Fail-safe E / E architecture for automated driving

Abstract

A system for motor vehicles is disclosed that efficiently manages and distributes electrical energy. It includes components such as a high-voltage source, a battery management system, a circuit breaker, low-voltage sources, a zone control unit, computing units, inverters, DC-DC converters, and a charging interface. The system ensures a safe and reliable power supply with effective communication and coordination between the components. It enables optimal power distribution, monitoring, and control, ensuring smooth operation of the vehicle's electrical systems.

Description

[0001] The present invention relates to a system for a motor vehicle. State of the art

[0002] In current powertrain systems, safety-relevant errors activate a so-called safe state, which is typically defined as system deactivation. At the vehicle level, this means the vehicle will stop running. System shutdown is achieved by deactivating the power control elements of the relevant drive units (typically an internal combustion engine or electric motor). Depending on the engine type, this shuts down or interrupts fuel injection and, if applicable, the air supply and ignition. For electric motors, the power supply is disconnected via circuit breakers.

[0003] The system behavior described above has also been implemented in vehicles that, in principle, have multiple drive units. This is possible because the driver assistance systems available to date always leave the actual responsibility for the driving task with the driver; this also applies in the event of a drive system failure and the vehicle breaking down.

[0004] Traction batteries for battery-electric vehicles typically have one or more connections for the consumers of the traction network in the vehicle, which are connected to the (serial and parallel) arrangement of the battery cells via a separating device (typically contactors).

[0005] The object of the present invention is to further improve the state of the art. This object is achieved by the features of the independent claims. Disclosure of the invention

[0006] To solve the problem, a system for a motor vehicle is proposed, comprising: - a high-voltage energy source, a battery management system, a circuit breaker, a first low-voltage energy source, a first consumer, a second consumer, a zone control unit, a zone control unit, a first computing unit, a second computing unit, a first inverter, a second inverter, a DC-DC converter and a charging interface, - wherein the first computing unit and the second computing unit each have a communicative connection to the third zone control device, - the zone control unit is communicatively connected to the DC-DC converter, - wherein the zone control unit is communicatively connected to the charging interface, the first inverter and the battery management, - wherein the high-voltage energy source is electrically connected to the battery management system and the isolating switch, - wherein the isolating switch is electrically connected to the first and second inverters, the charging interface and the DC-DC converter, - wherein the zone control device is electrically connected to the first low-voltage energy source and the DC-DC converter, wherein the DC-DC converter is designed as a low-voltage energy source, - wherein the first consumer is electrically connected to the first inverter, - wherein the second load is electrically connected to the second inverter, - and wherein the zone control unit is communicatively connected to the second inverter, - wherein the DC-DC converter electrically supplies the battery management, the zone control unit, the first computing unit, the first inverter and the battery management, - and wherein the first low-voltage energy source electrically supplies the zone control unit, the second computing unit and the second inverter.

[0007] Advantageously, the system according to the patent claim enables improved system availability in the event of system faults. By using a zone control unit as a communication gateway between the drive units and an integration platform, a functional extension can be achieved that enables separate shutdown of HV consumer branches. This is particularly advantageous for vehicles with increased requirements regarding the availability of HV supplies and / or separately switchable HV consumer branches to ensure restricted operating modes (degraded operation modes), as required for various automation levels in the context of autonomous driving. Restricted operating modes for the vehicle describe the state in which a vehicle operates with reduced power due to failures or malfunctions of certain components or subsystems.There are various types of such modes, such as redundancy mode, limp-home mode, reduced power mode, and emergency mode. In these modes, the vehicle can continue to operate, albeit with limited functionality, until the problems are resolved. Specifically, the system enables the separate shutdown of HV load branches to enable a restricted operating mode if a system fault occurs. This is particularly advantageous for vehicles with increased requirements regarding the availability of HV supplies and / or separately switchable HV load branches to ensure restricted operating modes, as required for various automation levels in autonomous driving.By using a zone control unit as a communication gateway between the drive units and an integration platform, a functional extension can be achieved that enables the separate shutdown of HV consumer branches. With the described solution, powertrain zones can be flexibly deployed as fail-degraded or fail-operational powertrain zones. An additional second zone control unit can be omitted. However, all functional advantages can still be utilized. In particular, this can ensure safe stop scenarios for highly automated vehicles (HAD vehicles) with the highest level of automation (Level 4, Level 5), for example, to ensure the residual availability of the drive system even in the event of a partial failure of relevant powertrain components.

[0008] A further improvement of the system is achieved according to a further development in that the zone control unit can be electrically supplied on the one hand by the low-voltage energy source and on the other hand by the DC-DC converter.

[0009] Advantageously, the feature of the claim enables the zone control unit to be electrically supplied by both the low-voltage energy source and the DC-DC converter. This improves the availability of the powertrain system in the event of system faults, particularly in vehicles with increased requirements regarding the availability of HV supplies and separately switchable HV consumer branches to ensure restricted operating modes. The possibility of a dual power supply increases the reliability of the zone control unit, which leads to greater reliability of the entire system. Compared to the prior art, in which the zone control unit is supplied by only one power source, the feature of the claim offers improved availability and reliability of the powertrain system.

[0010] A further improvement in the security of the system is achieved by designing the zone control unit as a communication gateway between the first and second computing units and the first and second inverters.

[0011] Advantageously, the feature of the patent claim, in which the zone control unit is configured as a communication gateway between the first and second processing units and the first and second inverters, enables improved availability of the powertrain system when system errors occur. Integrating the zone control unit as a communication gateway enables effective communication between the processing units and the inverters, leading to faster error detection and rectification. This increases system reliability and reduces vehicle downtime. Compared to the prior art, in which the system is deactivated when errors occur, the feature of the patent claim enables continuous use of the powertrain system, which is particularly advantageous for vehicles with increased requirements regarding the availability of HV supplies and separately switchable HV consumer branches.

[0012] This allows safe driving, possibly with reduced power and range, to be maintained. This is particularly important for assisted or automated driving, so that the vehicle can be brought to a safe stop or driven to a repair shop in the event of a fault. Short description of the characters

[0013] It shows: Fig. 1 a schematic representation of an embodiment of a system according to the invention for a motor vehicle. Detailed description of the implementation examples

[0014] The same reference numerals denote the same device components in all figures.

[0015] The Fig.1 shows a schematic representation of an embodiment of a system 100 according to the invention for a motor vehicle. The system 100 comprises a low-voltage energy source 30, which is connected to the first zone control unit 50 and the first and second processing units 61 by means of electrical connections (not shown). The first low-voltage energy source 30 is configured as a low-voltage energy source (NV), for example, as a 12V energy source. Voltages below 60V are referred to as low-voltage energy sources. The isolating switch 20 is designed in particular as a battery isolating switch in order to specifically disconnect the electrical connection to the consumers or energy sources, for example, controlled by a battery management system or a control unit.

[0016] The battery management system 10 continuously monitors and diagnoses the high-voltage energy source 5. To do so, the battery management system 10 records physical variables, such as voltages of the battery cells and temperatures of the high-voltage energy source 5.

[0017] Communicative connections (solid lines) particularly include communication networks that can be based on various protocols. Examples include networks based on CAN Controller Area Network, CAN-FD Controller Area Network (Flexible Data Rate), TCP / IP Transmission Control Protocol / Internet Protocol, LIN Local Interconnect Network, FlexRay, or other protocol forms. The battery management system 10 communicates via cable and / or wirelessly with the high-voltage energy source 5, and optionally with the first and second consumers 40; 41, in particular electric motors, and the circuit breaker 20.

[0018] The isolating switch 20 is electrically connected, on the one hand, to a high-voltage energy source 5 and the battery management system 10, and, on the other hand, to a first and second inverter 70:71, to a charging interface 90, and to a DC-DC converter 80. The isolating switch 20 is designed in particular as a battery isolating switch to specifically disconnect the electrical connection to the consumers or energy sources, for example, controlled by a battery management system 10 or a control unit.

[0019] The first and second inverters 70;71 are understood to mean, in particular, an inverter control unit 70;71.

[0020] The zone control unit 50 is communicatively connected, on the one hand, to the first and second computing units 60; 61 and, on the other hand, to the battery management system 10, the first inverter 70, the second inverter 71, the DC-DC converter 80 and the charging interface 90.

[0021] The DC-DC converter 80 also functions as a low-voltage energy source and is electrically connected to the first zone control unit 50, the first computing unit 60, the first and second inverters 70; 71, the charging interface 90, and the battery management system 10. Thus, the electrical loads can be supplied with power via the first low-voltage energy source 30 and / or via the DC-DC converter 80.

[0022] Furthermore, the first and second computing units 60; 61 are each communicatively connected to the first zone control unit 50.

[0023] The zone control unit 50 is further communicatively connected to the first inverter 70, the second inverter 71, the DC-DC converter 80, the charging interface 90 and the battery management 10.

[0024] The battery management system 10 can be understood as a system responsible for monitoring and controlling the battery in a motor vehicle. It ensures optimal charging of the battery by monitoring the battery's state of charge and temperature and adjusting the charging power accordingly. The battery management system also protects the battery from overcharging, overheating, and deep discharge by monitoring the voltage and current flow and, if necessary, activating the disconnect switch to isolate the battery from the rest of the system. Furthermore, the battery management system can also extend the battery's service life by evenly loading the cells and balancing the battery when necessary.

[0025] The first and second loads can be understood as an electrical device or component that draws power from the system and is supplied with energy by the first or second inverter. The loads can be, for example, electric motors, a braking system, an airbag system, a heating system, or any other electrical device required for the operation of the motor vehicle. The loads are electrically connected to the first or second inverter and are supplied with the required energy by them.

[0026] The zone control unit 50 is an electronic device, in particular a control unit, that is part of the system for a motor vehicle and plays a central role in controlling and monitoring various components of the system. It is specifically designed to coordinate and control communication between the DC-DC converter 80, the first and second computing units 60; 61, the charging interface 90, the battery management system 10, the first low-voltage energy source 30, the first inverter, and the second inverter 70; 71. The zone control unit can also function as a communication gateway between the first and second computing units and the first and second inverters. It can be electrically supplied by both the low-voltage energy source and the DC-DC converter. Overall, the zone control unit is an important component of the system for a motor vehicle, ensuring smooth and efficient operation of the system.A communication gateway is preferably a central communication node. The communication gateway acts as a data distributor for communication within the vehicle and, via a communication interface, with the outside world. It supports various bus systems (Ethernet, CAN, LIN, FlexRay). The communication gateway also serves as the central vehicle access point for the diagnostic tester and routes diagnostic requests from the tester to the various domains in the vehicle.

[0027] The particular advantage of System 100 is that it utilizes the zone control unit 50, which can be electrically supplied by the first low-voltage energy source 30 and also by the DC-DC converter 80. The highly integrated zone control unit 50 provides the complete range of functions of two individual zone control units.

[0028] The zone control unit 50 can be electrically supplied, on the one hand, by the first low-voltage energy source 30 and, on the other hand, via the DC-DC converter 80. Furthermore, the zone control unit 50 provides two independent communication networks for connected, subordinate control units, in this case the first and second inverters 70;71, and two independent communication channels to the first and second processing units 60;61.

[0029] Such a solution is particularly advantageous when a geometric separation of zones with their own zone control devices is not necessary or possible, but functional redundancy is required to ensure safe continued operation or emergency operation in the event of a fault.

[0030] Specifically, this can be particularly advantageous, for example, in applications for trucks with dual axles and at least one drive unit per axle. A geometric separation of zones makes little sense, since the actual drive axles are located close together. However, if specific availability requirements are placed on the drive system in the context of automated driving, the described solution can be flexibly deployed as a fail-degraded or fail-operational powertrain zone. An additional second zone control unit can be omitted. However, all functional advantages can still be utilized.

[0031] In particular, this makes it possible to ensure safe stop scenarios for highly automated vehicles (HAD vehicles) with the highest level of automation (Level 4, Level 5), for example to ensure the residual availability of the drive system even in the event of partial failure of relevant powertrain components.

[0032] The DC-DC converter 80 can be understood as an electronic circuit that converts an input voltage with a specific voltage and frequency into an output voltage with a different voltage and frequency. The DC-DC converter can be considered a type of electronic transformer that converts the input voltage into a higher or lower output voltage, depending on the system requirements. The DC-DC converter can also be referred to as a DC-DC converter and is often used in systems that require a stable and reliable power supply, such as in automobiles. The DC-DC converter can be available in various designs, such as a buck converter, boost converter, or buck-boost converter, depending on the system requirements.

Claims

[1] System (100) for a motor vehicle comprising: a high-voltage energy source (5), a battery management system (10), a circuit breaker (20), a first low-voltage energy source (30), a first consumer (40), a second consumer (41), a zone control unit (50), a zone control unit (50), a first computing unit (60), a second computing unit (61), a first inverter (70), a second inverter (71), a DC-DC converter (80), and a charging interface (90), - wherein the first computing unit (60) and the second computing unit (61) each have a communicative connection to the third zone control device (52), - wherein the zone control device (50) is communicatively connected to the DC-DC converter (80), - wherein the zone control device (50) is communicatively connected to the charging interface (90), the first inverter (70) and the battery management (10), - wherein the high-voltage energy source (5) is electrically connected to the battery management system (10) and the isolating switch (20), - wherein the isolating switch (20) is electrically connected to the first and second inverters (70; 71), the charging interface (90) and the DC-DC converter (80), - wherein the zone control device (50) is electrically connected to the first low-voltage energy source (30) and the DC-DC converter (80), wherein the DC-DC converter (80) is designed as a low-voltage energy source, - wherein the first consumer (40) is electrically connected to the first inverter (70), - wherein the second consumer (41) is electrically connected to the second inverter (71), - and wherein the zone control device (50) is communicatively connected to the second inverter (71), - wherein the DC-DC converter (80) electrically supplies the battery management (10), the zone control unit (50), the first computing unit (60), the first inverter (70) and the battery management (10), - and wherein the first low-voltage energy source (30) electrically supplies the zone control unit (50), the second computing unit (61) and the second inverter (71). [2] System (100) according to claim 1, characterized by that the zone control device (50) can be electrically supplied on the one hand by the low-voltage energy source (30) and on the other hand by the DC-DC converter (80). [3] System (100) according to claim 1 or 2, characterized by that the zone control device (50) is designed as a communication gateway between the first and second computing units (60;61) and the first and second inverters (70;71).

Images