Highly available dual DC / DC topology for battery electric vehicles

Abstract

The invention relates to an electrical system for a battery-electric vehicle, comprising an interface to a high-voltage battery (1) of the vehicle, a first DC / DC voltage converter (2) connected to the interface, and a second DC / DC voltage converter (3) connected to the first DC / DC voltage converter (2), wherein the first DC / DC voltage converter (2) is configured to reduce an electrical voltage present at the interface to the high-voltage battery (1) to a first low voltage and to supply a first supply terminal with the first low voltage, wherein the second DC / DC voltage converter (3) is configured to reduce the first low voltage at the first supply terminal to a second low voltage and to supply a second supply terminal.wherein the first supply connection is a connection for non-safety-critical electrical loads (5) and the second supply connection is a connection for safety-critical electrical loads (4). A sensor unit, upon detection of a fault, switches a switch between one or more redundant components of the first DC / DC voltage converter (2).

Description

The invention relates to an electrical system for a battery-electric vehicle, as well as a vehicle with such an electrical system. Battery-electric vehicles, such as battery-electric passenger cars, typically have a high-voltage battery. The problem then arises as to how low-voltage consumers, with a voltage requirement of, for example, 12V, can also be supplied using this high-voltage battery, which, for example, provides an electrical voltage of 800V. In this context, DE 10 2021 001 069 A1 relates to a power distribution arrangement for an electric vehicle, with a high-voltage battery serving to supply power to a traction motor of the vehicle and at least two DC / DC voltage converters, whose respective inputs tap partial voltages of different cell groups of the high-voltage battery and whose outputs are connected in parallel to supply power to a low-voltage circuit of the vehicle. In DE 10 2024 000 872 A1, an on-board network for a vehicle is described, comprising a high-voltage on-board network with a high-voltage battery (HVB) and a low-voltage area with an on-board network channel (EBN) which is designed as a comfort on-board network (EBN), wherein the comfort on-board network (EBN) is connected to the high-voltage on-board network via a DC / DC converter and is configured to supply static loads, wherein a low-voltage battery is arranged in the comfort on-board network (EBN), and wherein the on-board network is designed to be expandable by means of further on-board network channels. DE 10 2022 204 687 B4 describes an electrical system for an electrically powered motor vehicle. This system comprises a high-voltage electrical system, a high-voltage battery which has at least a first energy storage block and a second energy storage block, a DC / DC converter which has a first output for a low-voltage consumer, in particular a safety-relevant one, of a low-voltage network and a second output for the low-voltage consumer, and which comprises at least one input for the first energy storage block and one input for the second energy storage block, wherein the first output and the second output are each coupled to both the input for the first energy storage block and the input for the second energy storage block. German patent application DE 10 2018 214 759 A1 discloses a power supply system for an electric vehicle, comprising a first subnetwork with a first nominal voltage, a second subnetwork with a second nominal voltage, a third subnetwork with a third nominal voltage, a first DC-DC converter for coupling the first subnetwork with the second subnetwork, and a second DC-DC converter for coupling the first subnetwork with the third subnetwork. A third DC-DC converter is provided for coupling the second subnetwork with the third subnetwork. It is therefore fundamentally possible to implement a voltage converter with a switchable output to prevent over- or undervoltages, particularly with the aim of preventing over- or undervoltages on the secondary side, especially when an energy storage device is provided on the secondary side. It is specifically assumed that the voltage converter supplies a system on its secondary side whose correct functioning is relevant for the operation of a vehicle. Furthermore, it is assumed that the system on the secondary side has an energy storage device capable of keeping the secondary-side system operational for a previously specified minimum duration (i.e., supply redundancy). The task of the voltage converter is therefore to keep this energy storage device on the secondary side in a sufficiently charged state at all times. A malfunction of such a voltage converter, such as...Generating an overvoltage, for example due to incorrect clocking, or an undervoltage, for example due to incorrect clocking, a component failure, or an internal short circuit, would lead to a malfunction or even damage to the system on the secondary side. It is therefore required that the voltage converter detects and corrects this internal fault within the converter itself. An interruption of the power supply is permitted because a sufficiently charged energy storage device is present in the secondary-side electrical system. Typical functional requirements for preventing over- or undervoltages are ASIL B or ASIL C. One possible implementation is a so-called... Safety switch at the output of the secondary side of the voltage converter. It is typically constructed using two MOSFETs connected in series at the output of the secondary side. A disadvantage of this design is that an energy storage device is required on the secondary side. In addition to the aforementioned voltage converter with a switchable output, it is also possible to provide a voltage converter with functional safety requirements for secure energy transfer, particularly to prevent over- or undervoltage on the secondary side and to ensure energy transfer from the primary to the secondary side, especially when no energy storage device is provided on the secondary side. For this converter, it is specifically assumed that the voltage converter supplies a system on its secondary side whose correct operation is essential for the vehicle's operation. Furthermore, it is assumed that the system on the secondary side does not have an energy storage device, or at least no energy storage device capable of maintaining the secondary-side system's functionality for a previously specified minimum duration; i.e., that there is no redundancy with regard to the power supply.In this case, the voltage converter's task is to continuously supply the vehicle's secondary electrical system with power from the primary side, ensuring a specific availability requirement, such as ASIL B or D. The challenge lies in the fact that suitable fail-safe components are not readily available on the market to guarantee sufficiently reliable operation of the voltage converter. In other words, a single voltage converter cannot achieve the typically required safety objective in such a configuration, such as ASIL B or D for ensuring the secondary-side power supply. A common approach is therefore to connect multiple voltage converters in parallel, thereby achieving the required safety objective through power supply redundancy. This means maintaining a sufficiently charged energy storage system on the secondary side using the available components.A malfunction of the voltage converter can be compensated for by the function of the other redundant voltage converters. The condition is that the malfunctioning voltage converter is disconnected from the parallel-connected DC / DC converter system without any negative impact. A disadvantage of this is that, due to safety requirements, more voltage converter capacity must be installed than is actually needed, e.g., 3 kW of voltage converter capacity for 1 kW of on-board power. In addition to the two voltage converters described above, a voltage converter with functional safety requirements can be provided for secure power transmission. This converter aims to prevent over- or undervoltage on the secondary side and ensure power transfer from the primary to the secondary side, while also providing power distribution within the system on the secondary side. To counteract the disadvantage of installing more voltage converter capacity solely for ASIL compliance, intelligent power distribution can be implemented in the low-voltage (LV) electrical system. This system differentiates between safety-related and non-safety-related loads. In the event of a fault, such as the failure of an internal DC / DC converter, the power supply to non-safety-related loads can be shut off via communication.The same would apply to the non-safety-related functions in the event of a short circuit in the system. Alternatively, the non-safety-related loads can be switched off when a predefined voltage level is undershot. One advantage is that the total transmission power built into the DC / DC converter can be identical to the sum of the power consumption of the two connected systems. However, a disadvantage of such a configuration is that the safety-related system must still be designed to function without safety limitations at the voltage level when the non-safety-related loads are switched off. Furthermore, a certain amount of time is required for information transmission before the shutdown occurs when the system is triggered by communication. The safety-related system must be able to survive this period without sufficient power supply, e.g.,This can be achieved through smaller, dedicated energy storage devices within the safety-relevant system, particularly through backup capacitors. The following explanations assume that we are considering an electrical system for a battery-electric vehicle or at least for a hybrid vehicle with a battery to power an electric drive. This electrical system is designed to be a low-voltage (LV) system, to which various electrical consumers are connected, requiring different voltages, particularly 12 volts and 48 volts. Certain electrical consumers are considered safety-critical and require an energy availability of ASIL B or ASIL C from the power supply. Other electrical consumers are only needed for comfort applications or do not require an ASIL, as their failure is not considered safety-critical.It is further assumed that this low-voltage electrical system, i.e., the LV electrical system, does not have a sufficiently large energy storage device such as an LV battery installed, primarily due to space, cost, and weight constraints. Accordingly, a DC / DC converter must meet all energy availability requirements. Since the DC / DC converter must have internal redundancies due to its ASIL energy availability requirements and must also supply all loads at both 12V and 48V, a high overall power output from the DC / DC converter would be necessary. This results in significant disadvantages in terms of installation space, weight, and cost for a DC / DC converter with redundancies and high energy availability. The object of the invention is to improve an electrical system for a battery-electric vehicle with a high-voltage battery as an energy source for further subsystems of the vehicle. The invention is defined by the features of the independent claims. Advantageous further developments and embodiments are the subject of the dependent claims. A first aspect of the invention relates to an electrical system for a battery-electric vehicle, comprising an interface to a high-voltage battery of the vehicle, a first DC / DC voltage converter connected to the interface, and a second DC / DC voltage converter connected to the first DC / DC voltage converter, wherein the first DC / DC voltage converter is configured to reduce an electrical voltage present at the interface to the high-voltage battery to a first low voltage and to supply a first supply terminal with the first low voltage, wherein the second DC / DC voltage converter is configured to reduce the first low voltage to a second low voltage and to supply a second supply terminal with the second low voltage.where the first supply connection is a connection for non-safety-critical electrical consumers and the second supply connection is a connection for safety-critical electrical consumers. In other words, a voltage converter is provided that generates a DC electrical voltage at its input side into a first and second, respectively reduced, DC electrical voltage at its output side. A dual DC / DC converter unit is thus provided for converting direct current, with two voltage levels at the supply terminals. A first low voltage is provided as the output of the first DC / DC converter, and a second low voltage, lower than the first, is provided as the output of the second DC / DC converter. The output of the first DC / DC converter is therefore also the input of the second DC / DC converter. The first and second DC / DC converters are thus connected in series. Such an arrangement can also be called cascaded. The corresponding sub-networks are connected to the respective low-voltage supply connections. A sub-network designed for the first low voltage is connected to the first supply connection. This sub-network is preferably designed to draw a high current at a higher first low voltage than the second low voltage, for example, with a first low voltage of 48 volts, in order to supply high-power consumers, such as seat heating, which are not safety-critical. The sub-network with the secondary low-voltage supply, for example at 12 volts, supplies safety-critical components. For instance, a steering actuator or a driver assistance system can be connected to this sub-network with its lower secondary low-voltage supply. This does not preclude the possibility of connecting a non-safety-critical comfort component with a secondary low-voltage supply to the same supply connection. The dimensioning of the unit consisting of the first DC / DC voltage converter and the second DC / DC voltage converter is preferably carried out with regard to a total power output which, without any fault conditions, can easily cover the required power levels at the first supply connection and at the second supply connection. The use of a unit consisting of a first DC / DC converter and a second DC / DC converter creates synergies within a vehicle's electrical system when transforming from the high voltage of a high-voltage battery to a first low voltage and from there to an even lower second low voltage. Only this series connection offers these advantages. Two separate DC / DC converters would not provide these benefits. The inventive unit, consisting of a first DC / DC converter and a second DC / DC converter, advantageously allows for smaller dimensions of this unit without compromising the electrical supply to electrical consumers in the corresponding sub-networks. In particular, under normal, fault-free operation, all comfort functions in a sub-network can be operated at full electrical power from the first supply connection.The total electrical transmission power built into the DC / DC voltage converter unit can be identical to the sum of the power consumption of the two connected systems and does not need to be oversized due to necessary redundancies. Another advantage of using the unit from the DC / DC voltage converter is better detection of gradual aging by observing the internal sensors of a sensor unit, and thus the possibility of issuing a warning even before a component failure occurs. Especially when the first low voltage is chosen to be 48V, and thus significantly higher than a second low voltage of 12V, the required current can be reduced, since the electrical power required by a device is calculated as the product of current and voltage. Accordingly, conductor cross-sections can be smaller, reducing the load on electrical contacts, whereas otherwise, particularly in summer, higher temperature voltages can occur at high currents. According to an advantageous embodiment, the first low voltage is 48 volts (48V) and the second low voltage is 12 volts (12V). According to the invention, the first DC / DC voltage converter is implemented redundantly by means of components connected in parallel. According to the invention, the electrical system further comprises a sensor unit for detecting a fault, wherein the sensor unit is connected to a switch, and the sensor unit is configured to switch the switch upon detection of a fault, the switch establishing an electrical connection between one or more of the redundant components of the first DC / DC voltage converter. The total power transmission capacity of each DC / DC converter can be identical to the sum of the power consumption of the connected loads on the first and second low-voltage lines, allowing the redundancies to be utilized based on ASIL energy availability. If, in the event of a fault, some of the redundancies fail, for example, due to the failure of a redundantly connected DC / DC converter, the ASIL energy availability for the sub-network with the second low-voltage line can still be guaranteed by electrically isolating the sub-network with the first low-voltage line, without unnecessarily oversizing the electrical system. Switching off the loads in the sub-network with the first low-voltage line is possible because they do not have an ASIL rating. To enable the fastest possible shutdown of non-safety-related loads to the first low voltage after a fault occurs, e.g., in the event of a DC / DC converter failure or a fault in the system of non-safety-related loads, both the sensors for detecting all possible faults and the command / trigger for the shutdown are preferably implemented in a single component (together with the DC / DC converters). This minimizes the time interval between a fault occurring and the activation of a safety switch. According to another advantageous embodiment, each of the redundant components of the first DC / DC voltage converter is designed as a galvanically isolated DC / DC voltage converter. According to another advantageous embodiment, the second DC / DC voltage converter is designed as a galvanically coupled DC / DC voltage converter. It can be advantageous to use both galvanically isolated and galvanically coupled DC / DC converters, as this allows the installed power of the galvanically isolated converter phases to be used both to provide an ASIL-compliant power supply for the sub-system with the second low voltage (the ASIL supply includes redundancy of the converter phases) and to cover the maximum power of both sub-systems at the first and second supply terminals in the absence of a fault. In this case, a potential disconnect device at the output of non-safety-critical loads of the system at the first supply terminal can be partially handled by the galvanically coupled DC / DC converter.The shutdown in case of an overvoltage from the sub-system at the first supply terminal to the sub-system at the second supply terminal can be omitted. The second DC / DC converter provides protection in this case. However, if a short circuit occurs on the side of the first low voltage, it would short-circuit all secondary sides of the isolated DC / DC converters and thus also terminate the supply of the second low voltage. Therefore, it is advantageous to use at least one MOSFET with a body diode, configured to block current flow from the first supply terminal to the sub-system with the first low voltage. In particular, the use of a galvanically isolated DC / DC converter allows for a faster response time, especially a faster shutdown capability, upon detection of an internal fault. This is achieved primarily through improved sensing capabilities. Due to the ability to react quickly to a fault, either the consumers connected on the output side do not require any energy storage or at least only small local energy storage devices (e.g., decoupling capacitors), or the operating voltage range of the consumers in a safety-relevant sub-network at the second supply connection with the second low voltage does not need to be extended in addition to low supply voltages. The installation of an additional low-voltage battery in this electrical system, such as a 12-volt battery, is preferably omitted, particularly to reduce costs, installation space, and weight. However, in addition to the aforementioned advantages, an additional measure may be necessary to ensure the energy availability of the unit consisting of the first and second DC / DC converters according to ASIL standards. This energy availability according to ASIL is preferably achieved by connecting several instances, i.e., components, of the first and second DC / DC converters in parallel. According to another advantageous embodiment, neither the first DC / DC voltage converter nor the second DC / DC voltage converter is connected to a battery with first or second low voltage. Furthermore, overload protection and improved diagnostic capabilities of the interface to the output-side connected cable set are provided: By measuring the signal, in particular current, at one of the two supply terminals of the DC / DC converters and by measuring the signal of each individual internal DC / DC converter, especially the current, an overload of one of the two outputs can be detected, triggering a system response. Possible responses include, for example, disconnecting the supply terminal and increasing the voltage to reduce the current. If a voltage difference exists between the output terminals and the internal output voltages of the DC / DC converters, and the current is known, the internal contact resistance up to the terminals can be calculated and diagnosed. Another aspect of the invention relates to a vehicle with an electrical system as described above and below, wherein a plurality of non-safety-critical electrical consumers are connected to the first supply connection and a plurality of safety-critical electrical consumers are connected to the second supply connection. Advantages and preferred further developments of the proposed vehicle result from an analogous and meaningful transfer of the above statements made in connection with the proposed electrical system. Further advantages, features and details will become apparent from the following description, in which - possibly with reference to the drawing - at least one embodiment is described in detail. Figure 1 shows a simplified sketch of an electrical system according to an embodiment of the invention. Figure 2 shows an electrical system with further protective mechanisms according to an embodiment of the invention. Figure 3 shows an exemplary fault condition and a switching reaction according to an embodiment of the invention in the electrical system of Figure 2. Figure 4 shows another exemplary fault condition and a switching reaction according to an embodiment of the invention in the electrical system of Figure 2. The representations in the figures are schematic and not to scale. Figure 1 shows a simplified schematic diagram of the electrical system of a battery-electric vehicle. A key feature of this battery-electric vehicle is a high-voltage battery 1, which primarily serves to supply the vehicle's electric drive with electrical power. Such a high-voltage battery 1 can, for example, operate at voltages of 800 volts, but other voltage levels such as 500 volts are also possible. Such high voltages are far too high for typical electrical consumers used in a vehicle; rather, typical consumers operate at 12 volts, 24 volts, or 48 volts. To nevertheless enable the vehicle's high-voltage battery 1 to also be used as an energy source to supply these electrical consumers, a unit consisting of a first DC / DC converter 2 and a second DC / DC converter 3, connected in series, is introduced.The input of the first DC / DC converter 2 is connected to the high-voltage battery 1 via a corresponding interface, so that the correspondingly high voltage of the high-voltage battery 1 is present there. The task of the first DC / DC converter 2 is to reduce this high voltage to a significantly lower level, for example, 48 volts. This lower voltage is then provided at the output of the first DC / DC converter 2 and supplied to non-safety-critical electrical consumers 5 in the vehicle, which, however, typically require relatively high power, for example, an electric heater such as a self-heating unit. Figure 1 shows various examples of non-safety-critical electrical consumers 5, a first non-safety-critical electrical consumer 5a, a second consumer 5b, etc.A second DC / DC converter 3 connected downstream uses the first low voltage, for example 48 volts, to reduce it further, for example to 12 volts, i.e., to the second low voltage. A large number of electrical consumers 4 of the vehicle can also be connected to the supply connection with the second low voltage. In this case, however, typically a large number of safety-critical consumers 4a, 4b, and so on. If there is a high power demand from the consumers 5 at 48V, a large portion of the DC / DC power can be used at 48V; if there is a high power demand at 12V, a large portion of the DC / DC power can be used at 12V. However, the operating strategy used is also crucial for utilizing the advantages of the arrangement as shown schematically in Fig. 1. A suitable on-board network management system or...By installing switches, an ASIL-compliant power supply of 12 volts can be ensured at all times, thus guaranteeing safety-critical loads 4; see Fig. 2 and following. Fig. 2 shows an exemplary extended configuration of the schematic setup according to Fig. 1. Again, a high-voltage battery 1 of the vehicle is shown. However, while the second DC / DC converter 3 is designed as a galvanically coupled DC / DC converter, the redundant components of the first DC / DC converter 2 are designed as galvanically isolated individual DC / DC converters. Accordingly, the first DC / DC converter 2 is implemented with triple redundancy in the electrical system to ensure ASIL-compliant power availability for the 12V sub-system at the second supply connection with the second low voltage. Fig. 3 shows an exemplary fault scenario and the response based on the exemplary architecture of Fig. 2. If one of the components of the redundantly designed first DC / DC voltage converter 2 fails, wherein such a component itself forms a fully functional DC / DC voltage converter, which is marked here with an F for "fault", the connections of the faulty component of the first DC / DC voltage converter 2 are disconnected by opening the first switch S1 and the second switch S2, and switch S3 to the non-safety-critical loads 5 supplied by the first low voltage is also opened to disconnect them from the supply. Fig. 4 shows another exemplary fault scenario in the architecture of Fig. 2. This scenario involves a short circuit F in the sub-network 5, which is connected to the first supply terminal with the first low voltage. In such a short circuit in the 48-volt network, the switch S3 to the 48-volt sub-network opens. The total power can still be used at the second supply terminal with the second low voltage of 12 volts, and the ASIL power availability is maintained. Furthermore, this eliminates the need for an external intelligent power distribution system with semiconductor switches in the 48-volt sub-network. The design of switch S3 is reduced here to a unidirectionally blocking switch. In the event of an overvoltage in the 48V electrical system, no action such as opening a switch is necessary. The 48V / 12V DC / DC unit is sufficient to protect the 12V electrical system in this case.

Claims

Electrical system for a battery-electric vehicle, comprising an interface to a high-voltage battery (1) of the vehicle, a first DC / DC voltage converter (2) connected to the interface, and a second DC / DC voltage converter (3) connected to the first DC / DC voltage converter (2), wherein the first DC / DC voltage converter (2) is configured to reduce an electrical voltage present at the interface to the high-voltage battery (1) to a first low voltage and to supply a first supply terminal with the first low voltage, wherein the first DC / DC voltage converter (2) is configured redundantly by means of components connected in parallel, and wherein the second DC / DC voltage converter (3) is configured to reduce the first low voltage to a second low voltage and to supply a second supply terminal with the second low voltage.wherein the first supply connection is a connection for non-safety-critical electrical loads (5) and the second supply connection is a connection for safety-critical electrical loads (4), and comprising a sensor unit for detecting a fault, wherein the sensor unit is connected to a safety switch, and the sensor unit is configured to switch the switch upon detection of a fault, wherein the switch establishes an electrical connection between one or more of the redundant components of the first DC / DC voltage converter (2). Electrical system according to claim 1, wherein the first low voltage is 48 volts and the second low voltage is 12 volts. Electrical system according to claim 1, wherein each of the redundant components of the first DC / DC voltage converter (2) is designed as a galvanically isolated DC / DC voltage converter. Electrical system according to one of the preceding claims, wherein the second DC / DC voltage converter (3) is designed as a galvanically coupled DC / DC voltage converter. Electrical system according to one of the preceding claims, wherein neither the first DC / DC voltage converter (2) nor the second DC / DC voltage converter (3) is connected to a battery with first or second low voltage. Vehicle with an electrical system according to one of the preceding claims, wherein a plurality of non-safety-critical electrical consumers (5) are connected to the first supply connection and a plurality of safety-critical electrical consumers (4) are connected to the second supply connection.

Images