Fail-safe E / E architecture for automated driving

Abstract

A system for motor vehicles is disclosed that efficiently manages and distributes electrical energy. It includes components such as a high-voltage source, a battery management system, a circuit breaker, low-voltage sources, zone control units, computing units, inverters, DC-DC converters, and a charging interface. The system ensures a safe and reliable power supply with effective communication and coordination between the components. It enables optimal power distribution, monitoring, and control, ensuring smooth operation of the vehicle's electrical systems.

Description

The present invention relates to an electric power system, in particular for a motor vehicle.Prior ArtIn current Powertrain systems, a so-called safe state is activated in the event of safety-relevant errors, which is typically defined as deactivation of the system. At the vehicle level, this means that the vehicle remains in position. The system deactivation is implemented by deactivating the power control elements of the relevant drive units (typically an internal combustion engine or an electric motor). In internal combustion engines, the fuel injection and, if appropriate, the air supply and ignition are thus switched off or interrupted depending on the engine type. In electric motors, the power supply is disconnected via power switches.Even in vehicles which in principle have a plurality of drive units, the system behavior described above has been implemented up to now. This is possible since the driver assistance systems available hitherto always still leave the actual responsibility of the driving task on the part of the vehicle driver; this also applies in the event of failure of the drive system and the vehicle remaining in the standstill.Traction batteries for battery-electric vehicles typically have one or more connections for the consumers of the traction network in the vehicle, which connections are connected via a disconnection device (type. Contactors) are connected to the (serial and parallel) arrangement of the battery cells.It is the object of the present invention to further improve the prior art. This object is achieved by the features of the independent claims.Disclosure of the InventionTo achieve the object, a system for a motor vehicle is proposed, comprising:a high-voltage energy source, a battery management system, a circuit breaker, a first low-voltage energy source, a second low-voltage energy source, a first load, a second load, a first zone control device, a second zone control device, a first computing unit, a second computing unit, a first inverter, a second inverter, a DC-DC converter and a charging interface,wherein the first computing unit has a communicative connection to a first and a second zone control device,wherein the second computing unit has a communicative connection to the first and the second zone control device,and wherein the first and the second zone control device are communicatively connected to one another and to the DC-DC converter,wherein the first zone control device is communicatively connected to the DC-to-DC converter, the charging interface, the first inverter and the battery management,wherein the high-voltage energy source is electrically connected to the battery management system and the isolating switch,wherein the circuit breaker is electrically connected to the first and second inverters, the charging interface and the DC-DC converter,wherein the first zone control device is electrically connected to the first low-voltage energy source and the second zone control device is electrically connected to the second low-voltage energy source,wherein the first load is electrically connected to the first inverter,wherein the second load is electrically connected to the second inverter,wherein the second zone controller is communicatively connected to the second inverter,wherein the first low-voltage energy source electrically supplies the battery management system to the first zone control device, the first arithmetic unit and the first inverter,and wherein the second low-voltage power source electrically supplies the second zone controller, the second arithmetic unit, and the second inverter.This design has the particular advantage that, for example in the event of a fault in the at least one or second load, driving operation, optionally with a reduced power and range, is made possible even in the event of a fault. Comprehensive redundancy is provided by the use of two zone controllers, two low-voltage energy sources and two inverters. This means that in the event of a failure of one component, the other component may continue to function to maintain power supply and communication. This increases the availability of the system and reduces the probability of failure.Advantageously, the system according to the patent claim enables improved availability of the power train in the event of system errors. By using two separate zone control units and computing units, the drive functions on a vehicle axle can be controlled individually for each wheel. The zone controllers are geometrically located and provide flexible functional expansion in each zone. The system offers a circumferential redundancy property in order to realize a graded residual availability of the power train in the event of a fault. The use of two low voltage power sources allows separate supply of the zone controllers, arithmetic units and inverters, which increases the reliability of the system. In comparison with the prior art, the system offers improved residual availability of the drive system even in the event of partial failure of relevant components of the power train.The division of the vehicle into zones allows flexible functional expansion within each zone. This means that separate and independent subsystems can be provided for the drive train, thereby enabling separate control and coordination of the individual systems. This increases flexibility in integrating new functions and facilitates maintenance and diagnosis of failures.The architecture enables optimum use of the components and resources present. By using two zone controllers, separate functions can be implemented in each zone without requiring complete geometric separation. This reduces the cost of additional hardware and simplifies system integration. The redundancy and availability of the power supply and communication increase the safety of the system. In the event of a component failure, the system may continue to be operated in a safe state to ensure safe travel or stop. This is especially important for highly automated vehicles in which safety has a high priority. The architecture can be scaled according to requirements and functional extensions. By dividing the vehicle into zones, new functions and systems can be added in certain zones without affecting other zones. Overall, the proposed architecture provides a robust and reliable solution for the energy supply and communication in the vehicle. It enables efficient control and coordination of the various components and functions and meets the high safety requirements of highly automated vehicles. Thus, a safe driving operation, optionally with a reduced power and range, can be maintained. This is a prerequisite, in particular in assisted or automated driving, so that the vehicle can be stopped in a safe state or driven into the workshop in the event of a fault. This is a prerequisite, in particular in assisted or automated driving, so that the vehicle can be transferred in the event of a fault into a safe state, in which, for example, a safe stop position ("safe stop location") can be reached.According to a further refinement of the system, the battery management system, the first low-voltage energy source, the first arithmetic unit, the first zone control unit and the first inverter form a first zone and the second low-voltage energy source, the second zone control unit, the second arithmetic unit and the second inverter form a second zone for the system.This division into two zones achieves improved efficiency and performance of the system. Each zone is responsible for a particular area of the system and can operate independently of the other zone. As a result, tasks can be distributed and executed more efficiently. The battery management system in the first zone is responsible for monitoring and controlling the first low-voltage energy source. It ensures that the battery is used optimally and the energy efficiency is maximized. The first computing unit in the first zone is responsible for computing and controlling the processes in this zone. It processes the data of the battery management system and controls the processes in the first zone. The first zone controller in the first zone is responsible for controlling the various components in that zone. It coordinates the activities of the first low voltage power source, the first arithmetic unit and the first inverter. The second zone of the system accommodates the second low-voltage power source, the second zone controller, the second arithmetic unit, and the second inverter. These components operate independently of the first zone and are responsible for another area of the system. By dividing into two zones, better control and control of the system is made possible. Each zone may operate independently of each other, thus improving the efficiency and performance of the system.A further improvement in the safety of the system is achieved in that, according to one embodiment, the first and second zone control units are configured as a communication gateway between the first and second computing units and the first and second inverters.The configuration of the first and second zone control devices as a communication gateway between the computing units and inverters offers an additional safety level for the system. This configuration channels and monitors communication between the various components of the system. The zone controllers function as switches and ensure that the communication between the computing units and inverters is carried out reliably and reliably. They monitor the data flow, check the integrity of the transmitted data and ensure that only authorized communication takes place. The use of communication gateways minimizes the risk of unauthorized access, data manipulation or other security threats. The gateways may implement security protocols to encrypt the communication and ensure data integrity. In addition, the central control of the communication via the zone control devices enables effective monitoring and fault detection. Deviations or anomalies in the communication can be quickly detected and appropriate measures taken to ensure the safety of the system. Overall, the configuration of the zone control devices as communication gateways contributes to improving the safety of the system in that they enable reliable and reliable communication between the arithmetic units and inverters and at the same time ensure central monitoring and monitoring.Brief Description of the FiguresExemplary embodiments of the invention are illustrated in the drawings and explained in more detail in the following description.It shows: FIG. 1 shows a schematic illustration of an embodiment of a system according to the invention for a motor vehicle.DETAILED DESCRIPTION OF THE EMBODIMENTSFIG. 1 shows a schematic illustration of an embodiment of a system 100 according to the invention for a motor vehicle. The system 100 comprises a first low-voltage energy source 30, which is connected by means of electrical connections (not shown in greater detail) to a first zone control device 50, a first computing unit 60, a battery management system 10 and a first inverter 70. In this case, the first low-voltage energy source 30 is designed as a low-voltage energy source (NV), for example as a 12 V energy source. At voltages below 60 V, these are referred to as low-voltage energy sources. The circuit breaker 20 is designed in particular as a battery disconnect switch in order, for example under the control of a battery management system or a control device, to break the electrical connection to the consumers or energy sources in a targeted manner.The battery management system 10 continuously monitors or diagnoses the high-voltage energy source 5 for this purpose, the battery management system 10 detects physical variables, such as voltages of the battery cells and temperatures of the high-voltage energy source 5.Among communicative connections (solid lines) are in particular communication networks that can be based on different protocols. By way of example, this includes, inter alia, networks based on CAN controller area network, CAN-FD controller area network flexible data rate, TCP / IP transmission control protocol / Internet protocol, LIN local interconnect network, FlexRay or further protocol forms. The battery management system 10 communicates in a cable-bound and / or cable-free manner with that of the high-voltage energy source 5, and optionally with the first and second consumers 40; 41, in particular electric motors, and the isolating switch 20.The circuit breaker 20 is connected electrically, on the one hand, to a high-voltage energy source 5 and the battery management system 10 and, on the other hand, to a first and second inverter 70:71, to a charging interface 90 and to a DC-DC converter 80. The circuit breaker 20 is designed in particular as a battery circuit breaker in order, for example under the control of a battery management system 10 or a control device, to break the electrical connection to the consumers or energy sources in a targeted manner.The first and second inverters 70; 71 are understood to mean, in particular, an inverter control device 70; 71.The first zone control device 50 is communicatively connected, on the one hand, to the first and second arithmetic units 60; 61, a second zone control device 51 and, on the other hand, to the battery management system 10, the first inverter 70, the DC-DC converter 80 and the charging interface 90.The second zone control device 51 is connected on the one hand communicatively to the first and second arithmetic units 60; 61, the first zone control device 50 and on the other hand to the second inverter 71.The first and the second zone control device 50; 51 are preferably configured as communication gateways between the computing units 60; 61 and the first and second inverters 70; 71.A communication gateway is preferably understood to mean a central communication node. The communication gateway acts as a data distributor for communication within the vehicle and over a communication interface with the outside world. It supports different bus systems (Ethernet, CAN, LIN). The communication gateway also serves as a central vehicle access for the diagnostic tester and routes diagnostic requests from the tester to the different domains in the vehicle. Since zone control devices 50; 51 no longer have a classic function assignment such as, for example, a drive train (Powertrain), chassis (chassis), infotainment, but rather represent a geometric grouping of different subsystems and functions, a very flexible expansion of the function is possible in each zone.For the Powertrain aspects, this means that the use of a second zone directly produces two separate and independent subsystems, at least with respect to the voltage supply and communication network. These subsystems can be controlled and coordinated separately via the arithmetic units 60; 61.In this case, the battery management system 10, the first low-voltage energy source 30, the first zone control device 50, the first arithmetic unit 60 and the first inverter 70 form a first zone Z 1 for the system 100.Furthermore, the second low-voltage energy source 31, the second zone control device 51, the second arithmetic unit 61 and the second inverter 71 form a second zone Z 2 for the system 100.Thus, a simple zone oriented EE architecture for the system can be obtained. An important advantage of this system is that the voltage supply of the connected control units in a zone, in each case the first or second low-voltage energy source 30; 31, is ensured.Thus, two separate and independent subsystems are obtained directly, at least with respect to the voltage supply and communication network. These subsystems can be controlled and coordinated separately via the first and second arithmetic units 60; 61.The first and the second zones Z 1; Z 2 have the particular advantage here that classic electric motor control units can be used in each case in both zones Z 1; Z 2. The actual coordination of the drive systems takes place outside the zones Z 1; Z 2 by means of the first and the second computing unit 60; 61. With regard to the functionality of the control units used, each zone has an independent voltage and communication network, i.e. in the event of a fault in one of the two zones Z 1; Z 2, a safe continued propulsion for the system 100 is still possible.For a failure or fault case in the first zone Z 1, safe operation of the system 100 can still be ensured via the components of the second zone Z 2.For a failure or fault case in the second zone Z 2, safe operation of the system 100 can still be ensured via the components of the first zone Z 1.The term battery management system may be understood as a system responsible for monitoring and controlling the battery in a motor vehicle. It provides for the battery to be charged optimally and monitors the state of the battery to ensure that it is not overcharged or overheated. The battery management system may also monitor and control the performance of the battery to ensure that it operates efficiently and reaches maximum life. It may also coordinate communication between the battery and other systems in the vehicle to ensure optimal performance and efficiencyThe DC-DC converter 80 may be understood as an electronic circuit that converts an input voltage having a certain voltage and frequency into an output voltage having a different voltage and frequency. The DC-DC converter may be considered a type of electronic transformer that converts the input voltage to a higher or lower output voltage depending on the requirements of the system. The DC-DC converter can also be referred to as a DC-DC converter and is frequently used in systems which require a stable and reliable power supply, such as in motor vehicles. The DC-to-DC converter can be present in various embodiments, such as a buck converter, boost converter or a buck-boost converter, depending on the requirements of the system.In particular for highly automated vehicles HAD vehicles with the highest degree of automation (level 4, level 5), it is thus possible to ensure safe stop scenarios, in order to be able to ensure, for example, a remaining availability of the drive system even in the event of partial failure of relevant components of the power train.With the further development of assistance systems, however, the driver can provide control over his vehicle to the vehicle in the future in more and more driving situations. During this time, he may devote himself to other tasks.Collectively, these functions are referred to as HAD (Highly Automatically Driving). In the highest expansion stages, the vehicle can drive completely autonomously; a driver interaction in the sense of vehicle control is in some cases not provided at all or is no longer possible at all. Vehicles of the highest HAD expansion level are therefore often also referred to as robot taxis.In these vehicles as well, a safety concept must be defined which transfers the vehicle into the so-called "safe state". In the case of vehicles in HAD operation, this is also referred to as "safe stop scenario" or "minimum risk condition". The transition to these more reliable states is usually referred to as a "minimum risk manuver" and describes an operating strategy of the vehicle after the occurrence of a technical fault or the failure of a component.In particular in the case of HAD vehicles with the highest degree of automation, simple lane stay is typically no longer deemed sufficient. Reaching a lateral lane, an emergency stop bay, a parking lot or even ensuring reaching the destination are conceivable "safe stop scenarios".What is common to the scenarios mentioned is that, in order to ensure these safe stop scenarios, the drive system generally needs to be able to be permanently available even in the event of partial failure of relevant components of the power train.The EE architecture described here exhibits a fail operational / fail degraded poevalrain architecture which, corresponding to the expansion stage, offers a circumferential redundancy property in order to thus realize a graded residual availability of the power train in the event of a fault. The approach is described in the context of a zone-oriented EE architecture, since this provides particular advantages.

Claims

A system (100) for a motor vehicle, comprising: a high-voltage energy source (5), a battery management system (10), a disconnection switch (20), a first low-voltage energy source (30), a second low-voltage energy source (31), a first load (40), a second load (41), a first zone control unit (50), a second zone control unit (51), a first computing unit (60), a second computing unit (61), a first inverter (70), a second inverter (71), a DC-to-DC converter (80) and a charging interface (90), - wherein the first computing unit (60) has a communicative connection to a first and a second zone control unit (50; 51), - wherein the second computing unit (61) has a communicative connection to the first and the second zone control unit (50; 51), and wherein the first and the second zone control device (50; 51) are communicatively connected to one another and to the DC voltage converter (80), - wherein the first zone control device (50) is communicatively connected to the DC voltage converter (80), the charging interface (90), the first inverter (70) and the battery management (10), - wherein the high-voltage energy source (5) is electrically connected to the battery management system (10) and the isolating switch (20), - wherein the isolating switch (20) is electrically connected to the first and the second inverter (70; 71), the charging interface (90) and the DC voltage converter (80), - wherein the first zone control device (50) is electrically connected to the first low-voltage energy source (30) and the second zone control device (51) is electrically connected to the second low-voltage energy source (31), - wherein the first load (40) is electrically connected to the first inverter (70), wherein the second load (41) is electrically connected to the second inverter (71), - wherein the second zone control device (51) is communicatively connected to the second inverter (71), - wherein the first low-voltage energy source (30) electrically supplies the battery management (10) to the first zone control device (50), the first computing unit (60) and the first inverter (70), - and wherein the second low-voltage energy source (31) electrically supplies the second zone control device (51), the second computing unit (61) and the second inverter (71).The system (100) according to claim 1, characterized in that the battery management system (10), the first low-voltage power source (30), the first computing unit (60), the first zone controller (50) and the first inverter (70) form a first zone (Z1), and the second low-voltage power source (31), the second zone controller (51), the second computing unit (61) and the second inverter (71) form a second zone (Z2) for the system (100).System according to Claim 1 or 2, characterized in that the first and second zone control units (50; 51) are designed as a communication gateway between the first and second arithmetic units (60; 61) and the first and second inverter (70; 71).

Images