Control unit for a vehicle
A control unit for a vehicle. The control unit includes: interfaces for the connection to two independently redundant communication networks, messages to and from the control unit being transferrable via a second communication network, and vice versa, in the event of a failure of a first communication network; and interfaces for the electrical supply of the control unit via two independently redundant low-voltage networks. it being possible to electrically supply the control unit via a second low-voltage network, and vice versa, in the event of an error in a first low-voltage network.
1. A control unit for a vehicle, comprising:
interfaces for connection to two independently redundant communication networks, messages to and from the control unit being transferrable via a second communication network of the redundant communication networks, and vice versa, following a failure of a first communication network of the redundant communication networks;
interfaces for electrical supply of the control unit via two independently redundant low-voltage networks, it being possible to electrically supply the control unit via a second low-voltage network of the redundant low-voltage networks, and vice versa, in the event of an error in a first low-voltage network redundant low-voltage networks,
wherein the error in the first low-voltage network does not impair a functionality of a second low-voltage network, and vice versa; and
a degradation device configured to diagnose errors in the low-voltage and communication networks and to selectively degrade the control unit connected to the low-voltage and communication networks.
2. A control system for a vehicle, comprising:
two independently redundant high-voltage networks configured to provide electrical energy;
two independently redundant low-voltage networks configured to provide electrical control voltage;
two independently redundant communication networks configured to transfer messages between control units connected to the communication networks; and
a degradation device configured to diagnose errors in the high-voltage, low-voltage, and communication networks and to selectively degrade the control units connected to the high-voltage, low-voltage, and communication networks, the control system offering a sufficient functionality for a driving operation of the vehicle,
wherein, in the event of an error of a high-voltage network of the high-voltage networks, a DC/DC converter is shut off, and a rechargeable battery for an electrical supply of one of the low-voltage networks is connected.
3. The control system as recited in claim 2 , wherein the degradation device includes a diagnostic module configured to carry out the diagnosis, and a battery management device configured to selectively degrade the control units.
4. The control system as recited in claim 3 , wherein the diagnostic module and the battery management devices are configured to be mutually monitorable.
5. The control system as recited in claim 3 , wherein a state of the high-voltage, low-voltage, and communication networks is ascertainable using the battery management devices, corresponding data being transferrable via communication interfaces.
6. A control system for a vehicle, comprising:
two independently redundant high-voltage networks configured to provide electrical energy;
two independently redundant low-voltage networks configured to provide electrical control voltage;
two independently redundant communication networks configured to transfer messages between control units connected to the communication networks; and
a degradation device configured to diagnose errors in the high-voltage, low-voltage, and communication networks and to selectively degrade the control units connected to the high-voltage, low-voltage, and communication networks, the control system offering a sufficient functionality for a driving operation of the vehicle,
wherein the degradation device includes a diagnostic module configured to carry out the diagnosis, and a battery management device configured to selectively degrade the control units,
wherein a preventive and/or actual diagnosis of lines connected to the high-voltage, low-voltage, and communication networks and a selective shut-off of control units connected to the high-voltage, low-voltage, and communication networks may be initiated and carried out using the diagnostic module.
7. A method for operating a vehicle, comprising the following steps:
diagnosing, in each case, independently redundantly configured electrical high-voltage, electrical low-voltage, and electrical communication networks of a control system of the vehicle, which are functionally connected to one another;
transferring the diagnosis result to independently redundant battery management devices of the control system, an error in a first battery management device not impairing a functionality of a second battery management device, and vice versa; and
selectively degrading control devices connected to the electrical high-voltage, electrical low voltage, and electrical communication networks as a function of the diagnosis result in such a way that control units connected to the electrical energy supply, electrical low voltage, and electrical communication networks are still sufficiently functional for a safe driving operation of the vehicle.
8. The method as recited in claim 7 , wherein a selective shut-off of electrical consumers is delayed or carried out using predefined degradation control signals.
9. The method as recited in claim 7 , wherein one of the high-voltage networks is connectable to the other high-voltage network via a coupling switch.
10. A method for operating a vehicle, comprising the following steps:
diagnosing, in each case, independently redundantly configured electrical high-voltage, electrical low-voltage, and electrical communication networks of a control system of the vehicle, which are functionally connected to one another;
transferring the diagnosis result to independently redundant battery management devices of the control system, an error in a first battery management device not impairing a functionality of a second battery management device, and vice versa; and
selectively degrading control devices connected to the electrical high-voltage, electrical low voltage, and electrical communication networks as a function of the diagnosis result in such a way that control units connected to the electrical energy supply, electrical low voltage, and electrical communication networks are still sufficiently functional for a safe driving operation of the vehicle,
wherein a selective shut-off of electrical devices which are not necessary for fulfilling necessary driving functions of the vehicle is carried out.
11. The method as recited in claim 10 , wherein the control units includes a braking control unit, a steering control unit, a control unit for driver assistance systems, and a control unit for engine management, and wherein at least one of the control units is kept operational for a driving operation of the vehicle.
12. A method for operating a vehicle, comprising the following steps:
diagnosing, in each case, independently redundantly configured electrical high-voltage, electrical low-voltage, and electrical communication networks of a control system of the vehicle, which are functionally connected to one another;
transferring the diagnosis result to independently redundant battery management devices of the control system, an error in a first battery management device not impairing a functionality of a second battery management device, and vice versa; and
selectively degrading control devices connected to the electrical high-voltage, electrical low voltage, and electrical communication networks as a function of the diagnosis result in such a way that control units connected to the electrical energy supply, electrical low voltage, and electrical communication networks are still sufficiently functional for a safe driving operation of the vehicle,
wherein a selective shut-off of electrical consumers connected to the networks, which is carried out based on a diagnosis, results in soft switchovers, during which the vehicle does not carry out any abrupt movements.
13. A non-transitory computer-readable data medium on which is stored a computer program including program code for operating a vehicle, the program code, when executed by a computer, causing the computer to perform the following steps:
diagnosing, in each case, independently redundantly configured electrical high-voltage, electrical low-voltage, and electrical communication networks of a control system of the vehicle, which are functionally connected to one another;
transferring the diagnosis result to independently redundant battery management devices of the control system, an error in a first battery management device not impairing a functionality of a second battery management device, and vice versa; and
selectively degrading control devices connected to the electrical high-voltage, electrical low voltage, and electrical communication networks as a function of the diagnosis result in such a way that control units connected to the electrical energy supply, electrical low voltage, and electrical communication networks are still sufficiently functional for a safe driving operation of the vehicle.