Electronic protective device for an electronic system as well as electronic system and method for operating an electronic system

Abstract

The invention relates to an electronic protective device (3) for an electronic system (1), comprising - an energy storage (4), which can be coupled to a voltage source (2) external to the electronic system (1), to charge the energy storage (4) based on a first voltage (U1) of the voltage source (2), - an energy storage control unit (5), which is formed to provide a second voltage (U2) of the energy storage (4) for electrical supply of the electronic system (1) based on error information relating to the voltage source (2), - a switching device (6), which comprises a discharge circuit (9) for discharging the energy storage (4), and is formed to electrically couple the energy storage (4) to the voltage source (2) and / or the system (1), - an electronic computing unit (7), which is formed to control the switching device (6) based on at least one hazard information, to disconnect the energy storage (4) from the voltage source (2) and to discharge the energy storage (4). Furthermore, the invention relates to an electronic system (1) and to a method.

Description

[0001] Electronic protective device for an electronic system as well as electronic system and method for operating an electronic system

[0002] The present invention relates to an electronic protective device for an electronic system. Furthermore, the invention relates to an electronic system. The invention also relates to a method for operating an electronic system.

[0003] Electronic systems such as for example an ECU (electronic control unit), driver assistance system, ADAS (Advanced Driver Assistance System), ADS (autonomous driving systems), are employed in automated systems, in particular autonomous vehicles. Such electronic systems have to have a high reliability to be able to reliably perform in particular autonomous controls. In this respect, such autonomous systems have to have a higher safety and in particular a lower probability of failure. Such electronic systems can comprise additional electrical energy storages to be able to ensure the electrical supply of the electronic system in emergency situations. However, the electrical safety must not be disregarded herein.

[0004] Therefore, an object of the present invention is in increasing the electrical safety of an electronic system like an ECU to be able to better protect the electronic system from damages.

[0005] This object is solved by an electronic protective device, an electronic system as well as a method according to the independent claims. Meaningful developments are apparent from the dependent claims.

[0006] An aspect of the invention relates to an electronic protective device for an electronic system, comprising

[0007] - In particular an electrical energy storage, which can be coupled to a voltage source external to the electronic system, to charge the electrical energy storage based on a first voltage of the voltage source,

[0008] - In particular an energy storage control unit, which is formed to provide a second voltage of the electrical energy storage for electrically supplying the electronic system based on error information relating to the voltage source, by which a case of error of the voltage source is characterizable,

[0009] - In particular a switching device, which comprises a discharge circuit for discharging the electrical energy storage, and the switching device is formed to electrically couple the electrical energy storage to the voltage source and / or the electronic system, - In particular an electronic computing unit, which is formed to control the switching device based on at least one hazard information, by which a situation hazardous to the electronic system can be characterized, to disconnect the electrical energy storage from the voltage source and to discharge the electrical energy storage with the discharge circuit.

[0010] With the proposed electronic protective device, an electronic system can be safely operated and used, respectively. In particular, requirements with respect to the electrical safety of the electronic system can be satisfied with the aid of the electronic protective device.

[0011] As already initially explained, the electronic system can be an electronic control unit, which can be employed in autonomous systems like autonomously operated vehicles. Herein, the reliability, functionality and safety of the electronic system is of importance to for example be able to reliably perform autonomous driving operations or other autonomous controls.

[0012] With the electrical energy storage, the electronic system can also be supplied with electrical energy in an emergency operation or an emergency situation. In the normal case, the electronic system can be electrically supplied by means of the external voltage source. Put another way, the electronic system is electrically supplied by an energy source external to the electronic system in the normal case or normal operation. In the exemplary case of application with respect to the employment of the electronic system in an autonomously operated vehicle, this external energy source can be a vehicle battery. Thus, the electronic system is electrically powered or supplied via the external voltage source in the normal operation, and the electrical energy storage can additionally be electrically charged by means of the external voltage source. Hereto, the electrical energy storage of the electronic protective device can be electrically, in particular galvanically, coupled to the external voltage source. Hereto, the external voltage source can provide a DC voltage such as e.g. the voltage of the vehicle battery.

[0013] For example, the electrical energy storage can be referred to as emergency storage. With the aid of the electrical energy storage, a redundant energy supply of the electronic system can in particular be provided. The electrical energy storage can be understood as such an electrical component or electrical system, which is capable of storing electrical energy. For example, the electrical energy storage can be a capacitor. Depending on the fact in which electronic system the electronic protective device is to be employed, the electrical energy storage can be correspondingly adapted or dimensioned. This means that according to field of employment or field of application of the electronic protective device, the electrical energy storage can be correspondingly dimensioned. Hereto, such an electrical energy storage can be used, which has a sufficient capacity. Herein, the capacity or the required capacity can be preset. The required capacity can be set according to energy demand of the electronic system.

[0014] By means of the energy storage control unit, which can be an electronic unit, it can be determined if a case of error with respect to the external voltage source is present. If the external voltage source should be faulty, impaired in function or defective, thus, it can be switched to an error operation with respect to the electronic protective device with the aid of the energy storage control unit. Herein, the electronic system can now be electrically supplied with the energy stored in the electrical energy storage. Here, the electrical supply of the electronic system is in particular effected with the electrical energy storage instead of the external voltage source. Thus, even upon a failure of the external voltage source, the electronic system can nevertheless be electrically supplied. For example, this can occur if an electrical connection between the external voltage source and the electronic system is disconnected or was disconnected. This can be communicatively communicated to the energy storage control unit, for example by means of an electronic signal. It is also conceivable that the electronic control unit itself detects the defective or the lacking voltage source to correspondingly be able to provide or generate the error information.

[0015] In particular, the energy storage control unit can switch or control switching elements such that an electrical connection between the electrical energy storage and the electronic system is enabled. In addition, an electrical connection between the electrical voltage source and the electronic system and the electrical energy storage can be disconnected for safety such that interfering currents with respect to the electronic system or the electrical energy storage cannot flow and could damage them by the faulty or defective voltage source.

[0016] For example, the energy storage control unit can control the switching device. The switching device can in particular be such an electronic circuit, which is composed of multiple switching elements or other electrical components. By means of the switching device, the electrical energy storage can be coupled to or disconnected from the voltage source. With the aid of the switching device, the electronic system can also be coupled to or galvanically disconnected from the voltage source. Since such an electronic system comprises very sensitive members or components, it has to be protected from electrical disturbance variables in a hazardous situation. In this respect, it is advantageous if the electrical energy storage is discharged in a hazardous situation with respect to the electronic system. In the employment of the electronic system in an autonomously operated vehicle as an example, in a crash situation of the vehicle or in a hazardous situation of the electrical onboard power supply of the vehicle, the electronic system would have to be protected with respect to hazardous disturbance variables like overvoltage and overcurrents. Hereto, the electronic system can be disconnected from the voltage source as well as from the vehicle systems on the one hand. In addition, the electrical energy storage can be discharged such that a hazard does not exist for the sensitive electronic system emanating from the electrical energy storage. Hereto, the electronic computing unit of the electronic protective device can perform corresponding measures or protective mechanisms in such a hazardous situation. Hereto, at least one hazard information can for example be provided. It can have been generated by the electronic protective device itself or can have been communicatively provided by a system external to the electronic system, like a system superordinated to the electronic system.

[0017] Based on this provided hazard information, the electronic computing unit can control or drive the switching device. If the switching device should be driven with the electronic computing unit in a hazardous situation, thus, the electrical energy storage can be disconnected from the voltage source and the electrical energy storage can be discharged with the aid of the discharge circuit. In addition, the electronic system can also be disconnected, in particular electrically disconnected, with respect to the external voltage source. Thus, the hazard to the electronic system from outside of the electronic system and also by the stored energy in the electrical energy storage can be protected with respect to the electronic system.

[0018] Thus, the electronic system can be more reliably and more safely operated with the aid of the electronic protective device.

[0019] In an embodiment, it is provided that the discharge circuit comprises a switching element and a resistor, wherein the switching element is switchable for a discharge operation of the electrical energy storage such that the electrical energy storage can be discharged via a resistor. In the normal operation of the electronic system and in particular upon a charging operation of the electrical energy storage, the discharge circuit can be set into such a state that the switching element is switched such that the electrical energy storage is electrically connected to the external voltage source. Now, if it should be determined with the aid of the electronic computing unit that a hazardous situation for the electronic system is present, thus, the switching element can be switched such that the electrical energy storage is connected to the resistor. In this state, the electrical energy storage is not connected to the external voltage source. Here, a discharge operation of the electrical energy storage is now effected via the resistor. Put another way, a parallel connection between the electrical energy storage and the resistor can be established with the aid of the actuated switching element.

[0020] The resistor of the discharge circuit can be dimensioned such that it is adapted to the capacity of the electrical energy storage to be able to perform an efficient, in particular fast discharge of the electrical energy storage.

[0021] The electronic computing unit can for example be a microcontroller MCll (Micro Controller Unit).

[0022] It is also conceivable that the electronic computing unit is formed as an electronic evaluation unit or an electronic evaluation system.

[0023] In an embodiment, it is provided that the switching element is formed as a relay, transistor, bipolar transistor or metal oxide semiconductor field effect transistor. Depending on how the electrical energy storage is dimensioned, with regard to the capacity and the stored voltage, the active electrical components correspondingly suitable thereto can be used as the switching elements. Depending on how high the capacity of the electrical energy storage is and how the voltage level in this respect is, the switching element can be differently configured. Similarly, the switching time and in particular the period of time, which is preset for discharging, are decisive for the selection of the switching element.

[0024] In an embodiment, it is provided that the switching device comprises at least one voltage converter, wherein the voltage converter is formed to convert the first voltage of the voltage source into a charging voltage in a first operating state to be able to charge the electrical energy storage. Furthermore, the voltage converter is formed to convert a second voltage of the electrical energy storage into a supply voltage, in which the electronic system can be electrically supplied in case of error of the voltage source, in a second operating state different from the first operating state. Put another way, either the electrical energy storage can be charged or the energy stored in the electrical energy storage can be used for supplying the electronic system with the aid of the voltage converter.

[0025] In the first operating state, in which the normal case with respect to the electronic system is in particular present, the voltage of the external voltage source can be converted such that it is suitable for charging the electrical energy storage. As in the already mentioned example with respect to the application of the electronic system in an autonomously operated vehicle, the external voltage source can for example be the vehicle battery. Herein, the first voltage can have 12 V, 24 V or 48 V. In order to be able to charge the electrical energy storage as efficiently as possible and to provide a sufficient amount of energy for the emergency operation of the electronic system, the first voltage with a voltage level of 12 V, 24 V or 48 V can for example be converted into a charging voltage of > 60 V with the aid of the voltage converter. Thus, boosting the voltage of the voltage source is here effected to be able to more efficiently charge the electrical energy storage. In the second operating state, which in particular cannot come along with the first operating state at the same time, the stored voltage of the electrical energy storage, thus the second voltage, can be converted into the supply voltage with the aid of the voltage converter. In the example concerning the autonomously operated vehicle, the electronic system can now be operated with the voltage level with respect to the vehicle. Thus, the conversion of the voltage of the electrical energy storage, thus in this example > 60 V, into a supply voltage of for example 12 V or 48 V, is effected here to thereby be able to electrically operate the electronic system.

[0026] In particular, the voltage converter can be a buck-boost converter. Thus, a voltage conversion can here be performed on the input side as well as on the output side according to operating state of the converter. This is particularly efficient for the employment of the electronic protective device since a compact construction is thereby realizable. In an embodiment, it is provided that a voltage value of the first voltage is less than a voltage value of the second voltage. Thus, the electrical energy storage can be charged by means of a higher voltage than is providable by the external voltage source and in particular is required for the operation of the electronic system. Thereby, a greater amount of energy can be stored such that the electrical supply of the electronic system can also be ensured over a longer period of time for a failure of the external voltage source. Especially, by the higher voltage level with respect to the electrical energy storage, the electrical energy storage can be kept lower with respect to its installation space or space requirement than if the voltage level with respect to the energy storage would for example be less.

[0027] In an embodiment, it is provided that the electronic protective device comprises a communication interface, which can be communicatively coupled to the electronic system and / or to at least one device external to the electronic system, wherein the communication interface is formed to provide the at least one hazard information to the electronic computing unit. Accordingly, it can be communicated via a communicative connection of the electronic computing unit if a discharge operation of the electrical energy storage is for example to be performed due to a hazardous situation. The communication interface can for example be connected to the electronic computing unit or the communication interface can for example be a constituent of the electronic computing unit.

[0028] In particular, a wireless or wired communication connection to the electronic system and / or to the external device can be established with the aid of the communication interface.

[0029] The external device can for example be a superordinated system, which includes the electronic system. In the previously mentioned example of the autonomous vehicle, the external device can be a vehicle system or the vehicle as a whole. Further autonomous systems or other automation systems, which use the electronic system, would also be conceivable. Thus, with the aid of the communication interface, hazard information can be provided to the electronic computing unit or be ascertained, to in particular be able to control the switching device.

[0030] For example, the hazard information can have been generated by the electronic system itself and in turn be transferred to the electronic computing unit. Otherwise, by a system environment, in which the electronic system is used, at least one or more hazard information or other information can be transferred by external devices there.

[0031] A further aspect of the invention relates to an electronic system, which comprises a housing and an electronic protective device according to the preceding aspect or an advantageous development thereof. As already mentioned above, the electronic system can be an electronic control unit or an electronic control device.

[0032] For example, the electronic system can be formed as an ECU, which can in particular be employed in the automotive sector. Hereto, the electronic system can for example be an ADAS or an SVS (Surround View System). It is also conceivable that the electronic system is a domain controller DC or a car computer CC. Further fields of application with respect to the electronic system are also conceivable.

[0033] In particular, the electronic system comprises a housing, within which substantially all of the constituents or components of the electronic system are arranged.

[0034] In an embodiment of a further aspect, it is provided that the protective device or electronic protective device is arranged within the housing of the electronic system. Thus, the electronic system can be formed as a compact unit since all of the essential constituents of the electronic system are located within the housing. Thus, besides the compact configuration, an increased protection of the electronic components of the electronic system with respect to damages or other external influences can also be achieved.

[0035] In order that the electronic system can be employed for example in the automotive sector, it requires interfaces to allow a current supply and a data exchange with external systems or external devices. Hereto, specially configured interfaces can be provided in the housing, which are specially conceived with respect to the protection of the components within the housing.

[0036] In an embodiment of a further aspect, it is provided that the electronic system comprises a housing monitoring device, which is formed to monitor a state of the housing and to provide housing information relating to the state of the housing to the electronic computing unit as at least one hazard information. In particular, the sensitive electronic, electrical or data-related constituents of the electronic system are protected by the housing.

[0037] For example, these constituents can be protected from water, moisture, dirt, mud or other damages. Furthermore, the housing can form a shield against interfering electromagnetic radiations. If the housing should be at least partially opened or for example have a damage like a hole or a crack, thus, this could present a potential hazard to the electronic system and the components thereof. In order to be able to early determine this, the electronic system comprises the housing monitoring device. It monitors the state of the housing, thus if the housing is in particular not opened or open. The monitoring of the housing can in particular be continuously or permanently effected. If the housing monitoring device should determine a defective or impaired state with respect to the housing, thus, it can provide the hazard information to the computing unit by means of an electronic signal. For example, in turn perform the discharge of the electrical energy storage such that a hazard with respect to the electrical energy storage cannot occur for example by a disturbing influence from the outside due to the opened housing.

[0038] Furthermore, the electronic system can be formed such that it is allowed to be operated only if a faultless state with respect to the housing is present. If this should not be the case, thus, the switching device can in turn be correspondingly controlled with the aid of the electronic computing unit.

[0039] In an embodiment of a further aspect, it is provided that the housing monitoring device comprises at least a first and a second electrically conductive element, wherein a measurement device of the housing monitoring device is electrically connected to the housing by means of the first electrically conductive element and a reference potential of the electronic system is electrically connected by means of the second electrically conductive element. Put another way, an electrical connection exists between the measurement device and the housing by means of the first electrically conductive element, and a further electrical connection exists between the reference potential (for example ground) of the electronic system. With the aid of the electrically conductive elements, the state of the housing can be monitored. Hereto, it can be detected or determined with the aid of the electrically conductive elements and the measurement device when the housing is in an at least partially opened or open state. Thus, by attaching electrically conductive elements, monitoring the state of the housing can be performed in simplest manner.

[0040] In an embodiment of a further aspect, it is provided that the housing is formed of an electrically conductive material, wherein the two electrically conductive elements are electrically connected via the housing in a basic state of the housing. Put another way, an electrical connection can be present from the measurement device via the first electrically conductive element, the housing and the second electrically conductive element. Thus, it can be determined with the aid of the measurement device that the housing is in the basic state, thus in a faultless state, as long as an electrical connection between the two electrically conductive elements is present. Thus, in case of an opened or even removed housing, an electrical connection between the two electrically conductive elements is not present. If the housing is properly in the closed state as intended, thus, a current flow from the reference potential, the second electrically conductive element, the housing, the first electrically conductive element towards the measurement device can be present. If the housing should be opened or completely removed, thus, a current interruption between the two electrically conductive elements is present, which can in turn be determined or detected with the aid of the measurement device. Hereto, controlling the switching device and in particular discharging the electrical energy storage would now follow as a consequence.

[0041] For example, the housing can comprise aluminum, copper, stainless steel, brass or silver as the electrically conductive material.

[0042] In another example, the housing is designed as a non-electrical conductive housing. For this, a dedicated strip of conductive material can be fixed in the housing to allow electrical connection between the two electrically conductive elements.

[0043] In an embodiment of a further aspect, it is provided that a measurement voltage, which has a first voltage level, is applied to an input side of the measurement device in the basic state of the housing, wherein a pull-up resistor is arranged on the input side of the measurement device, which is configured to set the measurement voltage from the first voltage level to a second voltage level if the housing is in an opened state, in which an electrical connection between the two electrically conductive elements is impaired. Put another way, with the aid of the pull-up resistor, it can be ensured that such a voltage is applied to the input side, thus the voltage input, of the measurement device, which characterizes or represents the respective state of the housing. Thus, the measurement device can determine via a voltage measurement, in which state the housing is. If a voltage with the second voltage level should be measured on the input side of the measurement device, thus, it is determined by the measurement device that the housing is opened and in particular the electrical connection between the two electrically conductive elements is interrupted. This can in turn be transferred to the electronic computing unit as hazard information.

[0044] For example, the measurement device can be formed as a voltage measurement apparatus. It is also conceivable that the measurement device includes such a voltage measurement apparatus. A further possibility is that an operation amplifier (OpAmp) is arranged on the input side of the measurement device to be able to determine the voltage there and in particular a difference. If the housing should be opened or damaged and an interruption between the electrically conductive elements should be present, thus, the first electrically conductive element does not have a connection to the reference potential, thus ground, such that the first electrically conductive element experiences the state of "floating". Thereby, the measurement voltage is pulled from the first voltage level to the second voltage level with the aid of the pull-up resistor. This second voltage level is known to the measurement device as information or as a file such that upon measurement of the measurement voltage and with the second voltage level, the hazard information can, in particular instantaneously, be transferred to the computer device to be able to perform the corresponding protective measures or safety measures.

[0045] In an embodiment of a further aspect, it is provided that the two electrically conductive elements are formed as electrically conductive spring clips, electrically conductive sealing elements or electrically conductive gunning pastes. Thereby, according to present circumstance and in particular according to configuration of the housing and in particular of the electronic system, the electrically conductive elements suitable or specific thereto can be used. Especially, according to field of employment, the electrically conductive elements can be used as solid units like the spring clips. For example, if less installation space should be available for space reasons, thus, the use of electrically conductive sealing elements like EMC (electromagnetic compatibility) seals or electrically conductive gunning pastes or pastes would be possible. Thereby, the electronic system can be more compactly conceived.

[0046] In an embodiment of a further aspect, it is provided that the housing monitoring device comprises further electrically conductive elements, which are arranged distributed on the housing. Depending on how the housing is dimensioned, multiple such electrically conductive elements can be used. If the housing should have a certain size, thus, electrically conductive elements can be attached to various locations to be able to reliably determine at least partially opening of the housing. For example, multiple electrically conductive elements can be attached to particularly sensitive areas of the housing, which protects sensitive electronic components, to be able to here perform an improved, in particular continuous monitoring of the state of the housing there.

[0047] For example, multiple such first elements can be arranged between housing and measurement device. For example, they can be connected in parallel with each other. With respect to the connection between the reference potential and the housing, multiple such elements can also be arranged as the second elements. They can also be connected in parallel with each other.

[0048] A further aspect of the invention relates to a method for operating an electronic system, wherein the electronic system is electrically supplied by an external voltage source and an electrical energy storage of an electronic protective device is charged based on the external voltage source. In a case of error of the external voltage source, the electronic system is electrically supplied by the electrical energy storage, and if it is determined that a hazardous situation is present for the electronic system, the electrical energy storage is disconnected from the external voltage source and the electrical energy storage is discharged.

[0049] For example, the proposed method can be executed or performed with an electronic system according to the preceding aspect or an advantageous development thereof.

[0050] With the aid of the method, the electronic system, which can be an ECU, can be more efficiently and in particular more safely operated. In a normal operation of the electronic system, the voltage supply of the electronic system is effected via the voltage source external to the electronic system, such as e.g. by a vehicle battery in the employment of the electronic system in a vehicle. In this normal operation, the electrical energy storage of an electronic protective device can additionally be charged in addition to the supply of the electronic system. This electronic protective device in particular serves to be able to perform corresponding safety measures, in particular for complying with the electrical safety, in a case of error of the external voltage source or a hazardous situation. If the external voltage source should be faulty or for example have been disconnected from the electronic system, thus, remedy can here be provided in that an energy supply of the electronic system is performed with the aid of the electrical energy storage. Due to the electrical safety, however, it has to be ensured in certain hazardous situations that the electronic system is deenergized. Hereto, on the system side, in particular automatically upon determination of a hazardous situation, the electrical energy storage and in particular the electronic system can be galvanically disconnected with respect to the external voltage source on the one hand and the electrical energy storage can be discharged at the same time such that a hazard does no longer arise here for the electronic system.

[0051] Further implementations of the method according to the invention and of the electronic system according to the invention are directly apparent from the various embodiments of the electronic protective device according to the invention and vice versa. In particular, individual features and corresponding explanations, which relate to the different implementations of the electronic protective device, can be analogously transferred to corresponding implementations of the method according to the invention and of the electronic system according to the invention. In particular, the electronic protective device according to the invention can be configured or programmed or is configured or programmed to execute the method according to the invention. In particular, the electronic protective device according to the invention executes the method according to the invention.

[0052] Further features of the invention are apparent from the claims, the figures and the description of figures. The features and feature combinations mentioned above in the description as well as the features and feature combinations mentioned below in the description of figures and / or shown in the figures can be encompassed by the invention not only in the respectively specified combination, but also in other combinations. In particular, embodiments and feature combinations, which do not comprise all of the features of an originally formulated claim, can also be encompassed by the invention. Furthermore, embodiments and feature combinations, which extend beyond or deviate from the feature combinations set forth in the relations of the claims, are encompassed by the invention.

[0053] Therein, the following figures show in:

[0054] Fig. 1 an embodiment of an electronic system according to the invention and of an electronic protective device in schematic representation;

[0055] Fig. 2 a schematic representation of the electronic protective device from Fig. 1 , wherein it is here determined by the protective device that a housing of the system is closed;

[0056] Fig. 3 a schematic representation of the electronic protective device from Fig. 1 , wherein it is here determined by the protective device that a housing of the system is opened; and

[0057] Fig. 4 a further schematic representation of the electronic protective device from Fig. 1 , wherein the protective device is here alternatively formed to capture a state of the housing of the system.

[0058] In Fig. 1 , a schematic representation of an electronic system 1 is illustrated. This electronic system 1 can be an electronic control unit. Especially, the electronic system 1 can be used in the automotive sector or in other industrial fields. Especially, the electronic system 1 can be applied for vehicle systems of vehicles. In this respect, a case of application with respect to vehicle systems of an autonomously operated vehicle can for example be considered.

[0059] In the normal operation, thus in the operating mode, which is provided as intended, such an electronic system 1 is externally supplied with energy. Hereto, an external voltage source 2 can be provided. In the example of the application in the automotive sector, this external voltage source 2 can be a vehicle battery. Thus, in this example, the electronic system 1 can be operated or supplied with a voltage of 12 V, 24 V or 48 V by the vehicle battery in the normal operation. In the application in autonomously operated vehicles or other automated systems, a reliable functionality of the electronic system 1 is necessary to be able to perform these very complex autonomous controls or commands. Thus, the reliability of the electronic system 1 is of importance. Hereto, an electronic protective device 3 can for example be provided. It can be integrated in the electronic system 1 to be able to perform special protective measures and in particular safety measures. For example, as a first safety measure, the electronic protective device 3 can comprise an electrical energy storage 4.

[0060] The electrical energy storage 4 can for example be a capacitor, which can be referred to as emergency energy source. If the external voltage source 2 should be defective, impaired in function or faulty, thus, the electrical energy storage 4 can be used for emergency supply of the electronic system 1 . Thus, the electronic system 1 has a redundant energy supply such that it is in particular advantageous for the application in an autonomous system.

[0061] The electrical energy storage 4 can be coupled to or disconnected from the voltage source 2.

[0062] For example, an energy storage control unit 5 of the electronic protective device 3 can be provided. With this energy storage control unit 5, the emergency supply of the electronic system 1 can be realized via the electrical energy storage 4 based on error information relating to the voltage source 2. Especially, the voltage source 2 can provide a first voltage U1 , in particular a DC voltage. It can be used to charge the electrical energy storage 4. Now, if the voltage source 2 should be defective or no longer be electrically connected to the electronic system 1 , thus, the electrical energy storage 4 can be, in particular automatically, used as an emergency measure to be able to maintain the voltage supply or energy supply of the electronic system 1 . In particular, the electrical energy storage 4 is dimensioned to maintain a certain time span, in which the voltage source 2 is inoperative, according to field of application of the electronic system 1 .

[0063] In order to allow an amount of energy as great as possible with small space requirement and in particular complexity at the same time, the electrical energy storage 4 can be configured or dimensioned such that it has a second voltage U2, which is greater compared to the first voltage U1 . In the example relating to the automotive sector, the first voltage U1 can be 12 V, 24 V or 48 V. In contrast, the second voltage U2 can for example be > 60 V. Thus, the energy storage 4 can provide the required energy for the electronic system 1 over a longer period of time in an emergency situation.

[0064] Since the electrical energy storage 4 can store a relatively great amount of energy and provides a voltage with a high voltage level compared to the operating voltage of the electronic system 1 , further protective measures have to be provided with respect to the requirements of the electrical safety to be able to more safely use the electronic system 1 . Hereto, the electronic protective device 3 can comprise a switching device 6.

[0065] This, in particular electrical or electronic, switching device 6 is such an electrical protective mechanism or such a protective device to be able to safely discharge in particular the electrical energy storage 4 and in particular as fast as possible in a hazardous situation with respect to the electronic system 1 .

[0066] In the example of the automotive sector, this can be the case if the vehicle by itself, an electrical onboard power supply of the vehicle or the primary energy supply of the vehicle is damaged or impaired. For example, this can be the case in a crash situation. It is also conceivable that in case of a present overcurrent or an overvoltage in the onboard power supply of the vehicle, a corresponding hazard is present for the electronic system 1 , which is very sensitive in particular electrically considered. Hereto, it is especially advantageous if the electronic system 1 is disconnected with respect to the onboard power supply of the vehicle on the one hand and the electrical energy storage 4 is discharged such that potentially hazardous charges within the electronic system 1 can be eliminated. In order to be able to perform such protective measures and in particular to be able to detect or determine this in hazardous situations, the protective device 3 can comprise an electronic computing unit 7. This electronic computing unit 7 can be a processing unit such as e.g. an MCU. It can either autonomously determine or recognize a corresponding hazardous situation based on provided information or it obtains corresponding instructions via communication signals from a superordinated system, e.g. a vehicle system. Based on the respective hazardous situation, the electronic computing unit 7 can for example generate a control signal 8 and in particular transfer it to the switching device 6. Hereto, the switching device 6 especially comprises a discharge circuit 9, by means of which the electrical energy storage 4 can be discharged. Hereto, this discharge circuit 9 comprises a switching element S1 and a resistor R2. By means of the switching element S1 , the electrical energy storage 4 can be electrically connected to the resistor R2 such that the electrical energy storage 4 can be discharged via the resistor R2 in relation to the reference potential 10, thus ground. Hereto, the switching element S1 can for example be formed as a relay, transistor, bipolar transistor or metal oxide semiconductor field effect transistor. Further switchable electrical components are also conceivable. Furthermore, the electrical energy storage 4 can be electrically, in particular galvanically, disconnected from the voltage source 2 with the aid of the switching device 6 also based on the hazard information.

[0067] Put another way, the electronic computing unit 7 can control in particular the switching device 6 based on the control signal 8, to be able to cause in particular the discharge of the electrical energy storage 4 via the resistor R2 as a safety measure. In order to be able to regulate or control the voltage transfer between the electrical energy storage 4, the electronic system 1 and the external voltage source 2, the switching device 9 comprises at least one voltage converter 11 . With the aid of this voltage converter 11 , the first voltage U1 can for example be converted into a charging voltage UL to be able to charge the electrical energy storage 4. In this case, the voltage converter 11 can be operated in a first operating state, thus a charging state. Besides this first operating state, the voltage converter 11 can be set into at least one further, thus into a second, operating state. In this state, the provision of the stored energy of the electrical energy storage 4 is effected for the emergency supply of the electronic system 1 . In this case, the voltage converter 11 is operated such that the second voltage U2 of the electrical energy storage 4 can be converted into a supply voltage UV. For example, the supply voltage UV can have a substantially identical voltage value as the first voltage U1 . A further functionality of the voltage converter 11 can be an, in particular galvanic, disconnection of the electrical energy storage 4 with respect to the voltage source 2. Due to the different operating modes, the voltage converter 11 can also be controlled via the electronic computing unit 7 and in particular the control signal 8. Hereto, the voltage converter 11 can be formed as a buck-boost converter. It allows the mentioned different functionalities.

[0068] Furthermore, the protective device 3 can comprise a communication interface 12 to be able to provide or transfer the hazard information to the computing unit 7. Hereto, the communication interface 12 can for example be used to communicatively couple or link the computing unit 7 to at least one external device 13. This external device 13 can for example be a vehicle system or another system of an autonomous system, in which the electronic system 1 is used. Hereto, wired or wireless communication links 14, 15 can be provided. For example, they can contribute to be able to communicate with the vehicle. Similarly, diagnostic information of the vehicle or of the superordinated system, such as e.g. "onboard diagnostic information", can be provided or transferred via these communication links 14, 15. Thus, the electronic system 1 can autonomously determine when the electrical energy storage 4 is to be discharged on the one hand. Similarly, especially the computing unit 7 can be triggered for example by a vehicle system that such a hazardous situation is present, in which it is safe to discharge the electrical energy storage 4.

[0069] In the following Fig. 2, a potential hazardous situation for the electronic system 1 is explained based on Fig. 1. As already mentioned, the electronic system 1 comprises sensitive, in particular electronically highly sensitive, components, which have to be protected against external hazards. Furthermore, the risk of the internal second voltage U2 must be considered. At this, the electronic system 1 can be touched or get in contact with external objects, such as a human. A voltage above 60V are rated as a risk for humans. Hereto, the electronic system 1 comprises a housing 16, which is schematically illustrated in Fig. 2. This housing 16 can be a metal housing or a non-metallic housing or non-electrically conductive housing, in particular a component housing, enclosing the electronic system 1. For a functional or safe operation of the electronic system 1 , it is provided as intended that the housing 16 should be closed. If the housing 16 should be at least partially, in particular completely, opened, thus accessible from the outside, thus, the electronic system 1 should be set into a safety mode, since a functionality cannot be comprehensively provided anymore in this state of the opened housing 16. If such a state, thus of an opened housing 16, should be determined, thus, the discharge of the electrical energy storage 4 can be triggered or controlled as previously already explained. In order to be able to efficiently and in particular continuously monitor the state of the housing 16, a housing monitoring device 17 is provided. It can be a constituent of the electronic system 1.

[0070] Similarly, it is conceivable that this housing monitoring device 17 is a constituent of the protective device 3, wherein the protective device 3 in turn is located within the housing 16. With the aid of the housing monitoring device 17, the state of the housing 16, thus if the housing 16 is opened or firmly closed, can be determined. If an opened state should be present, thus, this can be provided to the computing unit 7 as hazard information to be able to initiate or perform the corresponding measures.

[0071] For determining if the housing 16 is opened or closed, the housing monitoring device 17 can comprise at least two electrically conductive elements 18, 19. Furthermore, a measurement device 20 can be provided. This measurement device 20 can be a voltage measurement device, current measurement device or a voltage-current measurement device. The measurement device 20 can for example be integrated in the computing unit 7 or be arranged on the computing unit 7.

[0072] The electrically conductive elements 18, 19 can for example be electrically conductive spring clips, electrically conductive sealing elements such as e.g. EMC seals or electrically conductive gunning pastes. Further configurations with respect to the elements 18, 19 are also conceivable. For determining if the housing 16 is opened or closed, the first element 18 can be arranged such that it is electrically connected to the measurement device 20 and the housing 16. The second element 19 can be arranged such that it is electrically connected to the reference potential 10 and the housing 16. Since the housing 16 is in particular electrically conductively formed, such as e.g. as an aluminum housing, an electrical connection 21 between the two electrically conductive elements 18, 19 can be realized via the housing 16. Put another way, this in turn means that the electrical connection 21 is existing or present as long as the housing 16 is closed.

[0073] As exemplary illustrated in Fig. 2, the housing 16 is here in a basic state, thus in a closed state. Thereby, an electrical connection arises between the measurement device 20 and the reference potential 10. In this basic state of the housing 16, a measurement voltage UM is present on an input side 22 of the measurement device 20, which has a first voltage level. Thus, it can here be determined on the system side that the basic state of the housing 16 is present, due to the detection of the measurement voltage UM, which has the first voltage level.

[0074] In Fig. 3, the case or the situation is now shown, in which the housing 16 has been at least partially removed and thus the housing 16 has an at least partially opened state. As schematically illustrated in Fig. 3, an electrical connection is no longer present between the elements 18, 19 since the housing 16 has been removed at least in certain areas. In order to now be able to detect this case, at least one pull-up resistor R1 is arranged on the input side 22 of the measurement device 20. It is in particular interconnected between the measurement device 20 and the element 18. Especially, the pull-up resistor R1 is connected in parallel with the element 18. By the disconnection of the electrical connection, the connection to ground or to the reference potential 10 lacks the element 18 such that the element 18 becomes "floating". This entails that the pull-up resistor R1 shifts or pulls the measurement voltage UM from the first voltage level to a second voltage level, for example denoted by Vss. This change of the voltage level of the measurement voltage UM can be measured or detected with the aid of the measurement device 20, such that it can in turn be inferred that the housing 16 has been opened and a hazardous situation is present. Accordingly, the switching device 6 can in turn be correspondingly controlled by the computing unit 7.

[0075] The pull-up resistor R1 can be a resistance in the range of 1 kQ - 10 kQ. This is only an exemplary resistance range, because it can be varied according to field of application of the electronic system 1 . By opening the housing 16, it can for example be present as hazardous situation that an intervention from the outside into the electronic system 1 is performed, in particular by an unauthorized person. Thus, hazards with respect to the cyber safety can be present here. If such an opening of the housing 16 should be detected, thus, a warning signal can for example be emitted to the vehicle by the communication interface 12. In order to be able to determine the reliability of the detection of the at least partially or completely opened housing 16, the housing monitoring device 14 can be extended. This is illustrated in the following Fig. 4.

[0076] As exemplarily illustrated in Fig. 4, further electrically conductive elements can be arranged at the housing 16 to be able to perform the reliability with respect to the detection of the state of the housing 16. Herein, multiple elements 18a, 18b, 18c can be provided with respect to the first electrically conductive element 18. Thus, critical areas on the system side can be better and in particular more specifically protected. Thereby, it can be more finely recognized if the housing 16 is opened at least in certain areas. Thereby, cracks or damages at the housing 16 can for example also be recognized. Each of these further electrically conductive elements 18a, 18b, 18c can be electrically connected to the measurement device 20 via an own electrical connection. With respect to a respective electrically conductive element 18a, 18b, 18c, a corresponding pull-up resistor R1a, R1 b, R1c can in turn be provided. The electrically conductive elements 18a, 18b, 18c can be connected in parallel with each other to improve the reliability of the detection. In this example, the connection of the housing 16 and of the reference potential 10 comprises the second electrically conductive element 19. It is also conceivable that multiple electrically conductive elements connected in parallel with each other are also provided with respect to the second electrically conductive element 19 and the connection to the ground. According to case of application with respect to the electronic system 1 and for example with respect to the electrical safety like the EMC safety, the number of the electrically conductive elements 18, 19 can be arbitrarily increased or reduced. Furthermore, the electrically conductive elements 18a, 18b, 18c can for example be arranged distributed or spaced from each other. Herein, the arrangement can be effected based on the housing geometry of the housing 16 and for example an EMC frequency. Further arrangements with respect to the electrically conductive elements 18, 19 are also conceivable.

[0077] By the use of the multiple electrically conductive elements 18a, 18b, 18c, the special areas of the housing 16, which are opened, can be delicately detected.

[0078] Claims

Claims

1 . An electronic protective device (3) for an electronic system (1 ), comprising- an electrical energy storage (4), which can be coupled to a voltage source (2) external to the electronic system (1), to charge the electrical energy storage (4) based on a first voltage (U1 ) of the voltage source (2),- an energy storage control unit (5), which is formed to provide a second voltage (U2) of the electrical energy storage (4) for the electrical supply of the electronic system (1) based on error information relating to the voltage source (2), by which a case of error of the voltage source (2) is characterizable,- a switching device (6), which comprises a discharge circuit (9) for discharging the electrical energy storage (4), and the switching device (6) is formed to electrically couple the electrical energy storage (4) to the voltage source (2) and / or the electronic system (1),- an electronic computing unit (7), which is formed to control the switching device (6) based on at least one hazard information, by which a situation hazardous to the electronic system (1) can be characterized, to disconnect the electrical energy storage (4) from the voltage source (2) and to discharge the electrical energy storage (4) with the discharge circuit (9).

2. The electronic protective device (3) according to claim 1 , wherein the discharge circuit (9) comprises a switching element (S1) and a resistor (R2), wherein the switching element (S1) is switchable for a discharge operation of the electrical energy storage (4) such that the electrical energy storage (4) can be discharged via the resistor (R2).

3. The electronic protective device (3) according to claim 2, wherein the switching element (S1) is formed as a relay, transistor, bipolar transistor or metal oxide semiconductor field effect transistor.

4. The electronic protective device (3) according to any one of the preceding claims, wherein the switching device (6) comprises at least one voltage converter (11 ), wherein the voltage converter (11) is formed to convert the first voltage (U1) of the voltagesource (2) into a charging voltage (UL) in a first operating state, to be able to charge the electrical energy storage (4), and wherein the voltage converter (11) is formed to convert the second voltage (U2) of the electrical energy storage (4) into a supply voltage (UV), by which the electronic system (1) can be electrically supplied in a case of error of the voltage source (2), in a second operating state different from the first operating state, in particular the voltage converter (11) is formed as a buckboost converter.

5. The electronic protective device (3) according to any one of the preceding claims, wherein a voltage value of the first voltage (U1) is less than a voltage value of the second voltage (U2).

6. The electronic protective device (3) according to any one of the preceding claims, comprising a communication interface (12), which can be communicatively coupled to the electronic system (1) and / or to at least one device (13) external to the electronic system (1), wherein the communication interface (12) is formed to provide the at least one hazard information to the electronic computing unit (7).

7. An electronic system (1) comprising a housing (16) and an electronic protective device (3) according to any one of the preceding claims.

8. The electronic system (1) according to claim 7, wherein the protective device (3) is arranged within the housing (16) of the electronic system (1)-9. The electronic system (1) according to claim 7 or 8, comprising a housing monitoring device (17), which is formed to monitor a state of the housing (16) and to provide housing information relating to the state of the housing (16) to the electronic computing unit (7) as at least one hazard information.

10. The electronic system (1) according to claim 9, wherein the housing monitoring device (17) comprises at least a first and a second electrically conductive element (18, 19), wherein a measurement device (20) of thehousing monitoring device (17) is electrically connected to the housing (16) by means of the first electrically conductive element (18) and a reference potential (10) of the electronic system (1) is electrically connected to the housing (16) by means of the second electrically conductive element (19).11 . The electronic system (1 ) according to claim 10, wherein the housing (16) is formed of an electrically conductive material, wherein the two electrically conductive elements (18, 19) are electrically connected via the housing (16) in a basic state of the housing (16).

12. The electronic system (1 ) according to claim 11 , wherein in the basic state of the housing (16), a measurement voltage (UM), which has a first voltage level, is applied to an input side (22) of the measurement device (20), wherein a pull-up resistor (R1) is arranged on the input side (22) of the measurement device (20), which is configured to set the measurement voltage (UM) from the first voltage level to a second voltage level if the housing (16) is in an opened state, in which an electrical connection (21) between the two electrically conductive elements (18, 19) is impaired.

13. The electronic system (1 ) according to claim 10, 11 or 12, wherein the two electrically conductive elements (18, 19) are formed as electrically conductive spring clips, electrically conductive sealing elements or electrically conductive gunning pastes.

14. The electronic system (1) according to claim 10, 11 , 12 or 13, wherein the housing monitoring device (17) comprises further electrically conductive elements (18a, 18b, 18c), which are arranged distributed on the housing (16).

15. A method for operating an electronic system (1), wherein- the electronic system (1) is electrically supplied by an external voltage source (2), and an electrical energy storage (4) of an electronic protective device (3) is charged based on the external voltage source (2),- in a case of error of the external voltage source (2), the electronic system (1) is electrically supplied by the electrical energy storage (4),- if it is determined that a hazardous situation is present for the electronic system(1), the electrical energy storage (4) is disconnected from the external voltage source (2) and the electrical energy storage (4) is discharged.

Images