DE102020120410B3 - Method for operating an on-board network, on-board network and motor vehicle with an on-board network - Google Patents

Abstract

A method for operating an on-board network (10) for an at least partially electrically powered motor vehicle (11), the on-board network (10) comprising an electrical high-voltage voltage source (12) with a positive pole (14) and a negative pole (16), - the The positive pole (14) can be connected to the vehicle electrical system (10) in an electrically conductive manner by means of a first connecting line (18) and the negative pole (16) by means of a second connecting line (20), with the first and second connecting lines (18, 20) in each case an electronic separating element (22, 24) is arranged, - wherein a pyrotechnic separating element (26) is coupled in series in the first and / or the second connecting line (18, 20), - wherein the pyrotechnic separating element (26) has a control connection (28) which in normal operation is coupled to an output connection (30) of a control device (32) by means of a control branch (34), a control unit (36) in the control branch (34) between the output connections connection (30) and the control connection (28) is serially interconnected, with a short-circuit branch (38) parallel to the control branch (34) between the output connection (30) of the control device (32) and the control connection (28) of the pyrotechnic separating element (26) which provides a short-circuit line (40) for short-circuiting the output connection (30) and the control connection (28), a switch arrangement (42) being designed to provide a controlling coupling for transmitting signals between the output connection (30) and the control connection ( 28) either via the short-circuit branch (38) or via the control branch (34), the control device (32) in a case of damage that is different from normal operation when a disconnection of the high-voltage voltage source (12) from the vehicle electrical system (10) occurs Emergency operation triggers and in the emergency operation a connection state of the electronic isolating element (22, 24) of the first connection line (1 8) and / or the electronic separating element (22, 24) of the second connecting line (20) monitored, and - in the event that the electronic separating element (22, 24) of the first connecting line (18) and / or the electronic separating element (22 , 24) of the second connecting line (20) are open, a switching command (50) for disconnecting the control branch (34) and for connecting the short-circuit branch (38) is transmitted to the switch arrangement (42) and an ignition pulse for igniting the pyrotechnic separating element (26) passes through the short-circuit branch (38) to the control connection (28).

Description

The invention relates to a method for operating an on-board network for an at least partially electrically driven motor vehicle. In addition, the application relates to such an on-board network and to a motor vehicle with such an on-board network.

It is known to equip motor vehicles with electrical systems. A large number of electrical consumers are usually connected to such an on-board network. If a motor vehicle is an at least partially electrically powered motor vehicle, the on-board network is normally divided into a high-voltage area with a high-voltage voltage source or high-voltage battery, which serves as a source of drive energy for the motor vehicle, and a low-voltage area, the latter being divided into a low-voltage battery can be connected, which supplies the remaining loads with an electrical voltage in the range of less than 20 volts, in particular with a 12-volt voltage. As a rule, the two network areas are coupled to one another by a DC voltage converter, so that electrical energy can be exchanged between the areas.

In connection with the present invention, an electrical energy store is referred to as a high-voltage voltage source or high-voltage battery, which primarily serves to provide electrical drive energy for a motor vehicle. As such, the high-voltage voltage source is designed to provide an electrical voltage in the range of more than 60 volts up to several hundred volts, in particular 400 volts.

During the operation of such a motor vehicle with a named high-voltage battery, it may be necessary to electrically disconnect the high-voltage battery from the rest of the on-board network. This case can occur, for example, for maintenance work or in the event of an accident. In order to disconnect the high-voltage battery from the on-board network, electronic isolating elements or high-voltage contactors are usually provided, which can separate the high-voltage battery from the on-board network with one pole and / or two poles and connect it to it. In addition, vehicle electrical systems of the known type generally have one or more pyrotechnic separating elements which are designed to irreversibly separate the high-voltage battery from the vehicle electrical system. Corresponding arrangements and separation concepts are, for example, from the DE 10 2018 203 915 A1 , the DE 10 2016 213 072 A1 or also the DE 10 2013 209 835 A1 known.

Also from the DE 10 2018 207 247 A1 a disconnection device for disconnecting a high-voltage line of a high-voltage electrical system of a motor vehicle is known. The separating device comprises two separating units, each of which has a controllable (pyrotechnic) disconnection unit. One of the separation units also has an overcurrent fuse. A control unit can activate the disconnection units depending on whether there is an overcurrent or an overcurrent-independent event that requires the high-voltage line to be disconnected.

If the high-voltage battery is disconnected from the vehicle electrical system as a result of an accident, this disconnection must be stored in a non-volatile manner so that it can be recognized when the motor vehicle is started up again (diagnosis in the init phase). The electrical energy that is made available by the low-voltage network area of the on-board network is generally used for storage. However, since an accident that leads to the high-voltage battery being disconnected from the on-board network can also lead to an operating voltage dropping in the low-voltage range, the electrical energy required to store the accident must be able to be buffered beyond the accident. The buffering is usually carried out with the aid of capacitors, which disadvantageously increase the weight and manufacturing costs of the entire on-board network and take up a lot of installation space. Such a capacitor solution is, for example, from DE 10 2017 214 302 A1 known.

The invention is based on the object of reliably and efficiently separating a high-voltage battery from an on-board network of the type described above in the event of damage or as a result of an accident.

The object is achieved by the subjects of the independent claims. Advantageous developments of the invention are described by the dependent claims, the following description and the figures.

The invention is based on the knowledge that the above-described requirement of buffering a collapsed operating voltage of the vehicle electrical system beyond an accident event limits the efficiency of the vehicle electrical system. The possibility of being able to do without this buffering in whole or at least in part can accordingly increase the efficiency of the on-board network.

The invention provides a method for operating an on-board network for an at least partially electrically driven motor vehicle. The vehicle electrical system comprises an electrical high-voltage voltage source with a positive pole and a negative pole. The positive pole is electrical by means of a first connecting line and the negative pole is electrical by means of a second connecting line conductively connectable to the on-board network. An electronic isolating element, which can be implemented as an electromechanical contactor, for example, is arranged in each of the first and second connecting lines. Furthermore, a pyrotechnic separating element is coupled in series in the first and / or the second connecting line. The pyrotechnic separating element can be coupled between the high-voltage voltage source and the respective electrical separating element.

The pyrotechnic separating element or ignition element or pyro element has a control connection which, in normal operation, is coupled to an output connection of a control device by means of a control branch. The control device can be arranged on the on-board network level or as an on-board computer on a higher-level vehicle control level. The output connection of the control device and the control connection of the pyrotechnic separating element can be connected to one another in an electrically conductive manner and / or coupled to one another for signaling purposes via an optical connection and / or a radio connection.

In the control branch described, a control unit or electronic control unit (Electronic Control Unit, ECU) is coupled in series between the output connection and the control connection. The control unit is preferably designed and set up to receive signals, in particular an ignition signal for igniting the pyrotechnic separating element, from the control device, to process them further and to transmit them to the control connection of the pyrotechnic separating element. The control unit can also carry out other coordinating tasks relating to the operation of the on-board network and / or the operation of the high-voltage battery. In particular, the control unit can detect a short circuit within the high-voltage battery and then trigger the control connection of the pyrotechnic separating element. In other words, signals run in normal operation from the control device to the pyrotechnic separating element exclusively via the control unit. For this purpose, electrical energy must be provided for operating the control unit in normal operation. This can be accomplished, for example, from the aforementioned low-voltage network area.

According to the invention, a short-circuit branch, which provides a short-circuit line for short-circuiting the output connection and the control connection, runs parallel to the control branch between the output connection of the control device and the control connection of the pyrotechnic isolating element. In other words, an electrically conductive connection between the control device and the pyrotechnic separating element runs parallel to the control branch, bypassing the control unit. This connection provides, so to speak, an alternative route between the output connection of the control device and the control connection of the pyrotechnic separating element. In normal operation, the connection is not coupled into the vehicle electrical system in an electrically conductive manner. In other words, the short-circuit branch is not used in normal operation.

According to the invention, a switch arrangement is now designed to produce a controlling coupling for the transmission of signals between the output connection and the control connection either via the short-circuit branch or via the control branch. The switch arrangement can therefore switch back and forth between the control branch and the short-circuit branch. It is not intended that both branches be connected at the same time. In other words, only one of the branches is served at a time. The switch arrangement can be designed as a semiconductor switching element.

In the event of damage requiring the high-voltage voltage source to be disconnected from the vehicle electrical system, the control device according to the invention triggers an emergency operation that differs from normal operation. The control device can have the damage event signaled, for example, by a collision detection unit of the motor vehicle and / or recognize it on the basis of a user input from a user of the motor vehicle. In the emergency mode, the control device monitors a connection state of the electronic isolating element of the first connecting line and / or of the electronic isolating element of the second connecting line between the high-voltage voltage source and the on-board electrical system. In other words, in emergency mode, the control device monitors whether the high-voltage voltage source is properly connected to or disconnected from the vehicle electrical system. The monitoring can be carried out, for example, by a regular and / or rhythmic and / or cyclical query of the connection status or by a continuously running query. The monitoring can also be a passive monitoring of an operating voltage of the high-voltage network area. In the event that the electronic isolating elements are electromechanical contactors, the monitoring can also consist in the control device checking a current flow through respective current-carrying coils driving the contactors.

In the event that the electronic isolating element of the first connecting line and / or the electronic isolating element of the second connecting line are open, that is, the high-voltage voltage source has one and / or two poles from the On-board power supply is disconnected, the control device transmits a switching command to disconnect the control branch, which up until then was still closed according to normal operation, and to connect the short-circuit branch to the switch arrangement. In other words, the control device triggers a switchover away from the control branch towards the short-circuit branch. This switchover can also be understood as bridging the control unit coupled in between in the control branch. Finally, the control device conducts an ignition pulse for igniting the pyrotechnic separating element via the short-circuit branch to the control connection of the pyrotechnic separating element. As a result, the pyrotechnic separating element is irreversibly separated, which is equivalent to storing the damage event.

At the moment when the high-voltage battery is safely disconnected from the vehicle electrical system by the opened electronic isolating elements, the control unit is bridged according to the invention. In this way, a supply of the control unit with electrical energy can advantageously be abandoned or omitted as soon as the control unit is no longer required. According to the invention, the storage of the mentioned damage case no longer has to be done by the control unit, but instead happens, as described above, by the ignition of the pyrotechnic separating element. The buffering described at the beginning can thus advantageously be dispensed with. The arrangement according to the invention therefore allows particularly efficient operation of the vehicle electrical system, with the accident event being reliably stored at the same time.

The invention also includes embodiments which result in additional advantages.

One embodiment provides that a buffer unit is designed to provide the control unit with electrical energy, the control device switching off the buffer unit as soon as the control device detects that the electronic isolating element of the first connecting line and / or the electronic isolating element of the second connecting line is open are. As described above, a capacitor, for example, can be provided as the buffer unit. According to the embodiment described here, the control device can now interrupt an electrically conductive connection between the capacitor and the control unit as soon as the electronic isolating elements are open and the control unit is no longer needed, for example to detect a short circuit in the high-voltage battery. In this way, electrical energy remaining in the buffer unit or the capacitor can advantageously be used for other purposes. Alternatively, the buffer unit can be made correspondingly small. In the latter case, there is no electrical energy left for other consumers, but there is advantageously a saving in weight and / or production costs for the on-board network.

According to a further advantageous embodiment, the electronic isolating elements of the connecting lines are designed as so-called high-voltage contactors, which open automatically when a predetermined operating voltage of the vehicle electrical system breaks down. The high-voltage contactors can be designed, for example, as electromechanical contactors that open as soon as the respective contactor coils are no longer supplied with voltage. When the on-board electrical system voltage drops, such contactors open automatically, as a result of which a chain reaction is set in motion, so to speak. The opening of the contactors can namely be recognized by the control device as described above, whereupon the control device triggers the above-described switchover between control branch and short-circuit branch. The mentioned drop in the predetermined operating voltage can consist, for example, in a complete elimination of the predetermined operating voltage or in an only temporary reduction in the operating voltage.

According to an advantageous development, a respective high-voltage contactor opens only after a predetermined contactor latency time, the contactor latency time depending on a contactor characteristic. In other words, the contactor latency can be set through a suitable selection of a contactor characteristic.

According to a further advantageous development, an electrical voltage required for operating the control unit is only buffered for a duration of the contactor latency. In other words, through a suitable selection of a contactor characteristic and dimensioning of the buffering, the vehicle electrical system can be optimally designed with regard to its weight and / or its production costs and / or its efficiency.

It can happen that a short circuit occurs in the high-voltage voltage source within the contactor latency period, i.e. while the high-voltage contactors are opening. At this point in time, the control unit is still supplied with electrical energy and can recognize this and then ignite the pyrotechnic separating element.

A connection state of the pyrotechnic separating element can advantageously be used as a diagnostic parameter. According to a further embodiment, the connection state or state of the pyrotechnic separating element is namely checked during an initialization phase of the vehicle electrical system. When disconnected commissioning of the high-voltage voltage source is prevented. In other words, closing of the electronic separating elements is prevented if it is established during the initialization phase that the pyrotechnic separating element has been ignited.

Another embodiment provides that the disconnection of the control branch and the connection of the short-circuit branch are prevented by a safety routine, in particular also in emergency operation. The safety routine can provide, for example, that the switchover of the ignition of the pyro element to the short-circuit line or ignition line may only take place in the event of an accident in which a predetermined voltage drop in the vehicle electrical system voltage is detected. Switching or switching must generally be prevented during normal operation. The switchover must be prevented in accordance with the safety routine (Automotive Safety Integrity Level, ASIL) according to which a potentially occurring short circuit in the high-voltage battery must also be disconnected. After switching over, the control unit can no longer ignite the pyro in the event of a short circuit.

The invention also relates to an on-board network for an at least partially electrically driven motor vehicle, the on-board network comprising an electrical high-voltage voltage source with a positive pole and a negative pole. The positive pole can be connected to the vehicle electrical system in an electrically conductive manner by means of a first connecting line and the negative pole can be connected in an electrically conductive manner by means of a second connecting line. An electronic isolating element is arranged in each of the first and second connecting lines. A pyrotechnic separating element is coupled in series in the first and / or the second connecting line. The pyrotechnic separating element has a control connection which, in normal operation, is coupled to an output connection of a control device by means of a control branch having a control unit. In other words, in the control branch, a control unit is interconnected in series between the output connection and the control connection.

According to the invention, a short-circuit branch, through which a short-circuit line is provided for short-circuiting the output connection and the control connection, runs parallel to the control branch between the output connection of the control device and the control connection of the pyrotechnic isolating element. Furthermore, a switch arrangement is designed to produce a controlling coupling for the transmission of signals between the output connection and the control connection either via the short-circuit branch or via the control branch.

The control device is set up to trigger an emergency operation different from normal operation in the event of a damage requiring a separation of the high-voltage voltage source from the on-board network and to apply a connection state of the electronic isolating element to the first connecting line and / or the electronic isolating element to the second connecting line in emergency operation monitor. In the event that the electronic isolating element of the first connecting line and / or the electronic isolating element of the second connecting line are open, the control device is set up to transmit a switching command for disconnecting the control branch and for connecting the short-circuit branch to the switch arrangement and an ignition pulse for ignition of the pyrotechnic separating element via the short-circuit branch, that is to say bypassing the control unit, to the control connection.

The invention also relates to a motor vehicle with an on-board network according to an embodiment of the invention.

The invention also includes further developments of the electrical system according to the invention and / or the motor vehicle according to the invention which have features as they have already been described in connection with the further developments of the method according to the invention. For this reason, the corresponding developments of the electrical system according to the invention and / or the motor vehicle according to the invention are not described again here.

The motor vehicle according to the invention is preferably designed as a motor vehicle, in particular as a passenger vehicle or truck, or as a passenger bus or motorcycle.

The control device for the motor vehicle also belongs to the invention. The control device can have a data processing device or a processor device which is set up to carry out an embodiment of the method according to the invention. For this purpose, the processor device can have at least one microprocessor and / or at least one microcontroller and / or at least one FPGA (Field Programmable Gate Array) and / or at least one DSP (Digital Signal Processor). Furthermore, the processor device can have program code which is set up to carry out the embodiment of the method according to the invention when it is executed by the processor device. The program code can be stored in a data memory of the processor device.

The invention also includes the combinations of the features of the described embodiments.

• 1 eine schematische Darstellung eines Kraftfahrzeugs mit einem Bordnetz in einer erfindungsgemäßen Ausführungsform;
• 2 eine schematische Darstellung eines zeitlichen Verlaufs eines ersten Betriebs eines erfindungsgemäßen Bordnetzes;
• 3 eine schematische Darstellung eines zeitlichen Verlaufs eines zweiten Betriebs eines erfindungsgemäßen Bordnetzes;
• 4 eine schematische Darstellung eines zeitlichen Verlaufs eines dritten Betriebs eines erfindungsgemäßen Bordnetzes; und
• 5 eine schematische Darstellung eines Verfahrens zum Betreiben eines erfindungsgemäßen Bordnetzes.

Exemplary embodiments of the invention are described below. This shows:

• 1 a schematic representation of a motor vehicle with an on-board network in an embodiment according to the invention;
• 2 a schematic representation of a time profile of a first operation of an on-board network according to the invention;
• 3 a schematic representation of a time profile of a second operation of an on-board network according to the invention;
• 4th a schematic representation of a time profile of a third operation of an on-board network according to the invention; and
• 5 a schematic representation of a method for operating an electrical system according to the invention.

The exemplary embodiments explained below are preferred embodiments of the invention. In the exemplary embodiments, the described components of the embodiments each represent individual features of the invention which are to be considered independently of one another and which also further develop the invention in each case independently of one another. Therefore, the disclosure is intended to include combinations of the features of the embodiments other than those shown. Furthermore, the described embodiments can also be supplemented by further features of the invention that have already been described.

In the figures, the same reference symbols denote functionally identical elements.

1 shows a schematic representation of a motor vehicle 11 with an on-board network 10 . The on-board network 10 can be a high-voltage voltage source 12th with an electrical positive pole 14th and an electrical negative pole 16 exhibit. The positive pole 14th can by means of a first connecting line 18th and the negative pole 16 can by means of a second connection line 20th with the electrical system 10 be connected. To connect the positive pole 14th and the negative pole 16 with the electrical system 10 can use the connecting lines 18th , 20th electronic separators 22nd , 24 each having an electronic separator 22nd , 24 in the first connection line 18th and an electronic separator 22nd , 24 in the second connection line 20th can be arranged. With the electronic separators 22nd , 24 can be electromechanical high-voltage contactors. The high-voltage contactors are preferably designed in such a way that they open automatically without current.

An example is in 1 shown that in the second connecting line 20th a pyrotechnic separator 26th is coupled in series. The pyrotechnic separator 26th can, as in 1 shown, between the high-voltage voltage source 12th and the electrical isolator 22nd , 24 be arranged. The pyrotechnic separator 26th however, it can also be on one of the high-voltage voltage sources 12th remote side of the respective electronic separating element 22nd , 24 serially in a respective connecting line 18th , 20th be coupled.

The pyrotechnic separator shown 26th has a control connection 28 on. Between the control connection 28 and an output port 30th a control device 32 of the electrical system 10 two parallel branches can be arranged. In one of the branches, the control branch 34 , can be a control unit 36 be serially coupled. In the other of the branches, the short-circuit branch 38 , no other electronic component is coupled in between. In other words, the short-circuit branch represents 38 a short circuit line 40 to short-circuit the output terminal 30th and the control connection 28 ready.

A switch arrangement 42 is designed to be between the control branch 34 and the short-circuit branch 38 to switch back and forth. The in 1 The state shown shows an example of how the switch arrangement 42 a controlling coupling for transmitting signals between the output port 30th and the control connection 28 via the short-circuit branch 38 manufactures. The dashed lines of the 1 however, show a state in which the switch assembly 42 said controlling coupling via the control branch 34 manufactures.

In addition, in 1 exemplarily shown that signal lines 44 , 46 between the electronic separators 22nd , 24 and the control device 32 get lost. By means of signals transmitted via these signal lines 48 can the control device 32 a connection state of each of the electronic separators 22nd , 24 monitor. In the event that one or both of the electronic separators 22nd , 24 are open, the control device 32 a switching command 50 to the switch assembly 42 to transfer.

1 also shows an example of a buffer unit 52 which, for example, can be designed as a capacitor and can be designed to supply the control unit 36 to provide with electrical energy. The control device 32 can be designed for this purpose, the buffer unit 52 by a control command 54 switch off and / or by opening a switching element 56 from the control unit 36 to separate electrically.

2 until 4th show different chronological sequences during the operation of an on-board network 10 . In particular, the exemplary case is discussed in which a motor vehicle first touches a collision partner at a respective point in time t0. A respective point in time t1 gives the point in time of the earliest detection of the collision by the control device 32 or a safety computer. A respective point in time t2 indicates a point in time of the latest detection of the collision. A respective point in time t3 indicates a point in time for non-volatile storage of the collision. A respective time period t21 indicates that time period within which a collision is detected by the control device 32 can be processed.

The schematic representation of the 2 is based on the exemplary situation that as a result of the aforementioned collision event, an operating voltage (not shown) collapses, causing the electronic isolating elements 22nd , 24 de-energize and open automatically at a point in time tMC.

The timeline of the 3 schematically depicts the case that the control device at a point in time tSC as a result of the detected collision 32 an ignition pulse for igniting the pyrotechnic separating element 26th transmitted before the high voltage contactors 22nd , 24 are open. Alternatively or additionally, a short circuit in the high-voltage system can be caused by the control unit at the time tKS 36 are recognized, whereupon this the ignition pulse to the pyrotechnic separating element 26th transmitted. At a point in time tPyro, the pyrotechnic separating element becomes 26th ignited and thereby irreversibly opened.

The schematic representation of the 4th is based, for example, on the situation that at a point in time tMC the high-voltage contactors 22nd , 24 be opened due to the aforementioned dropping of power, the switch arrangement at the same moment or after a contactor latency time has elapsed 42 from the control branch 34 on the short-circuit branch 38 switches over and the ignition pulse via the short-circuit line 40 directly to the pyrotechnic separator 26th is passed through. The pyrotechnic separating element is then activated at time tPyro 26th is ignited and at the same time the collision event is saved at time tSP.

5 shows with reference to the in connection with the 1 until 4th designated and described components a schematic representation of a method for operating an on-board network 10 . In one process step S1 becomes the electrical system 10 operated in normal operation. Normal operation describes in particular the state that the pyrotechnic separating element 26th via the control branch 34 and the interconnected control unit 36 with the output connector 30th the control device 32 connected is. In one process step S2 recognizes the control device 32 a claim. This is followed by a process step S3 an assessment of the damage case to determine whether it is a disconnection of the high-voltage voltage source 12th from the electrical system 10 requires or not. If separation is not required, the on-board network remains 10 in normal operation and the procedure is ended.

If separation is required, this is done in 5 Process shown in process step S4 continued. In process step S4 solves the control device 32 an emergency operation different from normal operation. In the emergency mode, the control device monitors 32 in one process step S5 a connection state of the electronic separators 22nd , 24 . Results in the monitoring in process step S6 that the electronic separators 22nd , 24 are closed, the monitoring of the connection status is continued. Results in the test in process step S6 however, that one or both of the electronic isolators 22nd , 24 are open, the control device transmits 32 in one process step S7 a switching command 50 to separate the control branch 34 and for connecting the short-circuit branch 38 to the switch assembly 42 . Finally, the controller conducts 32 in one process step S8 an ignition pulse for igniting the pyrotechnic separating element 26th via the short-circuit branch 38 to the control connection 28 of the pyrotechnic separator 26th by. This creates the pyrotechnic separator 26th separated, whereby the occurrence of the damage event is saved at the same time.

In known motor vehicles, a distinction is currently made between two crash states in the event of a crash or damage. If a slight crash is detected, the vehicle's airbags are usually not deployed, but the HV battery or high-voltage voltage source is requested by means of a bus signal to open the contactors or electronic isolating elements within a defined time (reversible). In the event of a hard crash, the safety computer or a control device ignites the airbags and transmits an ignition signal to the HV battery via a hardware line, the so-called ignition line or a control branch, which uses it to deactivate the battery irreversibly. The HV battery is deactivated by igniting a pyro element or a pyrotechnic isolating element with one pole and opening the contactors with two poles. Furthermore, the crash event must be stored in the battery in a non-volatile manner.

In the event of a hard crash, there are standard voltage drops in the 12 V on-board power supply system or in a low-voltage network area of an on-board network of the motor vehicle. This must be taken into account when designing the ignition in the event of a crash. The implementation must therefore buffer a certain time (cf. 2 until 4th ). The disadvantage here is that the buffering for such a long time requires large capacitors, which in turn leads to increased costs and more space.

The invention makes use of the fact that normally open contactors can be used as electronic isolating elements. The shutdown of the HV battery in the event of a crash and the non-volatile storage of the crash event are implemented using a combination of opening the contactor and igniting the pyro element.

This has the advantage that the duration for which a voltage drop has to be buffered only depends on the contactor characteristics. At the same time, the ignition of the pyro element is equivalent to storing the crash event in hardware.

In accordance with the requirements of HV safety, normally open contactors can be used in the HV battery. I. E. as soon as the 12 V voltage drops long enough, the contactors open because the contactor coils are no longer supplied with voltage.

A pyroelement is used both to separate a short circuit in the HV system and to ensure that the HV battery is deactivated in the event of a crash. An ECU or a control unit evaluates the ignition signal from the ignition cable (safety computer to HV battery) and generates an ignition pulse for the pyro element. Since this ECU is also supplied by the low-voltage on-board network, ignition in the event of a voltage failure is not possible without buffering.

In order to enable the lowest possible voltage buffering, credit is taken of the fact that currentless, open contactors are used. The supply voltage of the ECU for igniting the pyro element is supplied in the event of a collapse in the low-voltage on-board network via a buffer until the contactors are safely opened by the voltage drop. If a short circuit in the HV system or a signal on the ignition cable is detected during this time, the pyroelement is ignited by the ECU and a safe condition is thus established. This ensures that the crash event is saved in hardware via the separate pyro element, which is checked in the Init.

As soon as the contactors are open, the ECU no longer has to disconnect a short circuit, as the battery is already galvanically separated from the HV network. Furthermore, there is a need for the crash signal to be stored in a non-volatile manner. To do this, the wiring of the ignition cable is changed. This then no longer leads to the pyro element via the ECU, but the ignition pulse is transmitted directly to the pyro element (via a short-circuit line). This means that storage in the form of the ignited pyroelement is implemented in hardware again.

Two possible courses in a crash are conceivable, which are briefly explained below, whereby there is an interaction between the reaction to a short circuit in the HV system and the crash shutdown (cf. 2 ). Here, tMC denotes the time it takes for the contactor to open safely due to the 12 V on-board power supply voltage drop.

• - HV-Schütze sind zum Zeitpunkt des Crashs geschlossen
• - Die Zündleitung geht vom Airbag-Steuergerät (oder auch Safety Computer) zu einem Steuergerät (ECU), welches wiederum das Pyroelement zündet, sollte ein Crashsignal empfangen werden oder ein Kurzschluss detektiert werden

Possible course no. 1: HV contactors are closed and a crash occurs

• - HV contactors are closed at the time of the crash
• - The ignition cable goes from the airbag control unit (or safety computer) to a control unit (ECU), which in turn ignites the pyro element if a crash signal is received or a short circuit is detected

• - Die HV-Schütze sind geöffnet, weshalb ein Kurzschluss kein Problem mehr darstellt
• - Es erfolgt eine Umschaltung
• - Durch die Umschaltung wird das Zündsignal jetzt direkt an das Pyroelement weiter geleitet, wenn ein Zündsignal kommt
• - Da das Pyroelement im Init geprüft wird, wird ein Zuschalten der HV-Batterie verhindert (Hardware-Speicher des Crashs)

Possible course no. 2: HV contactors are already open because of a voltage drop in the event of a crash

• - The HV contactors are open, which is why a short circuit is no longer a problem
• - A switchover takes place
• - By switching, the ignition signal is now passed directly to the pyro element when an ignition signal is received
• - Since the pyro element is checked in the init, the HV battery is prevented from being switched on (hardware memory of the crash)

In 3 (Timeline in a crash from the first contact to the storage of the crash event by the pyro element before the contactors are opened) The case is shown when the ignition signal or a short circuit in the HV system is detected before the contactors are opened. The time between tPyro and tSC / tKS is the duration until the pyro element ignites (tSC: ignition pulse from the safety computer, tPyro: ignition of the pyro element and storage of the crash event, tKS: short circuit in the HV system).

4th (Timeline in a crash from the first contact to the storage of the crash event by the pyro element after the contactors have already opened) represents the case in which the ignition signal and a short circuit in the HV system are not detected before the contactors are opened. As soon as the contactors are opened, the system is changed so that the pyroelement is ignited directly by the signal on the ignition cable. Since the HV battery is already galvanically separated by the open HV contactors, the safe state is already taken with regard to the short circuit in the HV system. Accordingly, the short circuit in 4th is no longer taken into account (tPyro, U: point in time from which the ECU no longer ignites the pyro element, but rather the ignition line, tPyro, SP: point in time at which the pyro element ignited and the crash event is thus saved).

The switchover of the ignition of the pyro element to the ignition cable may only take place in the event of a crash and in the event of a voltage drop. This must be prevented during normal operation. The switchover must be prevented with the ASIL with which the short circuit must be separated. Reason: After switching over, pyro ignition by the corresponding ECU is no longer possible in the event of a short circuit.

Overall, the examples show how an on-board network can be operated efficiently using a shutdown concept for a high-voltage battery.

Claims (10)

A method for operating an on-board network (10) for an at least partially electrically powered motor vehicle (11), the on-board network (10) comprising an electrical high-voltage voltage source (12) with a positive pole (14) and a negative pole (16), - wherein the positive pole (14) can be connected to the vehicle electrical system (10) in an electrically conductive manner by means of a first connecting line (18) and the negative pole (16) by means of a second connecting line (20), - an electronic separating element (22, 24) being arranged in each of the first and second connecting lines (18, 20), - wherein a pyrotechnic separating element (26) is coupled in series in the first and / or the second connecting line (18, 20), - wherein the pyrotechnic separating element (26) has a control connection (28) which, in normal operation, is coupled to an output connection (30) of a control device (32) by means of a control branch (34), a control unit (36) in the control branch (34) ) is serially interconnected between the output connection (30) and the control connection (28), wherein parallel to the control branch (34) between the output connection (30) of the control device (32) and the control connection (28) of the pyrotechnic separating element (26) a short-circuit branch (38) runs, which has a short-circuit line (40) for short-circuiting the output connection (30 ) and the control connection (28), a switch arrangement (42) being designed to provide a controlling coupling for the transmission of signals between the output connection (30) and the control connection (28) either via the short-circuit branch (38) or via the control branch ( 34) to manufacture, wherein the control device (32) triggers an emergency operation different from normal operation and in the emergency operation when a case of damage that requires a separation of the high-voltage voltage source (12) from the vehicle electrical system (10) occurs - a connection state of the electronic isolating element (22, 24) of the first connecting line (18) and / or of the electronic isolating element (22, 24) of the second connecting line (20) is monitored, and - In the event that the electronic isolating element (22, 24) of the first connecting line (18) and / or the electronic isolating element (22, 24) of the second connecting line (20) are open, a switching command (50) to disconnect the control branch ( 34) and for connecting the short-circuit branch (38) to the switch arrangement (42) and transmits an ignition pulse to ignite the pyrotechnic separating element (26) via the short-circuit branch (38) to the control connection (28). Procedure according to Claim 1 , wherein a buffer unit (52) is designed to provide the control unit (36) with electrical energy, the control device (32) switching off the buffer unit (52) as soon as the control device (32) detects that the electronic isolating element (22 , 24) of the first connecting line (18) and / or the electronic separating element (22, 24) of the second connecting line (20) are open. Method according to one of the preceding claims, wherein the electronic isolating element (22, 24) of the first connecting line (18) and / or the electronic isolating element (22, 24) of the second connecting line (20) are designed as a high-voltage contactor which is activated in the event of a break-in a predetermined operating voltage of the vehicle electrical system (10) opens automatically. Procedure according to Claim 3 , whereby the high-voltage contactor opens only after a contactor latency period that depends on a contactor characteristic. Procedure according to Claim 4 , wherein an electrical voltage required for operation of the control unit (36) is buffered for a duration of the contactor latency. Method according to one of the Claims 4 or 5 , being in the event that within the Contactor latency a short circuit occurs in the high-voltage voltage source (12), the control unit (36) detects this and ignites the pyrotechnic separating element (26). Method according to one of the preceding claims, wherein a state of the pyrotechnic separating element (26) is checked during an initialization phase of the vehicle electrical system (10) and, when the state is disconnected, startup of the high-voltage voltage source (12) is prevented. Method according to one of the preceding claims, wherein the disconnection of the control branch (34) and the connection of the short-circuit branch (38) are prevented by a safety routine. On-board network (10) for an at least partially electrically powered motor vehicle (11), the on-board network (10) comprising an electrical high-voltage voltage source (12) with a positive pole (14) and a negative pole (16), - wherein the positive pole (14) can be connected to the vehicle electrical system (10) in an electrically conductive manner by means of a first connecting line (18) and the negative pole (16) by means of a second connecting line (20), - an electronic separating element (22, 24) being arranged in each of the first and second connecting lines (18, 20), - wherein a pyrotechnic separating element (26) is coupled in series in the first and / or the second connecting line (18, 20), - wherein the pyrotechnic separating element (26) has a control connection (28) which, in normal operation, is coupled to an output connection (30) of a control device (32) by means of a control branch (34) having a control unit (36), a short-circuit branch (38) through which a short-circuit line (40) for short-circuiting the output connection ( 30) and the control connection (28) is provided, wherein a switch arrangement (42) is designed to produce a controlling coupling for the transmission of signals between the output connection (30) and the control connection (28) either via the short-circuit branch (38) or via the control branch (34), the control device (32 ) is set up to trigger an emergency operation that differs from normal operation and in the emergency operation when a case of damage that requires separation of the high-voltage voltage source (12) from the vehicle electrical system (10) occurs - to monitor a connection state of the electronic isolating element (22, 24) of the first connecting line (18) and / or of the electronic isolating element (22, 24) of the second connecting line (20), and - In the event that the electronic isolating element (22, 24) of the first connecting line (18) and / or the electronic isolating element (22, 24) of the second connecting line (20) are open, a switching command (50) to disconnect the control branch ( 34) and to connect the short-circuit branch (38) to the switch arrangement (42) and to pass an ignition pulse for igniting the pyrotechnic separating element (26) via the short-circuit branch (38) to the control connection (28). Motor vehicle (11) with an on-board network (10) according to Claim 9 .

Images