DE102018221201B4 - Motor vehicle control device with a plurality of supply connections for a redundant voltage supply and motor vehicle with the control device and method for operating the control device - Google Patents

Abstract

Control unit (11) for a motor vehicle (10), having at least two supply connections (15, 19) for receiving a respective supply voltage (Ub, Un) from a respective supply line (13, 17), the respective supply connection being within the control unit (11). (15, 19) is connected via a respective supply path (27, 29) to a common supply input (21) of an electrical device circuit (20) of the control unit (11) and it is provided that at least one of the supply connections (19) is connected to a predetermined electrical Feedback from the control unit (11) is secured by a respective unidirectional blocking element (Dy) in the supply path (29) of the supply connection (19) to be secured, which has a unidirectional current flow towards the device circuit (20) and a blocking effect for a current flow towards the supply connection (19), is provided, characterized in that in each case in the supply path (29) of the supply connection (19) to be secured between the supply connection (19) and the blocking element (Dy) a switching element (Tx) is provided and a Control logic (46) for the switching element (Tx) is set up to switch the switching element (Tx) depending on a respective value of the supply voltage (Ub) present at each remaining supply connection (15), a diagnostic circuit (36) being set up for this is to check the blocking effect of the respective blocking element (Dy) while the switching element (Tx) is electrically blocked, and a controller circuit (31) of the control device (11) is connected to the switching element (Tx) and is set up to switch the switching element ( Tx) to determine its functionality to be electrically conductive or electrically blocking and then using the diagnostic circuit (36) to check a change in the potential in the supply path (29) in the section between the switching element (Tx) and blocking element (Dy).

Description

The invention relates to a control device for a motor vehicle. In the case of the control unit, it is ensured here that no electrical interference can get from the control unit into a supply line, as a result of which other control units connected to the supply line could otherwise be disturbed. The invention also includes a motor vehicle with at least one control unit according to the invention.

Provision can be made in a motor vehicle for a control device to be supplied with an electrical supply voltage via a plurality of electrical supply lines. Provision can be made here for the control device to be connected to a base supply line or to a plurality of base supply lines, via which an electrical device circuit of the control device, for example a power supply unit, receives an electrical base supply voltage in each case. The base supply voltage can be generated, for example, by means of an electrical generator and/or by means of a DC voltage converter. In the case of a DC voltage converter, the basic supply voltage can be generated, for example, from an electrical voltage of a different, for example higher, voltage level.

In order to be able to continue operating the control unit in the event of a fault in the basic supply voltage, for example if the said generator and/or DC voltage converter is defective, an emergency supply voltage can be provided via an emergency supply line or via several emergency supply lines. This can, for example, be backed up or buffered by a back-up battery compared to the basic supply voltage. A control unit, which is redundantly supplied via the emergency supply line, can be provided, for example, for a safety-related function in the motor vehicle. In particular in a motor vehicle with autonomous or semi-autonomous driving, ie in an autonomous or semi-autonomous motor vehicle, one or more control devices for providing the autopilot function can be redundantly or additionally connected to the emergency supply line.

If there is a failure or a fault in the basic supply voltage, each control unit connected to the emergency supply line can be supplied with the emergency supply voltage and can therefore continue to be operated at least to a limited extent. However, if there is an additional fault in one of these control units, it must be ensured that this fault in the control unit does not have any repercussions on the emergency supply line, since otherwise every other control unit connected to the emergency supply line would be affected, including its own operation would be disrupted. In other words, with such a control unit, the electrical emergency supply connection, via which the control unit is connected to the emergency supply line, must be secured against electrical feedback into the emergency supply line. An emergency supply connection can be provided for each emergency supply line to be connected, which must be secured against electrical feedback.

In order to connect a basic supply line, a corresponding basic supply connection can be provided in a control device. Each basic supply connection and each emergency supply connection can then be connected to a supply input of said electrical device circuit of the control device via a respective separate current path or supply path. The supply paths from each base supply connection and each emergency supply connection thus converge at the supply input so that the received supply voltages (at least one base supply voltage and at least one emergency supply voltage) can be provided at the supply input of the device circuit. This supply input can, for example, lead to the above-mentioned repercussion. If, for example, the base supply voltage rises to an overvoltage (e.g. over 150% of the nominal value), this overvoltage can reach an emergency supply line via the supply path of an emergency supply connection.

In order to prevent this, it is known from the prior art to connect a diode in the respective supply path of an emergency supply connection, the flow direction of which points from the emergency supply connection towards the supply input.

Depending on the degree or level of safeguarding against a reaction, a control device can also be provided for diagnosing or monitoring the blocking effect of the diode. This can, for example, be required for a level according to the ASIL (Automotive Safety Integrity Level) (e.g. ASIL-B and higher). If a diode is connected in a control device in the supply path of an emergency supply connection, a diagnostic circuit can also be provided which is set up to monitor its blocking effect, ie the functionality of the diode.

However, as in the DE 10 2012 110 281 A1 described, a check of the blocking effect can only be carried out when the control unit is started, since during operation of the control unit the supply input of the electrical device circuit, at which the supply voltage is to be provided, must be connected both to a basic supply line and to an emergency supply line, so that this is continuous during during operation, a fallback to the emergency supply voltage is possible. If there is a defect in the diode during operation, this will not be detected for the remaining duration of operation. If there is a fault in the base supply voltage during this period, this fault can be transmitted through the defective diode (if it has lost its blocking effect) to an emergency supply line.

From the DE 10 2016 112 764 A1 It is known that protection against repercussions can be achieved by actively switching transistor switches, which switch a consumer to another vehicle electrical system when a fault is detected in one vehicle electrical system.

The object of the invention is to provide protection in a control unit against an electrical reaction from the control unit into a supply line to which the control unit is connected.

The object is solved by the subject matter of the independent patent claims. Advantageous embodiments of the invention are described by the dependent patent claims, the following description and the figures.

The invention is based on a control device for a motor vehicle, the control device having at least two supply connections for receiving a respective supply voltage from a respective supply line of the motor vehicle. This results in a redundant power supply. At least one supply line can be a base supply line, for example, from which the base supply voltage described is received. At least one additional supply line can be an emergency supply line for receiving the emergency supply voltage described. Each supply connection is set up to connect one of the supply lines. For example, a plug connection for a plug of the supply line and/or a screw connection can be provided.

The supply voltages received at the supply connections are combined within the control unit. For this purpose, the respective supply connection within the control unit is connected via a respective separate supply path to a common supply input of an electrical device circuit of the control unit. The electrical device circuit is the circuit that provides the device function of the control device. In other words, the electrical device circuit is operated or supplied with the supply voltages that are received via the multiple supply connections.

In order to prevent, for example, an overvoltage that reaches the control unit via a supply line at one of the supply connections, being transmitted in the control unit via the device circuit to another supply connection and being impressed there into another supply line, i.e. the described repercussion of a fault in one of the supply lines (overvoltage) occurs in another supply line, it is provided that at least one of the supply connections is secured against a predetermined electrical reaction from the control device by providing a respective unidirectional blocking element in the supply path of the supply connection to be secured. Such a blocking element can be a diode, for example. In general, it is provided as a blocking element that allows a unidirectional current flow to the device circuit, but has a blocking effect on a current flow to the supply connection. It is therefore only permitted a current flow from the supply connection to be protected along the supply path and through the blocking element to the device circuit.

With this protection, which is known per se from the prior art, one would have to rely on the blocking element being permanently functional and not, for example, losing its blocking effect and becoming permanently conductive (so-called breakdown). If a fault then occurred in one of the supply lines, the blocking element would no longer suppress or prevent the reaction to the other supply line. In order not to have to rely exclusively on a functioning blocking element and/or to be able to check the blocking element during operation, the invention provides that in the supply path of the supply connection to be secured, i.e. in such a supply path that also contains a blocking element, between the Supply connection on the one hand and the blocking element on the other hand additionally provided a switching element and a control logic for the switching element is set up to the switching element depending on to switch an electrical voltage present at each remaining supply connection. The switching element can therefore be switched by means of a switching signal, for example. Such a switching element can be implemented on the basis of a transistor, for example. The switching of the switching element is performed by a control logic. This control logic switches the switching element as a function of the respective supply voltage which is present at every other supply connection to which a supply line is connected in each case. So while the blocking element passively blocks the reaction in the supply connection to be secured, in that the direction of flow of the electric current is unidirectional, the control logic now also provides active protection, which provides for the switching element to be activated depending on the electrical boundary conditions, namely the electrical supply voltage , to switch in the other supply paths or at every other supply connection. The control logic can thus always react by switching the switching element if there is a fault in at least one other supply line. The respective control logic for the switching element of a supply path can be implemented, for example, on the basis of discrete logic components and/or an integrated circuit.

Since the switching element is connected between the supply connection and the blocking element in the supply path of each supply connection to be secured against reaction, the switching element can also be used to provide a self-test.

For this purpose, the invention provides that a diagnostic circuit is set up to check the blocking effect of the respective blocking element, which is connected together with the switching element in the supply path. In this case, the blocking element is checked while the switching element is electrically blocked. If the blocking element is working, then there must be an electrical potential between the blocking element and the switching element that is different from the electrical potential at the supply input of the device circuit, which can be verified by the diagnostic circuit because the switching element is switched to be electrically blocking.

For this purpose, in one embodiment, the diagnostic circuit for testing the blocking element provides a voltage divider and a digital evaluation circuit. The voltage divider is connected on the one hand between the switching element and the blocking element to the supply path and on the other hand to a reference potential, for example a ground potential. In this case, a voltage divider can have two resistance elements, for example ohmic resistors, which are connected in series, so that the supply path is connected to the reference potential via a series connection of the two resistance elements of the voltage divider. A tap of the voltage divider results in a known manner between the two resistance elements. This tap of the voltage divider is connected to an analog/digital converter of the evaluation circuit. The functionality of the blocking effect can thus be checked digitally by means of the voltage divider and the evaluation circuit. The use of a voltage divider has the additional advantage that when the switching element is switched off, the potential of the supply path is set in a defined manner in the area between the switching element and the blocking element, with the potential having to correspond to the reference potential when the blocking element has a blocking effect.

In the case of the invention, a controller circuit of the control device is likewise connected to the respective switching element and set up to switch the switching element to an electrically blocking or electrically conducting state in order to determine its functionality. The switching state of the switching element can therefore be changed temporarily in order to determine the functionality. The controller circuit can be part of the device circuit described, for example. It can be implemented on the basis of at least one microcontroller. The controller circuit is designed to switch the switching element. A change in the potential in the supply path in the section between the switching element and blocking element can then be checked by means of the diagnostic circuit. If there is no change in the potential in the supply path during a switching process or a switching signal to the switching element, then the switching element has obviously not switched and is therefore inoperable. If the switching element is functional, a switching process results in a change in the potential in the supply path, which can be confirmed or verified by the diagnostic circuit.

The invention also includes embodiments that result in additional advantages.

Several embodiments address what circuit operations the control logic can perform to obtain protection against electrical feedback.

In one embodiment, the control logic of the respective switching element is set up to switch the switching element it controls to be electrically conductive if the supply voltage received there is present at every other supply connection is less than a predetermined threshold. If there is no longer any sufficient supply voltage available at any other supply connection, i.e. every remaining supply voltage is less than the threshold value, the blocking element is switched to be electrically conductive and the supply voltage received via the supply connection to be secured against the reaction is thus passed through to the supply input of the electrical device circuit . The supply connection to be protected is thus used when no supply voltage sufficient according to the threshold value is present at any other supply connection. The combination of the test results of each remaining supply voltage can be implemented, for example, by means of an OR circuit and an inversion element. For example, the threshold value can be less than 70 percent or less than 50 percent of a nominal value of the supply voltage of the respective supply connection. In a motor vehicle, for example, 12 volts or 24 volts or 48 volts can be provided as the nominal value.

In one embodiment, the respective control logic is set up to switch the switching element it controls to an electrically non-conducting state if the supply voltage received at at least one other supply connection is greater than the threshold value. So as long as a sufficient supply voltage (i.e. greater than the threshold value) is received at another supply connection, the electrical connection between the supply connection to be secured against the reaction and the device circuit of the control device remains blocked or electrically blocked because the corresponding switching element remains electrically blocked. The supply connection to be secured against the reaction is therefore only used if a supply voltage that is sufficient according to the threshold value cannot be received via any other supply connection. This connection strategy has the advantage that the supply connection to be secured is permanently secured against repercussions, since the switching element remains electrically blocked, and only in the event that a supply voltage greater than the threshold value is not present at any other supply connection, i.e. there is no risk of a Overvoltage is present, the switching element is switched to be electrically conductive.

In one embodiment, the respective control logic is set up to switch the switching element it controls to an electrically non-conducting state if the supply voltage received at at least one other supply connection is greater than a predetermined overvoltage value. As soon as the overvoltage is detected, the switching element is switched to be electrically non-conducting. This results in active protection against overvoltage. The overvoltage value can be in a range greater than 150 percent of said nominal value of the respective supply voltage, for example greater than 18 volts or greater than 20 volts. The switching element can also be switched to be electrically blocking when the voltage at the supply input of the device circuit, ie the voltage that ultimately reached the device circuit and/or a voltage generated by the device circuit itself, is greater than the overvoltage value. Overall, there is the advantage that the electrical connection to the supply connection to be protected is always turned off or blocked when there is an overvoltage.

Up to now, protection of the supply connection has been described, in particular with regard to an overvoltage. If there is a short circuit in the control unit or in a supply line, this can also have an effect on the supply connection to be protected in the form of a short circuit current. In order to avoid this, one embodiment provides that a fuse is provided for the supply connection to be secured, which fuse is set up to interrupt a current flow through the supply connection if an amperage of the current flow is greater than a predetermined trigger value. This triggering value can be in a range from 3 amperes to 10 amperes, for example 5 amperes. A fuse or an electronic fuse with a transistor can be provided as a fuse, for example. This also provides protection against reaction due to a short circuit.

In one embodiment, the respective said switching element is designed on the basis of at least one transistor for blocking the flow of current. In particular, a field effect transistor (FET), for example a MOSFET (MOS—metal oxide semiconductor), and/or a bipolar transistor can be used or provided as the transistor. A switching element based on at least one transistor has the advantage that a switching speed can be realized that is sufficiently high to prevent or block a reaction on the supply connection to be secured when a fault is detected in the control unit or in a supply line before damage can occur.

According to one embodiment, it is provided that the respective switching element has two MOSFETs with a respective body diode and the two MOSFETs are connected in opposite directions Body diodes are connected in series. Both MOSFETs can each be switched simultaneously. The opposite connection of body diodes is also referred to here as back-to-back connection (back-to-back connection). A switching element with two MOSFETs connected back-to-back has the advantage that a current flow in the two possible current directions can be blocked by means of the switching element.

A diode can be provided as the respective blocking element in the manner described and/or a MOSFET with a body diode and/or a switching unit which can be switched to be electrically conductive and electrically blocking depending on an electrical voltage drop across it (so-called ideal diode) . As an ideal diode, the blocking element is electrically conductive in the event that an electrical voltage at the supply connection is greater than at the supply input of the device circuit, and in the event that the electrical voltage at the supply connection is lower than at the supply input, the blocking element becomes electrically blocking switched. A voltage drop or voltage difference as with the real diode (e.g. of 0.7 volts) can therefore be dispensed with.

The invention also includes a motor vehicle with a plurality of electrical supply lines, of which at least one can be a basic supply line in the manner described and at least one can be an emergency supply line. In other words, different voltage sources can be provided for providing a respective supply voltage in the supply lines for at least two supply lines. In each case one of the supply lines is connected to or connected to a respective supply connection of a control device according to the invention. In the motor vehicle, the control unit advantageously prevents a predetermined electrical reaction, for example an overvoltage and/or a short-circuit current, from one of the supply lines to another supply line to be protected or secured.

The operation of the control device according to the invention results in a method that is also part of the invention. In the method, an electrical supply line of a motor vehicle is therefore protected against a predetermined electrical reaction from a control unit. In particular, an overvoltage (above an overvoltage value) and/or a short-circuit current (with a current strength greater than a short-circuit value, for example greater than 6 amperes) can be monitored or blocked as a reaction. In the method, in the manner described, the control device is connected to the supply line to be secured and at least one further electrical supply line for receiving a respective supply voltage. In the control device, a switching element is switched by a control logic, through which a supply path of that supply connection runs to which the supply line to be secured is connected. In this case, the control logic switches the switching element depending on the respective supply voltage of the at least one further supply line. The switching state of the switching element is therefore set depending on the value of the respective supply voltage on the at least one additional supply line, with this value being able to be determined or measured via the respective supply connection to which the respective additional supply line is connected.

The invention also includes developments of the method according to the invention, which have features as have already been described in connection with the developments of the control device according to the invention. For this reason, the corresponding developments of the method according to the invention are not described again here.

The invention also includes the combinations of features of the described embodiments.

• 1 eine schematische Darstellung einer Ausführungsform des erfindungsgemäßen Kraftfahrzeugs mit einer Ausführungsform des erfindungsgemäßen Steuergeräts; und
• 2 eine schematische Darstellung einer weiteren Ausführungsform des erfindungsgemäßen Kraftfahrzeugs mit einer weiteren Ausführungsform des erfindungsgemäßen Steuergeräts.

An exemplary embodiment of the invention is described below. For this shows:

• 1 a schematic representation of an embodiment of the motor vehicle according to the invention with an embodiment of the control unit according to the invention; and
• 2 a schematic representation of a further embodiment of the motor vehicle according to the invention with a further embodiment of the control unit according to the invention.

The exemplary embodiment explained below is a preferred embodiment of the invention. In the exemplary embodiment, the described components of the embodiment each represent individual features of the invention to be considered independently of one another, which also develop the invention independently of one another and are therefore also to be regarded as part of the invention individually or in a combination other than the one shown. Furthermore, the embodiment described can also be supplemented by further features of the invention already described.

Elements with the same function are each provided with the same reference symbols in the figures.

1 shows a motor vehicle 10, such as can be implemented by a motor vehicle (passenger car or truck) or a passenger bus. A control device 11 can be provided in motor vehicle 10, which can be, for example, a control device for a vehicle light, for example a headlight or a pair of headlights. An electrical voltage source 12 can be provided in motor vehicle 10 for operation of control unit 11 . A vehicle electrical system voltage can be provided by the voltage source 12, which is referred to here as the base supply voltage Ub. For example, the base supply voltage Ub can be in a range from 10 volts to 60 volts, for example it can be 12 volts. The voltage source 12 can be generated, for example, by means of a DC-DC converter, which can generate the base supply voltage Ub from a different voltage level, for example a higher voltage level. The control device 11 can be electrically connected to the voltage source 12 via a plurality of base supply lines 13 . A basic supply line 13 can be implemented, for example, on the basis of a wire or cable. It is shown how an electrical fuse 14 can also be provided for each basic supply line 13 . Each base supply line 13 can be connected to the controller 11 by means of a base supply connection 15 . A plug connection or screw connection can be provided on a basic supply connection 15 , for example.

For a redundant supply of the control device 11, an additional electrical emergency voltage source 16 can be provided in the motor vehicle 10, which can be implemented, for example, on the basis of an electric battery and/or at least one capacitor (double-layer capacitor). Provision can also be made for the voltage sources 12, 16 to be electrically connected to one another and in the event of a fault in the voltage source 12, this connection is interrupted so that the emergency voltage source 16 is operated exclusively on the basis of its battery and/or its at least one capacitor. The control device 11 can be electrically connected to the additional emergency voltage source 16 via an emergency supply line 17 . The emergency supply line 17 can also be implemented, for example, on the basis of a wire or a cable. An electrical fuse 18 can also be provided in the emergency supply line 17 . The emergency supply line 17 can be connected to the control device 11 by means of an emergency supply connection 19 of the control device 11 . A plug connection or screw connection for the emergency supply line 17 can also be provided here. An emergency supply voltage Un from the additional emergency voltage source 16 can be received at the emergency supply connection 19 via the emergency supply line 17 .

The basic supply lines 13 and the emergency supply line 17 each represent a supply line. The basic supply connections 15 and the emergency supply connection 19 each represent a supply connection. The basic supply voltage Ub and the emergency supply voltage Un each represent a supply voltage.

The base supply voltage Ub and the emergency supply voltage Un for the operation of an electrical device circuit 20 can be provided in the control unit 11 . For this purpose, the received base supply voltage Ub and the received emergency supply voltage Un can be brought together or combined at a supply input 21 of the device circuit 20 . When the voltage source 12 is functional, the base supply voltage Ub results at the supply input 21, as shown in 1 is specified. A power pack 22, for example, can be connected to the supply input 21, by means of which an operating voltage for the device circuit 20 can be generated from the received base supply voltage Ub. The power pack 22 can be implemented, for example, by means of an SBC (System Basic Chip). Voltage stabilization can be achieved by means of a step-up converter 23, via which the power pack 22 or the SBC can be coupled to the supply input 21. The step-up converter 23 can have an inductor 24, a diode 25, a capacitor C1 and a switching element 26 in a manner known per se.

Unlike in 1 shown, only one basic supply line 13 can also be provided. Unlike in 1 shown, the control device 11 can be connected to several emergency supply lines 17 .

In order to prevent an electrical fault in the device circuit 20 from affecting each of the base supply lines 13, a diode D1, D2, D3 and/or another blocking element can be connected in the respective supply paths 27, each of which connects a base supply connection 15 to the supply input 21 be, the blocking element blocks only unidirectionally, that is, a direction of flow from the respective base supply port 15 to the supply input 21 and a blocking effect of can provide the supply input 21 towards the respective base supply connection 15 .

The emergency supply line 17 represents a supply line to be secured against reaction. In the control unit 11, therefore, a reaction of the control unit 11 via the respective emergency supply connection 19 into the respective emergency supply line 17 is avoided in particular. This ensures that at least one other control unit 28, which is also supplied via the emergency supply line 17, is not also disrupted or affected by a fault in a basic supply line 13 and/or by a fault in the control unit 11 via the emergency supply connection 19 of the control unit 11 can be drawn. This prevents, for example, an overvoltage in one of the basic supply lines 13 from also causing an overvoltage in the emergency supply line 17 through the control device 11 .

For this purpose, a blocking element Dy can be connected in a supply path 29, which connects the emergency supply connection 19, which is to be secured against reaction, to the supply input 21 Blocking direction or blocking effect from the supply input 21 towards the emergency supply connection 19 . The supply path 29 can in each case be implemented, for example, on the basis of a wire and/or cable and/or a conductor track of a circuit board. A blocking element Dy can be implemented, for example, on the basis of a diode and/or a MOSFET with a body diode and/or the circuit described for an ideal diode, just to name examples.

The control unit 11 can also be designed with diagnostic capability, ie the functionality of each blocking element Dy of each supply connection to be secured can be checked. For this purpose, a switching element Tx can also be arranged in the respective supply path 29, which can be implemented, for example, on the basis of a transistor, in particular a MOSFET. A redundant resolution or switching of the switching element Tx can be carried out by a controller circuit 31 of the control device 11 via an OR circuit 30 . At least one microcontroller 32 can be provided in the controller circuit 31, for example, and optionally an auxiliary microcontroller 33, which can provide an emergency functionality in the event of an error in the microcontroller 32. The OR circuit 30 can be implemented in a manner known per se on the basis of at least one logic module and/or on the basis of diodes and/or transistors.

In error-free normal operation of the device circuit 20, in the in 1 embodiment shown, the switching element Tx remain permanently switched electrically off, so that only the base supply voltage Ub without the emergency supply voltage Un at the supply input 21 is available.

When the switching element Tx is electrically blocked, the respective blocking effect of the blocking element Dy can be verified by means of a diagnostic circuit 36 . For this purpose, an electrical voltage divider N of the diagnostic circuit 36 in the supply path 29 can be connected at a contact point 37 between the blocking element Dy on the one hand and the switching element Tx on the other hand. The voltage divider N can connect the contact point 37 to a reference potential 38, e.g. A tap 41 of the voltage divider N can be connected to an analog/digital converter 42 of a digital evaluation circuit 43 which can be implemented on the basis of the controller circuit 31 .

A voltage value 44 which corresponds or correlates with a voltage value at the contact point 37 can be tapped off at the tap 41 . It can thus be determined by the evaluation circuit 43 which electrical voltage or which potential the supply path 29 has between the switching element Tx and the blocking element Dy.

When the switching element Tx is switched to blocking and the blocking element Dy is simultaneously present, an electrical potential is produced at the contact point 37 which, due to the voltage divider N, can correspond to the reference potential 38 and/or which is smaller than the base supply voltage Ud and thereby also smaller than the emergency supply voltage Un is. On the other hand, if the voltage value 44 is above a predetermined threshold value, this can be evaluated or interpreted by the evaluation circuit 43 to the effect that the blocking effect on the blocking element Dy is not present and/or the switching element Tx is through-contacted, i.e. electrically not blocking.

For a self-test of the switching capability of the switching element Tx, for example when the control unit 11 is switched on, the switching element Tx can be temporarily switched to be electrically conductive for a diagnostic routine 34, which can be executed by the controller circuit 31, which can be done, for example, via a respective switching signal 35 of the controller circuit 31 can be implemented. In the electrically conductive state of the switching element Tx, the emergency supply voltage Un between the switching element Tx and the blocking element Dy is available or measurable if the switching element Tx is functional, ie actually switches to the switching signal 35 into the electrically conductive state.

In the control unit 11 according to 1 the switching element Tx also provides protection against a reaction from the supply input 21 to the emergency supply connection 19, in that the switching element Tx is switched to a normal mode by a control logic 46 in an electrically blocked manner when the base supply voltage Ub is above a threshold value 45 for a minimum base supply voltage is. If an overvoltage then occurs at the supply input 21 , this is blocked or held back both by the blocking element Dy and by the switching element Tx, that is to say it is kept away from the emergency supply connection 19 . The emergency supply connection 19 is thus secured against repercussions.

The control logic 46 can be implemented on the basis of an OR switching element 47 and an inversion element 48 . A switching signal 35' from the control logic 46 can be combined with the switching signal 35 by means of the OR circuit 30 described to form a switching signal for the switching element Tx, for example a gate voltage.

If, on the other hand, the base supply terminals 15 have a voltage value of the base supply voltage Ub that is less than the said threshold value 45, the switching element Tx can be switched to be electrically conductive by the control logic 46.

The first step is to introduce a switching element (e.g. MOSFET, bipolar transistor) that separates the respective supply path under test. This enables the functionality of the respective blocking element (e.g. diode) to be checked. The short response time for the blocking function and the lack of feedback must also be guaranteed in the event of a single fault in the components involved; dormant faults can be detected by cyclic testing. Since this can only be implemented when the switching element is deactivated, the solution to the problem is to switch on the relevant redundant supply only if the basic supply voltages are lost or undervoltage (switch-on strategy). This ensures that the redundant supply is always decoupled in the nominal case or during overvoltages on the basic supplies and can be diagnosed at any time.

2 illustrated as opposed to the activation strategy according to FIG 1 a switch-off strategy can be provided by using the control logic 46 to check for each base supply connection 15 whether the base supply voltage Ub received via it is greater than a predetermined overvoltage value 49 . This can be implemented using a comparator 50, which can be implemented on the basis of an operational amplifier, for example. The result of the comparison can be converted back into the switching signal 35' by means of an inverting element 48. The switching element Tx can thus remain electrically conductive during operation in which each received base supply voltage Ub is less than the overvoltage value 49, and the switching element Tx is then switched off electrically only in the event of an overvoltage in at least one of the base supply lines 13.

2 further illustrates how the switching element Tx can be implemented on the basis of two MOSFETs connected back-to-back. The two body diodes block current flow in either direction.

2 also illustrates how the switching element Tx is switched into an electrically blocking state temporarily or during a measurement phase for a test of the blocking effect of the blocking element Dy by means of a switching signal 35 from at least one of the two microcontrollers 32, 33 or by simultaneous switching by means of both microcontrollers 32, 33 can be. The switching signals 35 of the microcontrollers 32, 33 can be combined by means of a combination circuit 51, for example an AND circuit.

The diagnostic circuit 36 with the voltage divider N can be used in the circuit of 2 be realized in the same way as it is related to 1 is described. Therefore, the diagnostic circuit 36 in 2 is not shown again, but is instead represented by ellipsis at pad 37.

Different supply paths or supply paths can thus be brought together in the control unit 11 for the logic supply of the device circuit via blocking elements D1, D2, D3, Dy (e.g. diodes) in order to ensure redundancy. The blocking elements D1, D2, D3, Dy prevent cross currents (reactions) between the supply connections.

As soon as there is a requirement for freedom from feedback, particularly in ASIL-C/D, with a short reaction time, each blocking element to be secured must be able to be diagnosed for functionality based on the ASIL requirements.

For this purpose, the control unit sees a circuit to prevent overvoltage reactions from the basic supplies of a control unit to one or more redundancy supplies or emergency supplies, taking into account the necessary diagnostic requirements for fulfilling the ASIL-C/D requirements and at the same time ensuring the security of supply of the control unit concerned.

Overall, the example shows how the invention can prevent a time-critical supply feedback, taking functional safety and diagnostic capability into account.

Reference List

10

motor vehicle

11

control unit

12

voltage source

13

basic supply line

14

fuse

15

basic supply connection

16

backup power source

17

emergency supply line

18

fuse

19

emergency supply connection

20

device circuit

21

supply input

22

power adapter

23

boost converter

24

inductance

25

diode

26

switching element

27

supply path

28

control unit

29

supply path

30

OR circuit

31

controller circuit

32

microcontroller

33

microcontroller

34

diagnostic routine

35

switching signal

36

diagnostic circuit

37

contact point

38

reference potential

39

resistance element

40

resistance element

41

tap

42

Analog to digital converter

43

evaluation circuit

44

voltage value

45

threshold

46

control logic

47

switching element

48

inversion element

49

overvoltage threshold

50

comparator

51

combination circuit

C1

capacity

D1-D3

diode

dy

blocking element

tx

switching element

Ub

base supply voltage

U.N

emergency supply voltage

Claims (11)

Control unit (11) for a motor vehicle (10), having at least two supply connections (15, 19) for receiving a respective supply voltage (Ub, Un) from a respective supply line (13, 17), the respective supply connection being within the control unit (11). (15, 19) is connected via a respective supply path (27, 29) to a common supply input (21) of an electrical device circuit (20) of the control unit (11) and it is provided that at least one of the supply connections (19) is connected to a predetermined electrical Feedback from the control unit (11) is secured by a respective unidirectional blocking element (Dy) in the supply path (29) of the supply connection (19) to be secured, which has a unidirectional current flow towards the device circuit (20) and a blocking effect for a current flow towards the supply connection (19), is provided, characterized in that in each case in the supply path (29) of the supply connection (19) to be secured between the supply connection (19) and the blocking element (Dy) a switching element (Tx) is provided and a Control logic (46) for the switching element (Tx) is set up to switch the switching element (Tx) depending on a respective value of the supply voltage (Ub) present at each remaining supply connection (15). ten, wherein a diagnostic circuit (36) is set up to check the blocking effect of the respective blocking element (Dy) while the switching element (Tx) is electrically blocked, and a controller circuit (31) of the control unit (11) with the switching element (Tx ) is connected and set up to switch the switching element (Tx) to be electrically conductive or electrically blocked in order to determine its functional capability, and then by means of the diagnostic circuit (36) to detect a change in the potential in the supply path (29) in the section between the switching element (Tx) and the blocking element (Dy) check. Control unit (11) after claim 1 , wherein the respective control logic (46) is set up to switch the switching element (Tx) controlled by it to be electrically conductive if the supply voltage (Ub) received there is less than a predetermined threshold value (45) at every other supply connection (15). Control unit (11) after claim 2 , wherein the respective control logic (46) is set up to switch the switching element (Tx) controlled by it to an electrically blocking state if the supply voltage (Ub) received there is greater than the threshold value (45) at at least one other supply connection (15). Control device (11) according to one of the preceding claims, wherein the respective control logic (46) is set up to switch the switching element (Tx) controlled by it electrically to a blocking state if the supply voltage (Un) received there is present at at least one other supply connection (15). and/or an electrical voltage at the supply input (21) is greater than a predetermined overvoltage value (49). Control unit (11) according to one of the preceding claims, wherein the diagnostic circuit (36) for checking the blocking element (Dy) has a voltage divider (N) and a digital evaluation circuit (43), the voltage divider (N) on the one hand between the switching element (Tx) and the blocking element (Dy) is connected to the supply path (29) and on the other hand to a reference potential (38) and a tap (41) of the voltage divider (N) is connected to an analog/digital converter (42) of the evaluation circuit (43). . Control device (11) according to one of the preceding claims, wherein a fuse (18) is provided for the supply connection (19) to be secured, which is set up to interrupt a current flow through the supply connection (19) if a current strength of the current flow is greater than is a trigger value. Control device (11) according to one of the preceding claims, wherein the respective switching element (Tx) has at least one transistor, in particular a field effect transistor and/or a bipolar transistor, for blocking a current flow. Control unit (11) according to one of the preceding claims, wherein the respective switching element (Tx) has two MOSFETs with a respective body diode and the two MOSFETs are connected in series with body diodes connected in opposite directions. Control device (11) according to one of the preceding claims, wherein a diode and/or a MOSFET with body diode and/or a switching unit which is designed to be alternately electrically conductive and electrically blocking switchable is provided as blocking element (Dy). Motor vehicle (10) with a plurality of electrical supply lines (13, 17) and at least one control unit (11) according to one of the preceding claims, one of the supply lines (13, 17) being connected to a respective supply connection (15, 19) of the control unit (11) connected. Method for protecting an electrical supply line (17) of a motor vehicle (10) against reaction from a control device (11) which is connected to the supply line (17) to be protected and at least one further electrical supply line (13) for receiving a respective supply voltage (Ub, Un) is connected, characterized in that in the control unit (11) a switching element (Tx) via which a supply path (29) of that supply connection (19) to which the supply line (17) to be secured is connected is routed a control logic (46) is switched depending on the respective supply voltage (Ub) of the at least one further supply line (13), with a diagnostic circuit (36) checking the blocking effect of the respective blocking element (Dy) while the switching element (Tx) is electrically blocked and a controller circuit (31) of the control device (11) is connected to the switching element (Tx) and switches the switching element (Tx) to be electrically conductive or electrically blocked in order to determine its functionality and then detects a change in the potential by means of the diagnostic circuit (36). checked in the supply path (29) in the section between the switching element (Tx) and blocking element (Dy).

Images