Motor vehicle control unit, motor vehicle with such a control unit, method for operating and designing a control unit

Abstract

The invention relates to a control unit (3) for a motor vehicle (1), configured to perform at least one control function in the motor vehicle (1), with - a control circuit (5) which is configured to perform at least one control function, and - a safety circuit (7) which is configured to detect a switching request, and to switch off the control circuit (5) in a first switching state and to switch on in a second switching state depending on the switching request, wherein - the safety circuit (7) is at least partially encased in a potting compound, and wherein - the control circuit (5) is unpotted.

Description

[0001] The invention relates to a control unit for a motor vehicle, a motor vehicle with such a control unit, a method for operating and a method for designing a control unit.

[0002] For motor vehicles that either enter potentially explosive atmospheres or transport explosive substances themselves, a battery disconnect switch is mandatory by regulation. This switch allows the vehicle battery to be disconnected from the vehicle's electrical system. So-called continuous current circuits of a control unit, such as those in a control unit designed to disconnect the vehicle's electrical system from the battery or in a tachograph, which continue to receive electrical power even when disconnected, must meet prescribed conditions to be approved. In particular, they must comply with one of several categorized types of ignition protection; specifically, they must exhibit intrinsic safety, particularly through ignition energy limitation, increased safety, particularly through spark prevention, or potting.Typically, such control units, which have at least one permanent electrical circuit, are completely potted, a process that is time-consuming, expensive, and resource-intensive to manufacture. Furthermore, any modifications to the circuitry of such a control unit require recertification of the entire unit, which is again complex, time-consuming, and expensive. Rework or repairs to the control unit are also virtually impossible.

[0003] The invention is therefore based on the objective of creating a control unit for a motor vehicle, a motor vehicle with such a control unit, a method for operating and a method for designing a control unit, wherein the aforementioned disadvantages are at least reduced, preferably do not occur.

[0004] The problem is solved by providing the present technical teaching, in particular the teaching of the independent claims as well as the preferred embodiments disclosed in the dependent claims and the description.

[0005] The task is solved, in particular in a first aspect, by creating a control unit for a motor vehicle which is set up to perform at least one control function in the motor vehicle, wherein the control unit has: - a control circuit that is set up to perform at least one control function, and - a safety circuit that is set up to detect a switching request and to switch off the control circuit in a first switching state and switch it on in a second switching state, depending on the switching request.

[0006] Because the safety circuit is capable of switching off the control circuit in its first switching state, it is possible to reset the control circuit to its first switching state in a hazardous situation, particularly in a potentially explosive atmosphere, thereby eliminating any danger emanating from the control circuit by switching it off. Therefore, the control circuit advantageously does not need to meet any of the ignition protection requirements, nor does it require certification. Accordingly, the control circuit can advantageously remain unencapsulated. Only the safety circuit must meet at least one ignition protection requirement and is accordingly encapsulated, for example – and preferably only where no other ignition protection requirement, particularly intrinsic safety, can be guaranteed – with a potting compound. This simplifies the manufacturing of the control unit, reduces production time, and lowers costs.Furthermore, no new certification of the control unit is required if changes are made to the control circuitry. Only changes to the safety circuitry may require new certification. This significantly reduces the certification effort. In practice, changes to the control circuitry, regarding its functionality and / or operation, occur much more frequently than with the comparatively simple safety circuitry, which can be designed to be robust and usable in the long term. This also significantly reduces the effort required for new certification of the control unit, as it is needed far less often. Additionally, rework and repairs to the control unit can be carried out easily.

[0007] In one embodiment, the safety circuit satisfies at least one type of ignition protection. Optionally, the control circuit does not satisfy any type of ignition protection; this is advantageously possible because it can be switched off—in particular, completely. It is possible that different sections of the safety circuit satisfy one type of ignition protection, in particular exactly the same type of ignition protection. However, it is also possible that different sections of the safety circuit satisfy different types of ignition protection.

[0008] In one embodiment, the safety circuit is at least partially potted with a potting compound, and the control circuit is not potted.

[0009] The first switching state is, in particular, a shutdown state. The safety circuit is specifically designed to switch the control circuit off-energized and / or de-energized, in particular de-energized and de-energized, in the shutdown state.

[0010] The second switching state is, in particular, a switching-on state. The safety circuit is specifically designed to supply the control circuit with voltage and / or current in the switching-on state, or at least to pass voltage and / or current to the control circuit so that it is supplied with voltage and / or current.

[0011] In the context of this technical teaching, the fact that the control circuit is unencapsulated means that it is not potted, i.e., free of potting compound. As already explained, potting the control circuit is unnecessary because it can be switched off, in particular de-energized and disconnected from the power supply, in a hazardous area.

[0012] In the context of the present technical teaching, the fact that the safety circuit is at least partially encapsulated with a potting compound means in particular that those areas of the safety circuit which are under constant current and optionally do not meet the requirements of another type of ignition protection are encapsulated with the potting compound.

[0013] In particular, all circuit areas of the safety circuit that are under continuous current must meet at least one type of ignition protection, especially in accordance with DIN EN 60079 in the version applicable on the date determining the priority date of this intellectual property right; for example, they may all or some of them meet the type of ignition protection “intrinsic safety” (in particular “ib” according to DIN EN 60079) by limiting the voltage and / or current in such a way that the amount of energy released in the event of a spark is less than the minimum ignition energy required for ignition, or they may meet the type of ignition protection “increased safety” (in particular “ib” according to DIN EN 60079), or they are potted and thus meet the type of ignition protection “encapsulation” (in particular “mb” according to DIN EN 60079).It is also possible that all permanently energized circuit sections of the safety circuit meet the "intrinsic safety" type of protection, with some additionally being potted. Potted circuit sections do not necessarily meet the "encapsulation" type of protection.

[0014] Circuit areas that are not under continuous current do not need to comply with any type of ignition protection.

[0015] According to a further development of the invention, the switching request is selected from a group consisting of a shutdown request, a switch-on request, and a combination of these requests. Advantageously, this method uses a simple and reliable switching request. In one embodiment, the switching request results from or originates from a selector switch—in particular, a manually operated one; preferably, the switching request is a switching edge of the selector switch, which occurs especially when changing a switching position. The selector switch can be manually operated, in particular, by the driver of the vehicle or another suitable person when the vehicle has entered or is leaving an explosion-proof area.Alternatively or additionally, the switching request can be generated automatically and / or remotely, for example based on warning signs or hazard symbols detected by means of image recognition, by means of geofencing, by - especially automatic - communication between the vehicle and an explosion-proof system, or by a backend or a remote driver.

[0016] According to a further development of the invention, the control unit is designed as a battery disconnect switch. This configuration of the control unit realizes the advantages mentioned above in a particularly effective way. In particular, the battery disconnect switch can be connected upstream of all other electrical or electronic devices of the motor vehicle, so that all these devices—except for the permanent current circuits of the battery disconnect switch's safety circuit—are de-energized and disconnected from the vehicle battery when they are disconnected by the battery disconnect switch. The disconnection preferably occurs at the positive terminal of the vehicle battery.

[0017] Alternatively, the control unit can be designed as a tachograph or as a control unit for a tachograph.

[0018] In one embodiment, the control circuit is configured to electrically disconnect a vehicle's electrical circuit from the vehicle battery. This is where the previously mentioned advantages are particularly realized. The control circuit preferably acts on a battery disconnect switch that isolates the positive terminal of the vehicle battery from the vehicle's electrical circuit, and especially from all other electrical and electronic devices of the vehicle.

[0019] Additionally, the control circuit is preferably configured to exchange data with a vehicle control unit to prepare for disconnecting the vehicle's electrical system from the vehicle battery. Specifically, the control circuit can inform the vehicle control unit via a suitable interface that the disconnection is imminent, allowing the control unit to save any data and also to bring the vehicle into a state capable of being switched off or ready for shutdown. Furthermore, through communication with the vehicle control unit, the control circuit can ensure that the vehicle is in a state capable of being switched off or ready for shutdown, in particular that the vehicle is stationary, before the disconnection is performed and the battery disconnect switch is activated.

[0020] According to a further development of the invention, the control circuit includes the battery disconnect switch.

[0021] According to a further development of the invention, the safety circuit is provided to have: - a request detection circuit, configured to detect the switching request, in particular configured to detect a switching edge as the switching request, and - a switching function circuit, configured to switch the control circuit between the first switching state and the second switching state depending on the switching requirement, wherein - the request detection circuit is operatively connected to the switching function circuit in order to control the switching function circuit depending on the detected switching request.

[0022] In this way, reliable detection of the switching request and efficient execution of the switching process can be advantageously ensured. Specifically, the request detection circuit can be configured to detect the switching edge of the selector switch.

[0023] According to a further development of the invention, the switching circuit comprises at least one electronic switch configured to short-circuit an operating voltage for the control circuit in the first switching state, or—in other words—to connect it to ground or pull it to ground. This represents a particularly efficient way of switching the control circuit off from voltage and current. Preferably, a limiting circuit is provided that limits the resulting short-circuit current, in particular such that a fuse intended to protect the power supply of the control circuit does not trip. Furthermore, preferably an additional shutdown circuit is provided, which is subsequently activated and interrupts the short-circuit current so that it does not flow continuously in the shutdown state.In particular, the electronic switch is open in the second switching state, so that the operating voltage for the control circuit is not short-circuited. Furthermore, the additional shutdown circuit is preferably deactivated in the second switching state such that the control circuit can be supplied with the operating voltage and electrical power. The switching circuit can – particularly for reasons of redundancy – have more than one electronic switch, preferably two.

[0024] In one embodiment, the electronic switch is designed as a transistor. In another embodiment, the transistor is a field-effect transistor, in particular a MOSFET. This represents a design of the electronic switch that is both simple and reliable.

[0025] According to a further development of the invention, the safety circuit includes a wake-up circuit configured to activate the control circuit when switching from the first to the second switching state, wherein the wake-up circuit is not potted. In particular, the wake-up circuit preferably meets the type of ignition protection "intrinsic safety", and / or it is itself switched off in the first switching state, in particular de-energized and / or de-energized. In one embodiment, the wake-up circuit is electrically connected to the control circuit via at least one suitable resistor, wherein the at least one resistor decouples the wake-up circuit from the non-intrinsically safe but switched-off control circuit in the switched-off state.

[0026] The problem is also solved in a second aspect by creating a motor vehicle that has a control unit according to the invention or a control unit according to one or more of the embodiments described above. In connection with the motor vehicle, the advantages that arise are particularly those already explained in connection with the control unit.

[0027] In one embodiment, the safety circuit of the control unit is preferably connected to a selector switch, which is configured for operation when the motor vehicle is located in an explosion-proof environment. The selector switch is operatively connected to the safety circuit in such a way that the control circuit can be switched between the first switching state and the second switching state, depending on the position of the selector switch. The selector switch is, in particular, the selector switch described above, preferably manually operable.

[0028] The motor vehicle is designed in one embodiment as a truck or tractor.

[0029] Alternatively or additionally, the motor vehicle is an electrically powered vehicle – with battery, fuel cell and / or overhead lines – or a motor vehicle powered by an internal combustion engine.

[0030] The task is also solved in a third aspect by creating a procedure – hereinafter also referred to as the “operating procedure” – for operating a control unit in a motor vehicle, which comprises the following steps: - Determine whether the motor vehicle is located in an explosion-proof area, - Switching off a control circuit of the control unit when it is detected that the motor vehicle is located in an explosion-proof area, whereby - a safety circuit of the control unit, with which the control circuit can be switched on again, and continues to operate if the control circuit is switched off.

[0031] In this method, a control unit according to the invention or a control unit according to one or more of the embodiments described above is operated. The advantages of this operating method are particularly evident in the advantages already explained in connection with the control unit or the motor vehicle.

[0032] The step of determining whether the motor vehicle is located in an explosion-proof area preferably includes detecting the switching position of a selector switch, in particular the selector switch described above. Preferably, this is achieved by edge detection of a switching edge of the selector switch.

[0033] The selector switch can be operated manually, particularly by the driver of the vehicle. However, in one embodiment of the method, an explosion-proof area is automatically and / or remotely detected, preferably by means of image analysis or image recognition, particularly based on warning signs or hazard symbols, by means of geofencing, by means of – in particular automatic – communication between the vehicle and an explosion-proof system, or by a backend or a remote driver.

[0034] The fact that the control circuit is switched off means in particular that the control circuit is switched off without voltage and / or current, especially without voltage and current.

[0035] In particular, a safety circuit that meets at least one type of ignition protection continues to operate when the control circuit is switched off. Preferably, a safety circuit that is at least partially encapsulated continues to operate when the control circuit is switched off.

[0036] Alternatively or additionally, a control circuit that does not meet any type of ignition protection is switched off. Preferably, an unencapsulated control circuit is switched off.

[0037] The task is also solved in a fourth aspect by creating a procedure – hereinafter also referred to as the “design procedure” – for designing a control unit for a motor vehicle, which includes the following steps: - Identify at least one control circuit of the control unit, - Provision of a safety circuit to switch the control circuit between an on state and an off state in response to a switching request, - Identifying at least one protection area of ​​the safety circuit to be protected, and - Protecting at least one protection zone of the safety circuit according to at least one type of ignition protection.

[0038] In connection with the interpretation procedure, the advantages that have already been explained in connection with the control unit, the motor vehicle or the operating procedure become particularly apparent.

[0039] The protected area is, in particular, a potting area to be encapsulated. Specifically, at least one potting area of ​​the safety circuit is encapsulated with a potting compound.

[0040] In one embodiment, the at least one control circuit is automatically identified. Alternatively or additionally, the safety circuit is automatically provided, in particular automatically planned. Alternatively or additionally, the at least one protection zone is automatically identified; for this purpose, the safety circuit is preferably automatically analyzed, in particular with regard to explosion protection and / or at least one type of ignition protection, or a plurality of ignition protection types. Preferably, the at least one protection zone is automatically designed such that it satisfies the at least one type of ignition protection.

[0041] Preferably, the at least one potting area of ​​the safety circuit is automatically identified; for this purpose, the safety circuit is preferably automatically analyzed, in particular with regard to explosion protection and / or at least one type of ignition protection, or a plurality of types of ignition protection, wherein the at least one potting area is identified, in particular as an area that does not meet or cannot meet any other type of ignition protection.

[0042] In particular, the control circuitry is kept free of the potting compound, i.e., not potted. Furthermore, the safety circuitry is preferably kept free of the potting compound outside the potting area, i.e., not potted.

[0043] The invention will be explained in more detail below with reference to the drawing. The drawing shows: Fig. 1 a schematic representation of an embodiment of a motor vehicle with an embodiment of a control unit, and Fig. 2 a schematic representation of an exemplary embodiment of a safety circuit of the control unit.

[0044] Fig. Figure 1 shows a schematic representation of an embodiment of a motor vehicle 1 with an embodiment of a control unit 3.

[0045] The motor vehicle 1 is preferably designed as a truck or as a tractor. The motor vehicle 1 can be electrically powered – with a battery, fuel cell and / or overhead lines – or it can be powered by an internal combustion engine.

[0046] The control unit 3 is configured to perform at least one control function in the motor vehicle 1 and includes a control circuit 5, which is configured to perform the at least one control function, and a safety circuit 7, which is configured to detect a switching request and, depending on the switching request, to switch off the control circuit 5 in a first switching state – a switch-off state – and switch it on in a second switching state – a switch-on state. The safety circuit 7 is at least partially potted with a potting compound. The control circuit 5, on the other hand, is not potted.

[0047] This makes it possible, in particular, to switch the control circuit 5 to its first switching state in a hazardous situation, especially in a potentially explosive atmosphere, and thus eliminate any danger emanating from the control circuit 5 by switching it off. Only the safety circuit 7 – and even this preferably only where no other type of ignition protection, in particular intrinsic safety, can be guaranteed – is consequently encapsulated with the potting compound.

[0048] In particular, at least one potting area 9 of the safety circuit 7, which is under constant current and optionally does not meet any other type of ignition protection, is potted with the potting compound. At least one other circuit area 11 of the safety circuit 7, which is under constant current, meets at least one other type of ignition protection, for example the type of ignition protection "intrinsic safety" or "increased safety", and can therefore remain unpotted.

[0049] The switching request is, in particular, a shutdown request or a switch-on request.

[0050] The safety circuit 7 is preferably connected to a selector switch 13, which is configured for manual operation, particularly when the motor vehicle 1 is located in an explosion-proof environment. The selector switch 13 is operatively connected to the safety circuit 7, and the safety circuit 7 is configured such that the control circuit 5 is switched between the first and second switching states depending on the position of the selector switch 13. Thus, the switching request originates from the selector switch 13. In particular, the switching request is a switching edge of the selector switch 13.

[0051] The switching request can also be generated automatically and / or remotely, for example based on warning signs or hazard symbols detected by means of image recognition, by means of geofencing, through - especially automatic - communication between the vehicle and an explosion-proof system, or through a backend or a remote driver.

[0052] The control unit 3 is preferably designed as a battery disconnect switch. In particular, the battery disconnect switch is connected upstream of all other electrical or electronic devices of the motor vehicle 1, so that all these devices – except for the permanent circuits of the safety circuit 7 – are de-energized and disconnected from the power supply when they are disconnected from the positive terminal 15 of a vehicle battery (not shown) by the battery disconnect switch. The control circuit 5 is configured to electrically disconnect a vehicle circuit 17 from the positive terminal 15 of the vehicle battery. The advantages mentioned above are realized particularly in this respect. The control circuit 5 preferably acts on a battery disconnect switch 19, which disconnects the positive terminal 15 of the vehicle battery from the vehicle circuit 17. The control circuit 5 preferably includes the battery disconnect switch 19.

[0053] Additionally, the control circuit 5 is preferably configured to exchange data with a vehicle control unit (not shown) in order to prepare the disconnection of the vehicle circuit 17 from the vehicle battery.

[0054] Fig. Figure 2 shows a schematic representation of an embodiment of the safety circuit 7 of the control unit 3.

[0055] The safety circuit 7 preferably comprises a demand detection circuit 21, which is configured to detect the switching demand, in particular the switching edge of the selector switch 13, and a switching function circuit 23, which is configured to switch the control circuit 5 – indicated here only by double dashes – between the first switching state and the second switching state depending on the switching demand. The demand detection circuit 21 is operatively connected to the switching function circuit 23 in order to control the switching function circuit 23 depending on the detected switching demand.

[0056] Preferably, the switching circuit 23 has at least one electronic switch 25 configured to short-circuit an operating voltage for the control circuit 5 in the first switching state, or—in other words—to connect it to ground or pull it to ground. Preferably, a limiting circuit 27 is provided that limits the resulting short-circuit current, in particular such that a fuse 29 provided for protecting the power supply of the control circuit 5 does not trip. For redundancy reasons, the switching circuit 23 may have more than one electronic switch 25, in particular two electronic switches 25. Furthermore, preferably an additional shutdown circuit 31 is provided that subsequently disconnects the short-circuit current so that it does not flow continuously in the shutdown state.In particular, the electronic switch 25 is open in the second switching state, so that the operating voltage for the control circuit is not short-circuited. Furthermore, the additional shutdown circuit 31 is preferably deactivated in the second switching state such that the control circuit 5 can be supplied with the operating voltage and electrical power.

[0057] The electronic switch 25 can be designed as a transistor, in particular as a field-effect transistor, especially as a MOSFET.

[0058] Furthermore, the safety circuit 7 preferably includes a wake-up circuit 33, which is configured to activate the control circuit 5 when switching from the first switching state to the second switching state, wherein the wake-up circuit 5 is unencapsulated. In particular, the wake-up circuit preferably meets the type of ignition protection "intrinsic safety".

[0059] Furthermore, the potting area 9 is in Fig.2 schematically represented by a simple dash-dotted outline. Reference symbol list 1 motor vehicle 3 Control unit 5 Control circuit 7 Safety circuit 9 Potting area 11 Circuit area 13 selector switches 15 Positive pole 17 Vehicle electrical circuit 19 battery disconnect switches 21 Request Recognition Circuit 23 Switching function circuit 25 electronic switches 27 Limiting circuit 29 fuse 31 Shutdown circuit 33 Wake-up circuit

Claims

[1] Control unit (3) for a motor vehicle (1), designed to perform at least one control function in the motor vehicle (1), with - a control circuit (5) which is configured to perform at least one control function, and - a safety circuit (7) which is configured to detect a switching request, and to switch off the control circuit (5) in a first switching state and to switch on in a second switching state depending on the switching request, wherein - the safety circuit (7) is at least partially encased in a potting compound, and wherein - the control circuit (5) is unpotted. [2] Control unit (3) according to claim 1, wherein the switching request is selected from a group consisting of a switch-off request, a switch-on request, and a combination of the aforementioned requests. [3] Control unit (3) according to one of the preceding claims, wherein the control unit (3) is designed as a battery disconnect switch, wherein the control circuit (5) is preferably configured to - to electrically disconnect a vehicle electrical circuit (17) from a vehicle battery, and optionally - to exchange data with a vehicle control unit (3) to prepare for the disconnection of the vehicle electrical circuit (17) from the vehicle battery. [4] Control unit (3) according to claim 3, wherein the control circuit (5) has a battery disconnect switch (19). [5] Control unit (3) according to one of the preceding claims, wherein the safety circuit (7) - a request detection circuit (21), configured to detect the switching request, in particular configured to detect a switching edge as the switching request, and - a switching function circuit (23) configured to switch the control circuit (5) between the first switching state and the second switching state depending on the switching requirement, wherein - the request detection circuit (21) is operatively connected to the switching function circuit (23) in order to control the switching function circuit (23) depending on the detected switching request. [6] Control unit (3) according to claim 5, wherein the switching function circuit (23) has at least one electronic switch (25), in particular a transistor, which is configured to short-circuit an operating voltage for the control circuit (5) in the first switching state. [7] Control unit (3) according to one of the preceding claims, wherein the safety circuit (7) has a wake-up circuit (33) which is configured to activate the control circuit (5) when switching from the first switching state to the second switching state, wherein the wake-up circuit (33) is unencapsulated. [8] Motor vehicle (1) with a control unit (3) according to one of the preceding claims, wherein the safety circuit (7) of the control unit (3) is preferably connected to a selector switch (13) which is configured for actuation when the motor vehicle (1) is located in an explosion-proof environment, wherein the selector switch (13) is operatively connected to the safety circuit (7) in such a way that the control circuit (5) can be switched between the first switching state and the second switching state depending on a switch position of the selector switch (13). [9] Method for operating a control unit (3) in a motor vehicle (1), comprising the following steps: - Determine whether the motor vehicle (1) is located in an explosion-proof area, - Switching off a control circuit (5) of the control unit (3) when it is detected that the motor vehicle (1) is located in an explosion-proof area, wherein - a safety circuit (7) of the control unit (3) with which the control circuit (5) can be switched on again, continues to operate when the control circuit (5) is switched off. [10] Method for designing a control unit (3) for a motor vehicle (1), comprising the following steps: - Identify at least one control circuit (5) of the control unit (3), - Provision of a safety circuit (7) for switching the control circuit (5) between an on state and an off state in response to a switching request, - Identifying at least one potting area of ​​the safety circuit (7), and - Potting of at least one potting area of ​​the safety circuit (7) with a potting compound.

Images