Device for preventing overvoltage-induced damage caused by fault propagation in safety-relevant systems

Patent metadata

Field	Value
Publication number	US-11777326-B2
Application number	US-202017769818-A
Country	US
Kind code	B2
Filing date	Oct 7, 2020
Priority date	Oct 17, 2019
Publication date	Oct 3, 2023
Grant date	Oct 3, 2023

Abstract

A device controls a safety-relevant electronic system and has a power supply. The power supply is supplied with a battery voltage at a first input terminal and supplies a first supply voltage at a first output terminal which is lower than the battery voltage. A microcontroller for generating a first control signal, provided at a first control output of the microcontroller for processing by way of a control unit, is supplied with the first supply voltage at a second input terminal. A monitoring unit for generating a second control signal, provided at a second control output of the monitoring unit for processing by the control unit, is supplied with the first supply voltage at a third supply potential input terminal. The third supply potential input terminal, the second control output and the second data port of the monitoring unit are configured to be voltage-proof with respect to the battery voltage.

First claim

The invention claimed is:

1. A device for controlling a safety-relevant electronic system, comprising:
a power supply having at least one voltage regulator, wherein said power supply being supplied with a battery voltage during operation at a first supply potential input terminal and supplying a first supply voltage at a first supply potential output terminal being lower than the battery voltage;
a safety-relevant control unit;
a microcontroller for generating a first control signal, being provided at a first control output of said microcontroller for processing by way of said safety-relevant control unit, wherein said microcontroller being supplied with the first supply voltage at a second supply potential input terminal of said microcontroller, said microcontroller further having a first data port;
a monitoring unit for generating a second control signal, being provided at a second control output of said monitoring unit for processing by way of said safety-relevant control unit, said monitoring unit being supplied with the first supply voltage at a third supply potential input terminal of said monitoring unit, said monitoring unit further containing a second data port, wherein said third supply potential input terminal, said second control output and said second data port of said monitoring unit being configured to be voltage-proof with respect to the battery voltage; and
a communication link disposed between said first data port of said microcontroller and said second data port of said monitoring unit.

2. The device according to claim 1 , wherein said monitoring unit contains a controllable switch for generating the second control signal, wherein said controllable switch is supplied with a second supply voltage at a fourth supply potential input terminal of said monitoring unit which is lower than a first predetermined voltage value which corresponds to a maximum permissible voltage of said microcontroller at which no damage occurs.

3. The device according to claim 2 , wherein the second supply voltage is greater than a second predetermined voltage value which is greater than the first supply voltage.

4. The device according to claim 2 , wherein said at least one voltage regulator of said power supply includes a first voltage regulator for generating the second supply voltage and a second voltage regulator for generating the first supply voltage.

5. The device according to claim 4 , wherein said second voltage regulator is supplied with the second supply voltage generated by said first voltage regulator as an input voltage.

6. The device according to claim 1 , wherein all inputs and outputs of said monitoring unit are configured to be voltage-proof with regard to the battery voltage.

7. The device according to claim 2 , wherein said monitoring unit contains a monitoring module which is configured to receive and to process data from said microcontroller via said second data port and, when a function of said microcontroller as intended is determined, to cause said controllable switch to generate the second control signal.

8. The device according to claim 1 , wherein the safety-relevant electronic system is a part of a vehicle.

9. A device for controlling a safety-relevant electronic system, comprising:
a power supply having at least one voltage regulator, wherein said power supply being supplied with a battery voltage during operation at a first supply potential input terminal and supplying a first supply voltage at a first supply potential output terminal being lower than the battery voltage;
a safety-relevant control unit;
a microcontroller for generating a first control signal, being provided at a first control output of said microcontroller for processing by way of said safety-relevant control unit, wherein said microcontroller being supplied with the first supply voltage at a second supply potential input terminal of said microcontroller, said microcontroller further having a first data port;
a monitoring unit for generating a second control signal, being provided at a second control output of said monitoring unit for processing by way of said safety-relevant control unit, said monitoring unit being supplied with the first supply voltage at a third supply potential input terminal of said monitoring unit, said monitoring unit further containing a second data port, wherein said third supply potential input terminal, said second control output and said second data port of said monitoring unit being configured to be voltage-proof with respect to the battery voltage;
a communication link disposed between said first data port of said microcontroller and said second data port of said monitoring unit; and
all said inputs and said outputs of said monitoring unit configured to be voltage-proof with regard to the battery voltage.

10. The device according to claim 9 , wherein said monitoring unit contains a controllable switch for generating the second control signal, wherein said controllable switch is supplied with a second supply voltage at a fourth supply potential input terminal of said monitoring unit which is lower than a first predetermined voltage value which corresponds to a maximum permissible voltage of said microcontroller at which no damage occurs.

11. The device according to claim 10 , wherein the second supply voltage is greater than a second predetermined voltage value which is greater than the first supply voltage.

12. The device according to claim 10 , wherein said at least one voltage regulator of said power supply includes a first voltage regulator for generating the second supply voltage and a second voltage regulator for generating the first supply voltage.

13. The device according to claim 12 , wherein said second voltage regulator is supplied with the second supply voltage generated by said first voltage regulator as an input voltage.

14. The device according to claim 10 , wherein said monitoring unit contains a monitoring module which is configured to receive and to process data from said microcontroller via said second data port and, when a function of said microcontroller as intended is determined, to cause said controllable switch to generate the second control signal.

15. The device according to claim 9 , wherein the safety-relevant electronic system is a part of a vehicle.

Assignees

• Vitesco Tech Gmbh

Inventors

• Wunderlich Andreas
• Fisch Alfons

Classifications

• H02J7/855

  with circuits adapted for supplying loads from the battery · CPC title

• H02J7/80

  including monitoring or indicating arrangements · CPC title

• H02J7/40

  characterised by the exchange of charge or discharge related data · CPC title

• H02J7/64 Primary

  against overvoltage · CPC title

• H02J7/00308 Primary

  Electricity · mapped topic