Device, means of transportation, and method for protecting an on-board electrical system and a switch

Abstract

The invention proposes a device, a means of transportation, and a method for providing protection for an on-board electrical system (1) of a means of transportation. The method comprises the steps of automatically ascertaining a predefined change in voltage per unit time in the on-board electrical system (1) and automatically opening a switch (2) in the on-board electrical system (1) in response thereto.

Description

[0001] Device, means of transport and method for protecting an on-board network and a switch

[0002] Description

[0003] The present invention relates to a device, a means of transport, and a method for protecting the electrical system of a means of transport using a switch, in particular an eFuse. An "eFuse" is also referred to in the prior art as a smart FET, a high-switch switch with power protection function, a MOSFET isolating element with extended diagnostics and line protection functions, or similar. In particular, the present invention relates to the most gentle possible shutdown of an electrical system in the event of a fault.

[0004] Modern means of transport have a multitude of electrical consumers. In addition, the electrical power converted in the means of transport, particularly by electric drive trains, is becoming ever greater. Fuses have long proven themselves in the protection of vehicle electrical systems. However, these have the disadvantage that they cannot be triggered reversibly and must be replaced after they have tripped. In addition, they respond relatively slowly, meaning that consequential damage cannot always be avoided in every fault event. For this reason, semiconductor switches, also known as "eFuse", are increasingly being used for protection. These are usually based on a semiconductor switch (MOSFET), which opens / switches off the vehicle electrical system when a certain threshold is reached. The corresponding measured value can be, for example,by measuring an electrical quantity (voltage, current, or impedance), and when the predefined threshold is reached, a signal is issued to trigger the eFuse. eFuses are gradually replacing traditional fuses in vehicle power systems. Their popularity is based on functional safety, which provides very fast (within a few microseconds) selective isolation of fault currents (e.g., electrical short circuits). Fuses, on the other hand, trigger comparatively slowly (several milliseconds). Further advantages include more precise adaptability to the line to be protected. This line can be utilized more effectively or designed closer to the normal load level. This saves material and mass. Furthermore, unlike fuses, the switching state of eFuses is reversible.

[0005] Fig. 2 shows a possible equivalent circuit diagram for the use of an eFuse or a fuse to protect a line 7 of a vehicle electrical system 1. The eFuse is represented abstractly by an ideal switch. Fuse 3 represents an alternative to the eFuse 2. Physically, the eFuse 2 corresponds to a MOSFET. The battery provides a battery voltage UBAT and supplies the load RLOAD via a line 7. Line 7 is represented by a resistor R and an inductance L connected in series with it and is protected from thermal overload by the eFuse 2 or the fuse 3.

[0006] Fig. 3 shows the integrated protection mechanisms known in the prior art in a current-time diagram for protecting an on-board electrical system. An operating range 33 is separated from a fault range 40 by a tripping range 36. A line 31 indicates the maximum current permitted in the normal case / operating range. A line 32 indicates the earliest tripping time for the fuse / eFuse. A double arrow 34 indicates the nominal continuous current. A double arrow 35 indicates the range provided by a current-time algorithm. A double arrow 37 indicates the minimum peak current, while a double arrow 38 indicates a maximum peak current. A vertical line 30 indicates a latest tripping time, which merges into a line 39, which indicates the maximum current required to reach a cable temperature of 105°C.The most important line 41 identifies the overcurrent protection, which is to be provided in accordance with the invention to ensure the functional safety of ASIL-classified components in the form of an overcurrent shutdown.

[0007] There are essentially three protection mechanisms known in the state of the art:

[0008] - Equipment protection (thermal protection of the MOSFET) - Overcurrent-time protection (thermal line protection, overcurrent protection)

[0009] - Undervoltage protection

[0010] If a threshold is exceeded, the faulty on-board power supply is disconnected as quickly as possible. Rapid shutdown is particularly important because the (predominantly inductive) energy stored in the network can cause significant damage or electrical wear to the switch.

[0011] To reduce wear, the fault current should be allowed to run freely during the eFuse shutdown process, preventing destructive voltages from occurring in the vehicle electrical system. To achieve this, state-of-the-art eFuses already utilize freewheeling diodes or the avalanche effect of corresponding MOSFETs. However, the avalanche effect in particular must not be overstressed.

[0012] Fig. 7 shows that during avalanche freewheeling of a current (0 to 70 ps), thermal stress on the MOSFET of over 200 °C can occur. This value is well outside the MOSFET specification. A high inductance of the line to be protected is particularly critical, as it stores a large amount of energy at a fixed cut-off current. Freewheeling of increased energy carries the risk of overloading the avalanche effect or the freewheeling diodes. The amount of energy can be reduced by using a smaller inductance (e.g., short lines in the vehicle electrical system) or by setting the switch-off time very early. In practice, however, the inductance of the vehicle electrical system cannot usually be reduced arbitrarily, as it is predetermined or cannot be influenced due to the geometry of the wiring harness.

[0013] It is an object of the present invention to be able to disconnect a faulty vehicle electrical system area from the voltage supply as early as possible.

[0014] The above-mentioned object is achieved according to the invention by a method having the features according to claim 1, a device having the features according to claim 8 and a means of transport having the features according to claim 10. The subclaims show preferred developments of the invention.

[0015] The method is used to protect the electrical system of a vehicle using an eFuse or a switch. The electrical system can be a traction electrical system (medium or high voltage electrical system or a conventional 12 V, 24 V, or 48 V electrical system). In order to be able to disconnect the electrical system as early as possible, a predefined voltage change per unit of time or a predefined voltage gradient in the electrical system is automatically determined by measurement. In other words, a voltage swing is determined per predefined time interval and compared with a corresponding predefined reference. The voltage change can be an absolute value or a signed value. In response to a successful comparison / alignment of the voltage change per unit of time with the reference value, a switch in the electrical system is automatically opened to de-energize the electrical system.While in the prior art, eFuses are triggered based on predefined absolute thresholds, the particularly early detection of a critical voltage drop or a critical voltage rise per unit of time according to the invention can enable early shutdown of the vehicle electrical system. This point in time is usually before absolute thresholds known in the prior art are reached.

[0016] The automatic determination of the predefined voltage change can include additional steps, which are performed once or repeatedly, preferably during operation of the vehicle. In an optional step, a voltage change is calculated based on a measured input voltage for normal operation and short-circuit operation. In other words, depending on the knowledge of the specification and condition of the on-board electrical system and its components, a voltage change is determined for an OK case and a short-circuit case, and then a check is carried out to determine the extent to which a predefined difference or distinguishability is achieved between a calculation result for normal operation and a calculation result for short-circuit operation.If the differences are sufficiently distinguishable, it can then be determined to what extent the measured input voltage exhibits a predefined similarity to the measured input voltage in short-circuit operation. In other words, it can be determined whether the measured input voltage corresponds to short-circuit operation, and in response (as described above), the switch in the vehicle electrical system can be automatically opened. By continuously calculating the voltage change for normal and short-circuit operation, aging effects, temperature effects, and other circumstances can be taken into account, so that the differences between the two states (normal case versus short-circuit case) can always be perfectly distinguished, and an ideal reference value for the short-circuit case is maintained.

[0017] The predefined voltage change can, for example, be defined as a rate of change of 3 V / ps. In other words, the voltage of the vehicle electrical system changes by -3 V per microsecond when a short circuit occurs. Alternatively, a rate of change of 5 V per microsecond, and most preferably a rate of change of 7 V per microsecond, can be predefined to distinguish permissible operating conditions from impermissible operating conditions (not acceptable).

[0018] The voltage change for normal operation and short-circuit operation can be calculated, for example, at cyclically recurring intervals and / or based on events. For example, a determination can be made once every 10 ps or more frequently. An event-based recalculation of the respective voltage change can be performed, for example, depending on a temperature or once per life cycle (wake-up cycle) of the vehicle.

[0019] The predefined voltage change can, for example, be characterized by a minimum voltage change within a predefined period of time. For example, to avoid even the smallest voltage fluctuations with significant gradients, a minimum duration for the presence of the voltage gradient can be specified as a shutdown condition. For example, the gradient can be required for a duration of at least one microsecond, 10 ps, ​​100 ps, ​​or similar to trigger the automatic opening process of the switch proposed by the invention. This prevents non-critical voltage changes or those occurring during normal operation from leading to the shutdown of the vehicle electrical system.

[0020] To prevent the evaluation / calculation of the electrical parameters required by the invention from being performed unnecessarily frequently or during non-critical states of the vehicle electrical system, the determination of the voltage change can be made dependent on a predefined voltage threshold and / or a predefined current threshold being reached. In other words, a predefined (absolute) threshold of an electrical parameter is used as the trigger for the execution of the method according to the invention in order to reduce the computing power and energy consumption of the evaluation unit.

[0021] The vehicle electrical system protected according to the invention can, for example, have a nominal voltage range of 12 V to 800 V, preferably in the 400 V range. However, application to vehicle electrical systems outside the aforementioned voltage ranges is also possible in principle.

[0022] According to the invention, it is not excluded that the vehicle electrical system is additionally protected by a fuse. In other words, the vehicle electrical system or the vehicle electrical system section can be additionally protected by a fuse, which is provided, for example, in series with the eFuse or switch proposed according to the invention. In this way, physical protection of the vehicle electrical system can be provided that is independent of the current processor load, but is not reversible. In this way, a higher ASIL level is achieved.

[0023] According to a second aspect of the present invention, a device for protecting an on-board electrical system of a means of transport is proposed. The device can comprise an eFuse and / or a MOSFET and / or another electrical switch, which is controlled in the manner according to the invention. For this purpose, the device has a data input, an evaluation unit and a data output. The data input can, for example, be equipped with a measuring instrument for determining an electrical on-board electrical system variable. The evaluation unit can have a microcontroller, a nanocontroller, an FPGA or similar. The data output is at least configured to open the eFuse or the MOSFET or another switch when the evaluation unit obtains corresponding information. The evaluation unit is configured in the manner according to the invention to automatically use the data input to determine a predefined voltage change per unit of time orto determine a predefined voltage gradient in the vehicle electrical system. If this critical voltage gradient is determined, the evaluation unit is configured to automatically open the switch / MOSFET / eFuse in the vehicle electrical system via the data output in order to de-energize it and, if necessary, dissipate the energy stored in the vehicle electrical system via a freewheeling diode or similar. In this way, the device according to the invention is configured to implement a method according to the first-mentioned aspect of the invention in a manner that is evident in such a way that reference is made to the above explanations with regard to the features, combinations of features, and the advantages resulting from them.

[0024] According to a third aspect of the present invention, a means of transportation is proposed, which is configured, for example, as a car, van, truck, motorcycle, aircraft, and / or watercraft. The means of transportation has an on-board electrical system that is configured to be secured by a method according to the first aspect of the invention or by a device according to the second aspect of the invention. Thus, the features, combinations of features, and advantages of the above statements also apply correspondingly to the means of transportation according to the invention.

[0025] Further details, features, and advantages of the invention will become apparent from the following description and the figures. They show:

[0026] Fig. 1 is a schematic representation of an embodiment of a means of transport designed according to the invention;

[0027] Fig. 2 is a schematic representation of a protection system for a vehicle electrical system;

[0028] Fig. 3 shows a current-time diagram of operating points of a vehicle electrical system protected according to the invention; Fig. 4 shows a comparison of a short-circuit current and a normal current over time;

[0029] Fig. 5 shows a comparison of a short-circuit voltage with a normal voltage over time;

[0030] Fig. 6 shows a comparison of the rate of change of a short-circuit voltage compared to a normal voltage over time;

[0031] Fig. 7 shows a comparison of temperature, drain-source voltage, and drain-source current over time in the event of a fault;

[0032] Fig. 8 is a schematic diagram of an on-board power supply system protected according to the invention with a device according to an embodiment of a device according to the invention; and

[0033] Fig. 9 is a flowchart illustrating steps of an embodiment of a method according to the invention for securing an on-board network of a means of transport.

[0034] Fig. 1 shows a passenger car as a means of transport 10 designed according to the invention, with an on-board electrical system 1, through which an electric motor 5 is supplied with electrical energy via a traction battery 4. A short circuit 6 between the electrical line 8 and the vehicle ground causes a rapid drop in the on-board electrical system voltage, which can be detected according to the invention.

[0035] Fig. 4 shows a comparison of the time behavior of an on-board electrical system current in a short-circuit case 51 and a normal case 52. The maximum current IM ax permitted for the normal case is reached after just under two hundred microseconds in the normal case 52. Using an overcurrent shutdown according to the state of the art, shutdown would only occur when the threshold value of 700 A is exceeded (after 150 ps). The threshold value of 700 A was set based on the maximum input current (at 10 mF lMax = 600 A), which is the maximum operating current that should not be switched off under normal circumstances. Fig. 5 shows a voltage-time diagram for a short-circuit case 51 and a normal case 52. Since in the short-circuit case 51 an inductive characteristic causes the currents to lag behind the voltages, monitoring the current change leads to a delayed detection of the short-circuit.Rather, the inventive monitoring of the voltage change per unit of time enables particularly early detection of the fault and thus a shutdown process with comparatively low energy stored in the vehicle electrical system. In the steady-state fault case 51, the voltage is lower than the supply voltage (due to the voltage drop across the ohmic line resistance). In the normal case 52, however, a return of the voltage to the input voltage can be observed (due to the capacitive load characteristic).

[0036] Fig. 6 shows the rate of change of the voltage in the vehicle electrical system for a short circuit 51 and a normal case 52. To enable early detection of the fault, such as the short-circuit current, the voltage rise or fall per unit of time (voltage gradient) of the eFuse output voltage is monitored. Depending on the load capacitance, the short circuit can be detected early with a defined confidence. Fig. 6 compares the eFuse voltage rise for a short circuit 51 with the capacitive load in the normal case 52. After 22 ps, the short circuit can be differentiated with sufficient confidence from the capacitive charging current (10 mA) in the case of a capacitive load of 10 mF. The short circuit is thus detected and switched off at 22 ps and 120 A. The energy quantities that need to be switched according to the invention and the prior art compare as follows:

[0037] - Overcurrent shutdown (state of the art): 490 mJ (2 p, 700 A).

[0038] - Voltage gradient based (according to the invention): 14 mJ (- 97%).

[0039] Fig. 8 shows a block diagram of a schematically illustrated equivalent circuit of a vehicle electrical system for voltage-based shutdown according to the invention. The elements of the electrical system 1 already presented in Fig. 2 are supplemented by a voltage sensor 11, a current sensor 12 as data input 13, an evaluation unit 14, and a data output 15. In addition, the capacitive load C is bridged by a short circuit 6. The data input 13 is configured to perform a time derivative of the voltage at the battery, thereby producing a differential measured voltage dv meas is provided. By means of the current sensor 12, the evaluation unit 14 provides a differential short-circuit voltage dvsc and a differential normal case voltage dvc. If the differential short-circuit voltage reduced by a discount ö (e.g. 5% - 20%) is less than or equal to the differential measured voltage and at the same time the differential measured voltage is not less than or equal to the differential normal case voltage subject to a surcharge, the data output 15 is caused to activate the switch 2 in order to disconnect the battery from the vehicle electrical system 1. Otherwise, the method continues with the verification of the aforementioned condition. In other words, two parallel determinations are carried out, one of which carries out the measurement and the other of which calculates electrical quantities. The quantities determined in this way are then compared with one another to determine the extent to which a shutdown condition exists.On the one hand, a differential voltage of the on-board network (input voltage) and from this a measuring voltage increase m. V Measurement is measured or determined. At the same time, a differential input voltage is calculated using the input voltage u (t) and the current i (t). This calculation is performed for both the normal case (vehicle electrical system with a normal capacitive load) and a short-circuit case. While the normal case model includes a capacitance, the short-circuit model only has an inductive and a resistive component. The two models are therefore as follows:

[0040] Capacitive model:

[0041] Short circuit model: If the amount of the short-circuit voltage increase is greater than the amount of the normal case voltage increase with a surcharge ö, it is then checked to what extent the amount of the difference of the calculated measured voltage increase m VMeasurement and the short-circuit voltage change are smaller than the amount of the short-circuit voltage increase subject to the surcharge. If this condition / inequality is met, shutdown occurs by the eFuse tripping.

[0042] In other words, the procedure according to the invention can optionally be described as follows: The voltage increase is measured m V Measurement and calculated in two models (normal operation / capacitive charging m v i.oad and short-circuit operation m v sc). This requires knowledge of the equivalent resistance R (line + ESR of the capacitance or short-circuit resistance), line inductance L and component capacitance C. As soon as m v i.oad and m v sc differ sufficiently to provide confidence ö (e.g. 10%), a distinction can be made between short circuit and normal operation with a high degree of confidence. As soon as m v sc and m VMeasurements are close enough together (deviation of up to ö (e.g. 10%)) and m V Load and m v If the sc are far enough apart, a short circuit can be detected with a high degree of confidence. Once a short circuit is detected, it is immediately isolated by opening the eFuse.

[0043] Fig. 9 shows steps of an exemplary embodiment of a method according to the invention for securing an on-board electrical system of a means of transport. In step 100, a predefined voltage change per unit of time in the on-board electrical system (gradient of the on-board electrical system voltage) is automatically determined. In step 200, a voltage change is calculated for normal operation and for short-circuit operation based on a measured input voltage. In step 300, it is then checked to what extent a predefined relationship (e.g., difference) between a result of the calculation for normal operation and short-circuit operation has been achieved. In this way, it is determined whether a sufficient distinction between normal operation and short-circuit operation is possible in the present case.In step 400, it is then determined to what extent the measured voltage change in the input voltage exhibits a predefined similarity to the calculated voltage change in the input voltage during short-circuit operation. If the predefined similarity is present, a switch in the vehicle electrical system is automatically opened in step 500 to protect it against overload.

[0044] The present invention promises, among other things, the following advantages due to voltage change-based shutdowns:

[0045] - Reduction of energy loss when switching off a fault current. This reduces stress on the components (e.g., TVS diodes, freewheeling diodes, MOSFET avalanche).

[0046] - Benefits in the technical system are therefore: reduced aging of the components, possible downsizing of the protective circuit and / or eFuses (reduced installation space / smaller PCB).

[0047] - Overlaying the protection mechanism with a classic overcurrent shutdown makes sense (redundancy for the shutdown) However, most faults are detected using voltage-based shutdown.

[0048] - Decomposition of the protection mechanisms - e.g. ASIL B(D) for overcurrent shutdown and ASIL B(D) for voltage-based shutdown results in ASIL D.

[0049] List of reference symbols:

[0050] 1 on-board network

[0051] 2 switches

[0052] 3 fuse

[0053] 4 Traction battery

[0054] 5 Electric motor

[0055] 6 Short circuit

[0056] 7 Line

[0057] 8 Line

[0058] 10 Means of transport

[0059] 11 Voltmeter

[0060] 12 ammeters

[0061] 13 Data input

[0062] 14 Evaluation unit

[0063] 15 Data output

[0064] 31 , 32 line

[0065] 33 Work area

[0066] 34, 35 double arrow

[0067] 36 trigger range

[0068] 37, 38 double arrow

[0069] 39 Line

[0070] 40 Error case

[0071] 41 Line

[0072] 100 to 500 process steps

Claims

Patent claims:

1. Method for protecting an on-board network (1) of a means of transport (10) comprising the steps: - automatically determining (100) a predefined voltage change per unit of time in the vehicle electrical system (1) and in response thereto - automatic opening (500) of a switch (2) in the vehicle electrical system (1).

2. The method of claim 1, wherein the automatic determination of the predefined voltage change comprises - Calculating (200) a voltage change based on a measured input voltage (UBAT) for - normal operation and - short-circuit operation and - Check (300) to what extent a predefined difference between a result of the calculation for normal operation and short-circuit operation is achieved and - Determining (400) the extent to which the measured voltage change of the input voltage (UBAT) has a predefined similarity to the calculated voltage change of the input voltage in short-circuit operation.

3. The method according to claim 1 or 2, wherein the calculation of the voltage change for normal operation and short-circuit operation is carried out at cyclically recurring time intervals and / or event-based.

4. Method according to one of the preceding claims, wherein the predefined voltage change - is characterized by a minimum voltage change within a predefined period of time.

5. Method according to one of the preceding claims, wherein the determination of the voltage change - only occurs when a predefined voltage threshold and / or current threshold is reached.

6. Method according to one of the preceding claims, wherein the vehicle electrical system (1) has a nominal voltage of 400 V or 800 V or higher.

7. Method according to one of the preceding claims, wherein the vehicle electrical system (1) is additionally protected by means of a fuse (3).

8. Device for protecting an on-board network (1) of a means of transport (10) comprising - a data input (13), - an evaluation unit (14) and - a data output (15), wherein the evaluation unit (14) is configured to automatically determine a predefined voltage change per unit of time in the vehicle electrical system (1) by means of the data input (13) and, in response thereto, - to automatically open a switch (2) in the vehicle electrical system (1) by means of the data output (15).

9. Apparatus according to claim 8, which is arranged to carry out a method according to one of the preceding claims 1 to 7.

10. Means of transport comprising an on-board network (1) which is designed to be secured by means of a method according to one of the preceding claims 1 to 7 and / or by means of a device according to one of the preceding claims 8 or 9.

Images