Vehicle Electrical System and Method for Protecting a Vehicle Electrical System

Abstract

An electrical system for a motor vehicle includes a current distributor; a plurality of first lines which are designed to connect a corresponding plurality of electric components to the current distributor; a plurality of semiconductor-based first switch elements, wherein a specified first switch element of a specified first line is designed to interrupt said specified first line; a second line which is designed to connect the current distributor to the electrical system; a limiting unit which is designed to limit or prevent a second current on the second line; and a control unit which is designed to determine that the specified first switch element does not open although a first current running through the specified first switch element exceeds a first current threshold and, in response to said determination, to trigger the limiting unit to limit or prevent the second current on the second line.

Claims

1.-12. (canceled)

13. An on-board electrical system for a motor vehicle, the on-board electrical system comprising: a current distributor; a plurality of first lines, which are configured to connect a corresponding plurality of electrical components to the current distributor; a plurality of semiconductor-based first switching elements for the corresponding plurality of first lines, wherein a specified first switching element of a specified first line is configured to interrupt the specified first line; a second line, which is configured to connect the current distributor to the on-board electrical system; a limiting unit, which is configured to limit or to prevent a second current on the second line and/or to change a second voltage on the second line; and a control unit, which is configured: to determine that the specified first switching element does not open even though a first current through the specified first switching element exceeds a first current threshold value; and in response to the determination, to prompt the limiting unit to limit or to prevent the second current on the second line and/or to reduce the second voltage on the second line.

14. The on-board electrical system according to claim 13, wherein: the limiting unit has a superordinate current threshold value from which the second current on the second line is automatically limited or prevented; and the control unit is further configured to prompt the limiting unit to limit or to prevent the second current on the second line even if the second current has not yet reached the superordinate current threshold value.

15. The on-board electrical system according to claim 13, wherein the control unit is further configured to prompt information in relation to: the specified first line on which the specified first switching element is arranged; a specified component which is connected to the current distributor via the specified first line; and/or a fault cause for the first current on the specified first line being stored in a fault memory for the on-board electrical system before the second current on the second line is limited or prevented.

16. The on-board electrical system according to claim 13, wherein the control unit is further configured to prompt: at least one component of the plurality of components being transferred to a safe state; and/or at least one component of the plurality of components being coupled to an alternative power supply before the second current on the second line is limited or prevented.

17. The on-board electrical system according to claim 13, wherein: the limiting unit comprises a second switching element, which is configured to interrupt the second line in order to prevent the second current; and/or the limiting unit comprises a converter, which is configured to reduce and/or to prevent the second current.

18. The on-board electrical system according to claim 13, wherein: the converter is a DC-DC voltage converter.

19. The on-board electrical system according to claim 13, wherein the control unit is further configured to prompt the limiting unit to limit the second current on the second line such that at least one of the plurality of electrical components can continue to be operated in a downgraded operating mode.

20. The on-board electrical system according to claim 13, wherein: the control unit is part of the specified first switching element; and/or the control unit is further configured to send a control signal to a control module of the limiting unit in order to prompt the control module of the limiting unit to operate the limiting unit such that the second current on the second line is limited or prevented.

21. The on-board electrical system according to claim 13, wherein at least one of the first switching elements comprises a metal-oxide semiconductor (MOS), a transistor, and/or an insulated-gate bipolar transistor (IGBT).

22. The on-board electrical system according to claim 13, wherein the control unit is further configured: to predict, based on a prediction model, that the specified first switching element will not open at a future time even though the first current through the specified first switching element will exceed the first current threshold value; and, prior to the future time, to prompt one or more measures in order to reduce an effect of the limitation or interruption of the second current on the on-board electrical system that is brought about at the future time.

23. The on-board electrical system according to claim 13, wherein: the current distributor is configured such that the second current on the second line comprises a sum of a plurality of first currents on the corresponding plurality of first lines or corresponds to the sum; and/or the current distributor is configured to distribute the second current over the plurality of first lines.

24. The on-board electrical system according to claim 13, wherein: the specified first switching element is configured to open automatically in a fault-free operation as soon as the first current through the specified first switching element exceeds the first current threshold value; and/or the first current threshold value is lower than a superordinate current threshold value from which the limiting unit automatically limits or prevents the second current on the second line.

25. A method for protecting an on-board electrical system of a motor vehicle, wherein the on-board electrical system comprises a current distributor and a plurality of first lines, which are configured to connect a corresponding plurality of first lines to the current distributor, wherein the on-board electrical system comprises a plurality of semiconductor-based first switching elements for the corresponding plurality of electrical components, wherein a specified first switching element of a specified first line is configured to interrupt the specified first line, and wherein the on-board electrical system comprises a second line, which is configured to connect the current distributor to the on-board electrical system, and a limiting unit, which is configured to limit or to prevent a second current on the second line and/or to change a second voltage on the second line, the method comprising: determining that the specified first switching element does not open even though a first current through the specified first switching element exceeds a first current threshold value; and, in response to the determining, prompting the limiting unit to limit or to prevent the second current on the second line and/or to reduce the second voltage on the second line.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0027] FIG. 1a shows an exemplary vehicle having exemplary electrical consumers.

[0028] FIG. 1b shows a section of an exemplary on-board electrical system of a vehicle.

[0029] FIG. 1c shows an exemplary current distributor having fuses.

[0030] FIG. 2a shows an exemplary current distributor having semiconductor-based switching elements.

[0031] FIGS. 2b and 2c show exemplary reactions of a current distributor to an event on a first supply line.

[0032] FIG. 3 shows a flowchart of an exemplary method for safeguarding an on-board electrical system of a vehicle.

[0033] FIG. 4 shows a flowchart of a further exemplary method for safeguarding an on-board electrical system of a vehicle.

DETAILED DESCRIPTION OF THE DRAWINGS

[0034] As discussed in the introduction, the present document is concerned with increasing the safety of an on-board electrical system of a vehicle. In this connection, FIG. 1a shows an exemplary vehicle 100 having different electrical consumers 101, 102, 103. Exemplary electrical consumers are sensors 102, actuators 103 and/or control devices 101.

[0035] FIG. 1b shows a section of an exemplary on-board electrical system 150 of a vehicle 100. The on-board electrical system 150 comprises at least one energy source 151, which is set up to provide electrical energy in the on-board electrical system 150. Exemplary energy sources 151 are: an (electrochemical) energy store, a voltage converter and/or a generator.

[0036] The on-board electrical system 150 may have one or more current distributors 152, which are set up to supply the individual electrical consumers 153, 101, 102, 103 with current from the energy source 151 via individual first supply lines 154. The energy source 151 may be connected to the current distributor 152 via a second line 155.

[0037] As illustrated in FIG. 1c, a current distributor 152 may comprise fuses 164, 165 on the individual lines 154, 155 in order to be able to interrupt the individual lines 154, 155 in the event of a short circuit on the individual lines 154, 155.

[0038] Fuses 164, 165 typically have a relatively high tolerance, react relatively slowly and are irreversible (with the result that they must be exchanged manually). As illustrated in FIG. 2a, the fuses 164, 165 may be replaced by semiconductor switches 205, 204 with a safety function. It is thus possible to improve precision, speed and reversibility. Furthermore, the use of semiconductor-based switching elements 204, 205 makes it possible to provide protective and diagnostic capabilities.

[0039] A semiconductor-based switching element 204, 205 may possibly fail and/or have a fault. For example, an intrinsic defect density may lead to an increased leakage current, as a result of which the blocking properties of the switching element 204, 205 may be adversely affected and/or as a result of which it may possibly no longer be possible to completely switch on the switching element 204, 205 at load. Overloading of a switching element 204, 205 may lead to a permanent interruption or to a permanent short circuit of the switching element 204, 205.

[0040] If a semiconductor switch 204 with a protection function fails with a permanent short circuit in the “permanent on” state, the path 154 of the semiconductor switch 204 can no longer be disconnected. A safety function of the semiconductor switch 204 can thus no longer be ensured.

[0041] As illustrated in FIG. 2a, a hierarchical arrangement of switching elements 204, 205 at different hierarchy levels may exist. The next higher hierarchy level in the current distribution system, however, typically has a significantly higher safety threshold value than a switching element 204 on the hierarchy level below. Therefore, it may be that, in the event of a short circuit on a subordinate (first) line 154, the safety function of the higher level is not tripped. The current distributor 152 is then not disconnected from the on-board electrical system 150.

[0042] As an alternative or in addition, the individual semiconductor switches 204, 205 (for example a “+ switch” and a “− switch”) may be doubled in order to provide redundancy. However, this leads to doubling of the outlay and/or the costs as well as to a reduction in the availability.

[0043] As illustrated in FIG. 2a, the individual switching elements 204, 205 may be connected to one another via a communication network. In particular, the communication network may make it possible for a control unit 201 of a first switching element 204 of a first level to communicate with a second switching element 205 of a second level thereabove. In particular, the communication network may make it possible for the control unit 201 of the first switching element 204 to control the second switching element 205, for example in order to open the second switching element 205.

[0044] As illustrated in FIG. 2b, an event 214 may be detected, for example, at the first switching element 204, the event 214 adversely affecting the switching of the first switching element 204. In particular, it is possible to detect that the first switching element 204 does not open and therefore the first line 154 cannot be disconnected even though a specified first current threshold value is exceeded. The control unit 201 of the first switching element 204 may subsequently send a control signal 211 to the second switching element 204 (in particular a control module of the second switching element 204) in order to open the second switching element 204. The second switching element 204 may in this case be opened where appropriate even though the second current threshold value for the permissible current through the second switching element 205 has not yet been reached. It is thus possible to reliably protect the on-board electrical system 150 by disconnecting the current distributor 152.

[0045] The second switching element 205 may be part of a converter 215, in particular a DC/DC or DC-DC voltage converter. As illustrated in FIG. 2c, the control unit 201 of the first switching element 204 may be set up, in response to an identified event 214, to prompt the converter 215 to reduce the current on the second line 155. The effects of the event 214 on the rest of the on-board electrical system 150 can thus be limited. The converter 215 and the second switching element 205 are examples of a limiting unit for limiting and/or for interrupting the second current through the second line 155.

[0046] The protection function 201 with the failed end stage or with the failed semiconductor switch 204 can thus be linked informally with a superordinate safety function in order to indicate a safety situation or an event 214. In response thereto, the superordinate safety function can be tripped even if the current threshold value of the superordinate safety function has not been exceeded.

[0047] FIG. 2b illustrates the failure of a semiconductor switch unit 204 of the current distributor 152 and the transmission of the detected event 214 to the semiconductor switch unit 205 of the current distributor 152 with the command 211 to interrupt or to deactivate the power supply. FIG. 2c illustrates the failure of a semiconductor switch unit 204 of the current distributor 152 and the transmission of the detected event 214 to the DC/DC converter 215 for the current distributor 152 with the command 211 to downgrade or to deactivate the power supply.

[0048] As an alternative or in addition to a higher safety level, a DC-DC voltage converter may possibly be used as an energy source 151. The energy source 151 may be prompted, for example by a control instruction 211, to decrease the output voltage or to completely disconnect the output. The voltage may be reduced, for example, in such a way that a remaining function of individual consumers 153 continues to be made possible (for example for a specified period) and that the effects of the short-circuit case are reduced, in particular minimized.

[0049] The individual safety functions may be implemented in a manner based on models, for example in order to predict a fault case or an event 214. This results in the possibility of increasing or maximizing the available delay time for tripping. This is advantageous, in particular, when the rest of the consumers, generators, etc. 153 in the supply section that is to be disconnected have to be informed or deactivated.

[0050] The control unit 201 may be set up to document diagnosis and fault storing such that the fault cause for the event 214 can be contained. It is thus possible to efficiently exchange individual faulty components. In particular, it is thus possible to prevent the erroneous exchange of a deactivated, functional component.

[0051] The hierarchical protection described in this document can be applied to: a subsystem of the on-board electrical system 150; to a segment of a supply rail; and/or to a segment of an on-board electrical system ring structure. The disconnection may be effected, for example, based on a functionally substantiated disconnection of an electrical sub-path 154 or of a component 153.

[0052] FIG. 3 shows a flowchart of an exemplary method 300 for safeguarding an on-board electrical system 150. An event 214 may be detected (step 301) and a fault may be recognized based thereon (step 302). In response thereto, a higher safety level may be informed (step 303) about the identified fault and it is possible to check whether an immediate tripping is necessary (step 304).

[0053] If immediate tripping is not necessary, the safety situation within the affected subregion of the on-board electrical system 150 may be communicated, for example in order that a consumer with double energy supply can be switched over (step 305) and/or in order that a consumer is informed about the upcoming interruption of the power supply. Furthermore, if necessary, a controlled deactivation and/or downgrading of one of more systems may take place (step 306).

[0054] If immediate tripping is necessary or after the aforementioned steps 305, 306 have been carried out, the affected subregion of the on-board electrical system 150 can be disconnected (step 307). Furthermore, a diagnosis and/or the input of faults into a fault memory may be carried out (step 308). Furthermore, a fault may be notified to a user of the vehicle 100 (step 309). An emergency operation of the vehicle 100 (without the affected and/or disconnected subregion of the on-board electrical system 150) may also be brought about (step 310).

[0055] FIG. 4 shows a flowchart of a further method 400 for protecting an on-board electrical system 150 of a motor vehicle 100. The method 400 may be executed by way of a control unit 201.

[0056] The on-board electrical system 150 comprises a current distributor 152 and a plurality of first lines 154, which are set up to connect a corresponding plurality of electrical components 153 (in particular consumers 101, 102, 103) to the current distributor 152. Furthermore, the on-board electrical system 150 comprises a plurality of semiconductor-based first switching elements 204 for the corresponding plurality of electrical components 153 or for the corresponding plurality of first lines 154. In this case, a first switching element 204 on a first line 154 may be designed to interrupt the respective first line 154 (and thus to disconnect the respective component 153 from the current distributor 152). By way of a switching element 204, the individual components 153 may therefore each be disconnected from the current distributor 152 (by opening the switching element 204) or connected thereto (by closing the switching element 204).

[0057] The on-board electrical system 150 also comprises a second line 155, which is designed to connect the current distributor 152 to the on-board electrical system 150. The current distributor 152 may be designed to distribute the second current on the second line 155 over the plurality of first lines 154.

[0058] The on-board electrical system 150 furthermore comprises a limiting unit 205, 215, 151 (for example a second switching element 205 and/or a converter 215, 151), which is set up to limit or to prevent the second current on the second line 155 and/or to change a second voltage on the second line 155.

[0059] The method 400 comprises determining 401 that a specified first switching element 204 does not open even though the first current through the specified first switching element 204 exceeds a first current threshold value (at which the specified first switching element 204 should open). Furthermore, the method 400 comprises, in response thereto, prompting 402 the limiting unit 205, 215, 151 to limit or to prevent the second current on the second line 155 and/or to reduce the second voltage on the second line 155. It is thus possible to provide reliable protection for the rest of the on-board electrical system 150 even in the case of a faulty first switching element 204.

[0060] The measures described in this document make it possible to intercept a safety-critical event 311 in a subregion of an on-board electrical system 150 without additional circuitry (where possible purely on the basis of software). It is thus possible to reduce the costs, the weight and the required installation space of a vehicle 100. Furthermore, the availability of an on-board electrical system 150 may be increased. Diagnostics, fault localization and where necessary an emergency operation may also be assigned to individual components 153 of the on-board electrical system 150 in a reliable and efficient manner. In particular, fault notifications and a necessary component exchange may be clearly assigned to an affected component 153.

[0061] The present invention is not restricted to the exemplary embodiments shown. In particular, it should be noted that the description and the figures are intended to illustrate only the principle of the proposed method, devices and systems.