Method and device for the plausibility check of safety-relevant variables

• US 10,493,850 B2
• Filed: 05/27/2016
• Issued: 12/03/2019
• Est. Priority Date: 05/29/2015
• Status: Active Grant

• Current Assignee: Valeo Siemens Eautomotive Germany GmbH
• Original Assignee: Siemens AG
• Inventors: Adam, Alexander, Bohllander, Marco, Bogel, Bjorn, Llorente Alvarez, Esther, Lu, Caroline
• Primary Examiner(s): Edwards, Jerrah
• Assistant Examiner(s): Gordon, Mathew Franklin
• Application Number:
  US15/167,281
• Publication Number:
  US 20160347182A1
• Time in Patent Office: 1,285 Days
• CPC Class Codes: B60L 3/00 Electric devices on electrically-propelled vehicles for safety purposes; Monitoring operating variables, e.g. speed, deceleration or energy consumption methods or circuit arrangements for monitoring or controlling batteries or fuel cells B60L58/00
• CPC Class Codes: B60L 3/0061 relating to electrical machines
• CPC Class Codes: B60L 3/12 Recording operating variables ; Monitoring of operating variables
• CPC Class Codes: G07C 5/0808 Diagnosing performance data testing of vehicles G01M17/00; testing of electrical installation on vehicles G01R31/005
• CPC Class Codes: Y10S 903/904 Component specially adapted for hev

Abstract

A method for a plausibility check of safety-relevant variables, wherein a first safety-relevant variable and a further safety-relevant variable are dependent on one another and are each provided to be raised from a lower safety level to a higher safety level. The plausibility check of the first safety-relevant variable is performed in a first time interval of a cycle of a clock by implementing a first plausibility rule, and upon a successful plausibility check during the first time interval, is raised from the lower safety level to the higher safety level for the safety-relevant variable. The plausibility check of the further safety-relevant variable is performed in a second time interval of the cycle of the clock by implementing a further plausibility rule, and upon a successful plausibility check during the second time interval, is raised from the lower safety level to the higher safety level for the further safety-relevant variable.

Claims

1. A method for raising plausibility of interdependent safety-relevant electrical variables of an electrical DC-DC converter, the safety-relevant variables being selected from the group consisting of DC current and DC voltage from a high voltage side and a low voltage side of the electrical converter, the method comprising:

providing a first safety-relevant variable and at least one further safety-relevant variable measured on the electrical DC-DC converter to an input of a data processing unit controlling the electrical DC-DC converter and are each and configured to raise the first safety-relevant variable and at least one further safety-relevant variable from a lower safety-level to a higher safety level;

performing with the data processing unit a first plausibility check of the first safety-relevant variable in a first time interval of a cycle of a clock by implementing a first plausibility rule, wherein the first safety-relevant variable is raised from the lower safety level to the higher safety level for the first safety-relevant variable upon a successful first plausibility check during the first time interval of the cycle of the clock;

performing with the data processing unit a second plausibility check of the further safety-relevant variable in a second time interval of a cycle of a clock by implementing a further plausibility rule, wherein the further safety-relevant variable is raised from the lower safety level to the higher safety level for the further safety-relevant variable upon a successful second plausibility check during the second time interval of the cycle of the clock; and

with the data processing unit controlling electrical variables of the electrical DC-DC converter commensurate with the safety-relevant variable and the further safety-relevant variable being raised from the lower safety level to the higher safety level.

2. The method of claim 1, wherein the plausibility rules each have a calculation function configured to perform the plausibility checks of the safety-relevant variables at the higher safety level.

3. The method of claim 2, wherein in addition to the safety-relevant variables, at least one additional calculation variable is included in the calculation function of the plausibility rules.

4. The method of claim 1, wherein a cycle duration of the cycle of the clock, within which the plausibility checks of the first safety-relevant variable and the further safety-relevant variable and the raising from the lower safety level to the higher safety level is performed, does not exceed a latency time for a safety event to be monitored, wherein the latency time is that time required to monitor an exceeding of the variable.

5. The method of claim 4, wherein the first time interval of the cycle of the clock and the second time interval of the cycle of the clock have a same duration.

6. The method of claim 4, wherein the first time interval of the cycle of the clock and the second time interval of the cycle of the clock do not have a same duration.

7. The method of claim 1, wherein the first plausibility rule and/or the further plausibility rule includes a comparison operation for determining success of the plausibility check, configured to compare the safety-relevant variables, which are to be raised from the lower safety level to the higher safety level, with the safety-relevant variables which are provided but not yet plausibility checked by the plausibility rules.

8. The method of claim 1, wherein the method is repeatedly performed by repeating the clock cycle.

9. A data processing unit controlling an electrical DC-DC converter, comprising:

a first input for receiving a first safety-relevant variable measured on the DC-DC converter;

at least one further input for receiving at least one further safety-relevant variable, the first safety-relevant variable and the further safety-relevant variable being selected from the group consisting of DC current and DC voltage from a high voltage side and a low voltage side of an electric converter, wherein the first safety-relevant variable and the further safety-relevant variable are dependent on one another;

at least one additional input for receiving at least one additional calculation variable;

a first output for outputting the first safety-relevant variable, said first output being plausibility checked with a first plausibility rule during a first part of a clock cycle and raised to a higher safety level when a deviation between the first safety-relevant variable and the plausibility-raised first safety-relevant variable is acceptable within previously defined tolerances; and

at least one further output for outputting the further safety-relevant variable, said at least one further output being plausibility checked with a second plausibility rule during a second part of a clock cycle and raised to the higher safety level when the deviation between the further safety-relevant variable and the plausibility-raised further safety-relevant variable is acceptable within previously defined tolerances,

said data processing unit configured to control electrical variables of the electrical DC-DC converter commensurate with the safety-relevant variable and the further safety-relevant variable being raised from the lower safety level to the higher safety level.

10. An electrical DC-DC converter for an electric or hybrid vehicle, said electrical DC-DC converter comprising a a data processing unit which controls the electrical DC-DC converter and includes a first input for receiving a first safety-relevant variable, at least one further input for receiving at least one further safety-relevant variable, the first safety-relevant variable and the further safety-relevant variable being selected from the group consisting of DC current and DC voltage from a high voltage side and a low voltage side of an electric converter, wherein the first safety-relevant variable and the further safety-relevant variable are dependent on one another, at least one additional input for receiving at least one additional calculation variable, a first output for outputting the first safety-relevant variable, said first output being plausibility checked with a first plausibility rule during a first part of a clock cycle and raised to a higher safety level when a deviation between the first safety-relevant variable and the plausibility-raised first safety-relevant variable is acceptable within previously defined tolerances;

and

at least one further output for outputting the further safety-relevant variable, said at least one further output being plausibility checked with a second plausibility rule during a second part of a clock cycle and raised to the higher safety level when the deviation between the further safety-relevant variable and the plausibility-raised further safety-relevant variable is acceptable within previously defined tolerances,

said electrical DC-DC converter configured to convert high-voltage DC current to low-voltage DC current commensurate with the safety-relevant variable and the further safety-relevant variable received from the data processing unit that have been raised from the lower safety level to the higher safety level.

11. The electrical converter of claim 10, wherein the electrical converter comprises a traction converter for operating an electrical machine.