SAFETY SWITCHING DEVICE AND OPERATING METHOD THEREFOR

Abstract

A method for operating a safety switching device (6) comprising a relay (10) and a fuse (9), wherein the fuse (9) is connected in series with a switching contact (11) of the relay (10), comprises the steps: - applying (S3) a first switching voltage (U1) to open the switching contact (11) to control terminals of the relay (10), - Check (S4) whether a conductive connection exists via the switching contact (11) after the first switching voltage (U1) has been applied, and, - if the conductive connection exists, cyclical application (S6, S7) of a second switching voltage (U2) to close the relay (10) and the first switching voltage (U1) to the control terminals of the relay (10).

Description

[0001] The present invention relates to a safety switching device for interrupting a current flow between a power source and a consumer and to a method for operating such a safety switching device, in particular in an electrically powered vehicle in which the power source comprises a battery and the consumer comprises a drive motor.

[0002] To meet legal safety requirements, such vehicles must have a safety switching device between the battery and the engine, consisting of a relay and a fuse, each of which is capable of interrupting the flow of current between the battery and the engine. By opening when a rated current is exceeded, the fuse provides protection against damage caused, for example, by a short circuit on the consumer side. The relay is designed to cut off the power supply to the engine and any other consumers when the vehicle is switched off.

[0003] To trigger the fuse, its rated current must be exceeded for a certain period of time. A problem can arise where a short current pulse exceeds the rated current but, due to its short duration, does not trigger the fuse. At the same time, the contact surfaces of the relay heat up so much that they stick together, preventing the relay from opening properly. To alleviate this problem, the contact surfaces can be enlarged to distribute the heat generated by the current pulse over a wider area, or the contact surfaces can be made smaller.It is possible to choose more powerful electromagnets and springs to drive the switching movement of the relay, but these solutions are always associated with increased dimensions of the relay, which is undesirable for cost reasons, but can also lead to space problems, especially if the relay is to be integrated with the battery in a common housing to ensure that it cannot be combined with and overloaded by a battery that is too powerful.

[0004] DE 10 2015 104 211 A1 describes a safety switching device in which protection against malfunction is achieved using several redundant and, in some cases, mechanically coupled switching contacts. Multiplying the number of switching contacts leads to the same disadvantages in terms of cost and space requirements as described above.

[0005] There is therefore a need for a technology that can ensure reliable switching action at low cost and dimensions.

[0006] According to one aspect of the invention, this need is met by a method for operating a safety switching device comprising a relay and a fuse, the fuse being connected in series with a switching contact of the relay, comprising the steps: - Applying a switching voltage to open the switching contact to the control terminals of the relay, - Check whether there is a conductive connection across the switching contact after the first switching voltage has been applied, and, - If the conductive connection exists, cyclically apply a second switching voltage to close the relay and the first switching voltage to the relay's control terminals. If applying the switching voltage does not result in the relay opening as expected, it is assumed that the surfaces of the switching contact are stuck together. In this case, repeatedly changing the level of the applied switching voltage can be used to try to shake the stuck switching contact free and restore the relay's switching capability.

[0007] To test whether a conductive connection exists across the switching contact, according to a preferred embodiment of the method, a voltage is detected between an input and an output terminal on different sides of the switching contact, and a decision is made that a conductive connection exists if the voltage does not exceed a predetermined threshold. If the relay is properly opened and, as a result, no current flows, the voltage between the input and output terminals—provided both are connected to the poles of an electrical power source—should be equal to the terminal voltage of the power source. If it is significantly lower, this indicates that the current flow through the safety switching device is not completely interrupted, meaning the relay is not properly open.

[0008] If a circuit connecting the poles of an electrical power source can be interrupted at a location other than the safety switching device, then one of the terminals of the safety switching device can be isolated, and the voltage between the terminals disappears, just as it would if the relay did not open. To detect this situation, according to a second embodiment, a voltage can be applied to the input and output terminals, and a conductive connection can be determined if the current resulting from the applied voltage exceeds a predetermined threshold.

[0009] To notify a user of any relay defects or, if necessary, to trigger accompanying automatic safety measures, an initial error message can be generated if the test shows that the conductive connection is present. This initial error message can be generated immediately as soon as the conductive connection is established, or only after a specified number of cycles of applying switching voltages to open and close the relay have been performed without resulting in any change in the situation.

[0010] If the cyclic application of the switching voltages has resulted in the relay successfully opening, the first error message can be canceled because the original fault—the relay sticking—is no longer present. However, if the relay's contact surfaces have become hot enough to stick together, it is likely that damage will remain, increasing the likelihood of re-sticking. It is therefore useful to generate a second error message in such a case to alert the user that the relay's reliability has been compromised and that replacement or repair may be necessary.

[0011] In order to successfully separate the contact surfaces, it is desirable to change the force acting on them as abruptly as possible. The speed at which the force generated by a magnetic coil conventionally used in a relay can be changed is limited by the inductance of the coil. In order to nevertheless build up a force to pull the contact surfaces apart within the shortest possible time, it is helpful to insert a time period between a time period in which a switching voltage is applied between the input and output terminals, during which the contact surfaces are pressed together, and a time period in which the applied switching voltage creates a tensile force between the contact surfaces. This time the switching voltage assumes an intermediate value at which the forces acting between the contact surfaces are low.

[0012] To quickly separate the contact surfaces, the cyclical application should be performed with a period shorter than the switching time of the relay. Typically, the period should be between 10 and 1000 ms, preferably between 100 and 500 ms.

[0013] Traditionally, the switching contact of a relay comprises at least one stationary and one movable contact surface, which touch each other when the relay is closed and separated when the relay is open. If an armature driven by the applied switching voltages is coupled to the movable contact with a certain amount of play, it can be accelerated when the switching voltage is switched, even if the movable contact surface is stuck. By transferring the momentum absorbed when passing through the play to the movable contact surface upon impact, the armature can significantly increase the probability that the contact surfaces can still be successfully separated.

[0014] According to a preferred application, the safety switching device is inserted between a battery and a motor of an electrically powered vehicle.

[0015] According to a further aspect of the invention, the need identified above is satisfied by a control unit for a safety switching device which is configured to carry out the method described above.

[0016] The invention also relates to: - a vehicle comprising a battery, an engine, a safety switching device inserted between the battery and the engine, comprising a relay and a fuse connected in series between an input and an output terminal of the safety switching device and a switching contact of the relay, and a control unit as specified above, . and - a computer program comprising computer-executable instructions, the execution of which by a computer causes the computer to carry out the method described above.

[0017] Further features and advantages of the invention will become clear from the following description of exemplary embodiments with reference to the accompanying figures. They show: Fig. 1 is a block diagram of the electrical system of an electric vehicle with a safety switching device according to the invention; Fig. 2 a switching contact and an armature of a relay of the safety switching device; Fig. 3 a flowchart of an operating procedure executed by a control unit of the vehicle electrical system; and Fig. 4 shows a time sequence of voltages applied to control terminals of the relay in the context of the method according to the invention.

[0018] Fig. Figure 1 shows a schematic of the electrical system of an electric motor vehicle. A battery 1 has two terminals 2, 3, which carry an active voltage and ground, respectively. A power converter 4 converts the direct voltage of the battery 1 into alternating voltage to power an electric drive motor 5. Circuit components for recharging the battery 1, for example, with power from an on-board fuel cell, from a stationary power grid, or through regeneration of the drive motor 5 and the power converter 4, are not shown for the sake of clarity.

[0019] A circuit runs from pole 2 of battery 1 to an input terminal 7 of a safety switching device 6, within the safety switching device 6 via a fuse 9 and a switching contact 11 of a relay 10 to an output terminal 8, and from there via the power converter 4 to pole 3 of battery 1,

[0020] A control unit 12 is connected to input terminal 7 and output terminal 8 to detect a voltage between them. Assuming that output terminal 8 is conductively connected to pole 3 via converter 4, this voltage should be equal to the terminal voltage of battery 1 when the relay is open and close to zero when relay 10 is closed. Control unit 12 can therefore decide whether relay 10 is open or closed by comparing the detected voltage with a suitably set threshold voltage.

[0021] If the power converter 4 supports a state in which no current flow is possible between the output terminal 8 and pole 3, no conclusion can be drawn about the switching state of relay 10 from the observation that the voltage difference between terminals 7 and 8 disappears. To handle this case as well, the control unit can be configured to apply a non-zero measuring voltage to terminals 7 and 8 and measure the resulting current flow through relay 10. If the measured current is above a limit value, it can be concluded that relay 10 is closed.

[0022] The applied voltage may be an alternating voltage with a predetermined frequency; and the measurement of the resulting current may be narrow-band limited to this predetermined frequency in order to minimize interactions of the current induced by the measuring voltage with other current flows in the vehicle electrical system.

[0023] Fig. Figure 2 shows a schematic section through the relay 10 in the closed position. The switching contact 11 comprises fixed contact surfaces 14 on a housing 13 of the relay 10 and movable contact surfaces 15 on a disc 16 that can be moved within the housing 13. A spring 17 engages the disc 16 and an intermediate wall 18 of the housing 13 and presses the disc 16 away from the intermediate wall 18, so that the contact surfaces 14, 15 are held in contact with one another.

[0024] An elongated armature 19 extends through a hole in the disc 16 to a magnetic coil 20. The armature 19 is held in the position shown by a second spring 21, which acts on the one hand on a further intermediate wall 22 of the housing 13 and on the other hand on a flange 23 fixedly connected to the armature 19 and holds the flange 23 pressed against a stop, here for example the first intermediate wall 18.

[0025] A head 24 at the upper end of the armature 19 has a larger diameter than the hole in the disc 16 and is separated from the disc 16 by a distance d1 of, for example, 0.7 mm.

[0026] By applying a first switching voltage to the magnetic coil 20, a magnetic force is exerted on the armature 19, which has a value shown in the illustration of the Fig. 2 drives the downward movement of the armature 19. In a first phase of this movement, the head 24 moves downward against the restoring force of the spring 21 until the distance d1 is bridged and the head 24 strikes the disc 16. The impulse transmitted from the armature 19 to the disc 16 promotes a separation of the contact surfaces 14, 15 from each other.

[0027] When these separate properly, the armature 19 continues its downward movement, now also against the restoring force of the spring 17, until the flange 23, starting from the closed position, has traveled a distance d2 of, for example, 1.9 mm and encounters a stop 25. The armature 19 remains in the now reached open position as long as the first switching voltage or an intermediate voltage is applied to the solenoid 20, which is lower than the first switching voltage but high enough to compensate for the combined restoring forces of the springs 17, 21.

[0028] The control unit 12 is connected to a main switch (not shown) of the vehicle in order to, in step S1 of the Fig. 3 when the driver turns off the vehicle. When this happens, the control unit starts a timer in step S2 and applies the first switching voltage to the solenoid 20 in step S3 to open the switching contact 11 and thus interrupt the power supply to the power converter 4 and the drive motor 5.

[0029] In step S4, the control unit 12 checks as above with reference to Fig. 1, whether the application of the first switching voltage has actually led to the opening of the switching contact 11. If so, then the relay 10 operates correctly, and the process ends. Otherwise, the control unit 12 issues a warning message that the relay 10 has not opened, e.g., to a display on the vehicle's dashboard (S5), and issues a second switching voltage (S6), which may be zero and is at least low enough for the spring 21 to return the armature 19 from a position in which the head 24 rests against the fixed disc 16, which is Fig. 2, in which the distance d1 is open between the head 24 and the disc.

[0030] The second switching voltage does not need to be applied longer than necessary to return the armature to the position of the Fig. 2. Depending on the relay design, a few tens of milliseconds are sufficient. When this time period has elapsed, the control unit 12 switches back to the first switching voltage in step S7, whereupon the armature 19 accelerates downward again and the head 24 strikes the disc 16 again. If this causes the disc 16 to detach and the armature 19 to reach the open position, this is detected in S8 and leads in S9 to the warning message from step S5 being replaced by a warning message that the relay 10 is stiff and should be replaced.

[0031] Otherwise, step S10 checks whether the timer has expired. If this is not the case, the process returns to step S6, so that the first and second switching voltages alternate until the timer has expired. If the timer has expired without successfully breaking the disc 16, another warning message is generated (S11) to alert the driver that relay 10 is faulty and battery voltage is still present at the power converter 4.

[0032] Fig. Figure 4 shows the change between the first and the second switching voltage as a function of time t in the form of a thin solid curve, where the first switching voltage U1 is assumed to be 12 V and the second U2 to be 0. According to a variant of the method shown in the figure as a thick dashed curve, time periods Δt3 are inserted between time periods Δt1, Δt2, in which the first and second switching voltages are respectively applied, in which time periods the magnetic coil 20 is each subjected to an intermediate voltage U3. Even if the voltage U3 is still too high to allow the spring 21 to lift the head 24 from the fixed disk 16, its interim application shortens the time required by the magnetic field to decay in the time period Δt2 to such an extent that the spring 21 returns the armature to the position of the Fig.2; ie the time period Δt2 can be shortened so that more attempts can be made to release the disc 16 until the timer expires in step S11, and the probability of this being successful increases. Reference symbol 1 battery 2 pole 3 pole 4 power converters 5 Drive motor 6 Safety switching device 7 Input terminal 8 Output terminal 9 Security 10 relays 11 Switch contact 12 Control unit 13 housings 14 fixed contact surface 15 movable contact surface 16 slices 17 spring 18 Partition wall 19 anchors 20 solenoid coil 21 spring 22 Partition wall 23 Flange 24 heads 25 stops QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] DE 10 2015 104 211 A1

[0004]

Claims

[1] Method for operating a safety switching device (6) comprising a relay (10) and a fuse (9), wherein the fuse (9) is connected in series with a switching contact (11) of the relay (10), comprising the steps: - applying (S3) a first switching voltage (U1) to open the switching contact (11) to control terminals of the relay (10), - Check (S4) whether a conductive connection exists via the switching contact (11) after the first switching voltage (U1) has been applied, and, - if the conductive connection exists, cyclical application (S6, S7) of a second switching voltage (U2) to close the relay (10) and the first switching voltage (U1) to the control terminals of the relay (10). [2] Method according to claim 1, in which for checking (S4) whether a conductive connection exists via the switching contact (11), - a voltage is detected between an input and an output terminal (7, 8) on different sides of the switching contact (11) and it is decided that a conductive connection exists if the voltage does not exceed a predetermined threshold, and / or - a voltage is applied to the input and output terminals (7, 8) and it is decided that a conductive connection exists if a current resulting from the applied voltage exceeds a predetermined threshold. [3] A method according to claim 1 or 2, comprising the further step: - generating a first error message (S5, S11) if the test (S4) shows that the conductive connection exists or continues to exist after a predetermined number of cycles of applying the first and second switching voltages, and optionally the further step - Cancelling the first error message or generating (S9) a second error message if the conductive connection is interrupted during the cyclic application of the switching voltages. [4] Method according to one of the preceding claims, in which between a time period (Δt1) in which the first switching voltage (U1) is applied between the input and the output terminal (7, 8) and a time period (Δt2) in which the second switching voltage (U2) is applied, a time period (Δt3) is inserted in which a third switching voltage (U3) is applied, the level of which lies between the first and the second switching voltage. [5] Method according to one of the preceding claims, in which the cyclical application takes place with a period which is shorter than the switching time of the relay (10) and / or lasts between 10 and 1000 ms, preferably between 100 and 500 ms. [6] Method according to one of the preceding claims, in which the switching contact (11) comprises at least one stationary contact (14) and at least one movable contact (15), and an armature (19) driven by the applied switching voltages (U1, U2) is coupled to the movable contact (15) with play. [7] Method according to one of the preceding claims, in which the safety switching device (6) is inserted between a battery (1) and a motor (5) of an electrically driven vehicle. [8] Control unit (12) for a safety switching device (6) comprising a relay (10) and a fuse (9) connected in series between an input and an output terminal (7, 8) of the safety switching device (6) with a switching contact (11) of the relay (10), wherein the control unit (12) is arranged to carry out the method according to one of the preceding claims. [9] Vehicle comprising a battery (1), a motor (5), a safety switching device (6) inserted between the battery (1) and the motor (5), which comprises a relay (10) and a fuse (9) connected in series with a switching contact (11) of the relay (10), and a control unit (12) according to claim 8. [10] A computer program comprising computer-executable instructions, the execution of which by a computer causes the computer to carry out the method according to any one of claims 1 to 7.

Images