DE102023201504A1 - Device for supplying energy to a safety-relevant consumer in a motor vehicle - Google Patents

Abstract

The invention relates to a device for supplying energy to a safety-relevant consumer in a motor vehicle, wherein at least one switch (61, 62, 63) is provided in a supply path (64) for supplying the safety-relevant consumer (16), comprising at least one first monitoring device (140) for monitoring at least the supply path (64) for the safety-relevant consumer (66), comprising a further monitoring device (142) independent of the first monitoring device (140) for monitoring at least the supply path (64) and/or a further supply path (64) for the safety-relevant consumer (66), wherein the monitoring devices (140, 142) independently monitor at least one electrical characteristic of the supply path (64) and/or the further supply path (64) for a fault and compare each with a limit value (84, 130), wherein a plausibility check is provided in order to generate a shutdown signal (114,116) for the switch (61, 62, 63) when both output signals (92, 108) of the monitoring devices (140, 142) indicate that the respective limit value (84,130) has been reached and thus that an error has occurred, wherein the monitoring devices (140,142) each comprise at least one measuring amplifier (78,124) for detecting the respective characteristic variable, at least one comparator (82,128) to which an output variable of the respective measuring amplifier (78, 124) is fed, and a storage element (88,134) to which an output variable of the comparator (82,128) is fed.

Description

The invention relates to a device for supplying energy to a safety-relevant consumer in a motor vehicle according to the preamble of the independent claim.

State of the art

From the EN 102019205800 A1 A supply network output and a method for operating a supply network are known. The supply network output is designed for a nominal current and comprises n switches that are sufficient to carry the nominal current, with an additional switch being provided, so that a total of n+1 switches are provided that are arranged in parallel with each other, with each switch being assigned a driver, where: n >= 2.

From the DE 102020107695 A1 A method for configuring an on-board network of a motor vehicle is known, wherein at least one consumer is provided in the on-board network, wherein, as part of the configuration of the on-board network, at least one of the at least one consumers is assigned an electrical module, which in turn is selected from a module group, wherein, when selecting the electrical module, a first consumer criterion relating to a supply requirement of the at least one consumer and a second consumer criterion relating to a degree of reaction of the at least one consumer are taken into account.

The invention is based on the object of specifying a device which further increases the reliability of a power supply with a simple structure. The object is achieved by the features of the independent claim.

Disclosure of the invention

Because the monitoring devices each comprise at least one measuring amplifier for recording the respective characteristic value, at least one comparator to which an output value of the respective measuring amplifier is fed, and a storage element to which an output value of the comparator is fed, redundant operation can be achieved in a simple manner. Safety-relevant consumers are only switched off if higher-level safety objectives require it, for example for reasons of component protection or line protection. This means that a safe supply is achieved against single faults while maintaining the safety objective. A single fault in a switch does not lead to the immediate shutdown of the supply path or the consumer. This leads to low overall costs with the same reliability and safety level.

In a practical further development, at least two or three switches connected in parallel are provided for supplying and protecting the safety-relevant consumer. This allows the supply reliability of the safety-relevant consumer to be further increased through a possible redundant supply.

In an expedient development, at least one measuring device, in particular a measuring resistor or an inductive measuring device, preferably two or three measuring devices such as measuring resistors connected in parallel, is provided in series with the switch and/or in series with at least two or three switches connected in parallel. This makes it possible to implement a redundant measuring concept. The provision of at least two, possibly even three switches also ensures the security of supply, in particular of a safety-relevant consumer, even if at least one switch is accidentally switched off.

Instead of a measuring resistor, other current measuring methods such as inductive measuring methods can also be used.

In an expedient further development, the potential difference at the measuring resistor and/or at the switch is fed to the measuring amplifier, in particular via at least one resistor. This makes it possible to achieve single-fault safety in particular.

In an expedient further development, it is provided that the potential differences at at least two measuring resistors are each fed to the measuring amplifier and/or that the potential differences at at least one measuring resistor and at least one switch are each fed to the measuring amplifier and/or that the potential differences at at least two switches are each fed to the measuring amplifier. This allows redundant monitoring to be carried out for different circuit designs. Safety can be further increased.

In a practical further development, a limit value is fed to the comparator. This is particularly preferably a constant or static and/or a dynamically adjustable limit value. The constant limit value can be set either discretely (for example by means of a voltage divider) or by another microcontroller. The constant limit value represents a fallback level in the event of a fault in the dynamic dynamic limit value (for example, selection of the microcontroller). The dynamic limit value is set by a microcontroller, which preferably cannot be secured. The dynamic limit value can be used to easily adapt to the respective operating situation.

In an expedient further development, at least two independent supplies are provided, with one comparator and/or the measuring amplifier being supplied by one supply, and the other comparator and/or the other measuring amplifier being supplied by the other supply. This means that errors in the power supply do not lead to the complete failure of the entire monitoring equipment, which means that no shutdown is triggered and operational separation is still possible.

In an expedient further development, the output signals of the memory elements are fed to a logical connection, in particular an AND gate, for plausibility check or verification. This allows a particularly simple implementation of the plausibility check or verification.

In an expedient further development, at least two independent control devices or logic units are provided for generating a control signal for the driver(s). This further increases the reliability against single errors.

Further useful developments arise from further dependent claims and from the description.

Short description of the drawing

• die 1 beispielhaft ein Ausführungsbeispiel des Leistungsverteilers, der zwei Teilbordnetze miteinander verbindet,
• 2 ein Blockschaltbild einer fehlersicheren Energieversorgung eines Ausgangs für einen insbesondere sicherheitsrelevanten Verbraucher,
• 3 ein erstes Ausführungsbeispiel für eine redundante einfachfehlersichere Strommessung und eine Latentfehlererkennung des Schalters,
• 4 ein zweites Ausführungsbeispiel für eine einfachfehlersichere Strommessung,
• 5 ein drittes Ausführungsbeispiel für eine einfachfehlersichere Strommessung,
• 6 ein der Variante nach 2 ähnliches Ausführungsbeispiel einer einfachfehlersicheren Strommessung,
• 7 ein detailierteres Ausführungsbeispiel einer einfachfehlersicheren Strommessung sowie
• 8 eine schematische Darstellung der redundanten Betriebsführung.

Show it

• the 1 an example of an embodiment of the power distributor that connects two sub-board networks,
• 2 a block diagram of a fail-safe power supply of an output for a particularly safety-relevant consumer,
• 3 a first embodiment of a redundant single-fault-safe current measurement and a latent error detection of the switch,
• 4 a second embodiment for a single-fault-safe current measurement,
• 5 a third embodiment for a single-fault-safe current measurement,
• 6 a variant according to 2 similar embodiment of a single-fault-safe current measurement,
• 7 a more detailed example of a single-fault-safe current measurement and
• 8 a schematic representation of the redundant operational management.

Embodiment of the invention

The invention is illustrated schematically using an embodiment and is described in detail below with reference to the drawing.

The 1 shows a possible topology of an energy supply system, consisting of an on-board network 13, which includes an energy storage device 12, in particular a battery 12 with associated sensor 14, preferably a battery sensor, and several, in particular, safety-relevant consumers 16, which are supplied and protected by an electrical power distributor 18. The consumers 16 are special consumers with high requirements or a high need for protection, generally referred to as safety-relevant consumers 16. These are, for example, an electric steering and/or a braking system as components that absolutely have to be supplied in order to ensure that the vehicle can be steered and/or braked in the event of a fault. Characteristics of the respective consumer 16 are recorded separately and the respective switch 15 is opened if there is a deviation from tolerable values. The on-board network 13 consists of a safety-relevant sub-network 11 and a non-safety-relevant sub-network 10. The safety-relevant sub-network 11 can be separated from the non-safety-relevant sub-network 10 by the power distributor 18, in particular in the event of a fault or a critical state of the non-safety-relevant sub-network 10. The safety-relevant sub-network 11 is, for example, a sub-network 11 qualified according to ASIL, in particular ASIL C (for example according to DIN ISO26262), which includes at least one of the safety-relevant consumers 16 and can optionally be equipped with its own energy storage device 12 for voltage support. The non-safety-relevant sub-network 10 includes at least one non-safety-relevant consumer 17, for example it can be a so-called QM consumer or consumer whose safety integrity is classified as QM. However, it is not excluded that at least one other safety-relevant consumer in the non-safety-relevant sub-network 10, for example in the case of a redundant design of the safety-relevant consumers. The non-safety-relevant sub-network 10 is a non-ASIL qualified on-board network.

The energy storage device 12 is connected to a connection (terminal KL30_1) of the power distributor 18. The sensor 14 is able to detect an electrical parameter such as a voltage Ub at the energy storage device 12 and/or a current Ib through the energy storage device 12 and/or a temperature Tb of the energy storage device 12. The sensor 14 can determine, for example, the state of charge SOC of the energy storage device 12 or other parameters of the energy storage device 12 from the determined electrical parameters Ub, Ib, Tb. At the other connection (KL 30_1) of the power distributor 18, to which the energy storage device 12 is also connected, a further supply branch for at least one further consumer 25 can optionally be provided. The consumer 25 is protected, for example, by a fuse 23. Other consumers 25 can also be provided, which can also be protected by fuses 23. These consumers 25 are those that should still be supplied with energy from the energy storage device 12 even when the switching device 19 in the power distributor 18 is disconnected or opened, preferably those safety-critical consumers 25 that are critical with regard to disruptions in relation to the security of supply or consumers classified as QM that must meet certain requirements after an accident. An (optional) safety-relevant or safety-critical on-board network path or sub-on-board network 11 is therefore connected to the connection KL 30 _1.

The power distributor 18 can be able to determine corresponding parameters such as voltage Uv, current Iv of the consumers 16. The power distributor 18 can determine corresponding parameters of the energy storage device 12 such as voltage Ub and/or current Ib and/or temperature Tb. For this purpose, the power distributor 18 could contain the corresponding sensors or receive the data from the sensor 14. The power distributor 18 also has corresponding evaluation means 21 such as a microcontroller 21 to store or evaluate recorded variables. The evaluation means 21 is used to determine critical states, in particular of the safety-relevant sub-vehicle network 11, such as detecting an overcurrent and/or an undervoltage or overvoltage on the sub-vehicle network 11 for the safety-relevant consumer 16, 25. For this purpose, corresponding parameters are recorded and compared with suitable threshold values. A microcontroller, for example, is used as the evaluation means 21. The microcontroller or the evaluation means 21 is also able to control corresponding switch units 15 as described in more detail below. A switching unit 15 supplies the safety-relevant consumer 16 connected to it with energy provided via a distribution point, for example busbar 60 or backbone, or with the supply voltage U1 via an output 66. For example, three switching units 15 are provided, each of which supplies the corresponding safety-relevant consumers 16 with energy via the outputs 66.

Optionally, a disconnector 19 can be arranged in the power distributor 18 between terminal KL30_0 and terminal KL30_1. The optional disconnector 19 can be used to implement a corresponding disconnection or coupling function, in particular of the two on-board network branches (partial on-board network 10 for non-safety-relevant consumers 17 at connection KL 30_0; further partial on-board network 11 for safety-relevant consumers 16, 25). This serves in particular as a safety function to prevent the effects of critical conditions such as overvoltage or undervoltage and/or overcurrent and/or thermal overload. In the event of a fault, the two partial on-board networks 10, 11 can be separated from one another by the power distributor 18 by opening the disconnector 19. The disconnector 19 could include parallel-connected switching means for a fail-safe supply. The redundant monitoring or control described in more detail below could also be used for the disconnector 19.

The on-board network 13 has a lower voltage level U1 than an optionally provided high-voltage on-board network 20; for example, it can be a 14 V on-board network. A DC-DC converter 22 is arranged between the on-board network 13 and the high-voltage on-board network 20. The high-voltage on-board network 20 includes, for example, an energy storage device 24, for example a high-voltage battery, possibly with an integrated battery management system, shown as an example a load 26, for example a comfort consumer such as an air conditioning system or refrigerant compressor etc. supplied with an increased voltage level, and an electric machine 28. In this context, high voltage is understood to mean a voltage level U2 that is higher than the voltage level U1 of the basic on-board network 13. For example, it could be a 48-volt on-board network. Alternatively, especially in vehicles with electric drives, it could be even higher voltage levels, for example 400 V or 800 V. Alternatively, the high-voltage electrical system 20 could be omitted entirely.

By way of example, a battery or accumulator is described in the embodiment as a possible energy storage device 12, 24. Alternatively, however, other energy storage devices suitable for this task, for example on an inductive or capacitive basis, fuel cells, capacitors or similar, can be used in the same way.

The embodiment according to 2 discloses, by way of example, a switch unit 15 (or possibly a disconnector 19) with at least one, possibly two, preferably three switches 61, 62, 63 connected in parallel, via which the connection 66 for a safety-relevant consumer 16 can be supplied and secured with energy provided by an energy supply 60, in particular supply voltage U1. Each of the switches 61, 62, 63 connected in parallel is in each case part of a supply path 64. Between the energy supply 60, in particular a backbone (distribution point with supply line or busbar in an on-board network of a motor vehicle), and the switches 61, 62, 63 connected in parallel, at least one and, depending on the power requirement, two measuring resistors 70, 72 connected in parallel are provided. Alternatively, other measuring means, for example inductive, etc., could also be used.

At the first measuring resistor 70, the respective potentials before and after the measuring resistor 70 are fed via series resistors 74, 76 to a measuring amplifier 78 (current measurement via a current amplifier or CSA (Current Sense Amplifier)). The series resistors 74, 76 are not absolutely necessary, but they prevent reflections (signal interference). This is a so-called series termination. The measuring amplifier 78 is supplied with energy via a supply input 80 with a supply voltage 89, preferably with a first supply voltage V1 (logic supply or logic voltage: for example voltages of 5 V or 3.3 V, etc.).

The performance of the channel is ensured by providing at least two measuring devices or measuring resistors 70, 72 connected in parallel. There is also single-fault safety in the event of an open failure of a measuring resistor 70, 72. The open failure of a measuring resistor 70, 72 does not trigger the overcurrent shutdown by raising the maximum shutdown threshold. With two measuring resistors 70, 72, the shutdown threshold could be raised by 100%, with three measuring resistors 70, 72, 73 by 50%, and with four measuring resistors 70, 72, 73 by 33.3%. For example, the shutdown threshold could be increased to 240 A with three measuring resistors 70, 72, 73 at a peak current of 160 A. For a holistic system design, it is necessary to be able to diagnose an open failure of a measuring resistor 70, 72, 73. Due to the typical function execution times of current microcontrollers and operating systems, functions are usually executed in 5 ms or 10 ms cycles. The switches 61, 62, 63 or switch unit 15 are therefore subject to the additional requirement of carrying a current that is, for example, 50% higher without restrictions for around 10-20 ms. If an open failure of a measuring resistor 70, 72 is detected, the higher-level vehicle system is informed or warned by means of an error message in order to be able to carry out further measures such as degrading the consumer in question.

The output signal of the measuring amplifier 78 is fed to a comparator 82, for example as shown in 2 shown at its plus input. This output signal of the measuring amplifier 78 is compared with a limit value 84, which is fed to the negative input of the comparator 82. In general, the comparator 82 compares the two input signals with each other. If the difference between the two signals (voltages) is either positive or negative, the output of the comparator 82 changes its polarity. The comparator 82 is used to detect an overcurrent through the measuring resistor 70 or the measuring resistors 70, 72.

Appropriate circuits can be used to generate the limit value 84, 130. To ensure functional safety, adequate measures must be taken to prevent changes in the limit value 84, which would lead to a change in polarity at the output of the comparator 82 if the measured variable remained the same. For this purpose, the limit value 84, 130 could, for example, be formed from two reference sources. One of the limit values 84, 130 could be specified by a microcontroller 21, for example by means of a PWM signal and low-pass filter or by means of a digital-analog output (DAC). The other limit value 130 should be implemented by an independent reference source. A discrete circuit can be used for this, for example by means of a voltage divider, Zener diode or by means of integrated circuits (for example a band gap reference). The reference sources must be supplied from different and independent voltage sources (or supplies 89, 131). It is also conceivable to supply each reference source from both supply voltages 89, 131. Both supply voltages 89, 131 must be non-interacting with each other and, for example, via diodes and/or resistors (current limiting) or generally via an element to ensure non-interacting 141 (cf. 7 ) are coupled in. Both reference signals for generating the limit value 84, 130 must be superimposed in such a way that a minimum threshold or minimum limit value 84, 130 remains after the failure of a reference source. It is also possible, for example, to dynamically change the limit value 84, 130 using a microcontroller 21. This makes it possible to react to vehicle system specifications and/or compensate for component-specific changes (for example due to temperature drift). As a result, simple errors such as the failure of the limit value 84 provided by the microcontroller 21 or the failure of the second limit value 130 provided, for example, by a discrete circuit, do not lead to the power stage or switches 61, 62, 63 being switched off.

The comparator 82 is supplied with a supply voltage 89, 131, preferably with the first supply voltage V1, via a supply input 86. An output signal 87 of the comparator 82 is fed to a storage element 88, for example a flip-flop. The storage element 88 could also be implemented as software. If the measured difference at the measuring resistor 70 and 72 is above or, depending on the method used, below the corresponding limit value 84, the comparator 82 generates a corresponding output signal 87 (for example, overcurrent detected; switching unit 15 opens "off" for protection) or a change in the logical state of the output signal 87. If an overcurrent is detected, the output signal 87 leads to a change in polarity at the output 92 (this can mean, for example, an overcurrent detected at the measuring resistor 70; as a result, the switching unit 15 should open for protection). A reset of the output 92 of the memory element 88 could, for example, be done via the microcontroller 21.

The memory element 88 has a supply input 90, via which the memory element 88 is supplied with a supply voltage 89, preferably with a redundant supply voltage. The output signal 92 of the memory element 88 is fed to a driver 94. The output signal 92 of the memory element 88 is the off signal, which causes the respective switches 61, 62, 63 to be switched off (opened) in the event of an overcurrent via a respective output signal 114, 116 of the driver 94. Plausibility checks can be provided as part of the driver 94, via which it is determined whether the switching unit 15 with associated switches 61, 62, 63 should actually be switched off. In the following embodiments, this plausibility check can be carried out by a corresponding logical AND operation (in the following embodiments, AND operations designated 180 or 230) with further signals, in the embodiment according to 2 for example, with an output signal 108 of a further memory element 134 as described below. This plausibility logic is in the embodiment according to 2 integrated in the driver 94. At least the memory device 88, at least the comparator 82 and at least the measuring amplifier 78 are components of a monitoring device 140 indicated as a block.

A driver voltage is supplied to the driver 94 via an input 96 and/or a further driver voltage, independent of the driver voltage supplied via the input 96, is supplied via a further input 98. Both supply voltages, also referred to as auxiliary voltages 137, 139, must be connected to one another without any feedback.

In addition, the driver 94 generates further output signals 110, 112, which cause the respective switches 61, 62, 63 to be switched on. The output signal 110 activates the first switch 61, the output signal 112 activates the second switch 62, etc. In addition, the driver 94 generates corresponding output signals for switching off the respective switches 61, 62, 63. The output signal 114 is used to switch off the first switch 61, the output signal 116 is used to switch off the second switch 62, etc. This is done via the respective drivers 67, 68, 69 for the respective switches 61, 62, 63.

If necessary, a temperature shutdown can also be carried out in the event of an overtemperature via the driver(s) 67, 68, 69. For this purpose, a corresponding temperature detection 118 of the switching unit 15 can optionally be provided.

A redundant input signal 102 is generated for the driver 94 and made available to the driver 94 via an element 100 (for generating a redundant input signal "On"), for example another microcontroller, a register memory or the like. The input signal 102 can be a switch-on signal (On) for the switching unit 15. An output signal from the microcontroller 21 can be fed to the element 100 via an input 104. In addition, a further input signal 106 is provided for the driver 94, which can be provided by the microcontroller 21, namely a switch-on signal (On) for the switching unit 15. The two switch-on signals 102, 106 are ORed with one another. If there is at least one switch-on request via one of the signals 102, 106, the driver stage 94 generates corresponding switch-on signals 110, 112 for the switches 61, 62, 63.

The current flowing between the power supply 60 and the output 66 is detected redundantly. In the exemplary embodiment, redundant detection (in addition to detection via the measuring resistor 70) is carried out by detecting the current flowing between the branching points of the switches 61, 62, 63, i.e. the current flowing via the switching unit 15. The potentials before and after the parallel connection of the switches 61, 62, 63 are each fed to a further measuring amplifier 124 via the resistors 120, 122. The measuring amplifier 124 in turn has a supply input 126, via which the further measuring amplifier 124 is supplied with energy using a supply voltage 131, preferably a further supply voltage V2.

The output signal of the further measuring amplifier 124 is fed to a (further) comparator 128. The comparator 128 compares the supplied output signal with a limit value 130 that is made available to the comparator 128 at its input. The comparator 128 is used to detect overcurrent of the current flowing through the switching unit 15 if this exceeds the limit value 130. The limit value 130 to increase the single fault safety can in turn be formed from two shutdown thresholds. For example, one of the shutdown thresholds could be specified by the controller 21. The further shutdown threshold could be specified by another hardware circuit, possibly supplied by another supply voltage V2. Appropriate circuits can be used to generate the limit value 84, 130. To fulfill functional safety, the change in the limit value 84, which leads to a change in polarity at the output of the comparator 82 when the measured variable remains the same, must be prevented with sufficient measures. For this purpose, the limit value 84, 130 could be formed from two reference sources, for example. One of the limit values 84, 130 could be specified by a microcontroller 21, for example by means of a PWM signal and low-pass filter or by means of a digital-analog output (DAC). The other limit value 130 should be implemented by an independent reference source. A discrete circuit can be used for this, for example by means of a voltage divider, Zener diode or by means of integrated circuits (for example band gap reference). Both specification options are, for example, via the element 141 (as shown in the example in 7 shown) to ensure freedom from feedback, for example via diodes and resistors, to a voltage divider, which provides the corresponding voltage signal for the overcurrent threshold to the input of the comparator 128. As a result, single errors such as a failure of the limit value 84, 130 provided by the microcontroller 21 or the failure of the limit value 84, 130 provided by the other hardware do not lead to a shutdown of the power stage or switches 61, 62, 63.

The comparator 128 comprises a supply input 132, via which the comparator 128 is supplied with the supply voltage 131, in particular with the further supply voltage V2. If the output signal at the measuring amplifier 124 reaches the limit value 130, the comparator 128 generates a corresponding output signal 133, which is fed to a further storage element 134, in particular a flip-flop, and leads to a setting of the corresponding output 108 (switching off the switching unit 15 "off"). The further storage element 134 is supplied with energy via a supply input 136 with a supply voltage 131, in particular with the further supply voltage V2. The output signal 108 of the further storage element 134 is in turn fed to the driver 94. If the total current flowing through the switches 61, 62, 63 reaches a certain limit value 130, a corresponding off signal 108 is generated and fed to the driver 94. If both shutdown signals 92, 108 are present, the control signals for the switches 61, 62, 63 are deactivated via the driver 94. The shutdown signals 92, 108 and certain diagnostic mechanisms can be used for further diagnosis and plausibility checks of the cause of the error. At least the further storage device 134, at least the further comparator 128 and at least the further measuring amplifier 124 are components of a further monitoring device 142 indicated as a block.

The plausibility of the switch-off request 108 is checked via the output signal 92 of the storage element 88 and vice versa. If both output signals 92, 108 of the storage elements 88, 134 signal a switch-off request, the switch unit 15 is switched off. When using field effect transistors or MOSFETs as switching elements 61, 62, 63, the plausibility or, if necessary, further plausibility of an error detected via the measuring resistor 70 can be carried out using the resistance between drain and source Rds on the MOSFET via the described measurement and software evaluation. It may be possible to dispense with the measurement via the switch (RDSon measurement) completely. In order to meet certain safety requirements, measurements could be taken twice via the measuring resistors 70, 72, as for example in 4 shown. The switch diagnosis could then be carried out via an extended gate driver, which can switch the switches 61, 62, 63 on and off individually. This makes it possible to test whether the individual switch 61, 62, 63 can be blocked each time it is switched off.

In the embodiment according to 2 a redundancy concept of the switches 61, 62, 63 is implemented, which is characterized by the provision of a further switch 63 in addition to the switches 61, 62 connected in parallel. The switching elements 61, 62 represent the necessary current carrying capacity from a power electronics perspective. Due to the optimized switching process and single-fault-safe design, complete redundancy of all required elements is not necessary. A critical single fault is the open failure of one of the switching elements 61, 62 or 63. With the circuits proposed here, the assurance of freedom from feedback and decoupling of the respective single faults, the most critical single fault leads to the loss of a switch 61, 62, 63 at most. The switches 61, 62, 63 are power semiconductors such as field effect transistors (MOSFETs), IGBTs or similar.

The operation is redundant. By ORing (logical OR operation) the switch-on request (“On” according to signals 102, 106) and ANDing (logical AND operation) the switch-off request (“Off” according to output signals 92, 108) of the switch unit 15, it is also ensured that the consumer 16 or output 66 for the consumer is only switched off if higher-level safety objectives require it (for example, component protection, line protection, etc.). This ensures compliance with the safety objective of “safe supply” with the appropriate integrity. The concept described leads to low overall costs with the same reliability or the same safety level.

An element 141 to ensure freedom from feedback and decoupling (see for example 7 ) can have two branches of series-connected resistors and diodes, with the two branches connected to each other on the output side. The diodes are connected in such a way that they only allow current to flow from the input side, namely from the two input signals to be linked, to the output side. This ensures that there is no interference. The resistors are intended to limit the current and are dimensioned accordingly depending on the requirements.

In addition, the concept provides for a technical implementation of a single-fault-safe current measurement with latent error detection, whereby a single error in the current measurement does not lead to a violation of the safety objective of "safe supply". In addition, a latent error of the switches 61, 62, 63 in the power stage can be detected. In the following 3-6 Possible variants of current measurement are shown in order to be safe from (unjustified) rapid shutdown in the event of simple errors.

The embodiment according to 3 is characterized by three parallel-connected measuring resistors 70, 72, 73, which are each arranged between the power supply 60 or the connection for a power supply line and the branching point of the several parallel-connected switching means 61, 62, 63. The potential before and after the measuring resistors 70, 72, 73 is respectively led via the resistors 74, 76 to the measuring amplifier 78 (current measuring amplifier CSA) and via the resistors 174, 176 to the further measuring amplifier 178 (current measuring amplifier CSA). The output signal 79 of the measuring amplifier 78 and the output signal 179 of the measuring amplifier 178 reach the logic component 180, namely an AND connection. The logic component 180 generates an output signal 182 (off command) from the two input signals 79,179 if both output signals 79,179 indicate a switch-off request (off command in each case). In this way, a plausibility check is carried out so that unauthorized switching off of the switching unit 15 can be prevented. In addition, by evaluating the switch-off signals 79, 179, for example by means of measurement by the microcontroller 21, it can be concluded that there is a hardware error in the case of different signal states. However, further information is available, for example by means of another current measurement as in 3 shown, required in order to be able to determine the exact cause of the error. The evaluation of the cause of the error must be carried out using the process of elimination and software developed for this purpose. This significantly increases the reliability of the overall system and suitable measures can be introduced at vehicle level, for example driver warning, reducing the power of the affected consumers, etc.

The output signal 182 can in turn be fed to the driver 94. By ANDing the two signals 79, 179, a single error in the current measurement does not lead to the faulty switching off of the switches 61, 62, 63. Frequently occurring errors are, in particular, maximum deflections of the measured values. This can, for example, lead to the following error pattern. For example, if a measuring amplifier 78 outputs the minimum or maximum possible value and the other measuring amplifier 178 outputs a value that differs significantly from this, it cannot be clearly determined which path is faulty. The switch-off will not be triggered if the signals 79, 179 are in different states and thus prevents the opening of the switches 61, 62, 63 in the event of the error patterns (maximum value deflection (stuck to high) and minimum value deflection (stuck to low). or the channel, thereby ensuring the integrity of the security objective.

As already shown in the example according to 2 A measurement of the current flowing between the branching points of the parallel-connected switches 61, 62, 63 is also described. The potentials at the branching points of the switches 61, 62, 63 are each fed via resistors 120, 122 to the measuring amplifier 124, which generates an output signal 125. This current measurement and generation of the output signal 125 serves for diagnosis and thus also for latent error detection of the switching elements 61, 62, 63, so that safe separation and safe supply can be ensured. The embodiment according to 3 is thus characterized by an advantageous detection of simple errors and latent errors. As already optionally in connection with the embodiment according to 2 described three current measuring amplifiers 78, 124, 178 are required. By providing a third measured variable 125, a diagnostic function can determine the cause of the error and initiate specific measures. Again, at least the monitoring device 140 and the further monitoring device 142, each of which includes the memory device 90, 134 (not shown separately), at least the comparator 82, 128 (not shown separately) and at least the measuring amplifier 78, 124, 178, are included for redundant monitoring of the corresponding measured variables.

The embodiment according to 4 differs from that according to 3 merely in that current detection at switches 61, 62, 63 is no longer provided, while redundant current detection is carried out via two (of the three) measuring resistors 70, 72 connected in parallel using two measuring amplifiers 78, 178. Due to the AND connection in logic component 180, a single error in the current measurement still does not lead to the channel being opened, which means that the integrity of the safety objective is still ensured. The switching unit 15 is only opened if there is an overcurrent at the measuring resistors 70, 72 and it is detected by means of the measuring amplifiers 78, 178. Again, three measuring resistors 70, 72, 73 connected in parallel are provided. If it is assumed that the performance can also be achieved with fewer measuring resistors, then it is possible to reduce the number of measuring resistors to one measuring resistor. However, the dependency of the ASIL integrity must be checked here to see whether an additional measuring resistor may need to be used for redundancy reasons. 4 In the variant shown, the measurement via the switches 61, 62, 63 is missing. Therefore, in order to be able to clearly diagnose the isolating capability of the power switches 61, 62, 63, it is necessary to integrate a driver with individual control. Again, at least the monitoring device 140 and the further monitoring device 142, which each comprise the memory device 80, 134 (not shown separately), at least the comparator 82, 128 (not shown separately) and at least the measuring amplifier 78, 178, are included for redundant monitoring of the corresponding measured variables.

In the embodiment according to 5 the current flowing through the switches 61, 62, 63 is redundantly recorded. The potentials at the branching points are each fed via resistors 220, 222 to a further measuring amplifier 224, which generates an output signal 225. As already mentioned in 4 As explained, it is also provided that the potentials at the branching points of the switches 61, 62, 63 are fed via resistors 120, 122 to the measuring amplifier 124, which generates the output signal 125 from this. The output signals 125, 225 of the respective measuring amplifiers 124, 224 in turn reach a logic component 230, namely an AND connection, from which an output signal 231, in particular an off signal, is generated. Only when both output signals 125, 225 are active is a corresponding output signal 231 generated, which leads to the switching unit 15 being switched off. This output signal 231 is forwarded, for example, to the driver 94. Again, a single error in the current measurement (for example, stuck to high, drift) does not lead to the opening of the channel or all supply paths 64, since the two output signals 125, 225 are again AND-linked. This ensures the integrity of the safety target. As in 5 As indicated, the potentials for the measuring amplifier 224 are tapped close to the switch 61, while the potentials for the measuring amplifier 124 are tapped close to the switch 63. Again, at least the monitoring device 140 and the further monitoring device 142, which each comprise the memory device 80, 134 (not shown separately), at least the comparator 82, 128 (not shown separately) and at least the measuring amplifier 124, 224, are included for redundant monitoring of the corresponding measured variables.

In the embodiment according to 6 The current measurement is carried out by means of a measuring amplifier 178 via the measuring resistor 72 and the measuring amplifier 124 via the switches 61, 62, 63. The potentials before and after the measuring resistor 72 are each fed via the resistors 174, 176 to the measuring amplifier 178, whose output signal 179 is fed to the logic module 180 (AND gate). The potentials before and after the branching points of the switches 61, 62, 63 via the respective resistors 120, 122 to the measuring amplifier 124, whose output signal 125 also reaches the logic module 180. The two output signals 125, 179 are logically AND-linked and the output signal 181 ("Off") is generated from this. The output signal 181 can also be made available to the driver 94. Due to the AND-linking of the output signals 125, 179, a single error in the current measurement does not lead to the opening of the channel or the supply paths 64 of the switch unit 15, thereby ensuring the integrity of the safety objective. In addition, the low impedance of the switch 61, 62, 63 can be monitored by measuring in particular the resistance between drain and source (RDS(on)) in a field effect transistor or MOSFET. This low resistance between the input and output of the channel ensures that the safety objective of safe supply is not violated. The exemplary embodiment is characterized by a small number of components required for monitoring, whereby both simple errors and latent errors are nevertheless reliably detected. Again, at least the monitoring device 140 and the further monitoring device 142, which each comprise the memory device 80, 134 (not shown separately), at least the comparator 82, 128 (not shown separately) and at least the measuring amplifier 124, 178, are included for redundant monitoring of the corresponding measured variables.

The embodiment according to 7 is based on the monitoring concept according to 4 The monitoring device 140 comprises the measuring amplifier 78, the comparator 82 and the storage element 88. The limit value is formed by a voltage divider 232, redundantly supplied by supplies 89, 131, non-reactively coupled to one another via the element 141, and fed to one input of the comparator 82. The further monitoring device 142 comprises the measuring amplifier 178, the further comparator 128 and the storage element 134. The limit value of the further comparator 128 is redundantly supplied by the supply 89, 131 via a voltage divider 232. Corresponding output signals of the measuring amplifiers 82, 178 are also tapped and fed to the microcontroller 21 for further evaluation.

In the block diagram according to 8 The underlying concept for meeting the requirements of safe supply and safe separation with the appropriate integrity is summarized. The redundant operation is characterized by at least two independent and mutually non-reactive and decoupled control paths of the switching elements 61, 62, 63. For this purpose, all necessary supply voltages 89, 131 or auxiliary voltages 137,139, if these could cause a safety objective to be violated due to failure, must be implemented redundantly. In addition, all in 8 listed components with one or both of the redundant sources. In the concept shown here as an example, each source is connected via an element 141 to ensure freedom from feedback and decoupling. This prevents feedback and suppresses further cross effects. The microcontroller 21 as the main processor is supplied with the required operating and reference voltages, for example, from the sources of the supply 89 and another auxiliary computer 100 from the sources of the additional supply 131.

The embodiment according to 8 is characterized by a highly integrated driver circuit. This means that the number of components required for control can be reduced to a minimum. In addition, the introduction of a pulse driver stage 146 and a maintenance driver stage 144 enables the non-reactive use of the auxiliary voltage supplies. A single error, for example a short circuit of the gate (driver 67, 68, 69) of a power semiconductor (switch 61, 62, 63) to source, still leads at most to the loss of one of the switches 61, 62, 63, whereby the remaining switches 61, 62 are still available. A single error of the switch-off signal 92, 108 does not lead to the switching unit 15 being switched off. A single error in the event of a failure of the microcontroller 21 does not lead to the channel being switched off, since the switch-on signal 102 is buffered in the auxiliary computer or register 100.

This ensures that the supply paths 64 remain active even if a supply unit fails, in particular if a main source fails. For this purpose, all circuit elements must be supplied from the first supply 89 and from the further supply 131. This also ensures that the consumer 16 connected to the connection 66, in particular the safety-relevant consumer, is reliably connected to the main distribution or energy supply 60 with the required integrity.

For both supplies 89, 131 in 7 it is recommended to use heterogeneous (inhomogeneous) redundancy concepts. This could, for example, require the use of two different conversion units (linear, DC/DC, etc.). By connecting the respective circuit units (e.g. generation of switch-on signal, drivers, registers, microcontrollers, auxiliary voltages, logic voltages, etc.) via element 141 to Ensuring freedom from feedback and decoupling prevents errors in one of the supplies 89, 131 or in one of the connected components or elements from having negative effects on one of the common supplies 89, 131.

The two supplies 89, 131 can be designed with different power levels, since the additional supply voltages connected to them are connected in such a way that the supply path 64 can maintain emergency operation if necessary, but does not guarantee commissioning or rapid switching on (for example due to a high-impedance and a low-impedance connection to one of the two supplies 89, 131). In the event of a single error, one of the two sources can therefore always be used.

It is also possible to optimize one of the two supplies 89, 131 for a low quiescent current consumption. This can be particularly advantageous for a faster change from the sleep or standby operating states to normal operation or steady state. To maintain a low quiescent current consumption, for example 100 µA, circuit breakers must be opened. If a supply 89, 131 is also required in sleep mode, this is implemented via another, significantly lower-performance, quiescent current-optimized and cost-efficient source. This enables significantly shorter wake-up times to be achieved. Regardless of the wake-up cause (ignition signal KI15, CAN active, consumer current exceeds wake-up threshold, etc.), output channel 15 can bring consumer 16 to full performance within <1ms. When using the fast wake-up procedure described, supplies 89, 131 are either switched off or relieved for a low quiescent current consumption. This ensures that the restrictive quiescent current requirements and a fast wake-up are met, and in particular that operational readiness is ensured quickly. If output channels with safety integrity are switched on quickly (fast wake-up), diagnostic functions may have to be carried out until the necessary safety integrity of the connected consumer is provided. Full performance is therefore ensured very quickly (<1ms) and full safety integrity after the microcontroller 21 has booted up and the diagnostic functions provided for the switching unit 15 and the overall system have been carried out. The duration can be <250 ms, for example. If all diagnostic results are within the specified ranges, full safety integrity can be assured for the overall system, making it possible to start driving immediately, for example.

Two independent logic or control units (for example, main computer 99 such as a microcontroller 21 and an auxiliary computer 100 such as a register memory) provide the status information and the control information of the output channels or supply paths 64 redundantly. Preferably, a high-performance main computer 99 is installed, which is protected against malfunctions by an extensive architecture and thus comprehensive monitoring concepts. The auxiliary computer 100, in the simplest case just an independent status and control register, can maintain the current operating state and control signals independently of the main computer 99 or its supply in the event of a fault. The corresponding output signals (output signal 102 of the auxiliary computer 100, output signal 106 of the microcontroller 21) both reach the driver 94 for the switching unit 15.

There are two independent monitoring devices 140, 142 (as shown for the 2 - 7 described) are provided, which independently monitor the state of the supply paths 64 (between 60 and 66) for errors such as overload, in order to request a disconnection of the conductive connection between input 60 and output 66 in the event of an error. The independence must ensure that there are no (or only reasonably unlikely) error cases in which both monitoring devices 140,142 incorrectly request a disconnection at the same time. As already described, the protective devices 140, 142 comprise corresponding measuring resistors 70, 72, 73 or voltage taps on the switching means 61, 62, 63, corresponding measuring amplifiers 78, 124, 178 and/or corresponding comparators 82, 128 for evaluating the measurement signals of the measuring amplifiers 78, 124, 178 and/or corresponding storage elements 88, 134 for temporarily storing certain status information and/or corresponding logic elements 180 for checking the plausibility of a switch-off request or a switch-on request. The monitoring device 140 and the further monitoring device 142 in turn each comprise the storage device 80, 134 (not shown separately), the comparator 82, 128 (not shown separately) and at least the measuring amplifier 78, 124, 178 (not shown separately).

Furthermore, n decoupled driver stages 67, 68, 69, etc. and switches 61, 62, 63, etc. are provided. The switches 61, 62, 63, etc. serve to act as power switches in parallel by connecting, for example, Mosfets or IGBTs. the respective supply paths 64, to provide the low-resistance connection between the main supply 60 and the output 66 for supplying the connected consumer. The driver stages 67, 68, 69 are internally constructed in such a way that one of the two independent logic units 99, 100 is able to initiate or maintain the conductive status. The pulse driver stage 146 shown in the example is able to quickly transfer the switches 61, 62, 63 from the blocked to the conductive state due to its pulse capability. However, due to the pulse capability there is an increased risk that a single fault in one of the switches 61, 62 or 63 will affect the other driver stages 67, 68 or 69 via a coupling. Ultimately, a single fault in a power switch 61, 62, 63 can therefore affect the entire channel 15. By introducing an independent maintenance driver stage 144, for example supplied from two supply units 89, 131, the feedback effects caused by a high-impedance connection of the faulty path to the supply source can be avoided.

By ensuring the absence of feedback and decoupling through corresponding elements 141 or blocks 141 and the pulse and maintenance driver stage 146, 144, it can always be ensured in the event of a single fault of a circuit breaker 61, 62, 63 that the greatest effect is the failure of a MOSFET or switch 61, 61, 63. All other circuit breakers 61, 62, 63 and also any output channels connected in parallel and supplied from the same sources remain active.

The drivers 67, 68, 69 are internally designed in such a way that only both monitoring devices 140, 142 together are able to interrupt the conductive path between input 60 and output 66. The two isolation requirements of the two monitoring devices 140, 142 are only combined so close to the respective switches 61, 62, 63, 63.n that there are no single errors that deactivate several switches 61, 62, 63, 63.n at the same time. In addition, the connection close to the switch ensures a minimum of switch-specific components. The number of switches n is selected such that the high-resistance failure of one of the partial paths or supply paths 64.1... n for a sufficiently long fault tolerance time does not endanger the safety goal of a reliable supply of the loads connected to the output 66, in particular safety-relevant consumers 16. The drivers 67, 68, 69 ensure through their special internal structure that even errors in a single switch 61 do not have any negative effects on other switches 62, 63, 63n, which violates the safety objective of providing a sufficiently low-resistance connection (in the implementation, for example, a short circuit between gate and source, which must be encapsulated within the driver 67, 68, 69 in order to prevent it from affecting the other switches 62, 63, 63n).

Furthermore, a redundantly supplied ground concept is provided, indicated by a ground 148 and a further ground 150. This ensures that the internal reference ground of the control unit has a sufficiently high overall availability.

The power distributor 18 with associated monitoring circuits 140, 142 is arranged, for example, in a 12 V electrical system 13 in a motor vehicle directly at the interface between the non-safety-relevant sub-electrical system 10 and the safety-relevant sub-electrical system 11, in particular the ASIL-qualified sub-electrical system 11. However, the use is not restricted to this.

QUOTES INCLUDED IN THE DESCRIPTION

This list of documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions.

Cited patent literature

• DE 102019205800 A1 [0002]
• DE 102020107695 A1 [0003]

Claims (13)

Device for supplying energy to a safety-relevant consumer in a motor vehicle, wherein at least one switch (61, 62, 63) is provided in a supply path (64) for supplying and protecting the safety-relevant consumer (16), comprising at least one first monitoring device (140) for monitoring at least the supply path (64) for the safety-relevant consumer (66), comprising a further monitoring device (142) independent of the first monitoring device (140) for monitoring at least the supply path (64) and/or a further supply path (64) for the safety-relevant consumer (66), wherein the monitoring devices (140, 142) independently of one another monitor at least one electrical characteristic of the supply path (64) and/or the further supply path (64) for a fault and compare each with a limit value (84, 130), wherein a plausibility check is provided in order to generate a shutdown signal (114, 116) for the switch (61, 62, 63) when both output signals (92, 108) of the monitoring devices (140, 142) indicate that the respective limit value (84,130) has been reached and thus that an error has occurred, characterized in that the monitoring devices (140,142) each comprise at least one measuring amplifier (78,124) for detecting the respective characteristic variable, at least one comparator (82,128) to which an output variable of the respective measuring amplifier (78, 124) is fed, and a storage element (88,134) to which an output variable of the comparator (82,128) is fed. Device according to Claim 1 , characterized in that at least two or three switches (71, 72, 73) connected in parallel are provided for supplying and protecting the safety-relevant consumer (66). Device according to one of the preceding claims, characterized in that at least one measuring means, in particular a measuring resistor (70, 72,73) or an inductive measuring means, preferably two or three measuring means connected in parallel to one another, in particular measuring resistors (70, 72,73), is provided in series with the switch (61) and/or in series with at least two or three switches (61, 62, 63) connected in parallel. Device according to one of the preceding claims, characterized in that the potential difference at the measuring resistor (70, 72, 73) and/or at the switch (61, 62, 63) is fed to the measuring amplifier (78,124), in particular via at least one resistor (74, 76,120,122,174, 220, 222). Device according to one of the preceding claims, characterized in that the potential differences at at least two measuring resistors (70, 72, 73) are each fed to the measuring amplifier (78,124) and/or that the potential differences at at least one measuring resistor (70, 72,73) and at at least one switch (61, 62, 63) are each fed to the measuring amplifier (78,124) and/or that the potential differences at at least two switches (61, 62, 63) are each fed to the measuring amplifier (78, 124). Device according to one of the preceding claims, characterized in that a limit value (84,130) is supplied to the comparator (82,128). Device according to one of the preceding claims, characterized in that the limit value (84,130) is designed as a constant or static and/or as a dynamically adjustable limit value (84,130). Device according to one of the preceding claims, characterized in that at least two mutually independent supplies (89,131) are provided, wherein the one comparator (82) and/or the measuring amplifier (78) and/or a circuit for generating a limit value (84, 130) is supplied by the one supply (89), the further comparator (128) and/or the further measuring amplifier (124) and/or a circuit for generating a limit value (84, 130) is supplied by the further supply (131). Device according to one of the preceding claims, characterized in that the output signals of the memory elements (88,134) are fed to a logical combination (180, 230), in particular an AND gate, for plausibility check. Device according to one of the preceding claims, characterized in that a driver (67, 68, 69) is provided for each switch (61, 62, 63), in particular controlled by the driver (94), and/or wherein the driver (67, 68, 69) is supplied by at least two different supplies and/or the driver (67, 68, 69) receives a redundant control signal (102, 106; 92, 108), in particular a switch-on signal or a switch-off signal. Device according to one of the preceding claims, characterized in that at least two independent control devices or logic units are provided for Generation of a control signal (106) for the driver(s) (67, 68, 69, 94, 144,146). Device according to one of the preceding claims, characterized in that a controller (21) and at least one auxiliary computer (100), in particular a register, are provided as independent control devices. Device according to one of the preceding claims, characterized in that at least one limit value (82,130) for the comparator (82, 128) is generated redundantly, in particular by a hardware circuit and by an output signal of the controller (21) or the auxiliary computer (100).

Images