Safety switching device and operating method for it

Abstract

A method for operating a safety switching device (6), which comprises a relay (10) and a cutout (9), wherein the cutout (9) is connected in series to a switching contact (11) of the relay (10), comprises the steps: - applying (S3) a first switching voltage (U1) for opening the switching contact (11) at control connections of the relay (10), - checking (S4) whether after the applying of the first switching voltage (U1) a conducting connection exists via the switching contact (11), and - if the conducting connection exists, cyclic applying (S6, S7) of a second switching voltage (U2) for closing of the relay (10) and of the first switching voltage (U1) to the control connections of the relay (10).

Description

[0001] SAFETY SWITCHING DEVICE AND OPERATING METHOD FOR IT

[0002] Description

[0003] The present invention relates to a safety switching device for interrupting a flow of current between a current source and a consumer, and a method for operating such a safety switching device, in particular in an electrically driven vehicle, in which the current source comprises a battery and the consumer comprises a drive motor.

[0004] In order to meet legal safety requirements, such vehicles must have between battery and motor a safety switching device with a relay and a cutout, which are both respectively individually able to interrupt a flow of current between battery and motor. By the cutout opening in the case of an exceeding of a nominal current strength, it offers protection from damage caused for instance by a short-circuit on the consumer side. The relay is provided in order to prevent the current supply of the motor and, if applicable, further consumers, when the vehicle is switched off.

[0005] In order to trigger the cutout, its nominal current strength must be exceeded for a certain time. The problem may arise that a short current pulse does indeed exceed the nominal current strength, but owning to its short duration it does not lead to the triggering of the cutout, but at the same time heats up contact surfaces of the relay, which are touching one another, so intensively that they adhere to one another and prevent a proper opening of the relay. In order to mitigate this problem, the contact surfaces can indeed be made larger in order to distribute the heat generated by the current pulse over a larger area, or respectively stronger electromagnets and springs can be selected for driving the switching movement of the relay, but these solution approaches in every case involve increased dimensions of the relay, which is undesirable on the one hand for cost reasons, but on the other hand can also lead to space problems, in particular when the relay is to be integrated with the battery in a shared housing space, in order to ensure that it can not be combined by a battery which is too powerful and can be overloaded by the latter. DE 102015 104211 A1 describes a safety switching device in which a safeguarding against malfunction is to be achieved by means of several redundant switching contacts which are partly coupled with one another mechanically. The multiplication of the number of switching contacts leads to the same disadvantages with regard to costs and space requirement as described above.

[0006] A need therefore exists for a technology which can ensure a reliable switching effect with low costs and dimensions.

[0007] This need is met according to an aspect of the invention through a method for operating a safety switching device which comprises a relay and a cutout, wherein the cutout is connected in series to a switching contact of the relay, with the steps: applying a switching voltage for opening the switching contact at control connections of the relay, checking whether after the applying of the first switching voltage a conducting connection exists via the switching contact, and, when the conducting connection exists, cyclic applying of a second switching voltage for closing the relay and the first switching voltage to the control connections of the relay. When the applying of the switching voltage does not lead to the expected opening of the relay, it is to be assumed that the surfaces of the switching contact are adhering to one another; in this case, through a repeated change of the level of the applied switching voltage, an attempt can be made to shake loose the stuck switching contact and to restore the switching ability of the relay.

[0008] To check whether a conducting connection exists via the switching contact, according to a preferred embodiment of the method a voltage is detected between an input terminal and an output terminal on different sides of the switching contact, and a decision is made that a conducting connection exists when the voltage does not exceed a predetermined threshold. When the relay is properly opened and consequently no current is flowing, the voltage between input terminal and output terminal - in so far as both are connected with the poles of an electrical energy source - should be equal to the terminal voltage of the energy source; if it is distinctly less, then this leads to the conclusion that the flow of current through the safety switching device is not completely interrupted, therefore the relay is not properly open. If a current circuit which connects the poles of an electrical energy source to one another can also be interrupted at another location than in the safety switching device, then one of the terminals of the safety switching device can be potential- free, and the voltage between the clamps vanishes precisely as in the case that the relay does not open. In order to detect this case, according to a second embodiment a voltage can be applied to the input- and output terminal and a decision can be made that a conducting connection exists when a current strength resulting from the applied voltage exceeds a predetermined threshold.

[0009] In order to inform a user of possible deficiencies of the relay or to trigger, if applicable, automatic safety measures, a first error message can be generated when the check shows that the conducting connection exists. This first error message can be generated without delay, as soon as it is established that the conducting connection exists, or only when a predetermined number of cycles of the applying of switching voltages for opening and for closing of the relay has been carried out and has not led to a change of the situation.

[0010] If the cyclic applying of the switching voltages has led to the relay still having opened successfully, the first error message can be cancelled, as the original error, the relay being stuck, is no longer present. If, however, the contact surfaces of the relay have once become hot enough to adhere to one another, then it is to be assumed that damage remains, which increases the likelihood of a renewed adhering. It is therefore expedient to generate a second error message in such a case, in order to indicate to the user that the reliability of the relay is impaired and an exchange or a repair may become necessary.

[0011] In order to detach the contact surfaces from one another successfully, it is desirable per se to change as abruptly as possible a force which is acting on them. The speed at which the force generated by a magnetic coil conventionally used in a relay can be changed is limited by the inductivity of the coil. In order to nevertheless be able to build up a force for drawing the contact surfaces apart within as short a time as possible, it is helpful, between a time span in which a switching voltage is applied between the input- and the output terminal, in which the contact surfaces are pressed against one another, and a time span in which the applied switching voltage generates a tractive force between the contact surfaces, to insert a time span in which the switching voltage adopts an intermediate value in which the forces acting between the contact surfaces are low.

[0012] In order to detach the contact surfaces from one another in a short period of time, the cyclic applying should take place with a period which is shorter than the switching time of the relay. Typically, the period should last between 10 and 1000 ms, preferably between 100 and 500 ms.

[0013] Conventionally, the switching contact of a relay comprises at least one fixed and one movable contact surface, which touch one another in the closed state of the relay and are separated from one another in the open state. When an armature, driven by the applied switching voltages, is coupled to the movable contact in a clearancemaintaining manner, it can also then be accelerated on a switching over of the switching voltage when the movable contact surface is stuck. By the armature transferring the pulse, received on running through the clearance, on abutting onto the movable contact surface, it can considerably increase the likelihood that the contact surfaces can yet still be successfully separated from one another.

[0014] According to a preferred application, the safety switching device is inserted between a battery and a motor of an electrically driven vehicle.

[0015] According to a further aspect of the invention, the need which was established above is met through a control unit for a safety switching device which is configured to carry out the method described above.

[0016] Subject of the invention are, furthermore: a vehicle with a battery, a motor, a safety switching device inserted between battery and motor, which comprises a relay and a cutout, which are connected in series between an input- and an output terminal of the safety switching device with a switching contact of the relay, and a control unit as indicated above, and a computer program, comprising instructions able to be executed by a computer, the execution of which by a computer causes the latter to execute the method described above. Further features and advantages of the invention become clear from the following description of example embodiments with reference to the enclosed figures. There are shown:

[0017] Fig. 1 a block diagram of the electrical on-board network of a vehicle with electric drive and with electric drive and a safety switching device according to the invention;

[0018] Fig. 2 a switching contact and an armature of a relay of the safety switching device;

[0019] Fig. 3 a flow diagram of an operating method executed by a control unit of the on-board network; and

[0020] Fig. 4 a chronological sequence of voltages applied at control connections of the relay within the scope of the method according to the invention.

[0021] Figure 1 shows in schematised form the electrical on-board network of a motor vehicle with electric drive. A battery 1 has two poles 2, 3, which carry an active voltage or respectively earth. A power converter 4 converts the direct voltage of the battery 1 into alternating voltage for the supplying of an electric drive motor 5.

[0022] Switching components for recharging the battery 1 , for instance with current from an in-vehicle fuel cell, from a stationary power network or through regeneration operation of the drive motor 5 and of the power converter 4 are not illustrated for the sake of clarity.

[0023] A current circuit runs from the pole 2 of the battery 1 to an input terminal 7 of a safety switching device 6, within the safety switching device 6 via a cutout 9 and a switching contact 11 of a relay 10 to an output terminal 8, and from there via the power converter 4 to the pole 3 of the battery 1.

[0024] A control unit 12 is connected to the input terminal 7 and the output terminal 8, in order to detect a voltage between the two. Assuming that the output terminal 8 is connected via the power converter 4 in a conducting manner with the pole 3, this voltage should be equal to the terminal voltage of the battery 1 in the case of an open relay, and close to zero in the case of a closed relay 10. The control unit 12 can therefore decide by comparing the detected voltage with a suitably established threshold voltage whether the relay 10 is open or closed.

[0025] If the power converter 4 supports a state in which no current flow is possible via it between the output terminal 8 and the pole 3, no conclusion can be drawn via the switching state of the relay 10 from the observation that the voltage difference vanishes between the terminals 7 and 8. In order to also be able to manage this case, provision can be made that the control unit applies a non-vanishing measurement voltage to the terminals 7 and 8 and measures a current flow resulting therefrom through the relay 10. When the measured current strength lies above a threshold value, it can be concluded therefrom that the relay 10 is closed.

[0026] The applied voltage can be an alternating voltage with a predetermined frequency; and the measurement of the resulting current strength can be limited to this predetermined frequency in a narrow-band manner, in order to minimize interactions of the current which is brought about by the measurement voltage with other current flows in the on-board network.

[0027] Fig. 2 shows a schematic section through the relay 10 in closed position. The switching contact 11 comprises fixed contact surfaces 14 on a housing 13 of the relay 10 and movable contact surfaces 15 on a movable plate 16 within the housing 13. A spring 17 engages on the plate 16 and on an intermediate wall 18 of the housing 13 and presses the plate 16 away from the intermediate wall 18, so that the contact surfaces 14, 15 are held in contact with one another.

[0028] An elongated armature 19 extends through a hole of the plate 16 up to a magnetic coil 20. The armature 19 is held in the shown position by a second spring 21, which on the one hand engages on a further intermediate wall 22 of the housing 13, and on the other hand engages on a flange 23 which is connected securely to the armature 19, and holds the flange 23 pressed against a stop, here e.g. the first intermediate wall 18.

[0029] A head 24 at the upper end of the armature19 has a greater diameter than the hole in the plate 16 and is separated from the plate 16 by a distance d1 of e.g. 0.7 mm. By applying a first switching voltage to the magnetic coil 20, a magnetic force is exerted onto the armature 19, which drives a downwardly directed movement of the armature 19 in the illustration of Fig. 2. In a first phase of this movement, the head 24 moves downwards contrary to the restoring force of the spring 21 until the distance d1 is bridged and the head 24 strikes onto the plate 16. The pulse which is transferred here from the armature 19 to the plate 16 promotes a detaching of the contact surfaces 14, 15 from one another.

[0030] If these detach themselves from one another properly, the armature 19 continues its downwards movement, now also contrary to the restoring force of the spring 17, until the flange 23 proceeding from the closed position has covered a path d2 of e.g. 1.9 mm and butts onto a stop 25. In the open position which is now reached, the armature 19 remains as long as the first switching voltage or an intermediate voltage is applied at the magnetic coil 20 which is lower than the first switching voltage, but is high enough in order to compensate the combined restoring forces of the springs 17, 21.

[0031] The control unit 12 is connected to a main switch of the vehicle which is not illustrated, in order to detect in step S1 in Fig. 3 when the driver switches off the vehicle. When this takes place, the control unit starts a timer in step S2 and applies in step S3 the first switching voltage to the magnetic coil 20, in order to open the switching contact 11 and to thus interrupt the power supply of the power converter 4 and of the drive motor 5.

[0032] In step S4 the control unit 12 checks, as described above with reference to Fig. 1 , whether the applying of the first switching voltage has in fact led to the opening of the switching contact 11. If yes, then the relay 10 operates free of error, and the method ends. Otherwise, the control unit 12 issues a warning message that the relay 10 has not opened, e.g. to a display on the instrument panel of the vehicle (S5), and emits a second switching voltage (S6), which may be zero and is at least so low that the spring 21 can drive the armature 19 from a position in which the head 24 lies against the stuck plate 16 back to the position shown in Fig. 2, in which the distance d1 between the head 24 and the plate is open.

[0033] The second switching voltage does not have to be applied longer than necessary in order to transfer the armature into the position of Fig. 2 again. Depending on the type of construction of the relay, some 10-100 ms are sufficient. When this time span has elapsed, the control unit 12 switches over again in step S7 to the first switching voltage, whereupon the armature 19 accelerates downward again, and the head 24 strikes anew against the plate 16. If this leads to the plate 16 detaching itself and the armature 19 reaching the open position, this is detected in S8 and leads in S9 to the warning message of step S5 being replaced by a warning message that the relay 10 is stiff and should be changed.

[0034] Otherwise, a check is carried out in step S10 as to whether the timer has expired. As long as this is not the case, the method returns back to step S6, so that the first and the second switching voltage alternate one another until the timer has expired. When it has expired, without the plate 16 having been successfully struck loose, a further warning message is generated (S11) in order to draw the driver’s attention to the fact that the relay 10 is impaired and battery voltage is still applied at the power converter 4.

[0035] Fig. 4 shows the change between the first and the second switching voltage as a function of the time t in the form of a thin continuous curve, wherein the first switching voltage U1 is assumed here as 12 V and the second U2 as 0. According to a variant of the method illustrated as a thick dashed curve in the figure, time spans At3 in which the magnetic coil 20 is acted upon respectively by an intermediate voltage U3 are inserted between time spans At1, At2, in which respectively the first or respectively second switching voltage is applied. Even though the voltage U3 is still too high than that it would enable the spring 21 to lift the head 24 from the stuck plate 16, through its intermediate application, the time is shortened which the magnetic field needs in order to subside in the time span At2 to such an extent that the spring 21 can drive the armature back into the position of Fig. 2; i.e. the time span At2 can be shortened so that up to the expiry of the timer in step S11 more attempts can be undertaken to strike the plate 16 loose, and the likelihood increases that this is successful. Reference numbers battery pole pole power converter drive motor safety switching device input terminal output terminal cutout relay switching contact control unit housing fixed contact surface movable contact surface plate spring intermediate wall armature magnetic coil spring intermediate wall flange head stop

Claims

Claims1. A method for operating a safety switching device (6), which comprises a relay (10) and a cutout (9), wherein the cutout (9) is connected in series to a switching contact (11) of the relay (10), with the steps: applying (S3) a first switching voltage (U1) for opening the switching contact (11) at control connections of the relay (10), checking (S4) whether after the applying of the first switching voltage (U1) a conducting connection exists via the switching contact (11), and, if the conducting connection exists, cyclic applying (S6, S7) of a second switching voltage (U2) for closing of the relay (10) and of the first switching voltage (U1) to the control connections of the relay (10).

2. The method according to Claim 1 , in which for checking (S4) whether a conducting connection exists via the switching contact (11), a voltage is detected between an input- and an output terminal (7, 8) on different sides of the switching contact (11) and a decision is made that a conducting connection exists when the voltage does not exceed a predetermined threshold, and / or a voltage is applied to the input- and output terminal (7, 8) and a decision is made that a conducting connection exists when a current strength resulting from the applied voltage exceeds a predetermined threshold.

3. The method according to Claim 1 or 2, with the further step: generating a first error message (S5, S11) when the check (S4) shows that the conducting connection exists or exists further after a predetermined number of cycles of the applying of the first and the second switching voltage, and optionally the further step cancelling the first error message or generating (S9) a second error message, when in the course of the cyclic applying of the switching voltages, the conducting connection is interrupted.

4. The method according to one of the preceding claims, in which between a time span (At1), in which the first switching voltage (U1) is applied betweenthe input- and the output terminal (7, 8), and a time span (At2), in which the second switching voltage (U2) is applied, a time span (At3) is inserted, in which a third switching voltage (U3) is applied, the height of which lies between the first and the second switching voltage.

5. The method according to one of the preceding claims, in which the cyclic applying takes place with a period which is shorter than the switching time of the relay (10) and / or lasts between 10 and 1000 ms, preferably between 100 and 500 ms.

6. The method according to one of the preceding claims, in which the switching contact (11) comprises at least one fixed contact (14) and at least one movable contact (15), and an armature (19), driven by the applied switching voltages (U1, U2), is coupled to the movable contact (15) in a clearancemaintaining manner.

7. The method according to one of the preceding claims, in which the safety switching device (6) is inserted between a battery (1) and a motor (5) of an electrically driven vehicle.

8. A control unit (12) for a safety switching device (6), which comprises a relay (10) and a cutout (9), which are connected in series between an input- and an output terminal (7, 8) of the safety switching device (6) with a switching contact (11) of the relay (10), wherein the control unit (12) is configured to execute the method according to one of the preceding claims.

9. A vehicle with a battery (1), a motor (5), a safety switching device (6) inserted between battery (1) and motor (5), which comprises a relay (10) and a cutout (9), which are connected in series with a switching contact (11) of the relay (10), and a control unit (12) according to Claim 8.

10. A computer program, comprising instructions able to be executed by a computer, the execution of which by a computer causes the latter to execute the method according to one of Claims 1 to 7.

Images