Redundancy switching system for vehicle components

Abstract

The invention relates to a redundancy switching system (1) for supplying electrical energy to at least a primary load (2) and a secondary load (4) in a vehicle (100). The redundancy switching system (1) has a primary switching assembly (8) and a secondary switching assembly (10), the primary switching assembly (8) being designed to close or interrupt a primary circuit (12) between the main energy source (6) and the primary electrical load (2), and the secondary switching assembly (10) being designed to close or interrupt a secondary circuit (14) between the main energy source (6) and the secondary electrical load (4). The redundancy switching system also has at least one primary control device (16) for switching the primary switching assembly (8) and the secondary switching assembly (10) and a secondary control device (18) for switching the primary switching assembly (8) and the secondary switching assembly (10). The invention relates to a method for redundantly supplying energy to electrical loads in a vehicle (100) and to a vehicle (100) having a redundancy switching system (1).

Description

[0001] Hanover, October 30, 2024 IP, Rabe, Fegers / Ek SR 304955-DE-NP EM 304955

[0002] Redundancy switching system for vehicle components

[0003] The present invention relates to a redundant switching system for supplying electrical power to at least one primary electrical consumer and one secondary electrical consumer in a vehicle. The invention further relates to methods for the redundant power supply of a primary electrical consumer and a secondary electrical consumer in a vehicle, as well as to a vehicle.

[0004] In modern vehicles, numerous different components, often safety-relevant, are operated and / or powered by electrical energy. These include, among others, electromechanical braking units, driver assistance systems, steering systems, and lighting systems. The electrical energy is supplied by one or more main energy sources. For electrically powered vehicles, this can be the traction battery. However, electrical energy can also be supplied, for example, by another battery or an alternator.

[0005] For reasons of traffic safety, it is necessary to electrically isolate faulty components and / or circuits from other components and / or circuits if faults occur during operation. For example, a short circuit or excessive current draw in one component must be isolated from other electrical components and / or the main power source to prevent damage to other components and / or to prevent the main power source from being discharged.

[0006] EP 3 626 543 A1 describes the use of a protection circuit for the redundant power supply of at least two electrical circuits, whereby one or two microcontrollers control a logic gate element such that a first circuit and a second circuit are either closed or opened. A disadvantage of this solution is that there is no redundant fuse for the logic gate element itself. In the event of a defect in the logic gate element, the circuit is inoperable.

[0007] The object of the present invention is therefore to provide an improved and safer redundancy switching system for vehicle components, with which additional fault cases of the redundancy switching system can be taken into account.

[0008] This problem is solved by a redundant switching system with the features of independent claim 1. Such a redundant switching system for supplying electrical energy to at least one primary electrical consumer in a vehicle and one secondary electrical consumer in the vehicle comprises: A main energy source for providing electrical energy;at least one primary switching arrangement and one secondary switching arrangement, wherein the primary switching arrangement is configured to close or open a primary circuit between the main energy source and the primary electrical load, and wherein the secondary switching arrangement is configured to close or open a secondary circuit between the main energy source and the secondary electrical load, at least one primary control device for switching the primary switching arrangement with a primary-primary switching signal and the secondary switching arrangement with a primary-secondary switching signal, and a secondary control device for switching the primary switching arrangement with a secondary-primary switching signal and the secondary switching arrangement with a secondary-secondary switching signal.

[0009] The primary power source is preferably a battery or an alternator. The primary and secondary electrical consumers can be of the same type; for example, the primary electrical consumer can be a first electromechanical brake unit and the secondary electrical consumer a second electromechanical brake unit. It is preferred that the primary electrical consumer be of a different type than the secondary electrical consumer. For example, the primary electrical consumer can be a driver assistance system or a component of a driver assistance system, and the secondary electrical consumer can be an electromechanical brake unit. Other combinations of common electrical consumers in a vehicle are also possible and preferred. The primary electrical consumer is supplied with electrical energy from the primary power source via a primary circuit.The secondary electrical load is supplied with electrical energy from the main energy source via a secondary circuit. Here, "supply of electrical energy" means providing the operating voltage and current required for the operation of the respective component.

[0010] The primary circuit can be closed or opened by means of the primary switching arrangement, which is located between the main power source and the primary electrical load. In the open state, there is no current flow, i.e., no electrical power supply. In the closed state, there is current flow and thus an electrical power supply. Similarly, the secondary circuit can be closed or opened by means of the secondary switching arrangement.

[0011] The primary switching arrangement can be switched either by the primary-to-primary switching signal of the primary control unit or by the secondary-to-primary switching signal of the secondary control unit. The secondary switching arrangement can be switched either by the primary-to-secondary switching signal of the primary control unit or by the secondary-to-secondary switching signal of the secondary control unit. Advantageously, this provides a redundant switching option for both the primary and secondary switching arrangements. In the event of a failure of one control unit, e.g., the primary control unit, the primary and secondary switching arrangements can be switched by the other control unit, i.e., in this example, by the secondary control unit.

[0012] In a preferred embodiment, the primary control unit and the secondary control unit are configured to provide the primary-primary switching signal and the primary-secondary switching signal of the primary control unit independently of the secondary-primary switching signal and the secondary-secondary switching signal of the secondary control unit. By providing these switching signals independently, both the primary and the secondary switching arrangements can still be controlled in the event of a defect in either the primary or the secondary control unit.

[0013] Furthermore, the primary and secondary switching arrangements are preferably galvanically isolated from each other. Advantageously, a short circuit and / or other fault occurring in one of the two circuits, e.g., in the primary circuit, has no direct effect on the other circuit, i.e., the secondary circuit.

[0014] A preferred redundant switching system is wherein the primary switching arrangement comprises a first primary switch and a second primary switch connected in series with the first primary switch, and wherein the secondary switching arrangement comprises a first secondary switch and a second secondary switch connected in series with the first secondary switch.

[0015] Furthermore, it is preferred that the first primary switch is controllable by the primary-primary switching signal, the second primary switch by the secondary-primary switching signal, the first secondary switch by the secondary-secondary switching signal, and the second secondary switch by the primary-secondary switching signal. Advantageously, this prevents both control units (i.e., the primary and secondary control units) from simultaneously controlling the same switch in the primary or secondary switching arrangement. In the event of a fault and potentially resulting conflicting switching instructions from the respective switching signals of the control units, controlling the same switch, e.g., a switch in the primary switching arrangement, could be detrimental and damage the switch.

[0016] Preferably, the first primary switch and the second primary switch form a primary changeover switch, and the first secondary switch and the second secondary switch form a secondary changeover switch. A changeover switch can close or open a circuit at multiple switches. For example, the primary circuit can be switched from a closed state, in which current can flow, to an open state, in which no current can flow, when either the first primary switch or the second primary switch is actuated. If either the same primary switch is then actuated again, or the other primary switch is actuated, the primary circuit is closed again. Advantageously, the primary switching arrangement, or the secondary switching arrangement, is thus still able to close the primary circuit, or the secondary switching arrangement, even if the primary circuit is closed.The secondary circuit is to be closed or interrupted if there is a fault in one of the switches, for example, the first primary switch or the first secondary switch, so that the first primary switch or the first secondary switch cannot be actuated. Not only in the case of a fault in the switch, e.g., the first primary switch, but also in the case of a fault in a control unit, e.g., the primary control unit, the switching arrangement, e.g., the primary switching arrangement, is still functional, namely by using the other, non-defective control unit, e.g., the secondary control unit, to close or interrupt the respective circuit, e.g., the primary circuit.

[0017] It is further preferred that the redundancy circuit system also comprises a primary control circuit, comprising the primary-primary switching signal and the primary-secondary switching signal, and that the redundancy circuit system further comprises a secondary control circuit, comprising the secondary-primary switching signal and the secondary-secondary switching signal, wherein the primary control circuit is galvanically isolated from at least one of the primary and secondary circuits, and wherein the secondary control circuit is galvanically isolated from the other of the primary and secondary circuits. Preferably, the primary control unit is part of the primary control circuit and the secondary control unit is part of the secondary control circuit.By providing galvanic isolation between the primary and secondary control circuits, it is advantageously ensured that in the event of a fault and / or short circuit in either the primary or secondary circuit, only one of the control circuits, the primary or secondary, is affected. Switching of both the primary and secondary switching arrangements is advantageously still possible in this fault condition. The redundant switching system preferably also includes a control unit signal line, wherein the primary and secondary control units are connected to each other via this signal line. Preferably, the control unit signal line is configured to exchange information between the primary and secondary control units regarding their respective states.For example, the control unit signal line can transmit information regarding the primary-secondary switching signal and / or the primary-primary switching signal from the primary control unit to the secondary control unit. Preferably, detected faults in the primary switching arrangement, e.g., a fault in the first primary switch, can be transmitted from the primary control unit to the secondary control unit. Advantageously and preferably, in such a case, the other switching arrangement, e.g., the secondary switching arrangement, can trigger the switching of the respective switching arrangement in which a switch is defective, e.g., in the primary switching arrangement with a defective primary switch.

[0018] It is preferred that the redundant circuit system further comprises a primary functional monitoring unit and a secondary functional monitoring unit. The primary functional monitoring unit is preferably configured to provide at least one primary circuit information based on at least one primary electrical state parameter of the primary circuit. The secondary functional monitoring unit is preferably configured to provide at least one secondary circuit information based on at least one secondary electrical state parameter of the secondary circuit. A primary electrical state parameter and a secondary electrical state parameter, respectively, are each parameters from the group comprising: electrical resistance, electrical voltage, electrical flux, electrical charge, electrical capacitance, inductance, and AC voltage frequency. Preferably, the primary and secondary electrical state parameters are...Sensors for measuring at least one primary electrical state parameter and one secondary electrical state parameter are arranged in the secondary circuit. Preferably, the primary and secondary functional monitoring units are configured to process one or more primary and secondary electrical state parameters, respectively. Particularly preferably, the primary and secondary functional monitoring units are configured to detect irregularities, faults, anomalies, or the like in the primary and secondary circuits, respectively. The primary and secondary functional monitoring units provide the primary and secondary circuit information, respectively. That is, they each have an interface at which the primary and secondary circuit information can be received.The secondary circuit information can be transmitted to other elements or components of the redundancy switching system, the vehicle, and / or to external monitoring systems. The transmission of the circuit information preferably occurs wirelessly and / or via data transmission cables.

[0019] Preferably, the primary function monitoring unit is operated with electrical energy supplied by one of the circuits, the primary circuit and the secondary circuit, and the secondary function monitoring unit is operated with electrical energy from the other circuit. Preferably, the primary function monitoring unit is operated with electrical energy from the first circuit and the secondary function monitoring unit with electrical energy from the second circuit.

[0020] It is preferred that the primary and secondary functional monitoring units are further configured to each provide at least one source information based on at least one electrical energy source state parameter of the energy source. The energy source state parameter is preferably a charge or energy state of a battery, a charge or discharge rate of a battery, a temperature, a current, a battery voltage, a power state, an internal resistance, or the like.

[0021] Furthermore, the primary function monitoring unit is preferably configured to provide at least one primary function piece of information based on the operating state of the primary electrical load, and the secondary function monitoring unit is preferably configured to provide at least one secondary function piece of information based on the operating state of the second electrical load. For example, and preferably, the primary electrical load can be configured to transmit information to the primary function monitoring unit in the fault state, which then provides primary function information about the primary electrical load based on this information. Preferably, at least one function piece of information is provided not only in the fault state of the primary or secondary electrical load, but also in the functioning state of the primary or secondary load.Functional information is provided for the secondary electrical consumer.

[0022] The primary control unit is particularly preferably configured to control the primary switching unit and the secondary switching unit based on at least one primary circuit information, at least one primary function information, and / or the source information. The secondary control unit is also preferably configured to control the primary switching unit and the secondary switching unit based on at least one secondary circuit information, at least one secondary function information, and / or the source information. For this purpose, the primary control unit and the secondary control unit preferably process the information provided by the primary function monitoring unit and the secondary function monitoring unit, respectively.

[0023] Preferably, a primary energy storage device for storing and / or releasing electrical energy is arranged between the primary switching arrangement and the primary electrical load, and a secondary energy storage device for storing and / or releasing electrical energy is arranged between the secondary switching arrangement and the secondary electrical load. In the event that the primary or secondary circuit is interrupted, for example due to a fault in the main power source, the primary and / or secondary electrical load can continue to operate for a certain period of time using energy stored in the primary or secondary energy storage device. This may, for example, be sufficient to reach the nearest repair shop to have the fault rectified.

[0024] The primary energy storage unit or the secondary energy storage unit are preferably designed to supply the primary functional monitoring unit or the secondary functional monitoring unit with electrical energy.

[0025] In a second aspect, the problem is solved by a method for the redundant power supply of a primary electrical consumer and a secondary electrical consumer in a vehicle with a redundant switching system, preferably according to the first aspect of the invention, the method comprising the steps of: controlling a primary switching arrangement of a primary circuit with a primary control device for closing or interrupting the primary circuit; controlling a secondary switching arrangement of a secondary circuit with a secondary control device for closing or interrupting the secondary circuit; if a primary circuit fault occurs in the primary circuit, detecting the primary circuit fault and / or if a secondary circuit fault occurs in the secondary circuit, detecting the secondary circuit fault;If a primary circuit fault is detected in the primary circuit, the primary switching arrangement of the primary circuit is activated by the primary control device or by the secondary control device to interrupt the current flow from the main power source to the primary circuit; and if a secondary circuit fault is detected in the secondary circuit, the secondary switching arrangement of the secondary circuit is activated by the primary control device or by the secondary control device to interrupt the current flow from the main power source to the secondary circuit.

[0026] A primary circuit fault or a secondary circuit fault is, for example, a short circuit. However, a primary circuit fault or a secondary circuit fault can also occur if a primary electrical state parameter or a secondary electrical state parameter is faulty, i.e., if it lies above or below a predetermined threshold. Preferably, the method further comprises the steps of: providing primary functional information based on the operating state of the primary electrical load and providing secondary functional information based on the operating state of the secondary electrical load.If the primary function information indicates a faulty operating state of the primary electrical load, activate the primary switching arrangement of the primary circuit with the primary control device or with the secondary control device to interrupt the current flow from the main power source to the primary circuit; if the secondary function information indicates a faulty operating state of the secondary electrical load, activate the secondary switching arrangement of the secondary circuit with the primary control device or with the secondary control device to interrupt the current flow from the main power source to the secondary circuit.

[0027] Furthermore, the method preferably comprises, following the actuation of the primary switching arrangement of the primary circuit with the primary control device or with the secondary control device to interrupt the current flow from the main energy source to the primary circuit, the step of supplying the primary circuit with electrical energy through a primary energy storage unit; and / or following the actuation of the secondary switching arrangement of the secondary circuit with the primary control device or with the secondary control device to interrupt the current flow from the main energy source to the secondary circuit, the step of supplying the secondary circuit with electrical energy through a secondary energy storage unit.

[0028] It is preferred that the method includes the steps for testing the functionality of the redundancy switching system: closing the primary circuit with the primary switching arrangement; recording primary circuit information of the primary circuit; simultaneously actuating a first primary switch and a second primary switch of a primary changeover switch of the primary circuit; comparing the primary circuit information before and after switching; closing the secondary circuit with the secondary switching arrangement; recording secondary circuit information of the secondary circuit; simultaneously actuating a first secondary switch and a second secondary switch of a secondary changeover switch of the secondary circuit; and comparing the secondary circuit information before and after switching.

[0029] Preferably, the method also includes the following steps: outputting a primary error message if the compared primary circuit information differs from each other before and after switching by a predetermined primary threshold, and outputting a secondary error message if the compared secondary circuit information differs from each other before and after switching by a predetermined secondary threshold.

[0030] A third aspect of the invention relates to a vehicle comprising a redundant switching system for the electrical power supply of at least one primary electrical consumer in the vehicle and one secondary electrical consumer in the vehicle, wherein the redundant switching system is configured according to one of the preferred embodiments of the first aspect of the invention.

[0031] Preferably, the primary electrical consumer is an electrical consumer from the group comprising: an electromechanical brake unit, an electric steering system, on-board electronics, a lighting system, a driver assistance system, a pneumatic or hydraulic braking system, a stability control system, a sensor cleaning system, a fuel cell system, a compressed air generation system, a compressed air treatment system, an air suspension system, a clutch system, a transmission control system, a vehicle fleet management system, and a vehicle drive system. Preferably, the secondary electrical consumer is another or a redundant electrical consumer from the group.

[0032] It should be understood that the redundancy switching system according to the first aspect of the invention, the method according to the second aspect of the invention, and the vehicle according to the third aspect of the invention have the same and similar sub-aspects, as set forth in particular in the dependent claims. Therefore, for further developments of the second and third aspects of the invention, reference is made in full to the further developments of the first aspect of the invention. The invention is explained in more detail below with reference to exemplary embodiments and the accompanying figures. These figures show:

[0033] Fig. 1 : a first embodiment of a redundancy switching system;

[0034] Fig. 2: a second embodiment of a redundant switching system;

[0035] Fig. 3: a vehicle with a primary electrical consumer, a secondary electrical consumer and a redundant switching system;

[0036] Fig. 4: a first sequence of steps for carrying out a method according to the invention;

[0037] Fig. 5: a second sequence of steps for carrying out a method according to the invention;

[0038] Fig. 6: a third step sequence for carrying out a method according to the invention;

[0039] Fig. 7: a fourth step sequence for carrying out a method according to the invention; and

[0040] Fig. 8: a detailed view of selected steps of a method according to the invention.

[0041] In the embodiment of a redundant switching system 1 according to Figure 1, electrical energy is supplied by a main energy source 6. Electrical current can flow in a primary circuit 12 and / or in a secondary circuit 14. In the primary circuit 12, current flow can be enabled or prevented by closing or opening the primary circuit at a primary switching arrangement 8. The primary switching arrangement 8 is arranged between the main energy source 6 and a primary electrical load 2.

[0042] In the secondary circuit 14, current flow can be enabled or prevented by closing or opening the secondary circuit 14 at a secondary switching arrangement 10. The secondary switching arrangement 10 is located between the main energy source 6 and a secondary electrical load 4. Solid arrows indicate the current flow from the main energy source 6 to the primary switching arrangement 8 or to the secondary switching arrangement 10 when the primary circuit 12 or the secondary circuit 14 is closed, respectively. When the primary circuit 12 or the secondary circuit 14 is closed, solid arrows then indicate the further current flow from the primary switching arrangement 8 to the primary electrical load 2 or from the secondary switching arrangement 10 to the secondary electrical load 4, respectively.

[0043] A primary control device 16 and a secondary control device 18 are each configured to switch the primary switching arrangement 8 and / or the secondary switching arrangement 10, i.e., to switch them from a closed state to an open state or from an open state to a closed state. For this purpose, the primary control device 16 and the secondary control device 18 transmit switching signals, namely a primary-primary switching signal S-PP, a primary-secondary switching signal S-PS, a secondary-primary switching signal S-SP, and a secondary-secondary switching signal S-SS.

[0044] These switching signals are shown as dashed lines in Figure 1. The arrow directions of the switching signals indicate that the respective switching signal originates from the primary control unit 16 or the secondary control unit 18 and controls the primary switching arrangement 8 or the secondary switching arrangement 10, respectively. The primary switching arrangement 8 can therefore be controlled either by the primary-primary switching signal S-PP, which originates from the primary control unit 16, or by the secondary-primary switching signal S-SP, which originates from the secondary control unit 18. Similarly, the secondary switching arrangement 10 can be controlled either by the primary-secondary switching signal S-PS, which originates from the primary control unit 16, or by the secondary-secondary switching signal S-SS, which originates from the secondary control unit 18.Advantageously, even if one of the two control units (primary control unit 16, secondary control unit 18) is defective, switching of both the primary circuit 12 and the secondary circuit 14 is still possible with the other control unit. For example, if the primary control unit 16 is defective, no primary-primary switching signal S-PP can be provided to control the primary switching arrangement 8 and / or no primary-secondary switching signal S-PS can be provided to control the secondary switching arrangement 10. Nevertheless, in this case, both the primary switching arrangement 8 and the secondary switching arrangement 10 can be controlled: the primary switching arrangement 8 by the secondary-primary switching signal S-SP of the secondary control unit 18, and the secondary switching arrangement 10 by the secondary-secondary switching signal S-SS of the secondary control unit 18.

[0045] In the embodiment shown here, the primary-secondary switching signal S-PS and the primary-primary switching signal S-PP form a primary control circuit 13. Preferably, the primary control device 16 is part of the primary control circuit 13. In the embodiment shown here, the primary control circuit 13 is electrically operated. For this purpose, it can be provided that the primary control circuit 13 is supplied with electrical energy from the primary circuit 12 or the secondary circuit 14. Similarly, the secondary-primary switching signal S-SP and the secondary-secondary switching signal S-SS form a secondary control circuit 15. Preferably, the secondary control device 18 is also part of the secondary control circuit 15. Preferably, the secondary control circuit 15 is supplied by one of the circuits, primary circuit 12 or secondary circuit 14, from which the primary control circuit 13 is not supplied.For example, the primary control circuit 13 can be supplied with electrical energy from the primary circuit 12, and the secondary control circuit 15 can be supplied with electrical energy from the secondary circuit 14. It is particularly preferred that the primary circuit 12 and the secondary circuit 14 are galvanically isolated from each other. If a fault or short circuit occurs in one of the circuits, for example in the primary circuit 12, the other circuit, i.e., the secondary circuit 14, is advantageously not affected. In particular, the secondary control circuit 15 is also not affected, so that the secondary switching signal S-SS can be used to switch the secondary switching arrangement 10 and the secondary switching signal can be used to switch the primary switching arrangement 8.In the embodiment shown here, the primary control unit 16 and the secondary control unit 18 are configured to provide the primary-primary switching signal S-PP and the primary-secondary switching signal S-PS of the primary control unit 16 independently of the secondary-primary switching signal S-SP and the secondary-secondary switching signal S-SS of the secondary control unit 18. The switching state of the primary switching arrangement 8 can therefore be changed selectively by either the primary-primary switching signal S-PP or the secondary-primary switching signal S-SP. No condition of either switching signal, e.g., the primary-primary switching signal S-PP, needs to be met for the other switching signal, e.g., the secondary-primary switching signal S-SP, to be switched.

[0046] Preferably, the primary control unit 16 and the secondary control unit 18 can be interconnected, i.e., able to communicate with each other. This is the case in the redundancy switching system 1 according to Figure 2. The primary control unit 16 and the secondary control unit 18 are interconnected via a control unit signal line 32. In the embodiment shown here, the control unit signal line 32 is configured to transmit information bidirectionally between the primary control unit 16 and the secondary control unit 18. Such information preferably includes information regarding the switching signals, the functionality of the primary control unit 16, and / or the secondary control unit 18.the secondary control unit 18, source information lQ regarding the state of the main energy source 6, primary function information I-PF regarding the function of the primary consumer 4, secondary function information l-SF regarding the function of the secondary consumer 6, primary circuit information l-PS regarding the primary circuit 12 and / or secondary circuit information l-SS regarding the secondary circuit 14. In the embodiment shown in Figure 2, at least one of the information sources lQ, at least one primary function information l-PF, or at least one secondary function information l-SF, at least one primary circuit information l-PS, or at least one secondary circuit information l-SS is provided by a primary function monitoring unit 34 or a secondary function monitoring unit 36, respectively. Primary circuit information l-PS and secondary circuit information l-SS are denoted by the primary circuit information l-PS and secondary circuit information l-SS, respectively.Secondary circuit information l-SS: Information regarding the primary circuit 12 or the secondary circuit 14 based on primary electrical state parameters 38 or based on secondary electrical state parameters 40. Primary electrical state parameters 38 can be, for example, an electrical voltage, an electrical resistance, a current flow, or an electrical power in the primary circuit 12. Corresponding quantities of the secondary circuit 14 can be secondary electrical state parameters 40.

[0047] The secondary function monitoring unit 36 ​​is configured to provide secondary circuit information l-SS based on the electrical secondary state parameters 40. In a simple embodiment, the secondary circuit information l-SS indicates whether the at least one electrical secondary state parameter 40 is within a predefined target range. If so, the secondary circuit information l-SS assumes a first state (e.g., "1"). If not, the secondary circuit information l-SS assumes a second state (e.g., "0"). In more complex embodiments, the secondary circuit information l-SS is more extensive; that is, it can include, for example, information regarding various electrical secondary state parameters 40 and / or the degree of deviation from the predefined target range.Preferably, the secondary circuit information l-SS can include a time course of one or more electrical secondary state parameters 40.

[0048] Similarly, the primary functional monitoring unit 34 is designed to provide at least one circuit information l-PS based on the at least one primary electrical state parameter 38.

[0049] In the embodiment shown here, both the primary function monitoring unit 34 and the secondary function monitoring unit 36 ​​are configured to provide at least one source information lQ based on at least one electrical energy source state parameter 42 of the main energy source 6. The energy source state parameter 42 can, for example, be a state of charge if the main energy source 6 is a battery. In other embodiments, the energy source state parameter 42 is the currently supplied electrical power. In these cases, the primary function monitoring unit 34 and the secondary function monitoring unit 36 ​​are preferably configured to provide source information lQ in the event of a defective or faulty main energy source 6. Preferably, source information lQ is also provided in the non-defective state.

[0050] The primary function monitoring unit 34 and the secondary function monitoring unit 36 ​​shown in Figure 2 are further configured to provide at least one primary function information l-PF based on the operating state of the primary electrical load 2, and one secondary function information l-SF based on the operating state of the secondary electrical load 4, respectively. For example, such an operating state of the primary electrical load 2 is a defect or fault-free operation of the primary electrical load 2, and an operating state of the secondary electrical load 4 is a defect or fault-free operation of the secondary electrical load 4.

[0051] In the embodiment shown in Figure 2, the primary function monitoring unit 34 provides source information lQ, primary function information l-PF, and primary circuit information l-PS, each of which is transmitted to both the primary control unit 16 and the secondary control unit 18. The primary control unit 16 and the secondary control unit 18 are configured to control the primary switching unit 8 and the secondary switching unit 10 based on at least one of the pieces of information. For example, if a defect in the secondary load 4 is detected and a corresponding secondary function information l-SF is provided by the secondary function monitoring unit 36 ​​and transmitted to the primary control unit 16 and / or the secondary control unit 18, the current flow in the secondary circuit 4 can be interrupted by switching the secondary switching arrangement 10.

[0052] In the embodiments shown in Figure 2, a detailed structure of the primary switching arrangement 8 and the secondary switching arrangement 10 is also described, each comprising a primary changeover switch 28 and a secondary changeover switch 30, respectively. The primary changeover switch 28 comprises a first primary switch 20 and a second primary switch 22, which is connected in series with the first primary switch 20. The secondary changeover switch 30 comprises a first secondary switch 24 and a second secondary switch 26, which is connected in series with the first secondary switch 24. The primary switching arrangement 8 is switched, i.e.,It changes its state from a current-conducting to a non-current-conducting state or vice versa when either the first primary switch 20 is actuated, namely by being triggered with the primary-primary control signal S-PP, or when the second primary switch 22 is actuated, namely by being triggered with the secondary-primary control signal S-SP. Similarly, the secondary switching arrangement 10 is switched when either the first secondary switch 24 is actuated, namely by being triggered with the secondary-secondary control signal S-SS, or when the second secondary switch 26 is actuated, namely by being triggered with the primary-secondary switching signal S-PS.

[0053] In the embodiment shown in Figure 2, a primary energy storage device 44 for storing and / or releasing electrical energy and a secondary energy storage device 46 for storing and / or releasing electrical energy are also arranged. If, for example, the primary circuit 12 and / or the secondary circuit 14 at the primary switching arrangement 8 or at the secondary switching arrangement 10 has to be interrupted due to a fault in the main energy source 6, the primary electrical load 2 or the secondary electrical load 4 can be operated at least temporarily with previously stored electrical energy from the primary energy storage device 44 or the secondary energy storage device 46. Electrical energy from the primary energy storage device 44 and / or the secondary energy storage device 46 is preferably provided for operating the primary control device 16 and / or the secondary control device 18.

[0054] Figure 3 shows a vehicle 100 with a redundant switching system 1 for supplying electrical power to at least one primary electrical load 2 and one secondary electrical load 4. The primary electrical load 2 and the secondary electrical load 4 can be electrical loads of the same type; for example, the primary electrical load 2 and the secondary electrical load 4 can each be an electromechanical brake unit. Equally preferred is that the primary electrical load 2 is of a different type than the secondary electrical load 4.The primary electrical consumer 2 and the secondary electrical consumer 4 are preferably each an electrical consumer from a group comprising: an electromechanical brake unit, an electric steering system, on-board electronics, a lighting system, a driver assistance system, a pneumatic or hydraulic brake system, a stability control system, a sensor cleaning system, a fuel cell system, a compressed air generation system, a compressed air treatment system, an air suspension system, a clutch system, a transmission control system, a vehicle fleet management system, and a vehicle drive system. Preferably, the primary electrical consumer 2 and the secondary electrical consumer 4 are a plurality of different electrical consumers from the group, i.e., the primary circuit 12 and the secondary circuit 14, respectively, supply several consumers with electrical energy.

[0055] Figure 4 shows a sequence of steps for carrying out a method for the redundant power supply of a primary electrical load 2 and a secondary electrical load 4 in a vehicle 100 with a redundant switching system 1. In a first step S1, a primary switching arrangement 8 of a primary circuit 12 is controlled by a primary control device 16 to close or open the primary circuit 12. In a second step S2, a secondary switching arrangement 10 of a secondary circuit 14 is controlled by a secondary control device 18 to close or open the secondary circuit 14. If a primary circuit fault F-PS occurs in primary circuit 12 and / or a secondary circuit fault F-SS occurs in secondary circuit 14, this primary circuit fault or this secondary circuit fault F-SS is detected in the third step S3.In the fourth step S4, if a primary circuit fault F-PS is detected in primary circuit 12, the primary switching arrangement 8 of primary circuit 12 is interrupted by the primary control device 16 or by the secondary control device 18 to interrupt the current flow from the main power source 6 to primary circuit 12. Similarly, if a secondary circuit fault F-SS is detected in secondary circuit 14, in the fifth step S5, the secondary switching arrangement 10 of secondary circuit 14 is activated by the primary control device 16 or by the secondary control device 18 to interrupt the current flow from the main power source 6 to secondary circuit 14. It should be understood that steps S3, S4, and S5 are not necessarily executed, but only if a primary circuit fault F-PS and / or a secondary circuit fault F-SS occurs.It should also be understood that steps S1 and S2 can be performed in any chronological order or, preferably, essentially simultaneously.

[0056] A preferred embodiment of the method is shown in Figure 5. In the additional step S3a, primary functional information l-PF is provided based on the operating state of the primary electrical load 2, and secondary functional information l-SF is provided based on the operating state of the secondary electrical load 4. If the primary functional information l-PF indicates a faulty operating state of the primary electrical load 2, the primary switching arrangement 8 of the primary circuit 12 is controlled in the additional step S4a by either the primary control device 16 or the secondary control device 18 to interrupt the current flow from the main power source 6 to the primary circuit 12.If the secondary function information l-SF indicates a faulty operating state of the secondary electrical consumer 4, in step S5a the secondary switching arrangement 10 of the secondary circuit 14 is controlled with the primary control device 16 or with the secondary control device 18 to interrupt the current flow from the main energy source 6 to the secondary circuit 14.

[0057] Preferably, and as shown in Figure 6, the method further comprises steps S4b and S5b. Step S4b follows step S4a. In step S4b, the primary circuit 12 is supplied with electrical energy by a primary energy storage unit 44. Step S5b follows step S5a. In step S5b, the secondary circuit 14 is supplied with electrical energy by a secondary energy storage unit 46.

[0058] In a further development of the method, as shown in Figure 7, the method is further supplemented by a step S6. Step S6 comprises, if a source fault FQ is detected at the main energy source 6, activating the primary switching arrangement 8 of the primary circuit 12 with the primary control device 16 or with the secondary control device 18 to interrupt the energy supply from the main energy source 6 of the primary circuit 12, and activating the secondary switching arrangement 10 of the secondary circuit 14 with the primary control device 16 or with the secondary control device 18 to interrupt the energy supply from the main energy source 6 of the secondary circuit 14.

[0059] Furthermore, Figure 7 shows steps for testing the functionality of the redundancy switching system 1: In step S10, the primary circuit 12 is closed with the primary switching arrangement 8. In step S20, primary circuit information l-PS of the primary circuit 12 is recorded. In step S30, a first primary switch 20 and a second primary switch 22 of a primary changeover switch 28 of the primary circuit 12 are actuated simultaneously. In step S40, the primary circuit information l-PS before and after switching is compared. Similarly, in step S50, the secondary circuit 14 is closed with the secondary switching arrangement 10. Secondary circuit information l-SS of the secondary circuit 14 is recorded in step S60.In step S70, a first secondary switch 24 and a second secondary switch 26 of a secondary changeover switch 30 of the secondary circuit 14 are actuated simultaneously. In step S80, the secondary circuit information l-SS is compared before and after switching.

[0060] In a preferred further development, the functional testing as shown in Figure 8 is supplemented by steps S40a and S80a. In step S40a, a primary fault message P-FM is output if the primary circuit information l-PS, compared in S40, differs from each other by a predetermined primary threshold P-SW before and after switching. Similarly, in step S80a, a secondary fault message S-FM is output if the secondary circuit information l-SS, compared in step S80, differs from each other by a predetermined secondary threshold S-SW before and after switching.

[0061] Simultaneously actuating two switches of a two-way switching circuit, e.g., the first primary switch 20 and the second primary switch 22 in the primary two-way switching circuit 28 according to step S30, does not significantly affect the electrical primary state parameters 38, provided the primary two-way switching circuit 28 is fault-free. The primary circuit information l-PS is based on the electrical primary state parameters 38. Therefore, a comparison of the primary circuit information l-PS before and after switching shows no significant difference if the primary two-way switching circuit 28 is functioning correctly. However, if there are differences that are greater than a predetermined primary threshold value P-SW, this indicates faulty switching of the primary two-way switching circuit 28, for example, due to a defective first primary switch 20, a defective second primary switch 22, or a faulty transmission of a switching signal.

[0062] Reference symbol list (part of the description)

[0063] 2 Primary Consumer

[0064] 4 Secondary Consumer

[0065] 6 Main energy source

[0066] 8 Primary switching arrangement

[0067] 10 Secondary switching arrangement

[0068] 12 Primary Circuit

[0069] 13 Primary Control Circuit

[0070] 14 Secondary circuit

[0071] 15 Secondary control circuit

[0072] 16 Primary control unit

[0073] 18 Secondary control unit

[0074] 20 First primary switch

[0075] 22 Second primary switch

[0076] 24 First secondary switch

[0077] 26 Second secondary switch

[0078] 28 Primary changeover switch

[0079] 30 Secondary changeover switch

[0080] 32 Control unit signal line

[0081] 34 Primary Function Monitoring Unit

[0082] 36 Secondary Function Monitoring Unit

[0083] 38 Primary State Parameters

[0084] 40 secondary state parameters

[0085] 42 Energy source state parameters

[0086] 44 Primary energy storage

[0087] 46 Secondary energy storage

[0088] 100 vehicles

[0089] S-PS Primary-Secondary Switching Signal

[0090] S-SP Secondary-Primary Switching Signal

[0091] S-PP Primary-Primary Switching Signal

[0092] S-SS Secondary switching signal l-PS Primary circuit information I-SS Secondary circuit information l-Q Source information l-PF Primary functional information l-SF Secondary functional information

[0093] F-PS Primary Circuit Fault

[0094] F-SS secondary circuit fault

[0095] FQ Source Error

[0096] P-FM Primary Error Message

[0097] S-FM Secondary Error Message

[0098] P-SW Primary Threshold

[0099] S-SW Secondary Threshold

Claims

Patent claims 1. Redundancy switching system (1) for supplying electrical power to at least one primary electrical consumer (2) in a vehicle (100) and one secondary electrical consumer (4) in the vehicle (100), comprising the redundancy switching system (1): - a primary energy source (6) for providing electrical energy; - at least one primary switching arrangement (8) and one secondary switching arrangement (10), wherein the primary switching arrangement (8) is configured to close or open a primary circuit (12) between the main power source (6) and the primary electrical load (2), and wherein the secondary switching arrangement (10) is configured to close or open a secondary circuit (14) between the main power source (6) and the secondary electrical load (4), and - at least one primary control device (16) for switching the primary switching arrangement (8) with a primary-primary switching signal (S-PP) and the secondary switching arrangement (10) with a primary-secondary switching signal (S-PS) and a secondary control device (18) for switching the primary switching arrangement (8) with a secondary-primary switching signal (S-SP) and the secondary switching arrangement (10) with a secondary-secondary switching signal (S-SS).

2. Redundancy switching system (1) according to claim 1, wherein the primary control device (16) and the secondary control device (18) are configured to provide the primary-primary switching signal (S-PP) and the primary-secondary switching signal (S-PS) of the primary control device (16) independently of the secondary-primary switching signal (S-SP) and the secondary-secondary switching signal (S-SS) of the secondary control device (18).

3. Redundancy switching system (1) according to one of the preceding claims, wherein the primary switching arrangement (8) and the secondary switching arrangement (10) are galvanically isolated from each other.

4. Redundancy switching system (1) according to one of the preceding claims, wherein the primary switching arrangement (8) comprises a first primary switch (20) and a second primary switch (22) connected in series with the first primary switch (20), and wherein the secondary switching arrangement (10) comprises a first secondary switch (24) and a second secondary switch (26) connected in series with the first secondary switch (24), wherein preferably the first primary switch (20) is controllable by the primary-primary switching signal (S-PP), the second primary switch (22) is controllable by the secondary-primary switching signal (S-PS), the first secondary switch (24) is controllable by the secondary-secondary switching signal (S-SS), and the second secondary switch (26) is controllable by the primary-secondary switching signal (S-PS).and wherein preferably the first primary switch (20) and the second primary switch (22) form a primary changeover switch (28) and wherein preferably the first secondary switch (24) and the second secondary switch (26) form a secondary changeover switch (30).

5. Redundancy switching system (1) according to one of the preceding claims, comprising a primary control circuit (13) comprising the primary-primary switching signal (S-PP) and the primary-secondary switching signal (S-PS) and a secondary control circuit (15) comprising the secondary-primary switching signal (S-SP) and the secondary-secondary switching signal (S-SS), wherein the primary control circuit (13) is galvanically isolated from at least one of the circuits primary circuit (12) and secondary circuit (14) and wherein the secondary control circuit (15) is galvanically isolated from the other of the circuits primary circuit (12) and secondary circuit (14).

6. Redundancy switching system (1) according to one of the preceding claims, further comprising a control unit signal line (32), wherein the primary control device (16) and the secondary control device (18) are connected to each other by the control unit signal line (32).

7. Redundancy switching system (1) according to one of the preceding claims, further comprising a primary function monitoring unit (34) and a secondary function monitoring unit (36), wherein the primary function monitoring unit (34) is configured to provide at least one primary circuit information (1-PS) based to provide at least one electrical primary state parameter (38) of the primary circuit (12) and wherein the secondary function monitoring unit (36) is configured to provide at least one secondary circuit information (1-SS) based on at least one electrical secondary state parameter (40) of the secondary circuit (14).

8. Redundancy switching system (1) according to claim 7, wherein the primary function monitoring unit (16) and the secondary function monitoring unit (18) are further configured to each provide at least one source information (lQ) based on at least one electrical energy source state parameter (42) of the main energy source (6), and wherein the primary function monitoring unit (34) is preferably additionally or alternatively further configured to provide at least one primary function information (l-PF) based on the operating state of the primary electrical consumer (2), and wherein the secondary function monitoring unit (36) is further configured to provide at least one secondary function information (l-SF) based on the operating state of the secondary electrical consumer (4).

9. Redundancy switching system (1) according to one of the preceding claims, wherein the primary function monitoring unit (34) is operated with electrical energy from the first circuit (12) and the secondary function monitoring unit (36) is operated with electrical energy from the second circuit (14).

10. Redundancy switching system according to one of the preceding claims, wherein the primary control unit (16) is configured to control the primary switching unit (8) and the secondary switching unit (10) based on the at least one primary circuit information (l-PS), the at least one primary function information (l-FS) and / or the source information (lQ), and wherein the secondary control unit (18) is configured to control the primary switching unit (8) and the secondary switching unit (10) based on the at least one secondary circuit information (l-SS), the at least one secondary function information (l-SF) and / or the source information (lQ).

11. Redundancy switching system (1) according to one of the preceding claims, wherein a primary energy storage device (44) for storing and / or releasing electrical energy is arranged between the primary switching arrangement (8) and the primary electrical consumer (2), and wherein a secondary energy storage device (46) for storing and / or releasing electrical energy is arranged between the secondary switching arrangement (10) and the secondary electrical consumer (4).

12. Method for the redundant power supply of a primary electrical consumer (2) and a secondary electrical consumer (4) in a vehicle (100) with a redundancy switching system (1), preferably according to one of the preceding claims, comprising the steps: S1 : Controlling a primary switching arrangement (8) of a primary circuit (12) with a primary control device (16) for closing or interrupting the primary circuit (12); S2: Controlling a secondary switching arrangement (10) of a secondary circuit (14) with a secondary control device (18) for closing or interrupting the secondary circuit (14); S3: if a primary circuit fault (F-PS) occurs in the primary circuit (12), detect the primary circuit fault (F-PS) and / or if a secondary circuit fault (F-SS) occurs in the secondary circuit (14), detect the secondary circuit fault (F-SS); S4: if a primary circuit fault (F-PS) is detected in the primary circuit (12), the primary switching arrangement (8) of the primary circuit (12) is activated by the primary control device (16) or by the secondary control device (18) to interrupt the current flow from the main power source (6) to the primary circuit (12); and S5: if a secondary circuit fault (F-SS) is detected in the secondary circuit (14), the secondary switching arrangement (10) of the secondary circuit (14) is activated by the primary control device (16) or by the secondary control device (18) to interrupt the current flow from the main power source (6) to the secondary circuit (14).

13. The method of claim 12, further comprising the steps of: S3a: Providing primary functional information (l-PF) based on the operating state of the primary electrical consumer (2) and providing secondary functional information (l-SF) based on the operating state of the secondary electrical consumer (4); S4a: if the primary function information (l-PF) indicates a faulty operating state of the primary electrical load (2), activate the primary switching arrangement (8) of the primary circuit (12) with the primary control device (16) or with the secondary control device (18) to interrupt the current flow from the main power source (6) to the primary circuit (12); and S5a: if the secondary function information (l-SF) indicates a faulty operating state of the secondary electrical load (4), controlling the secondary switching arrangement (10) of the secondary circuit (14) with the primary control device (16) or with the secondary control device (18) to interrupt the current flow from the main power source (6) to the secondary circuit (14), preferably further comprising, following S4a, the step: S4b: Supplying the primary circuit (12) with electrical energy through a primary energy storage unit (44); and / or following S5a the step: S5b: Supplying the secondary circuit (14) with electrical energy by means of a secondary energy storage unit (46); and / or preferably further comprising the step: S6: If a source fault (FQ) is detected at the main power source (6), the primary switching arrangement (8) of the primary circuit (12) is activated by the primary control device (16) or by the secondary control device (18) to interrupt the power supply with energy from the main power source (6) of the primary circuit (12), and the secondary switching arrangement (10) of the secondary circuit (14) is activated by the primary control device (16) or by the secondary control device (18) to interrupt the power supply with energy from the main power source (6) of the secondary circuit (14).

14. Method according to one of claims 12 or 13, further comprising the steps for testing the functionality of the redundancy switching system (1): S10: Closing the primary circuit (12) with the primary switching arrangement (8); S20: Receiving primary circuit information (l-PS) of the primary circuit (12); S30: Simultaneous activation of a first primary switch (20) and a second primary switch (22) of a primary changeover switch (28) of the primary circuit (12); S40: Comparison of primary circuit information (l-PS) before and after switching, S50: Closing the secondary circuit (14) with the secondary switching arrangement (10); S60: Receiving secondary circuit information (l-SS) of the secondary circuit (14); S70: Simultaneous actuation of a first secondary switch (24) and a second secondary switch (26) of a secondary changeover switch (30) of the secondary circuit (14); and S80: Comparison of the secondary circuit information (l-SS) before and after switching; and preferably further comprising the steps: S40a: Output of a primary fault message (P-FM) if the primary circuit information (l-PS) compared in S40 differs from each other before and after switching by a predetermined primary threshold (P-SW). S80a: Output of a secondary fault message (S-FM) if the secondary circuit information (l-SS) compared in S80 differs from each other before and after switching by a predetermined secondary threshold (S-SW).

15. Vehicle (100) comprising a redundant switching system (1) for supplying electrical power to at least one primary electrical consumer (2) in the vehicle (100) and a secondary electrical consumer (4) in the vehicle (100), wherein the redundant switching system (1) is configured according to one of claims 1-11, wherein preferably the primary electrical consumer (2) is an electrical consumer from a group comprising: - an electromechanical brake unit, an electric steering system, an on-board electronics system, a lighting system, a driver assistance system, a pneumatic or hydraulic brake system, a stability control system, a sensor cleaning system, a fuel cell system, a compressed air generation system, a compressed air preparation system, an air suspension system, a clutch system, a transmission control system, a vehicle fleet management system, a vehicle drive system; and wherein preferably the secondary electrical consumer (4) is another or a redundant electrical consumer from the group.

Images