. 5 additionally includes a first test current source 505, which feeds an electrical test current 515 into the first terminal 26 of the circuit breaker 17 of the fuse 1. The additional first electrical test current 515 is preferably provided with a first modulation signal {505} from a first signal generator 520 by means of the first control signal 510. The curly brackets indicate that {505} is the first modulation signal with which the first current 515 of the first test current source 505 is modulated.

[0204] In the Fig. For the sake of clarity, not all useful and possibly common device components are shown in Figure 5. Further device components that the reader may consider to be potentially Fig. 1 can be found, for example, in the Fig. 1, Fig. 6, Fig. 9, Fig. 24, Fig. 41, Fig. 42, Fig. 52, Fig. 53, Fig. 54, Fig. 55, Fig. 57, Fig. 58. The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

[0205] Preferably, the control device 4 comprises a first gate control 530 of the control contact 27 of the first power switch 17 and a first control signal generation for the control signal of the control line 20 of the first power switch 17 for controlling the first power switch 17. Preferably, the computer core 2 controls the first gate control 530 via the internal data bus 11.

[0206] The proposed fuse 1 preferably comprises a first correlator 525. Preferably, the computer core 2 of the control device 4 of the fuse 1 controls the first correlator 525 via the internal data bus 11. The first correlator 525 preferably comprises one or more input amplifiers that detect, filter, and condition the voltages between the first measuring contacts (21, 25, 27, 28, 22). Preferably, the first correlator 525 comprises, for example, a first synchronous demodulator that examines one of the measurable voltages for first components of the first modulation signal {505} of the first current 515 of the first test current source 505.

[0207] Preferably, the first synchronous demodulator of the first correlator uses a correlation in the form of a scalar product, for example according to the form A=〈{505}|Vxy(t)〉=∫0T{505}×Vxy(t)dt

[0208] Here A stands for the value of the first share and V xyfor a voltage between the first measuring contacts (21, 25, 27, 28, 22). Preferably, the first correlator 525 uses a voltage V xy between the second terminal 28 of the first circuit breaker 17 and the first control terminal 27 of the first circuit breaker 17. The proposed fuse 1 preferably has a housing 535 of the fuse 1. The housing 535 of the fuse 1 preferably has one or more optical windows 545 through which the control device 4 of the fuse 1 can signal other devices and / or people.

[0209] The document presented here proposes an electronic fuse 1 having a first terminal 18 and a second terminal 19. The proposed electronic fuse 1 further comprises a power switch 17 and a control device 4. The power switch 17, according to the proposal, has a first terminal 26, a control terminal 27, and a second terminal 28. It is preferably a MOS transistor. The first terminal 26 of the power switch 17 is preferably electrically connected to the first terminal 18 of the fuse 1, and the second terminal 28 of the power switch 17 is preferably electrically connected to the second terminal 19 of the fuse 1. The control terminal 27 of the power switch 17 is typically electrically connected to the control device 4.According to the proposal, the control device 4 of the electronic fuse 1 detects electrical voltages between the terminals (26, 27, 28) of the circuit breaker 17 and / or functionally equivalent values ​​of physical parameters within the fuse 1 and determines therefrom a value for an electrical current 29 through the circuit breaker 17 between the first terminal 26 of the circuit breaker 17 and the second terminal 28 of the circuit breaker 17.

[0210] The electronic fuse 1 has an electronic test current source 505, which is connected to the circuit breaker 17 in such a way that it can feed an additional current 515 into the circuit breaker 17 between the first terminal 26 of the circuit breaker 17 and the second terminal 28 of the circuit breaker 17 as a function of a first control signal 510 from the control device 4. The control device 4 preferably modulates the control signal 510 with a first modulation signal {505}. This modulation signal {505}, in turn, modulates the temporal value profile of the current value of the additional current 515. The control device 4 preferably detects or determines the temporal value profile of the current value of the electrical current 29 through the circuit breaker 17.Preferably, the control device 4 checks whether the temporal value profile of the current value of the electrical current 29 includes signal components whose modulation correlates with the modulation of the modulation signal. In order to be able to detect the component of the test current 515 modulated in this way in the current 29 through the circuit breaker 17, the control device 4 of a proposed fuse 1 preferably comprises a synchronous demodulator 525 or a functionally equivalent device, such as an optimal filter or matched filter. The synchronous demodulator 525 typically determines the correlation between the signal of the temporal value profile of the electrical current 29 through the circuit breaker 17, on the one hand, and the temporal value profile of the modulation signal {505}, on the other. For example, a synchronous demodulator 525 can determine the value of the function C. 29m = ∫I 29 (t) × M(t)dt, where I 29(t) for the value curve of the electric current 29 through the power switch 17 and M(t) for the time value curve of the modulation signal {505} and C 29m stands for the correlation value determined by the synchronous demodulator 525. Other correlation methods are conceivable. In the method proposed here, the synchronous demodulator 525 multiplies the modulation signal {505} or a signal derived therefrom or a signal that has a fixed temporal relationship with the modulation signal {505}, on the one hand, preferably with the temporal value profile I 29 (t) of the electrical current 29 or a signal derived therefrom on the other hand. The synchronous demodulator 525 then filters the signal resulting from the multiplication into a correlation signal. This filtering is preferably a low-pass filter, so that the synchronous demodulator 525 then generates the function C 29m = ∫I 29(t) × M(t)dt. At least the synchronous demodulator should exhibit the integrating effect of a low-pass filter, at least in the frequency range. The synchronous demodulator 525 or the control device 4 can be used to determine the correlation signal C 29m (t) comprise a matched filter optimized for the modulation signal {505} and / or an optimal filter and / or a Kalman filter or another estimation filter that estimates the temporal value profile I 29 (t) of the electric current 29 to the correlation signal C 29m (t)wanders.

[0211] Typically, the control device 4 switches the circuit breaker 17 to non-conductive if the sign of the electrical voltage between the first terminal 18 of the fuse 1 and the second terminal 19 of the fuse 1 does not correspond to a specified value. To do this, the control device 4 detects the electrical voltage between the first terminal 18 of the fuse 1 and the second terminal 19 of the fuse 1. For example, the computer core 2 of the control device 4 can use an analog-to-digital converter 570 to detect the potentials at the circuit breaker 17 or at an auxiliary circuit breaker 23 via corresponding measuring lines 22, 21, 25. The auxiliary circuit breaker 23 is preferably used to detect an auxiliary current that is proportional to the current through the circuit breaker (17) or corresponds in some other way.A shunt resistor 24 then enables the computer core 2 of the control device 4 of the fuse 1 to measure this auxiliary current by means of the corresponding measuring lines 25, 21 and by means of the analog-to-digital converter 570. In the . Fig. 5, the connections between the analog-to-digital converter 570 and the measuring lines 20, 21, 22, 25 are not shown for clarity. The reader should assume they are present and disclosed. Preferably, the computer core 2 of the control device 4 of the fuse 1 switches the power switch 17 non-conductive when the electrical voltage between the first terminal 18 of the fuse 1 and the second terminal 19 of the fuse 1 falls below a first preset value. Preferably, the computer core 2 of the control device 4 of the fuse 1 switches the power switch 17 non-conductive when the electrical voltage between the first terminal 18 of the fuse 1 and the second terminal 19 of the fuse 1 exceeds a second preset value. Typically, the electronic fuse 1 has a reference potential terminal 201.Preferably, the computer core 2 of the control device 4 of the fuse 1 switches the circuit breaker 17 non-conductive when the electrical voltage between the first terminal 19 of the fuse 1 and the reference potential terminal 201 of the fuse 1 falls below a third preset value. Preferably, the computer core 2 of the control device 4 of the fuse 1 switches the circuit breaker 17 non-conductive when the electrical voltage between the second terminal 19 of the fuse 1 and the reference potential terminal 201 of the fuse 1 falls below a fourth preset value. Preferably, the computer core 2 of the control device 4 of the fuse 1 switches the circuit breaker 17 non-conductive when the electrical voltage between the first terminal 18 of the fuse 1 and the reference potential terminal 201 of the fuse exceeds a fifth preset value.Preferably, the computer core 2 of the control device 4 of the fuse 1 switches the circuit breaker 17 off when the electrical voltage between the second terminal 19 of the fuse 1 and the reference potential terminal 201 of the fuse 1 exceeds a sixth preset value. The control device 4 of the electronic fuse 1 thereby ensures that the downstream supply subnetwork is operated only within a predetermined voltage range.

[0212] Preferably, the circuit breaker 17 and the control device 4 are housed in a common housing 535. This has the advantage of increasing EMC compatibility.

[0213] The control device 4 of the electronic fuse can, for example, have an optical data interface 550 in order to achieve good galvanic isolation between the protected supply line at the first terminal 18 of the fuse 1 and / or at the second terminal 19 of the fuse 1. In order to be able to control this optical data interface 550, the housing 535 preferably has an optical window 545 that allows electromagnetic radiation to enter the housing 535 and thus allows the optical data interface 550 to interact with this incoming electromagnetic radiation, so that the optical data interface 550 can receive an optically transmitted signal 540. Conversely, the optical data interface 550 can emit electromagnetic radiation 540, which can then leave the housing 535 via this optical window 545 in the housing 535 of the fuse 1.Thus, such optical windows 545 are preferably sub-devices of one or more optical data interfaces 550 of the control device 4 of the respective electronic security device 1. Such an optical window 545 thus allows the entry and / or exit of electromagnetic radiation for the transport of data from and to the control device 4 of the security device 1 and thus makes it possible for an optical interface 550 of the control device 4 of the security device 1 within the housing 535 to communicate with an optical interface 555 of another device 12, for example a higher-level computer system 12, outside the housing 535 via an optical data connection 540 via this optical window 545. Optical functional elements 580 can guide and / or design the optical data connection 540.Such optical functional elements can be deflecting functional elements such as mirrors and / or prisms and the like, and / or cross-section-modifying functional elements such as apertures and / or focusing functional elements such as lenses and / or concave mirrors, and / or light-guiding optical functional elements such as optical waveguides and the like. Such a fuse with an optical data interface 550 preferably has an optical plug connection that allows the mechanical establishment of the optical connection between the optical data bus interface 550 and the optical data connection 540. Such an optical window 545 also allows the computer core 4 of the control device 4 or the control device 4 of the fuse 1 to signal to a person by means of an optical, visible signal. For example, the fuse can emit a red light through the optical window 545 when the circuit breaker 17 is open.Likewise, the fuse 1 can emit an optical signal, perceptible to a person, via such an optical window 545, which indicates the charge level of the energy reserve 8. The electromagnetic radiation for transporting data, which the optical interface 550 emits and / or receives, is preferably laser radiation from a laser 560 or radiation from an LED 560. The document presented here therefore proposes that the proposed fuse 1 preferably comprises a laser 560 or an LED 560. The computer core 2 of the control device 4 of the fuse 1 preferably uses this laser or this LED as a transmitter of data from the optical data interface 550 of the control device 4 of the fuse 1. In certain implementations, there may be a need not to have a separate laser ornot to install a separate LED in the housing 545 of the fuse 1, but to manufacture the LED monolithically with the rest of the control circuit 4 of the fuse in a semiconductor crystal. In this case, it is particularly advantageous if the control circuit 4 of the electronic fuse 1 has a silicon-based LED 560 as the LED. Typically, the control circuit then comprises a control device 565 for operating the silicon-based LED, which provides the operating voltage for the silicon-based LED. The silicon-based LED 560 is preferably a silicon avalanche LED 560, in particular a SPAD diode 560 operated as an LED. The control device 656 preferably operates it in the reverse direction above the breakdown voltage.The control device 565 generates the necessary operating voltage for the silicon-based LED 560 from the operating voltage of the electronic fuse 1 between the terminals 6, 201 by means of a voltage converter of a power supply 5.

[0214] The optical data bus interface 550 preferably also includes an optical receiver. This optical receiver of the data bus interface 550 is preferably a photodiode. To achieve maximum synergy, it may be expedient for the control device of the electronic fuse 1 to operate the silicon-based LED 560 at least temporarily as a receiver of the optical data bus interface 550. Preferably, the computer core 2 of the control device 4 of the electronic fuse 4 can, for example, use a circuit breaker of the control device 4 of the electronic fuse 1 to disconnect the silicon LED 560 from the electrical supply of the voltage converter of the power supply 5, and thus modulate the emitted light signal of the silicon LED 560 for the purpose of data transmission or switch the silicon LED from transmitting mode to receiving mode.In receive mode, the processor core 2 preferably detects the voltage signal 575 of the silicon LED 560 using the analog-to-digital converter 570 of the control device 4 of the electronic fuse 1, thus generating a digitized input data signal. The processor core 2 of the control device 4 of the fuse 1 uses the thus detected value as the input data signal of the optical data interface 550 and extracts the data transmitted to it from this input data signal stream. Of course, the control device 4 of the electronic fuse 1 can also comprise a separate photodetector, for example, a photodiode 560, and evaluation electronics for the photodetector 560.Preferably, the electronic fuse 1 is configured so that optical fibers 580 and / or other optical functional means connect the electronic fuse 1 to one or more other electronic fuses (214 to 217, 225 to 223, 230 to 235, 225 to 256) via the respective optical data interface 550 of these electronic fuses. Preferably, a supply network 200 comprises an optical data network as a data bus 9, with which the optical data interface 555 of a higher-level computer system 12 and / or the data interfaces 550 of the control devices 4 of the fuses of the supply network 200 can communicate with each other.The proposed electronic fuse 1 is, in particular when there is an increased requirement for galvanic isolation, preferably connected via its optical interface 550 and an optical fiber 580 to an optical interface 555 of a higher-level computer system 12, for example a higher-level computer system (12), and optionally to one or more further electronic fuses (214 to 217, 225 to 223, 230 to 235, 225 to 256). In addition to the data communication via this optical data interface 550 or the wired data interface 10, the control device 4 of the fuse 1 can be connected via a further, different optical data interface 551 or other data interface 610 to a higher-level control unit and / or a higher-level computer system 12 and, if necessary, to the control devices 4 of one or more further electronic fuses (1, 214 to 217, 225 to 223, 230 to 235, 225 to 256).A typical error that occurs is overheating of the fuse 1. In this case, both the circuit breaker 17 and the control device 4 can overheat. The control device 4 of the electronic fuse preferably comprises one or more temperature sensor evaluation devices 585. The control device 4 of the fuse 1 preferably comprises a temperature sensor 586, for example a PN junction or a PTC resistor or an NTC resistor, which detects the temperature of the control device 4 of the fuse 1 and converts it into an electrical signal that the temperature sensor evaluation device 585 and / or the analog-to-digital converter 570 converts into a measured variable for the computer core 2 of the control device 4 of the electronic fuse 1.The circuit breaker 17 of the fuse 1 preferably comprises a temperature sensor 586, for example a PN junction or a PTC resistor or an NTC resistor, which detects the temperature of the circuit breaker 17 of the fuse 1 and converts it into an electrical signal that the temperature sensor evaluation device 585 and / or the analog-to-digital converter 570 converts into a measured variable for the computer core 2 of the control device 4 of the electronic fuse 1. In this way, the computer core 2 of the control device 4 of the fuse 1 can detect a thermal overload of the circuit breaker 17 and / or the control device 4 and open the circuit breaker 17 before damage occurs and / or transmit an impending overload of the circuit breaker 17 and / or the control device 4 of the fuse 1 to the higher-level computer system 12 via the data bus 9.Thus, the electronic fuse 1 preferably comprises one or more temperature sensors 586 for monitoring the safe operation of the fuse 1. The control device 4 of the fuse 1 evaluates temperature measured values ​​from the one or more temperature sensor evaluation devices 585, which measure the temperature sensors 586. The temperature sensor evaluation devices 585 record these temperature measured values ​​with the aid of temperature sensors external to the electronic control device 4 and / or with the aid of temperature sensors 586 of the electronic fuse 1.

[0215] In many applications, it is useful for the fuse 1 to have a first terminal 18 on the energy source side and a second terminal 18 on the load side. In many applications, a return of electrical energy toward the energy source is not desired. Therefore, in such applications, the electrical current 29 through the circuit breaker 17 should preferably flow only from the first terminal 18 of the fuse 1 to the second terminal 19 of the fuse 1. In this case, the electronic fuse 1 comprises means (20, 21, 22, 23, 24, 25, 525, 570) for sensing and detecting a reverse-flowing current 29. For example, the analog-to-digital converter 570 can detect the voltages of the measuring lines (20, 21, 22, 25) among each other and / or with respect to the reference potential 201 and transmit the detected values ​​to the computer core 2 of the control device 4 of the fuse 1 via the internal data bus 11.The computer core 2 of the control device 4 of the fuse 1 can then, for example, infer the value of the auxiliary current 36 through the shunt resistor 24, which the auxiliary circuit breaker 23 generates proportionally to the current 29, and thus infer the sign of the current 29. For example, the computer core 2 of the control device 4 of the fuse 1 can open the circuit breaker 1 if the estimated and / or determined sign of the electrical current 29 does not correspond to an expected sign. This can be the case, for example, if energy is impermissibly transported from the second terminal 19 of the fuse 1 to the first terminal 18 of the fuse, even though the reverse energy transport direction is the expected energy transport direction.

[0216] The computer core 2 of the control device 4 of the electronic fuse 1 then evaluates the measured values ​​of the voltages of the measuring lines (20, 21, 22, 25) thus recorded and preferably forwards the measured values ​​and / or measured values ​​derived therefrom to other computer cores 2 of other electronic fuses (1, 214 to 217, 225 to 223, 230 to 235, 225 to 256) via a fuse data bus (9, 540) or the like or to a higher-level computer system 12, for example to a higher-level computer system 12.

[0217] In many cases, it is useful for the electronic fuse 1 to comprise two data interfaces 10 and 610. The data interfaces can also be a plurality of optical data interfaces 550 and 551. It is also conceivable for the electronic fuse 1 to comprise one or more wired data interfaces 10, 610 and / or simultaneously one or more optical data interfaces 550, 551. An optical fiber 580 can, for example, connect the one electronic fuse 1 or the multiple electronic fuses (1, 214 to 217, 225 to 223, 230 to 235, 225 to 256) via the optical data interfaces 551, 550 of the one electronic fuse 1 or the multiple electronic fuses to another device 12, for example to a higher-level computer system 12, or to the computer cores 2 of the control devices 4 of other electronic fuses and / or to each other.

[0218] The electronic fuse 1 disclosed in the document presented here preferably has a control device 4 and a circuit breaker 17 as the circuit breaker of the electronic fuse 1. The computer core 2 of the control device 4 controls, by means of a gate control circuit 16 for controlling and monitoring the circuit breaker 17, whether the circuit breaker 17 is conductive and thus operates as a closed circuit breaker, or whether the circuit breaker 17 is not conductive and thus operates as an open circuit breaker. The control device 4 of the electronic fuse preferably has a data interface 10 for a fuse data bus 9. The computer core 2 of the control device 4 of the fuse 1 receives and / or transmits data messages via the fuse data bus 9 and the data interface 10.The content of these data messages determines, at least partially and at least temporarily, whether the computer core 2 of the control device 4 of the fuse 1 closes or opens the circuit breaker 17 using the gate control circuit 16. In order to prevent unwanted opening and / or closing of the circuit breaker 17, the computer core 2 of the control device 4 of the electronic fuse 1 changes the switching state of the circuit breaker 17 based on a data message only if the control device 4 receives a data message with a password. For this purpose, the bit stream packet BP, which preferably contains the data message in the data part INFO, firstly includes the configuration data ILD and secondly, a password for authenticating this command. The computer core 2 compares the received password with an expected password in a predetermined method or otherwise verifies the validity of the received password.If the result of this verification is such that the password is valid, the computer core 2 of the control device 4 of the fuse 2 executes the received command and opens or closes the circuit breaker 17 of the electronic fuse 1 depending on the content of the command.

[0219] The document presented here thus describes an electronic fuse 1 with a circuit breaker 17, wherein the electronic fuse 1 detects and checks the voltage between this terminal 26 and a reference node 201 at the terminal 26 of its circuit breaker 17, which is located on the energy source side, and wherein the electronic fuse 1 detects and / or determines and checks the current 29 through the circuit breaker 17. The electronic fuse 1 preferably switches off the electrical supply of the subsequent subtree of the supply network 200 by switching off its circuit breaker 17 when the magnitude of the detected voltage falls below a minimum value and when, at the same time, the magnitude of the detected electrical current 23 through the circuit breaker 17 of the electronic fuse 1 exceeds a predetermined threshold.This is a clear indication of a short circuit, which is the task of fuse 1 to catch.

[0220] Since this could be a temporary fault, for example, resulting from the commutation of an inductive load, it may be advisable to attempt a reclosure. After a short-circuit event occurs, the computer core 2 of the control device 4 of the electronic fuse 1 then preferably performs one or more reclosure attempts of the circuit breaker 17, as described above. This could, of course, be a genuine short circuit. It is therefore advisable for the computer core 2 of the control device 4 of the fuse 1 to precisely monitor the number of reclosure attempts and the execution of the reclosure attempts, and if necessary, also to log their execution and results.When a short-circuit event occurs during a switch-on attempt of the circuit breaker 17, the computer core 2 of the control device 4 of the electronic fuse 1 therefore preferably increases a switch-on attempt counter of the control device 4, in particular a register value of the computer core 2, by a switch-on attempt counting step size, which can also be negative and is different from 0. The computer core 2 of the control device 4 of the electronic fuse 1 preferably transmits an error message to the computer core 2 of the control device 4 of another electronic fuse or to a higher-level computer system 12 via the data bus 9 if the number of unsuccessful switch-on attempts in the form of the counter reading of the switch-on attempt counter crosses or reaches a predetermined maximum number of switch-on attempts.The computer core 2 of the control device 4 of the proposed electronic fuse 1 sends and receives data such as configuration data (write / read), switching commands (write / read), diagnostic data (write / read), measured values ​​(read), and comparison value settings (write / read) via a data interface (10, 550) or via the fuse data bus (9, 540). The corresponding data bus 9 can, for example, be partially or entirely a two-wire data bus, in particular a bidirectional and / or differential two-wire data bus 9. It is particularly advantageous if the data bus 9 is a conventional automotive data bus, such as a CAN data bus or a data bus with a physical interface of a CAN data bus, a CAN-FD data bus, a Flexray data bus, an LVDS data bus, or the like. The fuses can be linked together in a daisy chain.For this purpose, for example, control devices 4 of fuses 1 of the supply network 200 can comprise two data interfaces 610, 10 for the fuse data bus (9). The connectors 410 and the fuse bodies 425 of the fuses 405, 1 should then have corresponding additional plugs and contacts. Preferably, the computer cores 2 of the control devices 4 of the electronic fuses (1, 214 to 217, 225 to 223, 230 to 235, 225 to 256) of a supply network 200 and the higher-level computer system 12, which are connected to the data bus 9, perform an auto-addressing method to assign a unique fuse address to each data interface 10 of each control device 4 of each fuse on the data bus 9. EP 1 490 772 B1 describes a possible exemplary auto-addressing method.The document presented here describes for the first time the use of an auto-addressing method for assigning unique fuse addresses to the electronic fuses of a supply network 200 that are connected to a fuse data bus 9.

[0221] Preferably, the data interfaces 10, 610 of the control device 4 of the electronic fuses 1 are configured to carry out an auto-addressing process for determining a fuse address or to participate in such an auto-addressing process.

[0222] The Fig. 5 shows, among other things, the optical data connection 540 between the first optical data interface 550 of the control device 4 of the fuse 1 and the optical interface 555 of the higher-level computer system 12. An optical fiber 580 carries the electromagnetic radiation of the optical data connection 540. The housing 535 of the electronic fuse 1 preferably has an optical plug connector which allows the mechanical and optical connection of the electronic fuse 1 to the optical fiber 580. This enables an LED 560 to feed electromagnetic radiation into the optical fiber 580 as an optical data connection 540. A photodetector of the optical data interface 550 can thereby receive electromagnetic radiation as a data connection 540 from the optical fiber 580. The optical plug connector preferably comprises an optical window 545, whereby the housing 535 of the fuse 1 comprises such an optical window 545.The optical data interface 550 preferably includes a control device 565 for controlling the LED 560. If the LED 560 is not supplied with electrical energy by the control device 565, the control device 4 can also use it as a photodetector for receiving the optical data connection 540 of the optical data interface 555 of the higher-level computer system 12. In this case, for example, an analog-to-digital converter 570 of the control device 4 of the fuse can detect the voltage signal 575 of the silicon LED 560 and feed it to the computer core 2 via the internal data bus 11 for evaluation. Of course, this evaluation and an analog-to-digital converter can also be part of the optical data interface 550.

[0223] The Fig. 5 shows, among other things, a second optical data connection 540 between the second optical data interface 552 of the control device 4 of the fuse 1 and an optical interface (not shown) of another higher-level computer system or another control device 4 of another fuse 1. The housing 535 of the electronic fuse 1 preferably has a further optical connector which allows the mechanical and optical connection of the electronic fuse 1 to a second, not-shown optical waveguide. As a result, an LED 561 can feed electromagnetic radiation into the further optical waveguide as an optical data connection 540 of the second optical data interface 551. A photodetector of the second optical data interface 551 can as a result receive electromagnetic radiation as a data connection 540 from the further, not-shown optical waveguide.The second optical connector preferably also comprises a second optical window 545, whereby the housing 535 of the fuse 1 comprises such a second optical window 545. The second optical data interface 552 preferably comprises a control device 565 for controlling the second LED 561. If the second LED 561 is not supplied with electrical energy by the control device 565 of the second optical data interface 551, the control device 4 can also use it as a photodetector for receiving the second optical data connection 540 of the optical data interface of the further higher-level computer system or the optical data interface of the other electronic fuse 1. In this case, for example, an analog-to-digital converter 570 of the control device 4 of the fuse can detect the voltage signal 576 of the second silicon LED 561 and feed it to the computer core 2 via the internal data bus 11 for evaluation.Of course, this evaluation and an analog-to-digital converter can also be part of the second optical data interface 551. The second laser or the second LED 561 can, for example, again be a silicon-based LED, in particular a silicon avalanche LED, in particular a SPAD diode operated as an LED.

[0224] Preferably, the control device 4 of the fuse 1 has temperature sensor evaluation devices 585, which, for example, determine temperature measured values ​​by means of temperature sensors 586 and make them available to the computer core 2 of the control device 4 of the fuse 1 via the internal data bus 11.

[0225] The control device 4 of the fuse 1 preferably comprises a random number generator 60 (RNG). The computer core 2 of the control device 4 of the fuse 1 can read the random value of the random number generator 60 via the internal data bus 11 of the control device 4 of the fuse 1. The computer core 2 of the control device then preferably uses this random number to encrypt the data communication via the data interface 10 or the optical data interface 550 with other computer cores 2 of other control devices 4 of other fuses 1 in the supply network 200 and / or to encrypt the data communication with a higher-level computer system 12. The random number generator 60 is preferably a so-called true random number generator (TRNG). The random number generator 60 is most preferably a quantum random number generator (QRNG).According to the proposal, the quantum random generator 60 has a first SPAD diode, which is reverse-biased with a voltage above the reverse voltage. The reverse voltage is preferably supplied by the power supply 5 or a device part thereof. As a result, the first SPAD diode begins to emit individual light pulses. Preferably, an optical waveguide of the control device forwards these light pulses from the first SPAD diode to a second SPAD diode. The two SPAD diodes are preferably fabricated monolithically in a silicon semiconductor crystal using CMOS technology. The optical waveguide is preferably fabricated in the metallization stack of the CMOS circuit, which comprises the first SPAD diode and the second SPAD diode. The metallization stack preferably comprises several structured metallic wiring levels and several insulating insulation levels.The metallic wiring levels can be made, for example, from an aluminum alloy, which can be patterned into conductor tracks, etc., using photolithography. The optically transparent insulation levels between these conductor levels of the metallization stack can be made, for example, from silicon dioxide or another optically transparent and suitable insulator. The insulation levels are also typically patterned photolithographically and provided with vias to connect lines of different conductor levels. Preferably, the metallization stack in the area of ​​the two SPAD diodes is structured and constructed in such a way that a larger number of the photons emitted by the first SPAD diode toward the metallization stack can reach the second SPAD diode, and conductor tracks of the metallization stack do not impede the photons.Preferably, conductor tracks of the metallization stack shield the optical waveguide upwards and to the sides in such a way that these conductor tracks reflect at least some of the photons that want to escape in this direction back toward the second SPAD diode. Therefore, the optical waveguide preferably comprises only material from the insulation layers within its interior and preferably no material from the conductor tracks. The optical waveguide of the quantum random number generator 60 preferably optically connects the first SPAD diode to the second SPAD diode. Preferably, the optical waveguide of the quantum random number generator 60 covers both the first SPAD diode and the second SPAD diode in order to capture the maximum number of photons from the first SPAD diode and feed them to the second SPAD diode. This design enables a maximum bit rate per second for the generated random bits.The second SPAD diode is preferably also reverse-biased with a detection voltage. The detection voltage is preferably again supplied by the voltage supply 5 and / or a sub-device thereof. The second SPAD diode also generates current pulses of a first maximum height through spontaneous emission of individual photons. When a photon from the first SPAD diode reaches the second SPAD diode, stimulated emission occurs. The resulting current pulse of the SPAD diode current of the second SPAD diode then has a second height. Typically, the first height is approximately twice as high as the second height. Preferably, a transimpedance amplifier amplifies the SPAD diode current of the second SPAD diode and thus the current pulses of the second SPAD diode. A comparator compares the amplified SPAD output signal with a threshold value.The threshold value is preferably set such that the comparator delivers a logical 1 at its output for current pulses of the second magnitude and a logical 0 at its output for current pulses of the first magnitude and in the case of no current pulses. Preferably, a counter, which preferably runs at the clock of the oscillator 30 or a clock of the clock system of the control device, counts the time between the occurrence of two ones at the output of the comparator. The counter represents a time-to-digital converter. This is referred to below as a time-to-digital converter. Since the second SPAD diode has a dead time for the detection of photons, the time-to-digital converter of the quantum random number generator preferably discards all pulse pairs of one-pulses at the comparator output that follow one another too closely, i.e., shorter than this dead time.In this way, the time-to-digital converter of the quantum random number generator 60 generates a first number that already depends significantly on a quantum process, namely the spontaneous emission of the first SPAD diode, and a second quantum process, namely the stimulated emission of the second SPAD diode. The subsequent entropy extraction device then uses a first number from the time-to-digital converter and a second number from the time-to-digital converter if the first number from the time-to-digital converter and the second number from the time-to-digital converter are different. If the first number from the time-to-digital converter is greater than the second number from the time-to-digital converter, the entropy extraction generates a random bit with a first logical value, and otherwise, a random bit with a second logical value that is different from the first value.From several of these random bits, the entropy extraction device of the quantum random number generator then generates a random number, which the entropy extraction device then makes available to the computer core 2 of the control device 4 of the fuse 1 in a register of the quantum random number generator 60.

[0226] Preferably, the computer core 2 of the control device 4 of the security device 1 generates a private and a public key using a random number generated in this way.

[0227] The computer core 2 of the control device 4 of the electronic security device 1 then transmits this public key via the data bus 9 to one or more computer cores 2 of other control devices 4 of other security devices and / or to a higher-level computer system 12. These can then use this public key to encrypt data messages in bitstream packets BP to the computer core 2 of the control device 4 of the security device 1 via the data bus interface (10, 610, 550, 551) and send encrypted data to the computer core 2 of the control device 4 of the security device 1 in this way.

[0228] Preferably, the computer core 2 of the control device 4 of the security device generates a new key pair from time to time, preferably regularly, with the aid of the random number generator 30 and then distributes the public key via the data bus 9 to one or more computer cores 2 of other control devices 4 of other security devices and / or to a higher-level computer system 12. The computer core 2 of the control device 4 of the security device 1 can then decrypt the received encrypted data messages with its private key.

[0229] The higher-level computer system 12 of the supply network 200 also preferably comprises one or more such random number generators 60. Here, too, these can be RNGs or QRNGs (quantum random number generators) that provide the higher-level computer system 12 with random numbers for key pair generation.

[0230] Preferably, the higher-level computer system 12 generates a private and a public key using a random number generated in this way by such a random number generator.

[0231] D the higher-level computer system 12 then transmits this public key via the data bus 9 to one or more computer cores 2 of other control devices 4 of other security devices and / or to another possibly existing higher-level computer system 12. These can then use this public key to encrypt data messages in bitstream packets BP to the higher-level computer system 12 and send encrypted data to the higher-level computer system 12 in this way.

[0232] Preferably, the higher-level computer system 12 generates a new key pair from time to time, preferably regularly, using its own random number generator and then distributes the public key via the data bus 9 to one or more computer cores 2 of other control devices 4 of other security devices and / or to the other higher-level computer system 12. The higher-level computer system 12 can then decrypt the received encrypted data messages using its private key. Figure 6

[0233] The Fig. 6 essentially corresponds to the Fig. 1, wherein the control device 4 of the fuse 1 of the Fig. 4 has an additional second data interface 610. What has already been described about the first data interface 10 should also apply to the second data interface 610. In particular, it can be a data interface for a single-wire data bus and / or a differential bidirectional data bus. In the automotive sector, the data bus 9 of the second data bus interface 610 can be, for example, a LIN data bus 9 or a DSI3 data bus 9 or a PSI5 data bus 9 or a CAN data bus 9 or a CAN-FD data bus 9 or an Ethernet data bus or a Flexray data bus 9 or an LVDS data bus 9 or another wired or wireless data transmission path, for example via a Bluetooth or WLAN data connection or an optical data connection 540.The data communication of the computer core 2 of the control device 4 of the fuse 1 takes place via a wired or wireless second interface 610, 551 in addition to the data communication via the first data bus interface 10, 550.

[0234] In the Fig. For the sake of clarity, not all useful and possibly common device components are shown in Figure 6. Further device components that the reader may consider to be potentially Fig. 1 can be found, for example, in the Fig. 1, Fig. 5, Fig. 9, Fig. 24, Fig. 41, Fig. 42, Fig. 52, Fig. 53, Fig. 54, Fig. 55, Fig. 57, Fig. 58. The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

[0235] In many cases, it is desirable for the control device 4 of a fuse 1 to have more than a single data interface 10. This can be the case, for example, when increased communication security is required through redundancy or, for example, secure addressing is to be achieved through a daisy chain. The computer core 2 of the control device 4 can access this second data interface 610 via the internal data bus 11 and communicate with other computer systems 12 and / or other computer cores 2 of other control devices 4 of other fuses 1 in the supply network 200. The document presented here therefore proposes electronic fuses 1 with control devices 4 that comprise two data bus interfaces (610, 10) for the fuse data bus 9. Some of these second data bus interfaces 10, 610 can be optical data interfaces 550, 551.Preferably, some of such fuses 1 are connected to this fuse data bus 9 by two data interfaces 10, 610 or are inserted into the fuse data bus 9 by means of two such data interfaces (10, 551, 550, 610). This then results in a supply network 200 in which one or more electronic fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) each have two data interfaces (214 to 217, 225 to 228, 235 to 238, 250, 251, 610, 10) per electronic fuse (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) and which are preferably inserted into the data bus 9. (See also . Fig. 7). The computer cores 2 of the control devices (4) of the electronic fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) of such a supply network 200 receive and transmit data such as configuration data (write / read), switching commands (write / read), diagnostic data (write / read), measured values ​​(read), and comparison value settings (write / read) via a data interface (10, 610, 550, 551) via this data bus 9. For example, it is conceivable that the computer core 2 of the control device 4 of a fuse 1 receives data from a computer core 2 of the control device 4 of another fuse 1 or from a higher-level computer system 12 via the first data interface 10 and then forwards this data directly or after modification of the data via the second data interface 610 to a computer core 2 of another control device 4 of another fuse 1 and / or to the higher-level computer system 12.In this way, the higher-level computer system 12 can, for example, check the functionality of the computer core 2 of the control device 4 of the fuse 1. For example, electronic fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) of such a supply network 200 can comprise two such data interfaces 10 and 610 for the data bus 9 and be inserted into the data bus 9. In this way, the fuses then form a linear chain of fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) of such a supply network 200 along at least part of the data bus 9.As a result, the fuses (1, 214 to 217, 225 to 228, 235 to 238, 250, 251) of such a supply network 200 then have a unique physical position, which the computer core 2 of a control device 4 of a fuse 1 can then determine for its fuse 1 within the framework of an auto-addressing process and can convert into a logical fuse address of its fuse 1 for addressing data messages in bit stream packets BP to this fuse. Preferably, the computer core 2 transmits the fuse address it has determined to the higher-level computer system 12 after completion of the auto-addressing process at the start of operation of the supply network 200. The higher-level computer system 12 then preferably checks whether the transmitted fuse addresses correspond to the expected values.If this is not the case, the higher-level computer system 12 preferably repeats the auto-addressing process, which typically results in the computer cores 2 of the control devices 4 of the fuses of the supply network 200 discarding the already determined fuse addresses in favor of the newly determined fuse addresses. Preferably, a higher-level computer system 12, which is preferably connected at the beginning of this part of the data bus 9, uses auto-addressing in cooperation with the computer cores 2 of the control devices 4 of the electronic fuses to determine a fuse address for each of the computer cores 2 of the control devices 4 of the electronic fuses for controlling the computer cores 2 of the control devices 4 of the fuses of the supply network 200 and, if necessary, transmits this address to the computer cores 2 of the control devices 4 of the electronic fuses of the supply network 200.The data communication of the computer core 2 of the control device 4 of the fuse 1 takes place via a wired or wireless interface 610, 10. Figure 7

[0236] The Fig. 7 corresponds in essential parts to the Fig. 3, wherein the data bus 9 is designed as a ring-shaped data bus ring 9'. The data interfaces 280 to 293 of the fuses (214 to 217 and 225 to 228 and 235 to 238 and 255 and 256) here comprise the two data interfaces 10, 610 of the Fig. 6. The higher-level computer system 12 again controls the supply network 200.

[0237] The higher-level computer system 12 is connected to a second data bus interface via the data bus ring 9' with the first data bus interface of the data bus interfaces 284 of the fuse 225 of the consumer 220.

[0238] The second data bus interface of the data bus interfaces 284 of the fuse 225 of the consumer 220 is connected via the data bus ring 9' to the first data bus interface 285 of the fuse 226 of the consumer 221.

[0239] The second data bus interface of the data bus interfaces 285 of the fuse 226 of the consumer 221 is connected via the data bus ring 9' to the first data bus interface 286 of the fuse 227 of the consumer 222.

[0240] The second data bus interface of the data bus interfaces 286 of the fuse 227 of the consumer 222 is connected via the data bus ring 9' to the first data bus interface 287 of the fuse 228 of the consumer 223.

[0241] The second data bus interface of the data bus interfaces 287 of the fuse 228 of the consumer 223 is connected via the data bus ring 9' to the first data bus interface 288 of the fuse 235 of the consumer 230.

[0242] The second data bus interface of the data bus interfaces 288 of the fuse 235 of the consumer 230 is connected via the data bus ring 9' to the first data bus interface 289 of the fuse 236 of the consumer 231.

[0243] The second data bus interface of the data bus interfaces 289 of the fuse 236 of the consumer 231 is connected via the data bus ring 9' to the first data bus interface 290 of the fuse 237 of the consumer 232.

[0244] The second data bus interface of the data bus interfaces 290 of the fuse 237 of the consumer 232 is connected via the data bus ring 9' to the first data bus interface 291 of the fuse 238 of the consumer 233.

[0245] The second data bus interface of the data bus interfaces 291 of the fuse 238 of the consumer 233 is connected via the data bus ring 9' to the first data bus interface 283 of the fuse 217 of the consumer 213.

[0246] The second data bus interface of the data bus interfaces 283 of the fuse 217 of the consumer 213 is connected via the data bus ring 9' to the first data bus interface 282 of the fuse 216 of the consumer 212.

[0247] The second data bus interface of the data bus interfaces 282 of the fuse 216 of the consumer 212 is connected via the data bus ring 9' to the first data bus interface 281 of the fuse 215 of the consumer 211.

[0248] The second data bus interface of the data bus interfaces 281 of the fuse 215 of the consumer 211 is connected via the data bus ring 9' to the first data bus interface 280 of the fuse 214 of the consumer 210.

[0249] The second data bus interface of the data bus interfaces 280 of the fuse 214 of the consumer 210 is connected via the data bus ring 9' to the first data bus interface 292 of the fuse 255 of the energy source 250.

[0250] The second data bus interface of the data bus interfaces 292 of the fuse 255 of the energy source 250 is connected via the data bus ring 9' to the first data bus interface 293 of the fuse 256 of the energy source 251.

[0251] The second data bus interface of the data bus interfaces 293 of the fuse 256 of the energy source 251 is connected to the first data bus interface of the higher-level computer system 12 via the data bus ring 9'.

[0252] This closes the data bus ring 9'. A supply network 200 with a data bus ring 9' as the data bus 9 has the advantage that if the data bus ring 9' is interrupted due to a fault or an accident at one point, communication between all bus participants and all other bus participants is still possible. This is particularly important because supply networks 200 are typically safety-relevant.

[0253] The document presented here also refers to the description of the Fig. 6, which essentially safeguards the Fig. 7 reproduces.

[0254] The document presented here explains using the example of Fig. 7 the targeted shedding of supply sub-networks. The supply network 200 of the vehicle comprises, among other things, device parts 210, a wiring harness with line sections 240, 241, 245, at least one energy source 250, 251, at least one control computer 12—for example, a higher-level computer system 12—and at least two electronic fuses 214, 225. Typically, the device parts 220 are electrical consumers. At least one or more energy sources 250, 251 of the supply network 200 supply at least two of the device parts 210, 220 with electrical energy via the wiring harness with the line sections 240, 241, 245. The electronic fuses 214, 225 are inserted into the wiring harness with the line sections 240, 241, 245.Preferably, each of the electrical fuses 214, 225 is assigned to at least one electrical load (210, 225), designated as number 1, which is referred to below as the electrical load assigned to the respective electronic fuse. A fuse of the fuses 214, 215 can enable or prevent the power supply to the electrical load assigned to this fuse depending on a control signal from the control computer, i.e., the higher-level computer system 12. The computer core of the control device of the respective fuse typically receives such a control signal via the data bus 9, here via the data ring bus 9'. A fuse assigned to this load can then prevent the power supply to the electrical load assigned to this fuse by means of the corresponding fuse assigned to this load.Preferably, the control computer 12, i.e., for example, the higher-level computer system 12, establishes an encrypted data connection 720 between the control computer 12 of the vehicle, i.e., for example, the higher-level computer system 12, and a computer 710 of a service provider, in particular a computer system of the vehicle's automobile manufacturer. The control computer 12 of the vehicle, i.e., for example, the higher-level computer system 12, preferably authenticates the vehicle with the service provider's computer 710. The vehicle's authentication data can include, for example, the data of the vehicle and / or the car key and / or a SIM card in the vehicle and / or a vehicle-specific password entry or password generation and / or biometric user data of a vehicle owner, etc.Typically, the service provider's computer 710 authenticates itself in return with the vehicle's control computer 12, for example, with a higher-level computer system 12 of the vehicle. If necessary, the requesting person 730 authenticates itself with the service provider's computer 710 using inputs and / or biometric sensor data such as fingerprint recognition via the vehicle's control computer 12, for example, via the higher-level computer system 12. The authentication data can include, for example, the vehicle's data and / or the personalized car key, a personalized SIM card, a personalized password entry, biometric user data, etc. The service provider's computer 710 then preferably generates or provides an activation code.The service provider's computer 710 transmits the activation code via the secure data connection 720 to the vehicle's control computer 12, for example, to the higher-level computer system 12. The vehicle's control computer 12, i.e., the higher-level computer system 12, preferably verifies the admissibility and / or syntactical correctness and / or situational admissibility of the activation code. If this verification was successful, the vehicle's control computer 12, i.e., the vehicle's higher-level computer system 12, enables the power supply of an electrical consumer 220 assigned to the fuse via the corresponding fuse 225 if the activation code is admissible and / or syntactically correct and / or situationally admissible. To this end, the vehicle's higher-level control computer 12, as the higher-level computer system 12, sends a command to the computer core 2 of the control device 4 of the corresponding fuse via the data bus 9.This command is preferably encrypted so that the computer core 2 of the control device 4 of the fuse can verify whether the command was sent by a reliable higher-level computer system 12. If the computer core 2 of the control device 4 of the corresponding fuse receives such a secured command, the computer core 12 of the control device 4 of the corresponding fuse closes the circuit breaker 17 of this fuse and thus allows the power supply of the downstream supply subnetwork via this circuit breaker 17. The higher-level computer system 12 preferably transmits billing data via the data connection 720 to a or the computer 710 of a or the service provider, in particular to a or the computer system of the automobile manufacturer, wherein preferably memory information in the computer 710 of the service provider indicates that the invoice has not yet been paid.Preferably, the service provider's or automobile manufacturer's computer 710 creates an invoice based on the transmitted billing data. The service provider's computer 710 then preferably transmits the invoice to a computer system 740 of the ordering person 730, or to the ordering person 730. The ordering person 730 or a computer (710) of the service provider then preferably pays this invoice. The service provider's computer 740 then marks the stored information in the service provider's computer (740) that the invoice has been paid.

[0255] A proposed vehicle comprises device parts 210, at least one wiring harness 1515 with line sections 240, 241, 245, at least one energy source 250, 251, at least one control computer 12—for example, a higher-level computer system 12—and at least two electronic fuses 214, 225. The device parts (220) are typically electrical consumers. The at least two energy sources 250, 251 of the vehicle's supply network 200 supply one or more of the device parts 210, 220 with electrical energy via the wiring harness with line sections 240, 241, 245. The electronic fuses 255, 256 are inserted into the wiring harness of the supply network, which comprises line sections 240, 241, 245. Preferably, substantially each of the electrical fuses 255, 256 is assigned at least one, as number 1, electrical energy source 250, 251, which is referred to below as the assigned electrical energy source 250, 251.The word "inserted" here can mean that the electronic fuse 255, 256 can connect a line section 240, 241, 241 to the electrical energy source 250, 251 assigned to this fuse 255, 256, or can disconnect the electrical energy source 250, 251 assigned to this fuse 255, 256 from this line section 240, 241, 241. A respective one of the fuses 255, 256 can enable or prevent the energy supply of the respectively assigned electrical energy source 250, 251 depending on a control signal from the control computer 12—for example, the higher-level computer system 12. The corresponding assigned fuse 255, 260 can prevent the energy supply of an assigned electrical energy source 250, 251.The control computer 12 establishes an encrypted connection 720 between the control computer 12 of the vehicle, for example the higher-level computer system 12, and a computer 710 of a service provider, in particular a computer system 710 of the automobile manufacturer. The control computer 12 of the vehicle - for example the higher-level computer system 12 - authenticates the vehicle with the computer 710 of the service provider, wherein the vehicle's authentication data can include, for example, the data of the vehicle and / or the car key and / or a SIM card in the vehicle and / or a vehicle-specific password input or password generation and / or biometric user data of a vehicle owner, etc. The service provider's computer 710 also authenticates itself with the control computer 12 of the vehicle, for example the higher-level computer system 12. If necessary,The requesting person 730 authenticates themselves using the vehicle's control computer 12, for example, using the higher-level computer system 12, with the service provider's computer 710. The authentication data may include, for example, the vehicle's data and / or the personalized car key, a personalized SIM card, a personalized password entry, biometric user data, etc. The service provider's computer 710 generates an activation code or provides this activation code. The service provider's computer 710 then transmits the activation code to the vehicle's control computer 12, for example, to the higher-level computer system 12. The vehicle's control computer 12, for example, the higher-level computer system 12, then verifies the admissibility and / or syntactical correctness and / or situational admissibility of the activation code.If the activation code is successfully verified, the vehicle's control computer 12 enables the energy supply of an assigned electrical energy source (250, 251) using the corresponding, assigned fuse 255, 260. To do so, the vehicle's control computer 12 sends a corresponding command via the data bus 9 to the respective fuse 255, 260. Preferably, the communication between the control computer 12 and the fuse 255, 260 is encrypted. Preferably, the communication is PQC encrypted. Preferably, the vehicle's control computer 12 has previously authenticated itself at least once with the computer core 2 of the control device 4 of the respective fuse 250, 260. Preferably, the computer core 2 of the control device 4 of the respective fuse 250, 260 has previously authenticated itself with the vehicle's control computer 12, i.e., the higher-level computer system 12.Preferably, the vehicle's control computer 12 transmits billing data to a computer 710 of a service provider, in particular to a computer system of the automobile manufacturer, wherein memory information in the service provider's computer 710 indicates that the invoice has not been paid. Preferably, a computer 710 or the service provider's computer 710 then generates an invoice based on the transmitted billing data, in particular to a computer system of the automobile manufacturer or the computer system of the automobile manufacturer. The billing data may, for example, relate to the duration of use of certain consumers or energy sources or certain line sections, or the determination of certain operating parameters, or the provision of certain methods for operating the vehicle or its device components.A computer 710 or the computer 710 of a service provider or the service provider then transmits the invoice thus created, preferably to a computer 750 or the computer 750 of a service provider or the service provider, in particular to a computer system or the computer system of the ordering person, or to the ordering person 730. A computer 750 or the computer 750 of a service provider or the service provider and / or the requesting person 730 then preferably settle the invoice. Preferably, an input from the requesting person 730 is required for this. Preferably, the computer 710 of the service provider marks the stored information in the computer 710 of the service provider that the invoice has been paid.

[0256] For example, a computer 710 of a service provider or the automobile manufacturer can use the transmitted billing data to create a forecast of the probability of failure of a component of the vehicle using the vehicle data and / or operating data and / or measured values ​​and / or damage data. This computer 710 can then transmit these forecast results to a server 1985 and / or a terminal of the workshop and / or a terminal 740 and / or a computer of a vehicle owner 730 and / or a terminal 740 and / or a computer of a vehicle driver 730 or a terminal and / or a server 710 of an automobile manufacturer and / or a terminal and / or server of a logistics company and / or a terminal and / or server of another user of this data and display them there, if necessary.

[0257] The vehicle can also use such a system to detect operating errors. For example, in the event of a hot-plug event in the supply network 3100, i.e., in particular, the unauthorized disconnection or connection of an electrical plug connection under current and / or voltage, the computer core 2 of a control device 4 of an electronic fuse can transmit a message to a computer 710, 750 of a service provider and / or the automobile manufacturer. In the event of a hot-plug event in the supply network 200 of a vehicle, the computer core 2 of the control device 4 of an electronic fuse can transmit a message to a computer 710 of a vehicle manufacturer or a service provider immediately or with a time delay, or can provide such information, for example, in a memory of a higher-level computer 12.

[0258] Preferably, the computers in the supply network 200 exchange encrypted security codes using data messages in the bit stream packets BP exchanged via the data bus 9. These security codes are special activation codes that enable the switching on or off of individual circuit breakers 17 of individual fuses in the supply network 200. Preferably, the computer core 2 of the control device 4 of a fuse checks the admissibility of a received switch-on or switch-off command for the circuit breaker 17 of its fuse using a security code that is also transmitted to this computer core 2 of the control device 4 of the fuse.The computer core 2 of the control device 4 of the fuse can take into account factors such as the time of transmission, the current flowing through the circuit breaker 17, the voltage of terminals 18, 19 of the circuit breaker 17 against a reference potential, the state of other fuses in the supply network 200, the priority of the downstream supply sub-network and / or the consumers contained therein and / or the energy sources contained therein and / or the originating computer of the security code and / or the transmitting computer of the security code, user inputs, messages from other computers 710, 750, etc.

[0259] For example, a service provider or the automobile manufacturer or an agent of the automobile manufacturer can transmit the security code or data for generating the security code by means of a server 710 through the higher-level computer system 12 or through computer cores 2 of the control devices 4 of the electronic security devices to the higher-level computer system 12 or a computer core 2 of a control device 4 of the electronic security device.

[0260] For example, the security data bus 9 can be provided directly or indirectly, e.g. via gateways or the like, with a terminal 740 for manual user input for reconfiguring the supply network 200 by means of the electronic fuses of the supply network.

[0261] The terminal 740 can also be configured to transmit authentication data to a server 710 of the automobile manufacturer or a vicarious agent of the automobile manufacturer, wherein the authentication data can include, in particular, authentication data of the operating person 730 and / or authentication data of the organization for which the person 730 works, and / or authentication data of the vehicle or and / or authentication data of the vehicle's car key and / or similar authentication data. In particular, the authentication data can be data from a signature card or the like and / or biometric data such as data from a fingerprint scanner and / or a retina scanner or the like, or data derived from such data.The terminal 740 is then preferably configured to receive the security code from the server 710 of the automobile manufacturer or an agent of the automobile manufacturer depending on the authentication data thus determined.

[0262] Preferably, one or more computer cores 2 of control devices 4 of electronic fuses of the electronic fuses in the supply network 200 are configured to determine measured values ​​by means of measuring means of these electronic fuses and to transmit these measured values ​​to a higher-level computer system 12 via the fuse data bus 9.

[0263] The higher-level computer system 12 is preferably configured to execute a neural network model and use the determined measured values ​​and / or values ​​dependent thereon as input values ​​of the neural network model. Preferably, at least the switching state of a circuit breaker 17 of an electronic fuse in the supply network 200 and / or the switching states of several circuit breakers 17 of several electronic fuses in the supply network 200 and / or at least one data message from the higher-level computer system 12 to another computer system (710, 750, 740) or a signal from the higher-level computer system 12 to a user 730 then depend on an output signal and / or output value of the neural network model.

[0264] The higher-level computer system 12 can also be configured to perform spectral analyses of the measured value curve data from the measuring devices of the fuses in the supply network, for example, using Fourier or Laplace transformation or wavelet transformation, and to determine spectral values. The higher-level computer system 12 can then be configured to conclude the need for preventive maintenance in the event of significant deviations of the spectral values ​​from expected value intervals for the spectral values, or to signal another computer system 750, 710 or a display 740.The higher-level computer system 12 can also be configured to perform spectral analyses of the curve data, for example, using Fourier or Laplace transformation or wavelet transformation, and to determine spectral values ​​and evaluate the system availability of device components of the supply network and / or the supply network 200 itself using the determined spectra. If necessary, signal the evaluation result to other computer systems 710, 750, 740, and / or change vehicle parameters depending on this evaluation. The other computer systems can be terminals 740 of a user 730 and / or computers 710 of a vehicle manufacturer or computers 710, 750 of one or more service providers and / or a workshop, or a higher-level computer system 12 of the vehicle or a computer core 2 of a control device 4 of a backup of the supply network 200.

[0265] The proposed supply network preferably comprises, at least temporarily, a computer (server) 710 of a service provider, in particular a computer system of an automobile manufacturer and thus possibly also of a repair shop. A preferably encrypted data connection 720 between the vehicle's control computer—e.g., a higher-level computer system 12—and a computer 710 of a service provider, in particular a computer system of the vehicle's automobile manufacturer, ensures communication. A requesting / operating person or user 730 can access the computers 4, 12 of the supply network 200 and thus the switching state of the circuit breakers 17 of the fuses via a data input means and / or data output means—e.g., a terminal 740.In addition to the computer 710 of the vehicle manufacturer or a service provider, further computers 750 of further service providers or further computers of the service provider that controls the computer 710 can communicate with the computers of the supply network 200 via the data bus 9 and the higher-level computer system 12 via wired and / or wireless data connections.;. Figure 8

[0266] The Fig. 8 corresponds in the most important parts of the Fig. 4.

[0267] The supply network of the Fig. 8 comprises a further fuse 805, a second further fuse 810, a first connected distribution tree 815, a second connected distribution tree 820, an electronic fuse 825, consumers 830 and further consumers 835. The other parts of the Fig. 8 have already been reported in connection with the Fig. 4 explained.

[0268] Preferably, a computer core 2 of a control device 4 of an electronic fuse 825 transmits parameters of the supply subtrees 815 connected to the electronic fuse 825 and / or individual nodes of the connected supply subtrees 815 and / or individual connected supply line sections of the supply tree of the supply lines of the vehicle to a computer core 2 of a control device 4 of another electronic fuse 805 and / or one or more control units of the vehicle and / or a higher-level computer system 12. Such parameters can in particular be measured values ​​that the computer core 2 of the control device 4 of a fuse detects by means of measuring devices of the control device 4 of the fuse.Such parameters may, for example, be a directly accessible parameter, such as the temperature of a temperature sensor 40, the voltage of a node 26, 27, 28 within the fuse against a reference potential 201 and / or the voltage of a node of the supply tree against a reference potential 201, and / or the current value of an electric current in a supply line section of the connected supply tree 820.

[0269] By means of this exchange of recorded measured values ​​and / or parameters, the computer core 2 of the control device 4 of an electronic fuse 825, 805 can record or determine derived parameters, such as leakage currents against other electrical nodes in the vehicle or electrical resistances of supply voltage line sections, in particular by applying Kirchhoff's equations to data which the computer core 2 of the control device 4 of the electronic fuse 825, 805 has determined by means of measuring devices of the control device 4 of this electronic fuse 825, 805 or which the computer core 2 of the control device 4 of this electronic fuse 825 has received from the computer cores 2 of the control devices 4 of other electronic fuses 805 or from higher-level computer systems 12, for example a higher-level computer system 12.

[0270] Preferably, the computer core 2 of the control device 4 of the electronic fuse 825 estimates the temperature of a subsequent supply line section, which is increased as a result of the electrical current 29 into this supply line section and the voltage drop across this supply line section. Such an estimate is also possible if its ohmic resistance and its heat capacity and its thermal discharge resistance and the ambient temperature in the region of the supply line section are known approximately, e.g., by estimation by the computer core 2 of the control device 4 of the electronic fuse 825 and / or by data transmission from the higher-level computer system 12 and / or by data transmission from the higher-level computer system 12 to the computer core 2 of the control device 4 of the fuse 825.

[0271] Preferably, the computer core 2 of the control device 4 of the electronic fuse 825 determines the voltage value of the voltage of a node 22, 25, 21 at the power switch 17 of the electronic fuse 825 or a node associated therewith relative to a reference potential 201 by means of a voltage measuring device 16 in order to enable such estimates as the one above and / or to be able to detect overvoltages or undervoltages and report them to a higher-level computer system 12 via the data bus 9. Preferably, the computer core of the control device 4 of the electronic fuse 825 determines the current value of the current 29 through the power switch 17 of the electronic fuse 825.The computer core 2 of the control device 4 of the electronic fuse 825 and / or a higher-level computer system 12 preferably determine the power value of the electrical power fed into the consumer or a downstream supply tree 815, 820 or into a downstream supply line section from the current value and / or the voltage value. If this power feed exceeds a power feed threshold, the computer core 2 of the control device 4 of the fuse 825 preferably opens the circuit breaker 17 of the fuse 825 and preferably signals this opening of the circuit breaker 17 to the higher-level computer system 12 via the data bus 9.

[0272] Typically, the computer core 2 of the control device 4 of the electronic fuse 825 uses a voltage measuring device to determine the voltage value of a node 22, 25, 21 at the power switch 17 of the electronic fuse 805 or a node associated therewith relative to a reference potential 201 and the current value of the current 29 through the power switch 17 of the electronic fuse. The computer core 2 of the control device 4 of the electronic fuse 825 and / or a higher-level computer system 12 use the current value and the voltage value to determine the power value of the electrical power flowing from the energy source or from a preceding supply tree or from a preceding supply line section.If this power consumption exceeds a power consumption threshold, the computer core 2 of the control device 4 of the fuse 825 preferably opens the circuit breaker 17 of the fuse 825 and preferably signals this opening of the circuit breaker 17 to the higher-level computer system 12 via the data bus 9.

[0273] Preferably, the computer core 2 of the control device 4 of the electronic fuse 805 transmits this power value via the fuse data bus 9 to the control device 4 of another electronic fuse 825 or the higher-level computer system 12 of the supply network 200. The higher-level computer system 12 can also be a server 710, 750 of an energy provider or one of the vicarious agents of an energy provider or the vehicle manufacturer or another service provider.

[0274] Preferably, a proposed electronic fuse 825, 1 comprises a control device 4 with a clock or a timer 35. The computer core 2 of the control device 4 of the fuse 1, 85 preferably uses this timer 35 for generating time stamps of a log table, which the computer core 2 of the control device 4 of the fuse 825 preferably creates in a memory of the control device 4 of the fuse 825 or which the higher-level computer system 12 preferably creates in a memory of the higher-level computer system 12 or which the computer core 2 of a control device 4 of another fuse 805 creates in the memory of this control device 4 of the other fuse 805.

[0275] Preferably, the clock or timer 35 of the control device 4 of the electronic fuse 1, 825 has a synchronization option with the clocks and timers 35 of the control devices 4 of other electronic fuses 805, 810 and / or with the clocks and / or timers 1970 of a higher-level computer system 12.

[0276] In a proposed electronic fuse 825, the computer core 2 of the control device 4 of this electronic fuse 825 preferably shuts down the circuit breaker 17 after receiving a shutdown signal and / or a shutdown command via the fuse data bus 9 only after a shutdown delay time has elapsed. Preferably, the computer core 2 of the control device 4 of the electronic fuse 825 determines the time since receipt of the shutdown signal or shutdown command using the timer 35 of the control device 4 of the electronic fuse 825.Preferably, the computer core 2 of the control device 4 of the electronic fuse 825 immediately switches off the circuit breaker 9 when the amount of the value of the electrical current 29 through the circuit breaker 17 of the electronic fuse 825 exceeds a threshold value and / or when the amount of power feed into the downstream supply sub-network and / or into the downstream supply line section or into a downstream consumer exceeds a power feed-in threshold value and / or when the amount of power drawn from the upstream supply sub-network and / or in the upstream supply line section or from a upstream energy source exceeds a power draw-off threshold value.Immediately means that the computer core 2 performs the shutdown in less than 100µs, better in less than 50µs, better in less than 20µs, better in less than 10µs, better in less than 5µs, better in less than 2µs, better in less than 1µs, better in less than 500ns, better in less than 200ns, better in less than 100ns.

[0277] Preferably, the switch-off delay time depends on the amount of the value of the electrical current 29 through the circuit breaker 17 and / or on the amount of power feed-in into the downstream supply sub-network and / or into the downstream supply line section or into a downstream consumer exceeding a power feed-in threshold and / or on the amount of power withdrawn from the upstream supply sub-network and / or in the upstream supply line section or from a upstream energy source.

[0278] Preferably, the switch-off delay time further depends on the magnitude of the value of the electrical current 29 through the circuit breaker 17, decreasing in a parabolic manner with increasing magnitude of the value of the electrical current 29 through the circuit breaker 17.

[0279] Preferably, the computer core 2 of the control device 4 of the electronic fuse 825 integrates the square of the magnitude of the electric current 29 through the power switch 17 of the electronic fuse 825 over time, thereby emulating the behavior of a fuse. Preferably, the computer core 2 of the control device 4 of the electronic fuse 825 opens the power switch 17 of the electronic fuse 825 when the magnitude of the time integral of the square of the magnitude of the current 29 through the power transistor 17 exceeds a current square threshold.Instead of the square of the magnitude of the electric current 29 through the circuit breaker 17 of the electronic fuse 825, the computer core 2 of the control device 4 of the electronic fuse can also form the integral of a polynomial of at least second degree of the value of the current 29 through the circuit breaker 17 of the electronic fuse 825 and then use this value for comparison with the current square threshold value for switching off the circuit breaker 17 when the current square threshold value is exceeded.

[0280] The computer core 2 of the control device 4 of the electronic fuse 825 preferably detects the magnitude of the value of the electrical current 29 through the circuit breaker 17 using appropriate measuring means 16, squares it or applies a polynomial of at least the second degree to it, and integrates the result over time. This integration can also be a filtering operation, in particular a low-pass filtering operation. The computer core 2 of the control device 4 of the electronic fuse then compares the detected, squared, and filtered magnitude of the value of the electrical current 29 with a threshold value, in particular the said current square threshold value. The switching state of the circuit breaker 17 of the electronic fuse 825 then depends, at least temporarily, on the result of this comparison.For example, it is possible that the circuit breaker 17 of the electronic fuse 825 is opened independently by command via the data bus 9 by the higher-level computer system 12.

[0281] As already indicated, the computer core 2 of the control device 4 of the electronic fuse 825 can detect the magnitude of the value of the electrical current 29 through the power switch 17 by means of corresponding means 16, convert the detected magnitude of the value of the electrical current 29 through the power switch 17 into a mapped value by means of a polynomial with an order of the polynomial greater than one, and integrate this mapped value of the electrical current 29 through the power switch 17 over time, wherein this value of the electrical current 29 integrated over time is filtered, in particular low-pass filtered.Preferably, the computer core 2 of the control device 4 of the electronic fuse 825 compares the mapped and filtered value of the electrical current 29 with a threshold value, in particular the current square threshold value, wherein the switching state of the power switch 17 of the electronic fuse 825 preferably depends, as before, at least temporarily on the result of this comparison.

[0282] Preferably, the computer core 2 of the control device 4 of the electronic fuse 825 allows the transport of electrical energy from one or more energy sources 250 to the load 835, 830 at least temporarily by the computer core 2 of the control device 4 of the fuse 825 closing its circuit breaker 17. Typically, the computer core 2 of the control device 4 of the electronic fuse 825 prevents the transport of electrical energy from the load 835, 830 to one or more or all energy sources 250.

[0283] The electronic fuse 825 and / or the control device 4 of the electronic fuse 825 preferably comprise means 24, 23 for detecting the direction of the electrical current 29 through the circuit breaker 17. The computer core 2 of the control device 4 of the electronic fuse 825 preferably detects the direction of the flowing electrical current 29 with the aid of these means 24, 23. If a return flow of energy towards the energy source 250 is not desired, the computer core 2 of the control device 4 of the electronic fuse 825 opens the circuit breaker 17 of the electronic fuse 825 when the electrical current 29 flows from the load 830 to one or more energy sources 250 through the circuit breaker 17 of the electronic fuse 825.

[0284] The control device 4 of the electronic fuse or the fuse 825 preferably comprises a third power switch 615, which is different from the power switch 17 of the electronic fuse 825. The computer core 2 of the control device 4 of the fuse 825 typically closes this third power switch 615 when the electrical current 29 flows from the load 835 to one or more energy sources 250 through the power switch 17 of the electronic fuse 825. In this case, when the third power switch 615 is closed, this third power switch 615 then diverts the electrical current 29 from the load 835 into a current sink, in particular a reference potential line 201. Figure 9

[0285] Preferably, the electronic fuse 1, and in particular the control device 4 of the electronic fuse 1, comprises means 505, 905 for detecting the switchability of the circuit breaker 17 of the electronic fuse 1.

[0286] In the Fig. For the sake of clarity, not all useful and possibly common device components are shown in Figure 9. Further device components that the reader may consider to be potentially Fig. 1 can be found, for example, in the Fig. 1, Fig. 5, Fig. 6, Fig. 24, Fig. 41, Fig. 42, Fig. 52, Fig. 53, Fig. 54, Fig. 55, Fig. 57, Fig. 58. The combination of the device parts of the figure described here with those of these figures is expressly part of the disclosure of the document presented here.

[0287] The fuse 1 of the Fig. 9 has opposite fuse 1 the Fig. 5 In addition to the first test current source 505, a second test current source 905, the test current 915 of which is modulated by means of the control signal 910 with a modulation signal {505} from a second signal generator 920. The second test current 915 preferably corresponds to the first test current 515. This allows the control device 4 to feed the test current 515 into the circuit breaker 17 and, after passing through the circuit breaker 17, to withdraw it again from the current path as the second test current 915. If the circuit breaker 17 is not in the expected state, e.g., open or closed, the second test current 915 and / or the first test current 515 and / or the voltage drops between the terminals 26, 27, 28 of the circuit breaker 17 do not correspond to the expected values. From this, the computer core 2 of the control device 4 of the electronic fuse 1 can then conclude that the circuit breaker 1 is faulty.In such a fault event, the computer core 2 of the control device 4 of the electronic fuse 1 can signal such a fault, for example, to a higher-level computer system 12 or to the computer cores 2 of the control devices 4 of other electronic fuses. To control the second test current source 905, a second signal generator 920 preferably generates a second control signal 910 of the second electronic test current source 905, which ensures that the second test current 915, which the second test current source (910) draws from the circuit breaker (17), is modulated with the modulation signal {505}.

[0288] The document presented here proposes that the control device 4 of the electronic fuse 1 comprises a first test current source 505 and a second test current source 905. The control device 4 of the electronic fuse 1 controls the first test current source 505 and the second test current source 905. The first test current source 505, at the instigation of the control device 4, feeds the test current 515 into the first terminal 26 of the circuit breaker 17. The second test current source 905 then draws this test current 915 from the second terminal 28 of the circuit breaker 17. The second test current source 905 preferably comprises means for detecting the withdrawal of the test current. The computer core 2 of the control device 4 concludes that there is a fault in the circuit breaker 17 of the electronic fuse 1 if the second current source 905, contrary to the respective expectation, detects or does not detect a withdrawal of a test current 915. In this case, for example,The control device 4 can also evaluate a deviation of the magnitude of the second test current 915 outside of an expected value interval as an error. The computer core 2 of the control device 4 of the electronic fuse 1 preferably changes the switching state of the circuit breaker 17 one or more times and checks the switching state of the circuit breaker 17.

[0289] For this purpose, the computer core 2 of the control device 4 of the electronic fuse 1 preferably determines measured values ​​using measuring means of the electronic fuse 1 and / or the control device 4 of the electronic fuse 1. Preferably, the computer core 2 of the control device 4 and / or the higher-level computer system 2 execute a neural network model. The computer core 2 of the control device 4 and / or the higher-level computer system 2 use the determined measured values ​​as input values ​​of the neural network model they are executing. To enable this, the computer cores 2 of the control devices 4 of one or more fuses and / or the higher-level computer system 12 preferably transmit the necessary data for the input signals of the neural network to the computer core 2 of the control device 4 of the fuse 1 and / or the higher-level computer system 12, depending on which computer is currently executing the neural network model.

[0290] The switching state of the circuit breaker 17 of the electronic fuse 1 and / or at least one data message from the computer core 2 of the control device 4 of the electronic fuse 1 to a higher-level computer system 12 or a computer core 2 of another control device 4 of another electronic fuse 805 then preferably depends on an output signal of the neural network model.

[0291] The neural network model is preferably trained with suitable training data from the development period.

[0292] For example, the computer core 2 of the control device 4 of the electronic fuse 825 can detect a failure of one or more consumers 835 or a failure of one or more energy sources 250 or another defect in the system of the overall device by means of an output signal of the neural network model.

[0293] The computer core 2 of the control device 4 of the electronic fuse 825 can exchange data with another computer system 12 and / or with the control device 4 of another electronic fuse 805, for example also via a supply voltage line (6, 241, 242, 245) by means of power line communication.

[0294] To implement power line communication, the computer core 2 of the control device 4 of the electronic fuse 1 can use the power switch 17 of the electronic fuse 825 as a transmitting transistor for data communication via the supply voltage line (6, 241, 242, 245).

[0295] The computer core 2 of the control device 4 of the electronic fuse 1 can, for example, open the power switch 17 of the electronic fuse 1 to transmit a bit of a first logical value. The computer core 2 of the control device 4 of the electronic fuse 1 can, for example, close the power switch 17 of the electronic fuse 1 to transmit a bit of a second logical value that is different from the first logical value.

[0296] Instead of this modeling via complete opening and closing, communication via different internal resistances of the circuit breaker 17 is possible.

[0297] The computer core 2 of the control device 4 of the electronic fuse 1 can, for example, bring the power switch 17 of the electronic fuse 1 into a first state with a first electrical resistance value between the first terminal 26 of the power switch 17 and the second terminal 28 of the power switch 17 in order to transmit a bit of a first logical value. The computer core 2 of the control device 4 of the electronic fuse 1 can, for example, bring the power switch 17 of the electronic fuse 1 into a second state with a second electrical resistance value between the first terminal 26 of the power switch 17 and the second terminal 28 of the power switch 17 in order to transmit a bit of a second logical value that is different from the first logical value.

[0298] In order to be able to receive data via the supply voltage line, the control device 4 of the electronic fuse 1 preferably has means for detecting the temporal profile of the electrical current 29 through the circuit breaker 17 of the electronic fuse 1. These means preferably detect, at least temporarily, the temporal profile of the electrical current 29 through the circuit breaker 17 of the electronic fuse 1. These means can in particular comprise an analog-to-digital converter 570 and / or a memory of the computer core 2 of the control device 4 of the electronic fuse 1 or of the control device 4 of the electronic fuse 1.

[0299] The control device 4 of the electronic fuse 1 preferably comprises means for detecting the temporal variation of the voltage between a terminal (26, 27, 28) of the circuit breaker 17 of the electronic fuse 1 and a reference potential 201. These means typically detect, at least temporarily, the temporal variation of the voltage between a terminal (26, 27, 28) of the circuit breaker 17 of the electronic fuse 1 and a reference potential 201.

[0300] The computer core 2 of the control device 4 of the electronic security device 1 preferably performs a spectral analysis of the data of the temporal profiles, for example, using Fourier or Laplace transformation or wavelet transformation, and determines values ​​of the spectrum. The computer core 2 of the control device 4 of the electronic security device 1 preferably concludes the need for preventive maintenance in the event of significant deviations of the values ​​of these spectra from the associated expected value intervals for these values ​​of these spectra and / or signals this deviation to a higher-level computer system 12.

[0301] The electronic fuse 1 preferably comprises means for detecting the value of the electrical current 29 through the circuit breaker 17 of the electronic fuse 1 and for detecting a voltage at a terminal (26, 27, 28) of the circuit breaker 17 of the electronic fuse 1 against a reference potential 201. According to the proposal, the computer core 2 of the control device 4 of the electronic fuse 1 switches off the circuit breaker 17 of the electronic fuse 1 in the event of a voltage drop in the measured voltage values ​​below a minimum voltage value AND a simultaneous current increase in the value of the current 29 through the circuit breaker 17 above a maximum current value, thus opening the line switch 17 in this case. This is therefore the case, if a) the measured voltage value falls below a voltage threshold AND at the same time the measured current value exceeds a current threshold and / or if b) the amount of a speed of a measured temporal change in the voltage value drop exceeds a voltage drop speed threshold AND at the same time the amount of the speed of a measured temporal change in the amount of the electric current 29 through the circuit breaker 17, i.e. the current increase, exceeds a current increase speed threshold.

[0302] Under such shutdown conditions, the computer core 2 of the control device 4 of the electronic fuse 1 preferably switches off the power switch 17 of the electronic fuse 1 faster than within 1 µs. This has the advantage that in many cases, this very short time is sufficient to prevent damage.

[0303] The proposed electronic fuse 1 preferably has an emergency operation control 925. The emergency operation control 925 can preferably send data via a data bus 540, 9 and receive data via this data bus 9, 540. The control device 4 of the electronic fuse 1, 825 can, for example, in emergency operation be the control device 4 of another electronic fuse 805, which controls the other electronic fuse 805 by means of data communication via the data bus 9, 540 and by means of the emergency operation control 925 of the other electronic fuse 805 in the event of a failure of the control device 4 of the other electronic fuse 805. (See also Fig. 8) The emergency operation control 925 preferably monitors the data communication between the control device 4 and the emergency operation control 925 of the other fuse 805. The emergency operation control 925 preferably emulates simple functions of the control device 4 in the event of a failure of the data communication of the fuse 1 and thus preferably ensures at least basic protection of the connected supply line 19, 815, 820 and / or supply sub-networks and / or consumers and / or energy sources.

[0304] The computer core 2 of the control device 4 of the electronic fuse 1 sends a signal to a higher-level computer system 12 via the fuse data bus 9, 540, which signal indicates that a) the corresponding electronic fuse 1 is still present and / or that b) the corresponding electronic fuse 1 is ready for operation and / or which fuse identification information the fuse 1 has and / or which operating parameters the electronic fuse 1 has. Figure 10

[0305] Fig. 10 shows a proposed energy source-side intersection fuse 1000. The exemplary intersection fuse 1000 comprises an energy source-side first supply line section 1005 of a first supply line, a load-side second supply line section 1010 of a first supply line, an energy source-side first supply line section 1015 of a second supply line, a load-side second supply line section 1020 of a second supply line, a first electrical node 1025, a second electrical node 1030, a first electronic fuse 1035, as previously described, a second electronic fuse 1040, as previously described, a third electronic fuse 1045, as previously described, and a fourth electronic fuse 1050, as previously described.Depending on the switching state of the circuit breaker 17 of the first electronic fuse 1035, the first electronic fuse 1035 connects the energy source-side first supply line section 1005 of the first supply line to the first node 1025 or disconnects the energy source-side first supply line section 1005 of the first supply line from the first node 1025. Depending on the switching state of the circuit breaker 17 of the second electronic fuse 1040, the second electronic fuse 1040 connects the energy source-side first supply line section 1015 of the second supply line to the first node 1025 or disconnects the energy source-side first supply line section 1015 of the second supply line from the first node 1025.The second electronic fuse 1040 does not connect the power source-side first supply line section 1015 of the second supply line to the first node 1025 when the first electronic fuse 1035 connects the power source-side first supply line section 1005 of the first supply line to the first node 1025. The first electronic fuse 1040 does not connect the power source-side first supply line section 1005 of the first supply line to the first node 1025 when the second electronic fuse 1040 connects the power source-side first supply line section 1015 of the second supply line to the first node 1025.Depending on the switching state of the circuit breaker 17 of the third electronic fuse 1045, the third electronic fuse 1045 connects the energy source-side first supply line section 1005 of the first supply line to the second node 1030 or disconnects the energy source-side first supply line section 1005 of the first supply line from the second node 1030. Depending on the switching state of the circuit breaker 17 of the fourth electronic fuse 1050, the fourth electronic fuse 1050 disconnects the energy source-side first supply line section 1015 of the second supply line to the second node 1030 or disconnects the energy source-side first supply line section 1030 of the second supply line from the second node 1030.The fourth electronic fuse 1050 does not connect the energy source-side first supply line section 1015 of the second supply line to the second node 1030 when the third electronic fuse 1045 connects the energy source-side first supply line section 1005 of the first supply line to the second node. The third electronic fuse 1045 does not connect the energy source-side first supply line section of the first supply line to the second node 1030 when the fourth electronic fuse 1050 connects the energy source-side first supply line section 1015 of the second supply line to the second node 1030. The load-side second supply line section 1055 of the first supply line is connected to the first node 1025. The load-side second supply line section 1060 of the second supply line is connected to the second node 1030.

[0306] A proposed consumer-side intersection fuse 1000 comprises a power source-side first supply line section 1005 of a first supply line, a consumer-side second supply line section 1015 of a first supply line, a power source-side first supply line section 1055 of a second supply line, a consumer-side second supply line section 1060 of a second supply line, a third electrical node 1065, a fourth electrical node 1070, a first electronic fuse 1035 as previously described, a second electronic fuse 1040 as previously described, a third electronic fuse 1045 as previously described, and a fourth electronic fuse 1050 as previously described.Depending on the switching state of the circuit breaker 17 of the first electronic fuse 1035, the first electronic fuse 1035 connects the load-side second supply line section 1055 of the first supply line to the third node 1065 or disconnects the load-side second supply line section 1055 of the first supply line from the third node 1065. Depending on the switching state of the circuit breaker 17 of the second electronic fuse 1040, the second electronic fuse 1040 connects the load-side second supply line section 1055 of the first supply line to the fourth node 1070 or disconnects the load-side second supply line section 1055 of the first supply line 1055 from the fourth node 1070.The second electronic fuse 1040 does not connect the load-side second supply line section 1055 of the first supply line to the fourth node 1070 when the first electronic fuse 1035 connects the load-side second supply line section 1055 of the first supply line to the third node 1065. The first electronic fuse 1035 does not connect the load-side second supply line section 1055 of the first supply line to the third node 1055 when the second electronic fuse 1040 connects the load-side second supply line section of the first supply line 1055 to the fourth node 1070.Depending on the switching state of the circuit breaker 17 of the third electronic fuse 1045, the third electronic fuse 1045 connects the load-side second supply line section 1060 of the second supply line to the third node 1065 or disconnects the load-side second supply line section 1060 of the second supply line from the third node 1065. Depending on the switching state of the circuit breaker 17 of the fourth electronic fuse 1050, the fourth electronic fuse 1050 connects the load-side second supply line section 1060 of the second supply line to the fourth node 1070 or disconnects the load-side second supply line section 1060 of the second supply line from the fourth node 1070.The fourth electronic fuse 1050 does not connect the load-side second supply line section 1060 of the second supply line to the fourth node 1070 when the third electronic fuse 1045 connects the load-side second supply line section 1060 of the second supply line to the third node 1065. The third electronic fuse 1045 does not connect the load-side second supply line section 1060 of the second supply line to the third node 1065 when the fourth electronic fuse 1050 connects the load-side second supply line section 1060 of the second supply line to the fourth node 1070. The energy source-side first supply line section 1005 of the first supply line is connected to the third node 1065.The energy source-side first supply line section 1015 of the second supply line is connected to the fourth node 1070.

[0307] In the above-described crossing fuses, the switching state of the circuit breakers 17 of the electronic fuses (1035, 1040, 1045, 1050) of the crossing fuse 1000 depends on a determined energy demand of one or more consumers (830, 835) and / or on a determined energy supply capability of one or more energy sources (250, 251).

[0308] Preferably, the computer cores 2 of the control devices 4 of the electronic fuses (1035, 1040, 1045, 1050) of the intersection protection device 1000 are connected to each other and to a higher-level computer system 12 via a security data bus 9. The higher-level computer system 12 preferably determines the energy demand of one or more consumers 835, 830 that can supply electrical energy to the supply lines (1005, 1010: 1015, 1020, 1055, 1060) of the intersection protection device 1000. The higher-level computer system 12 determines the energy supply capacity of one or more energy sources 250, 251 that can supply electrical energy via the supply lines (1005, 1010: 1015, 1020, 1055, 1060) of the intersection protection device 1000.The computer system 12 transmits configuration commands to the computer cores 2 of the control devices 4 of the fuses (1035, 1040, 1045, 1050) of the intersection protection 1000 via the protection data bus 9. These configuration commands depend on the determined energy demand of these consumers 830, 831 and / or on the determined energy supply capacity of these energy sources 250, 251. These configuration commands of the higher-level computer system 12 preferably cause the opening and closing of circuit breakers 17 of the electronic fuses (1035, 1040, 1045, 1050) of the intersection protection 1000. Figure 11

[0309] Fig. 11 shows a proposed supply network 1100 with a higher-level computer system 12 and with a plurality of supply lines and with a plurality of intersection protection devices 1110 to 1118, which enable a flexible load- and supply-dependent reconfiguration of the supply network 1100.

[0310] The cross-connection fuses 1110 to 1118 are each inserted into supply line pairs of the supply lines of the supply network 1100. The higher-level computer system 12 is connected to the computer cores 2 of the control devices 4 of the electronic fuses of the cross-connection fuses 1110 to 1118 via a fuse data bus 9.

[0311] The electronic fuses of the cross-fuses 1110 to 1118 each have control devices 4 with a respective computer core. These fuses are preferably electronic fuses of the type described above.

[0312] To simplify the structure, the exemplary four electronic fuses of a respective cross-fuse of the cross-fuses 1110 to 1118 can also have a common control device (4) in common, so that this single control device 4 controls four circuit breakers 17 of the four fuses simultaneously.

[0313] The higher-level computer system 12 preferably determines the energy demand of electrical energy consumers 1121 to 1124 in the supply network 1100. The higher-level computer system 12 preferably also determines the energy supply capacity of electrical energy sources 1150 to 1155 in the supply network 1100.

[0314] The higher-level computer system 12 preferably determines the current safety requirement based on the current driving situation of the vehicle, which means that the higher-level computer system draws conclusions about the future energy supply capability and future energy consumption, for example, based on measurement data, which may in particular include measurement data from electronic fuses in the supply network 1100.

[0315] The higher-level computer system 12 preferably adapts the electrically effective topology of the supply network of the supply lines dynamically according to the determined energy demand and / or according to the determined energy supply capability and / or according to the current safety requirement by means of configuration commands via the safety data bus 9 to the computer cores 2 of the control devices 4 of the fuses of the intersection fuses (1110 to 1118). Figure 12

[0316] Fig. Figure 12 shows the basic flow of a method 1200 for operating a supply network. The method comprises the following steps: Step 1: Providing 1210 a supply network (250, 251, 210 to 213, 245) with a device part of the vehicle, hereinafter referred to as energy-supplying device part 210, wherein the energy-supplying supply part 210 comprises a control device 280, 4 and a memory in a first logical state; Step 2: Supplying 1220 the power supplying device part 210 with electrical energy from a power source 251, 250 of the vehicle; Step 3: Connecting 1230 a first terminal of a further line section 240 to the energy supplying device part 210 of the vehicle; Step 4: Connecting 1240 a second terminal of the further line section 240 to a further device part 220, 221 of the vehicle; Step 5: Signaling 1250 a switch-on signal to the control device 280, 4 of the energy-supplying device part 210; Step 6: Changing 1260 the logical state of the memory to a second logical state depending on the logical state of the memory; Step 7: Supplying 1270 the further device part 220 to 221 of the vehicle with electrical energy via the further line section 240 depending on the logical state of the memory.

[0317] Preferably, the signaling 1250 of the switch-on signal is carried out via a security data bus 9.

[0318] Preferably, the energy-supplying device part 210 has an electronic fuse 215 of the energy-supplying device part 250, 251. The supply 1270 of the further device part 220, 221 of the vehicle with electrical energy preferably takes place via the further line section 240 by switching on the electronic fuse 215 of the energy-supplying device part 210 depending on the logical state of the memory.

[0319] A variant of the method 1200 for operating a supply network 200 comprises the steps: Step 1: Providing 1210 a supply network 200 with a device part 210 of the vehicle, hereinafter referred to as energy-supplying device part 210. Step 2: Supplying 1220 the power supplying device part 210 with electrical energy from a power source 250, 251 of the vehicle; Step 3: Connecting 1230 a first terminal of a further line section 240 to the energy supplying device part 210 of the vehicle; Step 4: Connecting 1240 a second terminal of a further line section 240 to a further device part of the device parts 220 to 221 of the vehicle, wherein the further supply part of the device parts 220 to 221 of the vehicle comprises a control device 280, 4 and wherein the further supply part of the device parts 220 to 221 of the vehicle comprises a memory in a first logical state; Step 5: Signaling 1250 a switch-on signal to the control device 280, 4 of the further device part of the device parts (220 to 221) of the vehicle; Step 6: Changing 1260 the logical state of the memory to a second logical state depending on the logical state of the memory; Step 7: Supplying 1270 the further device part of the device parts 220 to 221 of the vehicle with electrical energy via the further line section 240 depending on the logical state of the memory. Preferably, the switch-on signal is also signaled here via a fuse data bus 9. Preferably, the further device part has an electronic fuse 225 for protecting the further device part 220. The further device part 220 of the vehicle is preferably supplied with electrical energy via the further line section 240 by switching on the power switch 17 of the electronic fuse 225 of the further device part 220 depending on the logical state of the memory. Figure 13

[0320] Fig. Figure 13 outlines a method 1300 for operating a vehicle (consumer-side feature version). It includes the steps: Step 1: Prepare 1305 the vehicle, (see also Fig. 7), wherein the vehicle comprises, among other things, device parts 210 and at least one wiring harness with line sections 240, 241, 245 and at least one energy source 250, 251, and at least one control computer 12, for example, a higher-level computer system 12, and at least two electronic fuses 214, 225. The device parts 220 are electrical consumers here. At least one or more energy sources 250, 251 supply at least two of the device parts 210, 220 with electrical energy via the wiring harness with line sections 240, 241, 245. The electronic fuses 214, 225 are preferably inserted into the wiring harness with line sections 240, 241, 245. Preferably, each of the electrical fuses 214, 225 is preferably assigned at least one electrical load 210, 225, as number 1, which is referred to below as the electrical load assigned to the respective electronic fuse.A fuse of the fuses 214, 215 can enable or prevent the power supply of the electrical consumer assigned to this fuse depending on a control signal from the control computer, for example a higher-level computer system 12. Step 2: Disabling 1310 the power supply to an associated electrical load by means of the corresponding fuse to which this load is associated; Step 3: Establishing 1315 an e...

Claims

[1] Supply network (200) for supplying electrical consumers (210 to 213 and 220 to 223 and 230 to 233) of a vehicle with electrical energy with one or more energy sources (250, 251) and with multiple consumers (210 to 213 and 220 to 223 and 230 to 233) and with several electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256), wherein the consumers (210 to 213 and 220 to 223 and 230 to 233) are connected to the one or more energy sources (250, 251) by means of supply lines (245, 240, 241, 242, 243), wherein the consumers (210 to 213 and 220 to 223 and 230 to 233) and the one or more energy sources (250, 251) together with the supply lines (245, 240 to 243) are connected to one another in a tree structure or a network, where the tree structure or network comprises subtrees or subnetworks, wherein the electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256) are inserted into supply lines so that these sub-trees of the tree structure can be separated from the remaining tree structure or can be connected to this remaining tree structure, or wherein the electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256) are inserted into supply lines so that these sub-networks of the network can be separated from the remaining network or can be connected to this remaining network, wherein one or more of the electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256) each have at least one data interface (280 to 293), which may be optical, wherein the supply network (200) comprises a higher-level computer system (12) and wherein the higher-level computer system (12) is configured to switch off subtrees or subnetworks of the supply network (200) by means of the electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256) having at least one data interface by means of data messages via a data bus (9), wherein at least one of the data messages includes a security code that enables the shutdown. [2] Supply network (200) according to claim 1, wherein the higher-level computer system (12) is configured to switch off subtrees or subnetworks of the supply network (200) by means of the electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256) having at least one data interface by means of data messages via a data bus (9) for maintenance purposes. [3] Supply network (200) according to claim 2, wherein a server (710) of a service provider or of the automobile manufacturer or of an agent of the automobile manufacturer is configured to transmit the security code or data used to generate the security code by the higher-level computer system (12) or control devices (4) of the electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256) to the higher-level computer system (12) or a control device (4) of a fuse of the electronic fuses (214 to 217, 225 to 228, 235 to 238, 255, 256). [4] Supply network (200) according to one of claims 1 to 3, wherein the data bus (9) is provided directly or indirectly, e.g. via gateways, with a terminal (740) for an input for reconfiguring the supply network (200) by means of the electronic fuses. [5] Supply network (200) according to claim 4, this dependent on claim 3, wherein the terminal (740) is also configured to transmit authentication data to a server (710) of the automobile manufacturer or an agent of the automobile manufacturer, wherein the terminal (740) is configured to receive the security code from the server (710) of the automobile manufacturer or an agent of the automobile manufacturer in dependence on the authentication data. [6] The supply network (200) according to claim 5, wherein the authentication data comprises authentication data of the operating person (730) and / or authentication data of the organization for which the person (730) works, and / or authentication data of the vehicle or and / or authentication data of the car key of the vehicle.

Images