DE102022200880B4 - Low-voltage supply arrangement for an automated or partially automated vehicle and method for operating a partially automated or partially automated vehicle - Google Patents

Abstract

Low-voltage supply arrangement (1) for an automated or partially automated vehicle (50), comprising: - a first sub-network (2) and a second sub-network (3), each with at least one supply unit (20,30,40), wherein the at least one Supply unit (20,30,40) comprises a DC/DC converter (20-1,30-1,40-1) and an energy storage (20-2,30-2,40-2), the DC/DC -Converter (20-1.30-1.40-1) can be connected or is connected on one side to a high-voltage supply (51) and on the other side to the energy storage (20-2.30-2.40-2 ) and a supply bus (20-3,30-3,40-3) for supplying low-voltage consumers (21-x,31-x,41-x), - a first control device (4), set up to monitor the first Subnetwork (2), - a second control device (5), set up to monitor the second subnetwork (3), and wherein the supply units (20,30,40) are galvanically isolated from one another, the DC/DC converters (20-1 ,30-1,40-1) and the energy storage (20-2,30-2,40-2) of a sub-network (2,3) differ from those of the other sub-network (2,3), and safety-critical low-voltage consumers ( 21-x,31-x,41-x) are redundantly distributed among the subnetworks (2,3).

Description

The invention relates to a low-voltage supply arrangement for an automated or partially automated vehicle and a method for operating a partially automated or partially automated vehicle.

Automated driving without a human fallback poses major challenges for automotive electrics. The energy requirement of environmental sensors such as lidars, radars or cameras together with control computers for data processing and path planning is considerable. The environmental sensors and control computers for data processing are currently powered by a low-voltage battery (usually 12 V technology). This low-voltage battery is powered by a voltage converter, which is connected to high-voltage cabling of a traction battery in the (electric) vehicle.

The control computers for automated driving are high-current consumers with a high power consumption in the vehicle's low-voltage network and a highly dynamic load profile. For example, if the vehicle's environment changes very dynamically (e.g. the vehicle turns into a street with a lot of pedestrians on the road, which brings with it a lot of objects to be recognized and processed during path planning), significantly more data is required very quickly be evaluated. In this case, the power consumption of the control computers increases significantly due to the required computing power. This sharply increasing current consumption results in an undervoltage in the low-voltage supply, so that this undervoltage must be dynamically compensated for by the low-voltage battery and the supplying voltage converter. However, if the vehicle's environment changes, it may be that, in addition to high computing power, dynamic steering and/or braking maneuvers must also be carried out immediately, which also results in undervoltage. This dynamic superposition must be safely controlled by the low-voltage supply in all possible operating cases.

The low-voltage supply for operating the safety-relevant components - environmental sensors with data processing, steering and brakes - should also be so reliable that no simple error can damage the system to such an extent that the system can no longer safely stop the vehicle automatically (e.g. by braking). is possible. Errors in the system must be immediately detected by diagnostic functions and lead to the vehicle being stopped automatically.

From the US 2020/0001806 A1 a supply system is known. The system includes a first DC/DC converter arranged to output electrical power only to a first battery and to first loads in a first specified set. The first specified set includes loads provided to control and perform steering and braking. The system further includes a second DC/DC converter arranged to output electrical power to loads isolated from the first loads provided to control and perform steering and braking.

From the US 2020/0014240 A1 a vehicle power management system is known. This includes a backup battery and an isolation circuit. The isolation circuit has a switch in parallel with a diode. The isolation circuit is electrically connected to the backup battery. The isolation circuit electrically isolates the backup battery from a non-critical load when the switch is open.

The DE 10 2019 214 720 A1 relates to a control device for a vehicle. The invention further relates to a control system for a vehicle, a method for operating a control system for a vehicle and a computer program product.

The DE 10 2020 202 466 A1 concerns a redundant on-board electrical system. The invention also relates to a motor vehicle with such a redundant electrical system.

From the DE 10 2021 114 689 A1 a power control device and a power control method or a device and a method for power control (eg for power control or for energy control) for an autonomous vehicle are known.

In the US 2019/ 0 013 664 A1 describes a vehicle-side power source switching device with a circuit breaker disposed between a first system and a second system. The circuit breaker is controlled via two different control circuits.

The invention is based on the object of improving a low-voltage supply arrangement for an automated or partially automated vehicle and a method for operating a partially automated or partially automated vehicle.

The object is achieved according to the invention by a low-voltage supply arrangement with the features of patent claim 1 and a method ren solved with the features of patent claim 10. Advantageous embodiments of the invention result from the subclaims.

In particular, a low-voltage supply arrangement is created for an automated or partially automated vehicle, comprising a first sub-network and a second sub-network, each with at least one supply unit, wherein the at least one supply unit comprises a DC/DC converter (direct-voltage converter) and an energy storage device, wherein the DC/DC converter can be connected to a high-voltage supply on one side or is connected and is connected on the other side to the energy storage and a supply bus for supplying low-voltage consumers, a first control device, set up to monitor the first subnetwork, a second control device, set up to monitor the second subnetwork, the supply units being galvanically isolated from one another, the DC/DC converters and the energy storage of one subnetwork being different from those of the other subnetwork, and safety-critical low-voltage consumers being distributed redundantly among the subnetworks.

Furthermore, in particular, a method for operating a partially automated or automated vehicle is provided, with safety-critical low-voltage consumers being supplied by means of a low-voltage supply arrangement according to one of the described embodiments, with the subnetworks being monitored, and with the vehicle being converted into a safe one by carrying out a safety maneuver State is brought when an error is detected in the subnets.

The low-voltage supply arrangement and the method make it possible to provide a safe supply of safety-critical low-voltage consumers. By dividing the low-voltage consumers into several sub-networks, each with at least one supply unit, a power flow can be distributed across several DC/DC converters. This makes it possible, in particular, to use smaller and therefore more cost-effective DC/DC converters in relation to a nominal power (for example in the range from 2 to 3 kW, in particular 2.4 kW in the first sub-network and 2.8 kW in the second sub-network). The supply units, in particular the supply buses of the supply units, are galvanically isolated from one another. The galvanic isolation occurs, for example, via a transformer core in the DC/DC converters. The supply units represent, in particular, supply islands that are separate from one another. Furthermore, safety-critical low-voltage consumers, for example a steering system and/or a braking system and/or control computer for automated driving, are redundantly distributed over the two sub-networks and are supplied via them. A single error therefore does not lead to a failure of the vehicle's automated driving function, so that the vehicle can still be brought into a safe state (in particular into a standstill) after a single error occurs. Furthermore, the subnets are each monitored by a control device so that single errors can be detected and the vehicle can be transferred to a safe state after a single error has been detected. For this purpose, the control devices monitor in particular at least one state of the DC/DC converters and the energy storage in the supply units. In particular, a voltage on the respective supply bus of the supply units is monitored. Furthermore, the low-voltage consumers can also be monitored and/or carry out monitoring functions themselves. The DC/DC converters and energy storage of one sub-network are different from those of the other sub-network. This makes it possible to prevent similar errors, i.e. errors with the same cause (“common cause”) that would lead to a failure of both (and possibly other) subnetworks. For example, DC/DC converters and energy storage devices of different designs and/or from different manufacturers can be used in the subnetworks. For example, lead batteries (e.g. lead batteries with Absorbent Glass Mat [AGM] technology) can be used in the first subnetwork and lithium-ion batteries can be used in the second subnetwork.

Overall, the supply of safety-critical low-voltage consumers can be improved using the low-voltage supply arrangement and the method.

The control devices monitor in particular a state of the DC/DC converters and the energy storage. Furthermore, the status of the low-voltage consumers can also be monitored. For this purpose, in particular, corresponding communication messages, which include, for example, status queries and/or status messages, can be exchanged using a communication bus, for example using a CAN and/or LIN bus. For this purpose, the low-voltage supply arrangement includes corresponding communication connections, in particular communication buses (e.g. CAN and/or LIN buses).

An error can, for example, include one or more of the following states: a failure of a main control computer and/or a secondary control computer, failure or error of one of the DC/DC converters, failure or error of one of the low-voltage consumers, in particular the steering system and/or the braking system, presence of undervoltage, presence of overvoltage, presence of a short circuit, etc.

It can also be provided that the communication connections between the control devices and the safety-critical low-voltage consumers are also designed differently (e.g. different technology, manufacturer, topology, etc.). This can also prevent similar errors (“common causes”). This can further increase security in the event of an error. Furthermore, the communication connections can also be designed redundantly.

The term low voltage in this disclosure is intended to denote in particular voltages up to 60 V, for example ~12 V or ~48 V. The term high voltage in this disclosure is intended to denote in particular areas above, in particular far above, 60 V, for example areas of several hundred volts, especially -400V or -800V.

The control devices can be designed as a combination of hardware and software, for example as program code that is executed on a microcontroller or microprocessor. However, it can also be provided that parts are designed individually or combined as an application-specific integrated circuit (ASIC) and/or field-programmable gate array (FPGA).

The DC/DC converters, the energy storage devices and the safety-critical low-voltage consumers can in particular carry out diagnostic functions themselves and send a status via a communication connection. For this purpose, the DC/DC converters, the energy storage devices and/or the safety-critical low-voltage consumers in particular have appropriately set-up controls and, if necessary for detecting a state, correspondingly set-up sensors.

An energy storage is in particular an electrical energy storage. The energy storage is in particular a battery. However, the energy storage can also be another electrical energy storage, for example a capacitor, in particular a supercapacitor (supercap).

In one embodiment, it is provided that the low-voltage supply arrangement has at least one semiconductor switch, via which non-safety-critical low-voltage consumers are connected to the supply bus of one of the supply units, and which can be disconnected from the supply bus in a controlled manner via this. This means that power consumption by non-safety-critical low-voltage consumers can be prevented in the event of a fault, so that only the safety-critical low-voltage consumers are supplied via the supply bus. The at least one semiconductor switch is in particular connected to the respective control device and is controlled by it. Several semiconductor switches can also be provided, for example for each of the supply units.

In one embodiment it is provided that the second subnetwork has at least two supply units, the supply bus of one of the at least two supply units of the second subnetwork being connected to a main control computer and a first environment sensor system for automated driving and supplying them, the main control computer being set up to do so If necessary, a security maneuver is to be carried out, the supply bus of the at least one supply unit of the first subnetwork being connected to a second control computer and a second environmental sensor system and supplying them, the second control computer being set up to carry out a security maneuver if necessary. In particular, it is provided that the main control computer and the first environment sensor system are the only low-voltage consumers on the supply bus. In particular, other safety-critical low-voltage consumers, in particular the steering system and the braking system, are connected to a supply bus of the other of the at least two supply units of the second subnetwork. In this way, a supply to the main control computer can be secured because it is not affected by other low-voltage consumers. This can prevent undervoltage due to an increase in computing power and a simultaneous increase in power consumption by other safety-critical low-voltage consumers, in particular a steering system and a braking system, within a single supply unit.

In one embodiment it is provided that the first control device and/or the second control device are set up to transfer the vehicle into a safe state by directly controlling at least some of the safety-critical low-voltage consumers when a fault condition is detected in the subnetworks. This means that the vehicle can be brought into a safe state, especially if both control computers fail. In particular, the first control device or the second control device then control a steering system and/or a braking system. In particular, after detecting an error, for example the failure of both control computers, the vehicle can be (fully) braked, for which the respective control device controls the braking system accordingly.

In one embodiment it is provided that the first control device and the second control device are set up to monitor each other and to initiate at least one safety maneuver when an error is detected. Since two control devices are provided, they can mutually monitor their respective functions. In particular, such monitoring can include exchanging status messages via a communication bus, in particular a CAN bus. If a control device is no longer accessible or no longer transmits status messages, the other control device can arrange for the vehicle to be transferred to a safe state or can do this itself according to the embodiment described above.

In one embodiment, it is provided that the control devices are set up to monitor a charge status of the energy storage units of the supply units, so that a predetermined minimum supply duration of at least the safety-critical low-voltage consumers in the supply units is ensured. This can ensure that the vehicle can be brought into a safe condition at any time. The minimum supply period is set in particular in such a way that even in the event of high power consumption, for example in the event of a short circuit, a voltage can be provided on the supply bus for the minimum supply period. The minimum supply duration can be, for example, a few seconds, in particular 20 seconds or more. The state of charge is determined using methods known per se. It is then continuously checked whether a minimum charge level is present based on the specified minimum supply period or not. If this is not the case, the respective control device causes the affected energy storage unit to be recharged up to the specified minimum charge level.

In one embodiment it is provided that the low-voltage supply arrangement has a maintenance isolating plug, with a voltage from the energy storage for each supply unit being routed via the maintenance isolating plug to a detection contact of the respective DC/DC converter, and wherein the DC/DC Converters are set up to go out of operation if the detection contact detects that the maintenance disconnect plug is pulled. This can prevent the DC/DC converters from causing a power flow from the energy storage towards the high-voltage supply, i.e. into a high-voltage network. This can increase safety during maintenance work.

In one embodiment, it is provided that the supply units of the subnetworks each meet a safety requirement level in accordance with Automotive Safety Integrity Level (ASIL) B (in particular in accordance with ISO 26262 in the version valid on the filing date). Overall, the low-voltage supply arrangement then achieves a safety requirement level in accordance with ASIL D.

Furthermore, a vehicle is also created, comprising a low-voltage supply arrangement according to one of the described embodiments. The vehicle is in particular a motor vehicle, in particular an electric or hybrid vehicle. In principle, however, the vehicle can also be another (electrified) land, rail, water, air or space vehicle, for example a drone or an air taxi.

• 1 eine schematische Darstellung von Ausführungsformen der Niedervolt-Versorgungsanordnung für ein automatisiert oder teilautomatisiert fahrendes Fahrzeug.

The invention is explained in more detail below using preferred exemplary embodiments with reference to the figure. This shows:

• 1 a schematic representation of embodiments of the low-voltage supply arrangement for an automated or partially automated vehicle.

The 1 shows a schematic representation of embodiments of the low-voltage supply arrangement 1 for an automated or partially automated vehicle 50. The vehicle 50 has a high-voltage supply 51, in particular a high-voltage battery 52. The high-voltage battery 52 has a battery control 52-1 for battery management. The vehicle 50 is in particular an electric or hybrid vehicle. The vehicle 50 also has an application server 53 and a drive control 54, which controls a drive train of the vehicle 50.

The low-voltage supply arrangement 1 comprises a first sub-network 2 and a second sub-network 3. The first sub-network 2 has a supply unit 20. The second subnetwork 3 has two supply units 30, 40.

The supply units 20, 30, 40 each include a DC/DC converter 20-1, 30-1, 40-1 and an energy storage 20-2, 30-2, 40-2. The DC/DC converters 20-1, 30-1, 40-1 are connected on one side to the high-voltage supply 51, in particular to the high-voltage battery 52 of the vehicle 50. On another side are the DC/DC converters 20-1, 30-1, 40-1 with the energy storage 20-2, 30-2, 40-2 and a supply bus 20-3, 30-3, 40-3 for supplying low-voltage consumers 21-x, 31-x, 41-x connected.

Safety-critical low-voltage consumers 21-x, 31-x, 41-x are redundant on subnetworks 2, 3 divided. The safety-critical low-voltage consumers 21-x, 31-x, 41-x include steering systems 21-1, 41-1 and braking systems 21-2, 41-2. A main control computer 31-3 (and a first environment sensor system 31-4 used by it) is connected as the only safety-critical low-voltage consumer 31-x to the supply bus 30-3 of the supply unit 30. A second control computer 21-3 (and a second environmental sensor system 21-4 used by it) is connected to the supply bus 20-3 of the supply unit 20.

The main control computer 31-3 is set up to carry out a safety maneuver if necessary. The second control computer 31-3 is also set up to carry out a safety maneuver if necessary.

The supply units 20, 30, 40 are galvanically isolated from one another. This is done in particular via a respective transformer core of the DC/DC converters 20-1, 30-1, 40-1. Existing communication lines are particularly high-resistance, but can also include optocouplers and/or light guides that prevent charge flow.

In particular, it is provided that the supply units 20, 30, 40 of the subnetworks 2, 3 each meet a security requirement level according to ASIL B.

Furthermore, the low-voltage supply arrangement 1 includes a first control device 4, which is set up to monitor the first sub-network 2. For this purpose, the first control device 4 is connected to the DC/DC converter 20-1 and the energy storage 20-2 via at least one communication connection 4-1, 4-2, in particular via communication buses (e.g. CAN bus and/or LIN bus). as well as the low-voltage consumers 21-1, 21-2, 21-3, 21-4.

The low-voltage supply arrangement 1 further comprises a second control device 5, which is set up to monitor the second subnetwork 3. For this purpose, the second control device 5 is connected to the DC/DC converters 30 via at least one communication connection 5-1, 5-2, 5-3, 5-4, in particular via communication buses (e.g. CAN bus and/or LIN bus). -1, 40-1 and the energy storage devices 30-2, 40-2 as well as the low-voltage consumers 31-3, 34-4, 41-1, 21-2.

The first control device 4 and the second control device 5 are connected to each other and to the application server 53 via communication connections 4-3, 4-4, 5-5 (e.g. CAN or LIN bus).

The DC/DC converter 20-1 and the energy storage 20-2 of the first subnetwork 2 differ from the DC/DC converters 30-1, 40-1 and energy storage devices 30-2, 40-2 of the second subnetwork 3. For example, the DC/DC converter 20-1 is an OCDC/DC converter which, in addition to a DC/DC converter with an output of 2.4 kW, also provides charging electronics for charging the high-voltage battery 52. The DC/DC converters 30-1, 40-1, for example, are designed for an output of 2.8 kW. In particular, the manufacturers and/or parts or components as well as an interconnection of the DC/DC converters 20-1, 30-1, 40-1 can also differ from one another. The differences are intended to prevent the occurrence of similar errors. The energy storage 20-2 is in particular a lead accumulator (e.g. a lead AGM battery), the energy storage 30-2, 40-2 are in particular lithium-ion batteries. However, the energy stores 20-2, 30-2, 40-2 can in principle (at least partially) also be other electrical energy stores, for example capacitors, in particular supercapacitors (supercaps).

It can be provided that the low-voltage supply arrangement 1 has semiconductor switches 20-4, 40-4, via which non-safety-critical low-voltage consumers 22, 42 are connected to the supply bus 20-3, 40-3 of the supply units 20, 40 and which via this can be separated in a controlled manner from the supply bus 20-3, 40-3.

It can be provided that the first control device 4 and/or the second control device 5 are set up to, when an error condition is detected in the subnetworks, the vehicle 50 by directly controlling at least some of the safety-critical low-voltage consumers 21-x, 31-x, 41- x to a safe state. In particular, the control devices 4, 5 detect faulty states of the DC/DC converters 20-1, 30-1, 40-1, the energy storage devices 20-2, 30-2, 40-2 and the safety-critical low-voltage consumers 21-x, 31- x, 41-x and monitor them. The control devices 4, 5 become active in particular when the transfer to a safe state can no longer be carried out by the control computers 21-3, 31-3, for example if they have failed. The control devices 4, 5 then directly control at least the braking systems 21-2, 41-2 in order to bring about (full) braking of the vehicle 50.

It can be provided that the first control device 4 and the second control device 5 are set up to monitor each other and to initiate at least one safety maneuver when an error is detected. The tax For this purpose, directions 4, 5 are connected to one another in particular via the communication connection 5-5, in particular via a communication bus (eg CAN bus). For example, status reports can be exchanged at regular intervals. If status messages are no longer received and/or there is no longer any feedback from a control device 4, 5, the other control device 4, 5 can initiate at least one safety maneuver in order to bring the vehicle 50 into a safe state. For example, the respective control device 4, 5 can initiate the at least one safety maneuver via the control computers 21-3, 31-3 or the at least one safety maneuver directly by controlling the braking systems 21-2, 41-2 and/or the steering systems 21-1, Perform 41-1.

It can be provided that the control devices 4, 5 are set up to monitor a charge status of the energy storage devices 20-2, 30-2, 40-2 of the supply units 20, 30, 40, so that a predetermined minimum supply duration of at least the safety-critical low-voltage consumers 21- x, 31-x, 41-x in the supply units 20, 30, 40 is ensured. The state of charge is determined in particular in a manner known per se by integrating/balancing a charge or power flow detected at the energy storage devices 20-2, 30-2, 40-2. If such a determined state of charge of an energy storage device 20-2, 30-2, 40-2 falls below a predetermined minimum state of charge depending on the predetermined minimum supply period, the control devices 4, 5 cause the affected energy stores 20-2, 30-2, 40-2 to be recharged. 2. The minimum state of charge is determined, for example, with the help of empirically obtained data for the specified minimum supply period and/or with the help of simulations.

It can be provided that the low-voltage supply arrangement 1 has a maintenance disconnecting plug 6, with a voltage from the energy storage devices 20-2, 30-2, 40-2 via the maintenance disconnecting plug 6 for each supply unit 20, 30, 40 Detection contact of the respective DC/DC converter 20-1, 30-1, 40-1 is guided, and the DC/DC converters 20-1, 30-1, 40-1 are set up to go out of operation, when it is detected at the detection contact that the maintenance disconnect plug 6 is pulled. In the embodiment shown schematically, the isolating plug 6 is designed to be three-pole. In particular, a voltage measurement is carried out at the respective detection contact of the DC/DC converters 20-1, 30-1, 40-1. If such a voltage measurement results in a voltage of 0 V (i.e. the maintenance plug 6 is pulled), the respective DC/DC converter 20-1, 30-1, 40-1 goes out of operation.

Some scenarios in which errors occur in the supply units 20, 30, 40 are described below as examples. The scenarios serve to illustrate embodiments of the method for operating a partially automated or automated vehicle 50.

Example scenario 1:

In the example scenario, an undervoltage occurs on the supply bus 20-3 because the DC/DC converter 20-1 has failed and/or a short circuit has occurred.

• - Erkennung an dem Energiespeicher 20-2 und Weiterleitung über die Kommunikationsverbindungen 4-2, 4-4 an die erste Steuereinrichtung 4 und den Applikations-Server 53, Weiterleitung an die zweite Steuereinrichtung 5 über die Kommunikationsverbindung 5-5;
• - Erkennung durch den DC/DC-Wandler 20-1 und Meldung über die Kommunikationsverbindung 4-1 an die erste Steuereinrichtung 4;
• - Erkennung durch das Lenksystem 21-1 und das Bremssystem 21-2 und Meldung über die Kommunikationsverbindung 4-1 an die erste Steuereinrichtung 4;
• - Erkennung durch den Zweitsteuerrechner 21-3 und Meldung an die erste Steuereinrichtung 4 über eine Kommunikationsverbindung (nicht gezeigt);
• - Erkennung eines Bus-Timeouts der sicherheitskritischen Niedervoltverbraucher 21-x der Versorgungseinheit 20 durch die Steuereinrichtungen 4, 5, wenn die Spannung zusammengebrochen ist und die Niedervoltverbraucher 21-x nicht mehr aktiv sind;
• - Weiterleitung eines Zustands der ersten Steuereinrichtung 4 an die zweite Steuereinrichtung 5 und andersherum.

As a result, this condition or an error is detected in several places:

• - Detection on the energy storage device 20-2 and forwarding via the communication connections 4-2, 4-4 to the first control device 4 and the application server 53, forwarding to the second control device 5 via the communication connection 5-5;
• - Recognition by the DC/DC converter 20-1 and notification via the communication link 4-1 to the first control device 4;
• - Recognition by the steering system 21-1 and the braking system 21-2 and reporting via the communication link 4-1 to the first control device 4;
• - Recognition by the second control computer 21-3 and notification to the first control device 4 via a communication connection (not shown);
• - Detection of a bus timeout of the safety-critical low-voltage consumers 21-x of the supply unit 20 by the control devices 4, 5 when the voltage has collapsed and the low-voltage consumers 21-x are no longer active;
• - Forwarding a state of the first control device 4 to the second control device 5 and vice versa.

• - (optional) Abtrennen aller nicht-sicherheitskritischen Niedervoltverbraucher 22 durch Ansteuern des Halbleiterschalters 20-4;
• - Einleiten eines Sicherheitsmanövers (insbesondere eines Bremsvorgangs) über die Versorgungseinheiten 30, 40 mit Hilfe des Hauptsteuerrechners 31-3 und der Umfeldsensorik 31-4 sowie des Lenksystems 41-1 und des Bremssystems 41-2.

The following actions are then taken in response to one or more of these events:

• - (optional) disconnecting all non-safety-critical low-voltage consumers 22 by activating the semiconductor switch 20-4;
• - Initiating a safety maneuver (in particular a braking process) via the supply units 30, 40 with the help of the main control computer 31-3 and the environmental sensors 31-4 as well as the steering system 41-1 and the braking system 41-2.

The vehicle is brought into a safe state via the safety maneuver carried out.

Example scenario 2:

In the example scenario, an undervoltage occurs on the supply bus 30-3 because the DC/DC converter 30-1 has failed and/or a short circuit and/or a fault has occurred in the energy storage 30-2.

• - Erkennung an dem Energiespeicher 30-2 und Weiterleitung über die Kommunikationsverbindung 5-3 an die zweite Steuereinrichtung 5;
• - Erkennung durch den DC/DC-Wandler 30-1 und Meldung über die Kommunikationsverbindung 5-1 an die zweite Steuereinrichtung 5;
• - Erkennung durch den Hauptsteuerrechner 31-3 und die Umfeldsensorik 31-4 und Meldung über die Kommunikationsverbindung 5-1;
• - Erkennung eines Bus-Timeouts der sicherheitskritischen Niedervoltverbraucher 31-x der Versorgungseinheit 30 durch die Steuereinrichtungen 4, 5, wenn die Spannung zusammengebrochen ist und die Niedervoltverbraucher 21-x, insbesondere der Hauptsteuerrechner 31-3 und die Umfeldsensorik 31-4, nicht mehr aktiv sind;
• - Weiterleitung eines Zustands der ersten Steuereinrichtung 4 an die zweite Steuereinrichtung 5 und andersherum.

As a result, this condition or an error is detected in several places:

• - Detection on the energy storage 30-2 and forwarding via the communication connection 5-3 to the second control device 5;
• - Recognition by the DC/DC converter 30-1 and notification via the communication link 5-1 to the second control device 5;
• - Detection by the main control computer 31-3 and the environmental sensors 31-4 and reporting via the communication connection 5-1;
• - Detection of a bus timeout of the safety-critical low-voltage consumers 31-x of the supply unit 30 by the control devices 4, 5 when the voltage has collapsed and the low-voltage consumers 21-x, in particular the main control computer 31-3 and the environmental sensors 31-4, are no longer active are;
• - Forwarding a state of the first control device 4 to the second control device 5 and vice versa.

• - (optional) Abtrennen aller nicht-sicherheitskritischen Niedervoltverbraucher durch Ansteuern des Halbleiterschalters (in 1 nicht gezeigt, grundsätzlich kann aber auch die Versorgungseinheit 30 nicht-sicherheitskritische Niedervoltverbraucher versorgen);
• - Einleiten eines Sicherheitsmanövers (insbesondere eines Bremsvorgangs) mittels der Steuereinrichtungen 4, 5 über die Versorgungseinheiten 20, 40 mit Hilfe des Zweitsteuerrechners 21-3 und der Umfeldsensorik 21-4 sowie der Lenksysteme 21-1, 41-1 und der Bremssysteme 21-2, 41-2 über die Kommunikationsverbindungen 4-1, 5-2.

The following actions are then taken in response to one or more of these events:

• - (optional) Disconnecting all non-safety-critical low-voltage consumers by activating the semiconductor switch (in 1 not shown, but in principle the supply unit 30 can also supply non-safety-critical low-voltage consumers);
• - Initiating a safety maneuver (in particular a braking process) by means of the control devices 4, 5 via the supply units 20, 40 with the aid of the second control computer 21-3 and the environmental sensors 21-4 as well as the steering systems 21-1, 41-1 and the braking systems 21-2 , 41-2 via the communication connections 4-1, 5-2.

The vehicle is brought into a safe state via the safety maneuver carried out.

Example scenario 3:

In the example scenario, an undervoltage occurs on the supply bus 40-3 because the DC/DC converter 40-1 has failed and/or a short circuit and/or a fault has occurred in the energy storage 40-2.

• - Erkennung an dem Energiespeicher 40-2 und Weiterleitung über die Kommunikationsverbindung 5-4 an die zweite Steuereinrichtung 5 und von dort über die Kommunikationsverbindung 5-5 an die erste Steuereinrichtung 4;
• - Erkennung durch den DC/DC-Wandler 40-1 und Meldung über die Kommunikationsverbindung 5-2 an die zweite Steuereinrichtung 5;
• - Erkennung durch das Lenksystem 41-1 und das Bremssystem 41-2 und Meldung über die Kommunikationsverbindung 5-2 an die zweite Steuereinrichtung 5;
• - Weiterleitung eines Zustands der ersten Steuereinrichtung 4 an die zweite Steuereinrichtung 5 und andersherum.

As a result, this condition or an error is detected in several places:

• - Detection on the energy storage 40-2 and forwarding via the communication connection 5-4 to the second control device 5 and from there via the communication connection 5-5 to the first control device 4;
• - Recognition by the DC/DC converter 40-1 and notification via the communication link 5-2 to the second control device 5;
• - Recognition by the steering system 41-1 and the braking system 41-2 and reporting via the communication link 5-2 to the second control device 5;
• - Forwarding a state of the first control device 4 to the second control device 5 and vice versa.

• - (optional) Abtrennen aller nicht-sicherheitskritischen Niedervoltverbraucher 42 durch Ansteuern des Halbleiterschalters 40-4;
• - Einleiten eines Sicherheitsmanövers (insbesondere eines Bremsvorgangs) mittels der Steuereinrichtungen 4, 5 über die Versorgungseinheiten 20, 30 mit Hilfe des Hauptsteuerrechners 31-3 und der Umfeldsensorik 31-4 und des Zweitsteuerrechners 21-3 und der Umfeldsensorik 21-4 sowie des Lenksystems 21-1 und des Bremssystems 21-2 über die Kommunikationsverbindungen 4-1, 5-1.

The following actions are then taken in response to one or more of these events:

• - (optional) disconnecting all non-safety-critical low-voltage consumers 42 by activating the semiconductor switch 40-4;
• - Initiating a safety maneuver (in particular a braking process) by means of the control devices 4, 5 via the supply units 20, 30 with the aid of the main control computer 31-3 and the environment sensors 31-4 and the second control computer 21-3 and the environment sensors 21-4 and the steering system 21 -1 and the brake system 21-2 via the communication connections 4-1, 5-1.

The vehicle is brought into a safe state via the safety maneuver carried out.

Example scenario 4:

In the example scenario, an undervoltage occurs on the supply buses 20-3 and 30-3 because the DC/DC converters 20-1, 30-1 have failed and/or a short circuit and/or a fault in the energy storage devices 20-2 , 30-2 occurred.

• - Erkennung durch den Zweitsteuerrechner 21-3 und die Umfeldsensorik 21-4 und Meldung über die Kommunikationsverbindung 4-1;
• - Erkennung an dem Energiespeicher 30-2 und Weiterleitung über die Kommunikationsverbindung 5-3 an die zweite Steuereinrichtung 5;
• - Zustandsmeldungen der Niedrigvoltverbraucher 21-x, 31-x an den Versorgungsbussen 20-3, 30-3 über die Kommunikationsverbindungen 4-1, 5-1 an die Steuereinrichtungen 4, 5 und Weiterleitung an die jeweils andere Steuereinrichtung 4, 5 über die Kommunikationsverbindung 5-5.

As a result, this condition or an error is detected in several places:

• - Detection by the second control computer 21-3 and the environmental sensors 21-4 and reporting via the communication connection 4-1;
• - Detection on the energy storage 30-2 and forwarding via the communication connection 5-3 to the second control device 5;
• - Status reports from the low-voltage consumers 21-x, 31-x on the supply buses 20-3, 30-3 via the communication connections 4-1, 5-1 to the control devices 4, 5 and forwarding to the other control device 4, 5 via the communication connection 5-5.

• - (optional) Abtrennen aller nicht-sicherheitskritischen Niedervoltverbraucher 22 durch Ansteuern des Halbleiterschalters 20-4 (wenn vorhanden, erfolgt dies ebenfalls bei der Versorgungseinheit 30);
• - Einleiten eines Sicherheitsmanövers (insbesondere eines Bremsvorgangs) mittels der zweiten Steuereinrichtung 5 durch direktes Ansteuern des Bremssystems 41-2 über die Kommunikationsverbindung 5-2.

The following actions are then taken in response to one or more of these events:

• - (optional) disconnecting all non-safety-critical low-voltage consumers 22 by activating the semiconductor switch 20-4 (if present, this also occurs at the supply unit 30);
• - Initiating a safety maneuver (in particular a braking process) by means of the second control device 5 by directly controlling the braking system 41-2 via the communication connection 5-2.

The vehicle is brought into a safe state via the safety maneuver carried out.

Example scenario 5:

In the example scenario, an undervoltage occurs on the supply buses 20-3 and 40-3 because the DC/DC converters 20-1, 40-1 have failed and/or a short circuit and/or a fault in the energy storage devices 20-2 , 40-2 occurred.

• - Erkennung durch den DC/DC-Wandler 20-1 und Meldung über die Kommunikationsverbindung 4-1;
• - Erkennung durch den DC/DC-Wandler 40-1 und Meldung über die Kommunikationsverbindung 5-2;
• - Erkennung durch das Bremssystem 21-1 und/oder das Lenksystem 21-2 und Meldung über die Kommunikationsverbindung 4-1;
• - Zustandsmeldungen der Niedrigvoltverbraucher 21-x, 41-x an den Versorgungsbussen 20-3, 40-3 über die Kommunikationsverbindungen 4-1, 5-2 an die Steuereinrichtungen 4, 5 und Weiterleitung an die jeweils andere Steuereinrichtung 4, 5 über die Kommunikationsverbindung 5-5.

As a result, this condition or an error is detected in several places:

• - Detection by the DC/DC converter 20-1 and reporting via the communication link 4-1;
• - Detection by the DC/DC converter 40-1 and reporting via the communication link 5-2;
• - Detection by the braking system 21-1 and/or the steering system 21-2 and reporting via the communication link 4-1;
• - Status reports from the low-voltage consumers 21-x, 41-x on the supply buses 20-3, 40-3 via the communication connections 4-1, 5-2 to the control devices 4, 5 and forwarding to the other control device 4, 5 via the communication connection 5-5.

• - (optional) Abtrennen aller nicht-sicherheitskritischen Niedervoltverbraucher 22, 42 durch Ansteuern der Halbleiterschalter 20-4, 40-4;
• - Einleiten eines Sicherheitsmanövers (insbesondere eines Bremsvorgangs) mittels der ersten Steuereinrichtung 4 durch direktes Ansteuern des Bremssystems 21-2 über die Kommunikationsverbindung 4-1. Für eine Betriebsdauer von etwa 20 s wird zum Versorgen des Bremssystems 21-2 eine Restenergie in dem Energiespeicher 20-2 vorgehalten.

The following actions are then taken in response to one or more of these events:

• - (optional) disconnection of all non-safety-critical low-voltage consumers 22, 42 by controlling the semiconductor switches 20-4, 40-4;
• - Initiating a safety maneuver (in particular a braking process) by means of the first control device 4 by directly controlling the braking system 21-2 via the communication connection 4-1. For an operating period of approximately 20 s, residual energy is stored in the energy storage 20-2 to supply the brake system 21-2.

Example scenario 6:

In the example scenario, an undervoltage occurs on the supply buses 30-3 and 40-3 because the DC/DC converters 30-1, 40-1 have failed and/or a short circuit and/or a fault in the energy storage devices 30-2 , 40-2 occurred.

• - Erkennung durch die DC/DC-Wandler 30-1, 40-1 und/oder die Energiespeicher 30-2, 40-2 und Meldung über die Kommunikationsverbindungen 5-1, 5-2;
• - Erkennung durch den Hauptsteuerrechner 31-3 und die Umfeldsensorik 31-4 und Meldung die Kommunikationsverbindung 5-1;
• - Erkennung durch das Bremssystem 41-1 und/oder das Lenksystem 41-2 und Meldung über die Kommunikationsverbindung 5-2;
• - Zustandsmeldungen der Niedrigvoltverbraucher 31-x, 41-x an den Versorgungsbussen 30-3, 40-3 über die Kommunikationsverbindungen 5-1, 5-2 an die Steuereinrichtung 5 und Weiterleitung an die erste Steuereinrichtung 4 über die Kommunikationsverbindung 5-5.

As a result, this condition or an error is detected in several places:

• - Recognition by the DC/DC converters 30-1, 40-1 and/or the energy storage devices 30-2, 40-2 and reporting via the communication connections 5-1, 5-2;
• - Detection by the main control computer 31-3 and the environmental sensors 31-4 and reporting the communication connection 5-1;
• - Detection by the braking system 41-1 and/or the steering system 41-2 and reporting via the communication link 5-2;
• - Status reports from the low-voltage consumers 31-x, 41-x on the supply buses 30-3, 40-3 via the communication connections 5-1, 5-2 to the control device 5 and forwarding to the first control device 4 via the communication connection 5-5.

• - (optional) Abtrennen aller nicht-sicherheitskritischen Niedervoltverbraucher 42 durch Ansteuern des Halbleiterschalters 40-4;
• - Einleiten eines Sicherheitsmanövers (insbesondere eines Bremsvorgangs) mittels der ersten Steuereinrichtung 4 durch direktes Ansteuern des Bremssystems 21-2 über die Kommunikationsverbindung 4-1.

The following actions are then taken in response to one or more of these events:

• - (optional) disconnecting all non-safety-critical low-voltage consumers 42 by activating the semiconductor switch 40-4;
• - Initiating a safety maneuver (in particular a braking process) by means of the first control device 4 by directly controlling the braking system 21-2 via the communication connection 4-1.

Reference symbol list

1

Low voltage supply arrangement

2

first subnet

3

second subnet

4

first control device

4-x

Communication link

5

second control device

5-x

Communication link

6

Maintenance disconnect plug

20

Supply unit

20-1

DC/DC converter

20-2

Energy storage

20-3

Supply bus

20-4

Semiconductor switch

21-x

Low-voltage consumers (safety-critical)

21-1

Steering system

21-2

Braking system

21-3

Secondary tax calculator

21-4

second environmental sensor system

22

Low-voltage consumers (not safety-critical)

30

Supply unit

30-1

DC/DC converter

30-2

Energy storage

30-3

Supply bus

31-x

Low-voltage consumers (safety-critical)

31-3

Main tax calculator

31-4

first environmental sensor system

40

Supply unit

40-1

DC/DC converter

40-2

Energy storage

40-3

Supply bus

40-4

Semiconductor switch

41-x

Low-voltage consumers (safety-critical)

41-1

Steering system

41-2

Braking system

42

Low-voltage consumers (not safety-critical)

50

vehicle

51

High voltage supply

51-1

Battery control

52

High voltage battery

53

Application server

Claims (10)

Low-voltage supply arrangement (1) for an automated or partially automated vehicle (50), comprising: - a first subnetwork (2) and a second subnetwork (3), each with at least one supply unit (20,30,40), wherein the at least one supply unit (20,30,40) has a DC/DC converter (20-1, 30-1,40-1) and an energy storage device (20-2,30-2,40-2), with the DC/DC converter (20-1,30-1,40-1) on one side a high-voltage supply (51) can be connected or is connected and on another side with the energy storage (20-2,30-2,40-2) and a supply bus (20-3,30-3,40-3) for supply connected to low-voltage consumers (21-x,31-x,41-x), - a first control device (4), set up to monitor the first subnetwork (2), - a second control device (5), set up to monitor the second sub-network (3), and wherein the supply units (20,30,40) are galvanically isolated from one another, the DC/DC converters (20-1,30-1, 40-1) and the energy storage (20-2,30-2,40-2) of one sub-network (2,3) differ from those of the other sub-network (2,3), and safety-critical low-voltage consumers (21-x,31 -x,41-x) are redundantly distributed among the subnetworks (2,3). Low-voltage supply arrangement (1). Claim 1 , characterized by at least one semiconductor switch (20-4,40-4), via the non-safety-critical low-voltage consumer (22,42) with the supply bus (20-3,30-3,40-3) of one of the supply units (20,30 ,40) are connected, and which can be controlled via this and separated from the supply bus (20-3,30-3,40-3). Low-voltage supply arrangement (1). Claim 1 or 2 , characterized in that the second subnetwork (3) has at least two supply units (30,40), the supply bus (30-3,40-3) being one of the at least two supply units (30,40) of the second subnetwork (3). a main control computer (31-3) and a first environment sensor system (31-4) for automated driving and supplies them, the main control computer (31-3) being set up to carry out a safety maneuver if necessary, the supply bus (20-3 ) the at least one supply unit (20) of the first subnetwork (2) with a second control computer (21-3) and a second environmental sensor system (21-4) is connected and supplies it, the second control computer (21-3) being set up to carry out a safety maneuver if necessary. Low-voltage supply arrangement (1) according to one of the preceding claims, characterized in that the first control device (4) and / or the second control device (5) are set up to detect the vehicle ( 50) to be transferred to a safe state by directly controlling at least some of the safety-critical low-voltage consumers (21-x,31-x,41-x). Low-voltage supply arrangement (1) according to one of the preceding claims, characterized in that the first control device (4) and the second control device (5) are set up to monitor each other and to initiate at least one safety maneuver when an error is detected. Low-voltage supply arrangement (1) according to one of the preceding claims, characterized in that the control devices (4,5) are set up to determine a charge state of the energy storage (20-2,30-2,40-2) of the supply units (20,30 ,40) to monitor so that a predetermined minimum supply period of at least the safety-critical low-voltage consumers (21-x,31-x,41-x) in the supply units (20,30,40) is ensured. Low-voltage supply arrangement (1) according to one of the preceding claims, characterized by a maintenance disconnect plug (6), with a voltage of the energy storage (20-2,30-2,40-2) for each supply unit (20,30,40). via the maintenance disconnect plug (6) to a detection contact of the respective DC/DC converter (20-1,30-1,40-1), and the DC/DC converter (20-1,30-1 ,40-1) are set up to go out of operation if the detection contact detects that the maintenance disconnect plug (6) is pulled. Low-voltage supply arrangement (1) according to one of the preceding claims, characterized in that the supply units (20,30,40) of the sub-networks (2,3) each meet a safety requirement level according to ASIL B. Vehicle (50), comprising a low-voltage supply arrangement (1) according to one of Claims 1 until 8th . Method for operating a partially automated or automated vehicle (50), wherein safety-critical low-voltage consumers (21-x,31-x,41-x) are supplied by means of a low-voltage supply arrangement (1) according to one of Claims 1 until 8th are supplied, the subnetworks (2,3) being monitored, and the vehicle (50) being brought into a safe state by carrying out a safety maneuver if an error in the subnetworks (2,3) is detected.

Images