Fuse device for an electrical system of a vehicle

Abstract

The electrical system (100) comprises a first power source (E1) and a second power source (E2), multiple loads and the fuse device (10). The fuse device has a first, a second, and a further supply path segment (VS1, VS2, VSw). Furthermore, the fuse device (10) has a first disconnecting entity (T1) and a second disconnecting entity (T2). The first supply path segment (VS1) is arranged between the first supply connection (VA1) and the first disconnecting entity (T1). The second supply path segment (VS2) is arranged between the second supply connection (VA2) and the second disconnecting entity (T2) and the further supply path segment (VSw) is arranged between the first disconnecting entity (T1) and the second disconnecting entity (T2). One or more first load connections (LA1) are respectively connected to the first supply path segment (VS1) via a first fuse (S1). A plurality of third load connections are respectively connected to the further supply path segment (VSw) via a third fuse (S3).

Description

[0001] Description

[0002] Safety device for a vehicle's electrical system

[0003] The invention relates to a security device and an on-board power supply for a vehicle, wherein the on-board power supply comprises the security device. Furthermore, the invention relates to a method for operating the on-board power supply and a control device for operating the on-board power supply. Furthermore, a computer program for operating the on-board power supply is described.

[0004] As the level of automation in vehicles increases, so do the functional safety requirements for a vehicle's power supply. To ensure the power supply to safety-relevant consumers even in the event of a fault, these are typically designed redundantly. Furthermore, to improve the safety concept, a separator is provided between the safety-relevant consumers and non-safety-relevant consumers, so that in the event of a fault, such as a short circuit in a consumer, the safety-relevant consumers can be isolated from the other consumers.

[0005] Figure 1 shows a simplified block diagram of an on-board electrical system 1 with a redundant power supply. In addition to simple loads 2, e.g., an air conditioning system, the on-board electrical system 1 also supplies several safety-relevant loads 3, e.g., an electric brake, which require a voltage supply according to ASIL C or ASIL D, for example. The on-board electrical system 1 has a DC / DC converter 4 and a battery 5, which are connected via a supply line. A disconnect switch 7 between the two sources 4, 5 serves to ensure freedom from interference in the event of a defective DC / DC converter or its supply line. The supply line has connection points for connecting the safety-relevant loads 3 and the simple loads 2. The safety-relevant loads 3 and the simple loads 2 are each connected to one of the connection points via a fuse 6.To ensure that, for example, short circuits in the individual load branches only have a very low probability of affecting the power supply of the safety-relevant loads 3, the ASIL requirements for the fuses 6 are very high. This means that since the power supply of the safety-relevant loads 3 must meet ASIL-C requirements, the fuses 6 in the circuit structure shown in Figure 1 must also meet at least ASIL-C requirements. This can be achieved, for example, by using two fuses connected in series that meet ASIL-B requirements.

[0006] Fuses 6 can be designed as melting fuses or as semiconductor circuit breakers. A key advantage of melting fuses is that they can be manufactured very cost-effectively. Semiconductor circuit breakers have the advantage that the reaction time until the semiconductor circuit breaker trips is many times shorter than with a melting fuse. A further disadvantage, besides the cost, is that semiconductor circuit breakers lack an intrinsic fuse. In the event of damage to the semiconductor circuit breaker itself, for example, due to an overload, the semiconductor circuit breaker is highly likely to be fully conductive. A melting fuse is open after tripping and is therefore intrinsically safe.When replacing fuses with semiconductor circuit breakers in vehicle electrical systems, the probability of failure of the semiconductor circuit breakers must therefore be taken into account and changed requirements arise with regard to the impact on other consumers.

[0007] An object to be achieved by the invention is to create a safety device that can be provided cost-effectively and that contributes to a high availability of electrically assisted or purely electrically executed functions in the vehicle.

[0008] The problem is solved by the features of the independent patent claims. Advantageous developments of the invention are characterized in the subclaims.

[0009] According to a first aspect, the object is achieved by a safety device for an on-board electrical system of a vehicle, wherein the on-board electrical system has a first energy source and a second energy source as well as a plurality of loads. Each load can comprise an individual consumer or a consumer group. The loads of the on-board electrical system are each assigned requirements or requirement levels with regard to safety integrity. In particular, the loads are each assigned a requirement level from a set of requirement levels which comprises at least requirement levels I, II, III and IV, wherein the requirements increase in the stated order. The safety device comprises a first supply connection for connecting the safety device to the first energy source and a second supply connection for connecting the safety device to a second energy source.

[0010] Furthermore, the securing device has a first supply path segment, a second supply path segment and a further supply path segment.

[0011] The safety device has a plurality of first load terminals, each connected to the first supply path segment via a first fuse, for connecting a respective first load. The first loads are preferably assigned requirement level I with regard to safety integrity. The first loads are therefore preferably simple loads.

[0012] The safety device has a plurality of third load terminals, each connected to the wide supply path segment via a third fuse, for connecting a third load. The third loads preferably meet safety integrity requirements of Levels II or III.

[0013] Furthermore, the safety device has a first and a second isolating instance. The first supply path segment is arranged between the first supply connection and the first isolating instance. The second supply path segment is arranged between the second supply connection and the second isolating instance, and the further supply path segment is arranged between the first and second isolating instances.

[0014] Advantageously, the safety device enables the additional supply path segment to be separated from the first supply path segment and the second supply path segment. This allows the first loads connected to the first supply path segment to continue to be supplied via the first energy source, and the safety-relevant loads connected to the second supply path segment of the safety device or to the second energy storage device outside the safety device to continue to be supplied via the second energy storage device. The separation of the additional supply path segment ensures that a fault in the additional supply path segment does not affect the first supply path segment or the second supply path segment.In at least one advantageous embodiment according to the first aspect, the safety device comprises a further isolating element and one or more second load terminals for connecting a second load, wherein the second load terminal(s) are each connected to the further isolating element via a second fuse, and the further isolating element is connected to the second supply path segment. The second loads are preferably each assigned a safety integrity requirement level III or IV.

[0015] Advantageously, this allows several loads that have increased safety requirements to be connected to the safety device and the disconnection of these more safety-relevant loads can be carried out very quickly and flexibly.

[0016] In at least one advantageous embodiment according to the first aspect, the safety device comprises a third isolating instance, a fourth isolating instance, an additional supply path segment, and a plurality of fifth load connections, each with an associated fifth fuse. The first supply path segment is additionally connected to the third isolating instance. The second supply path segment is additionally connected to the fourth isolating instance, and the additional supply path segment is arranged between the third and fourth isolating instances. The fifth load connections are each connected to the additional supply path segment via their associated fifth fuse.

[0017] The ring structure of the supply path segments makes it possible to isolate subnetworks with the isolation instances in the event of a fault and thus ensure the availability of the remaining loads.

[0018] In at least one advantageous embodiment according to the first aspect, the securing device comprises a fifth isolating instance arranged in the additional supply path segment, so that the additional supply path segment is formed by a third and fourth supply path segment, which can be coupled and decoupled via the fifth isolating instance. Alternatively or additionally, the securing device comprises a sixth isolating instance arranged in the additional supply path segment, so that the additional supply path segment is formed by a fifth and sixth supply path segment, which can be coupled and decoupled via the sixth isolating instance.Due to the ring structure of the supply path segments and the further subdivision of the supply path segments in the ring structure, it is possible to use the isolation instances to isolate the subnetworks even more flexibly in the event of a fault and thus further increase the availability of the remaining loads.

[0019] At least some of the fuses, i.e., the first, second, third, fourth, fifth, and sixth fuses, each have a monitoring unit. The respective monitoring unit is configured to detect whether the respective fuse is open or whether predetermined conditions are met which, in the case of a fault-free fuse, lead to the fuse changing to an open state. If the respective fuse is open or the predetermined conditions are met, the monitoring unit is configured to provide a monitoring signal indicating that the fuse is open. Preferably, all of the first to sixth fuses, if present, have such a monitoring module.Detecting whether the specified conditions are met means, for example, that a current is detected that exceeds a specified threshold and would therefore cause the fuse to blow if the fuse were faultless.

[0020] The monitoring module is preferably designed to detect a current flowing through the associated load terminal and / or a voltage applied to the associated load terminal and, depending on the detected current and the detected voltage or only depending on the detected current or the detected voltage, to transfer the fuse into an open state and, if it is a switchable fuse, to also switch the fuse into a closed state.

[0021] This allows for the fuses to be doubled or multiplied. If it is determined that a fuse has blown or should have blown, the associated disconnection instance(s) can be disconnected immediately, approximately within 100 ps to 500 ps.

[0022] In at least one advantageous embodiment according to the first aspect, the safety device comprises a control device configured to receive the monitoring signals and, depending on the monitoring signals, to control one or more of the isolating instances such that they assume an open state, in order to thereby isolate the respective supply path segment to which the respective fuse signaling an open state is connected, from the other supply path segments. The control device can be configured as a central unit or distributed. For example, the control device can comprise a plurality of logic circuits, each of which is assigned to one or more of the isolating instances or to one of the supply segments.

[0023] In particular, the isolating instances each have a control circuit by means of which the opening and closing of the isolating instance is effected and which is controlled by the control device.

[0024] In at least one advantageous embodiment according to the first aspect, the safety device has a coupling unit which is designed to electrically connect the supply path segment separated from all other supply path segments due to the opening of the isolating instances to the first and / or second supply path segment for a predetermined period of time, preferably via an ohmic resistor for current limiting, and to detect, in the predetermined period of time, a first measurement signal which is representative of a first voltage which the respective separated supply path segment has, and a second measurement signal which is representative of a second voltage which the first or second supply path segment provides.

[0025] The coupling unit is preferably designed in a distributed manner. In particular, the coupling unit provides multiple measuring lines, i.e., a separate measuring line for each supply path segment, with the exception of the first and second supply path segments.

[0026] In at least one advantageous embodiment according to the first aspect, the safety device has a comparator designed to compare the first measurement signal with the second measurement signal and, if an amount of deviation between the first measurement signal and the second measurement signal falls below a predetermined threshold value, to cause the control device to return at least one of the isolating instances that cause the isolating of the respective separated supply path segment to a closed state. The comparator can be part of the control device or comprise a separate device. The comparator can be designed to perform the comparison in an analog or digital manner. This advantageously makes it possible to check whether a faulty load has been completely disconnected and / or all faulty loads have been disconnected from their associated supply path segment.When the first voltages and the second voltages equalize, it can be assumed that the disconnection of the respective faulty load by the corresponding fuse has functioned correctly, and the supply path segment affected by the faulty load can be reconnected to the other supply path segments with its remaining loads. This can increase the availability of the remaining loads in the supply path segment affected by the faulty load.

[0027] The comparator may be a separate unit or the control device may include the comparator.

[0028] In at least one embodiment according to the first aspect, the isolating elements (first, second, third, fourth, and fifth isolating elements) and at least some of the fuses each have a switchable semiconductor switch. Preferably, all of the fuses, ie, the first, second, third, fourth, fifth, and sixth fuses, have a semiconductor switch.

[0029] In at least one advantageous embodiment according to the first aspect, the semiconductor switch comprises a metal-oxide-semiconductor field-effect transistor (MOSFET), or multiple MOSFETs connected in parallel and / or multiple MOSFETs connected in series. The parallel connection is advantageous for very high power levels. The series connection enables redundancy, for example, if a MOSFET malfunctions.

[0030] The semiconductor switch preferably has one or more gate drivers that are controlled by the control device.

[0031] In at least one advantageous embodiment according to the first aspect, at least one of the isolating devices has two MOSFETs that are connected in anti-serial fashion. In particular, the fifth and sixth isolating devices can have such an anti-serial arrangement of the MOSFETs, also called a back-to-back arrangement. In particular, a series connection of several back-to-back arrangements of the MOSFETs is also possible. Such a series connection enables redundancy if, for example, a MOSFET malfunctions. The control device is designed to cause, when the isolating device has two MOSFETs that are connected in anti-serial fashion and one of the supply path segments is to be separated from the other supply path segments, at least the MOSFET whose source is arranged on the side facing the supply path segment to be separated to be transferred to a blocking state.

[0032] According to a second aspect, the object is achieved by an on-board electrical system for a vehicle, wherein the on-board electrical system comprises a security device according to the first aspect. Furthermore, the on-board electrical system comprises a first energy source, a second energy source, and a plurality of loads. The loads of the on-board electrical system are each assigned requirements or requirement levels regarding safety integrity.

[0033] Advantageous embodiments according to the first aspect are also valid for the second aspect.

[0034] According to a third aspect and a fourth aspect, the object is achieved by a method and a corresponding control device for an on-board electrical system, wherein the on-board electrical system is designed according to the second aspect. The method comprises the following steps: Depending on a received monitoring signal that signals that one of the fuses has an open state, one or more of the isolating instances are controlled such that they assume an open state, thus isolating the supply path segment to which the fuse signaling the open state is connected from the other supply path segments.Furthermore, the coupling instance is caused to electrically connect the separated supply path segment to the first and / or second supply path segment for a predetermined period of time, preferably via an ohmic resistor for current limiting, and to detect and provide, within the predetermined period of time, a first measurement signal representative of a first voltage exhibited by the respective separated supply path segment, and a second measurement signal representative of a second voltage provided by the first or second supply path segment. The first measurement signal is compared with the second measurement signal, and if an amount of deviation between the first measurement signal and the second measurement signal falls below a predetermined threshold, at least one of the isolating instances that cause the isolating of the separated supply path segment is returned to a closed state.

[0035] According to a fifth aspect, the object is achieved by a computer program comprising instructions which cause a control device to carry out the method according to the third aspect.

[0036] According to a sixth aspect, the problem is solved by a computer-readable non-volatile storage medium on which the computer program according to the fifth aspect is stored.

[0037] Advantageous embodiments according to the first aspect are also valid for the fifth and sixth aspects.

[0038] For the purposes of this document, the mention of such a computer program is synonymous with the term "a program element" and / or "a computer program product" and / or "a computer-readable medium" containing instructions for controlling a computer system in order to coordinate the operation of a system or method in a suitable manner in order to achieve the effects associated with the method according to the invention.

[0039] The computer program can be implemented as computer-readable instruction code in any suitable programming language, such as JAVA, C++, etc. The computer program can be stored on a computer-readable storage medium (CD-ROM, DVD, Blu-ray disk, removable drive, volatile or non-volatile memory, built-in memory / processor, etc.). The instruction code can program a computer or other programmable devices, such as, in particular, a control unit for a motor vehicle engine, to perform the desired functions. Furthermore, the computer program can be provided on a network, such as the Internet, from which it can be downloaded by a user as needed.

[0040] Embodiments of the invention are explained below with reference to the schematic drawings.

[0041] The description of the subject matter presented herein is not limited to the specific individual embodiments. Features of different embodiments may be combined with one another—where technically feasible—to form further embodiments. For example, variations or modifications described with respect to one embodiment may also be applicable to other embodiments, unless otherwise stated.

[0042] They show:

[0043] Figure 1 shows a state-of-the-art vehicle electrical system,

[0044] Figure 2 shows an exemplary equivalent circuit diagram of an embodiment of an on-board network for a vehicle,

[0045] Figure 3 shows an exemplary equivalent circuit diagram of a second embodiment of an on-board network for a vehicle,

[0046] Figure 4 shows an exemplary equivalent circuit diagram of a third embodiment of an on-board network for a vehicle and

[0047] Figure 5 shows an exemplary flow chart for a program for a control device for operating an on-board network.

[0048] In the figures, the same reference numerals are used for elements with essentially the same function, but these elements do not have to be identical in all details.

[0049] Details are set forth below to provide a more complete explanation of the exemplary embodiments. However, it will be apparent to those skilled in the art that embodiments may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form or in a schematic view rather than in detail to facilitate understanding.

[0050] It should be noted that when an element is described as being "connected" or "coupled" to another element, the element may be directly connected or coupled to the other element, or intervening elements may be present. Conversely, when an element is described as being "directly connected" or "coupled" to another element, no intervening elements are present. Other terms used to describe the relationship between elements should be interpreted similarly (e.g., "between" versus "directly between," "adjacent" versus "directly adjacent," etc.).

[0051] Figure 2 shows an exemplary equivalent circuit diagram of an embodiment of an on-board electrical system 100 for a vehicle.

[0052] The vehicle electrical system 100 has a first energy source E1, a second energy source E2, a plurality of loads L1, L2, L3 and a safety device 10.

[0053] The first energy source E1 comprises, for example, a DC / DC converter. The second energy source E2 comprises, for example, a battery or accumulator. The on-board electrical system 1 is, for example, a 12-V on-board electrical system.

[0054] For example, the loads L1, L2, L3 of the on-board network 100 are assigned requirement levels with regard to a safety integrity from a set of predetermined requirement levels, which includes at least requirement levels I, II, III and IV, wherein the requirement increases in the stated order.

[0055] For example, requirement level I corresponds to ASIL QM (non-safety-relevant). Requirement level II corresponds to ASIL A according to ISO 26262. Requirement level III corresponds to ASIL B according to ISO 26262, and requirement level IV corresponds to ASIL C according to ISO 26262.

[0056] Such a requirement level can also be assigned to the energy storage devices E1 and E2. For example, the first energy source E1 can be assigned requirement level I, and the second energy source E2 can be assigned requirement level IV. The higher requirement level for the second energy source E2 results from the fact that the second energy source E2 is intended for the redundant power supply of the safety-relevant loads, which are assigned, for example, requirement level IV.

[0057] The safety device 10 has a first supply terminal VA1 and a second supply terminal VA2. The first supply terminal VA1 of the safety device 10 is connected to the first energy source E1 via a first supply line VL1. The first energy source E1 can be connected to the first supply terminal VA1 of the safety device 10 via a fuse F (not shown in Figure 2), in particular a safety fuse, which is arranged in the first supply line VL1.

[0058] For example, a plurality of first loads L1 are connected to the first supply line VL1. These first loads L1 are connected to the first supply line VL1, for example, via fuses F.

[0059] The second supply connection VA2 of the safety device 10 is connected to the second energy source E2 via a second supply line VL2. One or more second loads L2 are connected to the second supply line VL2, for example. These second loads L2 are connected to the second supply line VL2, for example, via fuses F. The second loads L2 are, in particular, safety-relevant loads, for example, with a requirement level IV or AS I LC requirement.

[0060] The safety device 10 has a first supply path segment VS1, a second supply path segment VS2, and a further supply path segment VSw.

[0061] Furthermore, the security device 10 has a first separating instance T1 and a second separating instance T2.

[0062] The first supply path segment VS1 is arranged between the first supply connection VA1 and the first isolating instance T1. This means that the first supply path VS1 connects the first supply connection VA1 to a first connection of the first isolating instance T1.

[0063] The second supply path segment VS2 is arranged between the second supply connection VA2 and the second isolating device T2. This means that the second supply path VS2 connects the second supply connection VA2 to a second connection of the second isolating device T2.

[0064] The further supply path segment VSw is between the first separation instance

[0065] T1 and the second isolating instance T2. This means that the further supply path segment VSw connects a second terminal of the first isolating instance T1 with a first terminal of the second isolating instance T2.

[0066] Furthermore, the fuse device 10 has a plurality of first load terminals LA1, each of which is connected to the first supply path segment VS1 via a first fuse S1. Preferably, a first load L1 is connected to each of the first load terminals LA1.

[0067] The fuse device 10 has a plurality of third load terminals LA3, each of which is connected to the further supply path segment VSw via a third fuse S3. Preferably, a third load L3 is connected to each of the third load terminals LA3.

[0068] In an optional embodiment, the safety device 10 comprises a further isolating element Tw and one or more second load terminals LA2, to each of which a second load L2 is connected. The second load terminal(s) LA2 are each connected via a second fuse S2 to a first terminal of the further isolating element Tw, and a second terminal of the further isolating element Tw is connected to the second supply path segment VSw.

[0069] The first fuses S1, second fuses S2 and third fuses S3 each have a monitoring unit MU which is designed to detect whether the respective fuse has an open state or predetermined conditions are met (a current through the fuse exceeds a predetermined threshold value), which in the case of a fault-free fuse lead to the fuse changing to an open state, and if the respective fuse has an open state or the conditions are met, to provide a monitoring signal which signals that the fuse has an open state.

[0070] The fuse device 10 has a control device CU configured to receive the monitoring signals from the fuses S1, S2, S3 and, depending on the monitoring signals, to control one or more predetermined isolating elements such that they assume an open state. For example, if one of the first fuses S1 signals to the control device CU that it is open, the control device CU causes the first isolating element T1 to be switched to an open state. This allows the second and third loads L2, L3 to continue to be supplied by the second energy source E2.

[0071] For example, if one of the third fuses S3 signals to the control device CU that it is open, the control device CU causes the first and second isolating elements T1, T2 to each be switched to an open state. This allows at least the second loads L2 to continue to be supplied by the second energy source E2.

[0072] For example, if one of the second fuses S2 signals to the control device CU that it is open, the control device CU causes the additional isolating device Tw to be switched to an open state. This allows the first and third loads L1, L3 to continue to be supplied redundantly by the first energy source E1 and the second energy source E2. However, the additional loads L2 of the second supply line VL2 can also be supplied redundantly via the first energy source E1 and the second energy source E2.

[0073] The safety device 10 further comprises a coupling unit SU which is designed to connect the further supply path segment VSw, which has been separated from the first supply path segment VS1 and the second supply path segment VS2, for example due to a short circuit in one of its loads, to the first and / or second supply path segment VS1, VS2 in an electrically conductive but high-impedance manner for a predetermined period of time and to detect, in the predetermined period of time, a first measurement signal which is representative of a first voltage which the further supply path segment VSw has, and a second measurement signal which is representative of a second voltage which the first or second supply path segment VS1, VS2 provides.

[0074] The coupling unit SU has, for example, for all supply path segments VS3, ..., VS6 except for the first and second supply path segments VS1, VS2, a switchable connection, for example a line with a transistor, for example a bipolar pnp transistor or a MOSFET, so that in the event of a fault, the supply path segment affected by the fault and the first supply path segment VS1 or the second supply path segment VS2 can be electrically connected for a predetermined period of time.

[0075] The safety device 10 has a comparator which is designed to compare the first measurement signal with the second measurement signal and, if an amount of deviation between the first measurement signal and the second measurement signal falls below a predetermined threshold value, to cause the control device to return at least one of the isolating instances which cause the isolating of the respective separated supply path segment to a closed state.

[0076] This means that if during the coupling the voltage in the further supply path segment VSw equals the voltage of the first supply path segment VS1 or the voltage of the second supply path segment VS2, it can be assumed that the associated fuse is functioning correctly and that the faulty consumer has been correctly disconnected, and the further supply path segment VSw can be reconnected to the first and / or second energy source E1, E2 and permanently supplied.

[0077] Figure 3 shows an exemplary equivalent circuit diagram of a further embodiment of an on-board electrical system 100 for a vehicle.

[0078] In contrast to the exemplary embodiment shown in Figure 1, the fuse device 10 has a third isolating instance T3, a fourth isolating instance T4, an additional supply path segment VSz and a plurality of fifth load connections LA5. The first supply path segment VS1 is additionally connected to a first connection of the third isolating instance T3 and the second supply path segment VS2 is additionally connected to a first connection of the fourth isolating instance T4. The additional supply path segment VSz is arranged between the third and fourth isolating instances T3, T4. This means that it connects a second connection of the third isolating instance T3 and a second connection of the fourth isolating instance T4. The fifth load connections LA5 are each connected to the additional supply path segment VSz via a fifth fuse S5.

[0079] The fifth fuses S5 are designed, for example, analogously to the third fuses S3 and the control device CU is designed to also receive and evaluate the monitoring signals of the fifth fuses S5 and to suitably control the isolating instances T3, T4.

[0080] Furthermore, the coupling unit SU is additionally designed to electrically connect the additional supply path segment VSz to the first and / or second supply path segment VS1, VS2 for a predetermined period of time, in particular with high impedance, if it has been separated from the first supply path segment VS1 and the second supply path segment VS2, for example due to a short circuit in one of its loads, and to detect a first measurement signal, which is representative of a first voltage which the additional supply path segment has, and a second measurement signal, which is representative of a second voltage which the first or second supply path segment VS1, VS2 provides, in the predetermined period of time.

[0081] The comparator is designed to compare the first measurement signal with the second measurement signal for the additional supply path segment VSz as well and, if an amount of deviation between the first measurement signal and the second measurement signal falls below a predetermined threshold value, to cause the control device CU to return at least one of the isolating instances that effect the isolating of the additional supply path segment, ie the third and / or the fourth isolating instance, to a closed state.

[0082] Figure 4 shows an exemplary equivalent circuit diagram of a further embodiment of an on-board electrical system 100 for a vehicle.

[0083] In contrast to the embodiment shown in Figure 3, the safety device 10 has a fifth isolating instance T5, which is arranged in the further supply path segment VSw, so that the further supply path segment VSw is formed by a third and fourth supply path segment VS3, VS4, which can be coupled and decoupled via the fifth isolating instance T5.

[0084] The third load terminals LA3 are each connected to the third supply path segment VS3, for example, via the third fuses S3. The fuse device 10 further comprises a plurality of fourth load terminals LA4, which are connected to the fourth supply path segment VS4 via fourth fuses S4.

[0085] The safety device 10 has, for example, a sixth isolating instance T6, which is arranged in the additional supply path segment VSz, so that the additional supply path segment VSz is formed by a fifth and sixth supply path segment VS5, VS6, which can be coupled and decoupled via the sixth isolating instance T6.

[0086] For example, the fifth load terminals LA5 are each connected to the fifth supply path segment VS5 via the fifth fuses S5.

[0087] The fuse device 10 further comprises a plurality of sixth load terminals LA6, which are connected to the sixth supply path segment VS6 via sixth fuses S6.

[0088] The fourth and sixth fuses S4, S6 are designed, for example, analogously to the third fuses S3 and the control device CU is designed to also receive and evaluate the monitoring signals of the fourth and sixth fuses S4, S6 and to suitably control the isolating instances, in particular also the fifth and sixth isolating instances T5, T6.

[0089] The coupling unit CU is, as already described in connection with Figures 2 and 3, designed to electrically connect the respective supply path segment, which has been separated from the other supply path elements, for example due to a short circuit in one of its loads, to the first and / or second supply path segment for a predetermined period of time and to detect, in the predetermined period of time, a first measurement signal which is representative of a first voltage which the additional supply path segment has, and a second measurement signal which is representative of a second voltage which the first or second supply path segment provides.

[0090] The comparator is, as already described in connection with Figures 2 and 3, designed to compare the first measurement signal with the second measurement signal for the respective supply path segment when it is separated, and if an amount of deviation between the first measurement signal and the second measurement signal falls below a predetermined threshold value, to cause the control device to return at least one of the separation instances that cause the separation of the separated supply path segment to a closed state.

[0091] In the examples shown in Figures 2 to 4, the first to sixth fuses comprise a circuit breaker. Alternatively, it is possible for the first to sixth fuses S1, ... S6 to have melting fuses. Furthermore, it is possible for the first to sixth fuses S1, ... S6 to be configured differently, so that some of the fuses comprise a melting fuse and the other part of the fuses comprise a circuit breaker.

[0092] The respective isolating switch is designed as a semiconductor switch. The respective semiconductor switch preferably comprises a metal-oxide-semiconductor field-effect transistor (MOSFET) or several MOSFETs connected in parallel. In particular, n-channel MOSFETs can be used.

[0093] The first to fifth isolating elements T1, ..., T5 and the further isolating element Tw also comprise a semiconductor switch. The respective semiconductor switch preferably comprises a MOSFET or several MOSFETs connected in parallel.

[0094] At least one of the isolating elements T1, ... T5, Tw, preferably the fifth and sixth isolating elements T5, T6, has two MOSFETs connected in series. The two MOSFETs can also each be formed by a group of MOSFETs connected in parallel. The control device CU is designed to cause, when one of the supply path segments (in particular the third or fourth or fifth or sixth) is to be separated from the other supply path segments, the MOSFET whose source is arranged on the side facing the supply path segment to be separated to be placed in a blocking state.

[0095] For example, the fifth isolating instance T5 has a first and a second MOSFET that are connected in anti-series, wherein the first MOSFET is arranged on the side of the third supply path segment VS3 and the first MOSFET is directly connected with its drain to the third supply path segment VS3, and the second MOSFET is arranged on the side of the fourth supply path segment VS4 and the second MOSFET is directly connected with its drain to the fourth supply path segment VS4. The control device CU is designed to cause, when the third supply path VS3 is to be disconnected, at least the second MOSFET of the fifth isolating instance T5 to be set to high resistance and the first isolating instance to be switched into an open state. When the fourth supply segment is to be disconnected, at least the first MOSFET of the fifth isolating instance T5 is set to high resistance and the second isolating instance to be switched into an open state.

[0096] The respective semiconductor switch preferably has one or more gate drivers which are controlled by the control device CU.

[0097] The monitoring unit MU of the first to sixth fuses S1, S6 is in particular each designed to detect a voltage at the associated load terminal and / or a load current flowing through the fuse. The monitoring module MU is further designed to control a switching state of the fuse's disconnector depending on the detected current and the detected voltage, or only depending on the detected voltage or the detected load current.

[0098] The loads L1, .... L6 are assigned the following requirement levels with regard to safety integrity: o first load -> requirement level I o second load -> requirement level III or IV o third load -> requirement level II or III o fourth load -> requirement level II or III o fifth load -> requirement level II or III o sixth load -> requirement level II or III

[0099] Figure 5 shows an exemplary flow chart for a program for a control device CU for operating an on-board network 100, as described by way of example with reference to Figures 2 to 4.

[0100] The program is first started in step S01. The program can start, for example, when a monitoring signal is present at an input of the control device CU. In step S01, program variables are initialized, for example. In step S03, a monitoring signal is received or read in, which is provided by one of the fuses, for example due to a fault, in particular a short-circuit fault, and depending on the received or read-in monitoring signal, which signals that the fuses are open, one or more of the isolating instances are controlled such that they assume an open state and that the supply path segment to which the fuse that signals the open state is connected is separated from the other supply path segments, in particular from all other supply path segments.

[0101] In step S05, for example, a switching transistor of the coupling unit SU is controlled so that the switchable connection connecting the fault-affected supply path segment and the first supply path segment VS1 or the second supply path segment VS2 is electrically conductive for a predetermined period of time. The connection is designed with high resistance, so that only a small current can flow compared to the actual load current.

[0102] Furthermore, a first measurement signal and a second measurement signal are received, which the coupling unit SU provides. The first measurement signal is representative of a first voltage provided by the separated supply path segment. The second measurement signal is representative of a second voltage provided by the first supply path segment VS1 and the second supply path segment VS2, respectively.

[0103] In a step S07, the first measurement signal is compared with the second measurement signal and, if an amount of deviation between the first measurement signal and the second measurement signal falls below a predetermined threshold value, at least one of the isolating instances that cause the isolating of the separated supply path segment is returned to a closed state.

[0104] The program is terminated in step S09. Alternatively, the program can execute a detection mode in which the inputs of the control device CU are monitored to detect whether monitoring signals are being sent from the fuses S1, ..., S6. The program can thus switch to the detection mode.

[0105] 1 , 100 on-board network

[0106] 10 Safety device cu control device

[0107] E1 first energy source

[0108] E2 second energy source

[0109] L1, L2, L3, first load, second load, third load, fourth load, fifth load, sixth load

[0110] L4, L5, L6

[0111] LA1, LA2, LA3, first to sixth load connection

[0112] LA4, LA5, LA6, MU monitoring unit

[0113] S1, S2, S3, S4, S5, first to sixth fuse

[0114] S6

[0115] SU coupling unit

[0116] T1, T2, T3, T4, T5 first separation instance to fifth separation instance

[0117] Tw further separation instance

[0118] VA1 first supply connection

[0119] VA2 second supply connection

[0120] VL1 first supply line

[0121] VL2 second supply line

[0122] VS1, VS2, VS3, first, second, third, fourth, fifth, sixth

[0123] VS4, VS5, VS6 supply path segment

[0124] VSw additional supply path segment

[0125] VSz additional supply path segment

Claims

Patent claims 1. A safety device (10) for an on-board power supply (100) of a vehicle, wherein the on-board power supply (100) has a first energy source (E1) and a second energy source (E2) and a plurality of loads (L1, L2, L3, L4, L5, L6), and the loads (L1, L2, L3, L4, L5, L6) of the on-board power supply (100) are each assigned requirements or requirement levels with regard to safety integrity, and the safety device (10) - a first supply connection (VA1) for connecting the safety device (10) to the first energy source (E1) and a second supply connection (VA2) for connecting the safety device (10) to the second energy source (E2), - a first, a second, and a further supply path segment (VS1, VS2, VSw), - one or more first load terminals (LA1) for connecting a first load (LA1), wherein the first load terminals (LA1) are each connected to the first supply path segment (VS1) via a first fuse (S1), - has a plurality of third load terminals (LA3) for connecting a third load (L3), wherein the third load terminals (LA3) are each connected to the further supply path segment (VSw) via a third fuse (S3), - a first separating instance (T1 ) and a second separating instance (T2), wherein - the first supply path segment (VS1 ) is arranged between the first supply connection (VA1 ) and the first isolating instance (T1 ), - the second supply path segment (VS2) is arranged between the second supply connection (VA2) and the second isolating instance (T2), - the further supply path segment (VSw) is arranged between the first isolating instance (T1) and the second isolating instance (T2), wherein at least some of the fuses (S1, S6) each have a monitoring unit (MU) which is designed - to detect whether the respective fuse (S1, ..., S6) has an open state or whether predetermined conditions are met which, in the case of a fault-free fuse, lead to the fuse changing to an open state, and - if the respective fuse (S1, ..., S6) has an open state or the conditions are met, a monitoring signal which signals that the fuse (S1, ..., S6) is in an open state.

2. Safety device (10) according to claim 1, wherein the safety device comprises a control device (CU) which is designed - to receive the monitoring signals and, depending on the monitoring signals, to control one or more of the isolating instances (T1, ... T5) in such a way that they assume an open state in order to separate the respective supply path segment to which the respective fuse (S1, ..., S6) is connected, which signals an open state, from the other supply path segments.

3. Safety device (10) according to claim 2, wherein the safety device (10) has a coupling unit (SU) which is designed to electrically connect a supply path segment which is separated from all other supply path segments due to the opening of the isolating instances to the first and / or second supply path segment (VS1, VS2) for a predetermined period of time and to detect, in the predetermined period of time, a first measurement signal which is representative of a first voltage which the respective separated supply path segment has, and a second measurement signal which is representative of a second voltage which the first supply path segment (VS1) or the second supply path segment (VS2) provides.

4. Safety device (10) according to claim 3, wherein the safety device (10) has a comparator which is designed to compare the first measurement signal with the second measurement signal and, if an amount of deviation between the first measurement signal and the second measurement signal falls below a predetermined threshold value, to cause the control device (CU) to transfer at least one of the isolating instances which cause the isolating of the respective separated supply path segment back into a closed state.

5. Safety device (10) according to one of the preceding claims, comprising a further isolating instance (Tw) and one or more second load terminals (LA2) for respectively connecting a second load (L2), wherein the second load terminal(s) (LA2) are each connected via a second fuse (S2) are connected to the further separation instance (Tw) and the further separation instance (Tw) is connected to the second supply path segment (VS2).

6. Safety device (10) according to one of the preceding claims, wherein - the safety device (10) has a third isolating instance (T3), a fourth isolating instance (T4), an additional supply path segment (VSz) and a fifth load connection (LA5) with an associated fifth fuse (S5), - the first supply path segment (VS1) is connected to the third separation instance (T3), - the second supply path segment (VS2) is connected to the fourth separation instance (T4), - the additional supply path segment (VSz) is arranged between the third separation instance (T3) and fourth separation instance (T4) and - the fifth load terminal (LA5) is connected to the additional supply path segment (VSz) via the fifth fuse (S5).

7. Safety device (10) according to claim 6, wherein - the safety device (10) has a fifth isolating instance (T5) which is arranged in the further supply path segment (VSw), so that the further supply path segment (VSw) is formed by a third supply path segment (VS3) and a fourth supply path segment (VS4), which can be coupled and decoupled via the fifth isolating instance (T5), and / or - the safety device (10) has a sixth isolating instance (T6) which is arranged in the additional supply path segment (VSz), so that the additional supply path segment (VSz) is formed by a fifth supply path segment (VS5) and sixth supply path segment (VS6), which can be coupled and uncoupled via the sixth isolating instance (T6).

8. Safety device (10) according to one of the preceding claims, in which the isolating instances (T1, ... T5) and at least some of the fuses (S1, ..., S6) have a semiconductor switch.

9. The safety device (10) according to claim 8, wherein the semiconductor switch comprises a metal oxide semiconductor field effect transistor, MOSFET, or a plurality of MOSFETs connected in parallel or a plurality of MOSFETs connected in series.

10. Safety device (10) according to one of the preceding claims, in which at least one of the isolating instances (T1, ... T5) has two MOSETs which are connected in anti-serial.

11. A safety device (10) according to claim 10, wherein the control device (CU) is designed to cause, when one of the supply path segments is to be separated from the other supply path segments, the MOSFET whose source is arranged on the side facing the supply path segment to be separated to be put into a blocking state.

12. On-board network (100) for a vehicle, comprising a security device (10) according to one of claims 1 to 11, a first energy source (E1), a second energy source (2) and a plurality of loads (L1, ..., L6), wherein the loads (L1, ... L6) of the on-board network (100) are each assigned requirements or requirement levels with regard to safety integrity.

13. A method for operating a borne network (1) with a security device (10) according to one of claims 4 to 11, in which - depending on a received monitoring signal indicating that one of the fuses is open, one or more of the isolating instances are controlled in such a way that they assume an open state and that the supply path segment to which the fuse indicating the open state is connected is separated from the other supply path segments, - the coupling unit (SU) is caused to electrically connect the separated supply path segment to the first supply path segment (VS1) and / or second supply path segment (VS2) for a predetermined period of time and to detect and provide a first measurement signal representative of a first voltage provided by the respective separated supply path segment and a second measurement signal representative of a second voltage provided by the first supply path segment (VS1) or the second supply path segment (VS2) in the predetermined period of time, - the first measurement signal is compared with the second measurement signal and, if an amount of deviation between the first measurement signal and the second measurement signal falls below a predetermined threshold value, at least one of the Separation instances that cause the separation of the separated supply path segment are returned to a closed state.

14. Control device (CU) for operating an on-board network (100) according to claim 12, which is designed to carry out the method according to claim 13.

15. A computer program comprising instructions which, when executed by a processor or controller of a control device, cause the control device (CU) to carry out the method according to claim 13.

Images