Control device for a vehicle

Abstract

The invention relates to a control device (5; 6; 7; 8; 10) for a vehicle, having an interface (5a...5d; 6a...6d; 7a...7d; 8a...8d) for connection to two independently redundant communication networks (KN1, KN2), wherein messages can be passed to and from the control device (5; 6; 7; 8; 10) via the second communication network (KN2) in the event of a failure of the first communication network (KN1) and vice versa, and an interface for supplying the control device (5; 6; 7; 8; 10) with power via two independently redundant low-voltage networks (NN1, NN2), wherein the supply of the control device (5; 6; 7; 8; 10) with power can be carried out via the second low-voltage network (NN2) in the event of a fault in the first low-voltage network (NN1) and vice versa.

Description

TECHNICAL FIELD

[0001] The present invention relates to a control device for a vehicle. Furthermore, the present invention relates to a control system for a vehicle. Furthermore, the present invention relates to a method for operating a control system for a vehicle. Furthermore, the present invention relates to a computer product. BACKGROUND

[0002] Known automated driving functions require, in particular in the case of a handover to the driver, a certain bridging and handover time to the driver in order to enable the driver to take over the driving situation again and to take over the correct vehicle driving function again on his own. Vehicle driving functions that can be taken over by the driver after the handover time of the automated driving function can be, for example, deceleration and steering of the vehicle. In other possible cases, the driver has to correct longitudinal and lateral motion functions of the automated driving function in order to, for example, end an overtaking maneuver or to drive the vehicle out of a crossroads, a construction site, a tunnel, a rail, etc.

[0003] DE 10 2016 215 564 A1 discloses a method for operating an electrical network of a motor vehicle, wherein values of parameters relating to a current situation of the electrical supply of electrical components of the electrical network are ascertained and, depending on the ascertained values, only those electrical components of the network are switched off which are not necessary for a predefined emergency operation of the motor vehicle.

[0004] DE 10 2015 008 005 A1 discloses a method for operating a motor vehicle, wherein a first electrical vehicle network has a first battery and an electrical generator, and a second electrical vehicle network has a second battery, which vehicle networks are coupled by means of a DC / DC converter via which electrical power is transmitted from the first battery and the electrical generator into the second vehicle network by means of voltage conversion of the DC / DC converter. Even in the event of a failure of the first battery and / or in the event of a defect of the DC / DC converter, the first vehicle network should be able to supply the second vehicle network. To this end, a detection device detects a failure of the first battery and / or of the DC / DC converter, and in the event of a detected failure, a switching device short-circuits the vehicle networks to one another and sets a regulator rating of the electrical generator to the voltage of the second vehicle network.

[0005] It is important, especially in the case of automated driving, that functions which are important for safety are also designed to be fault-tolerant, so that even in the event of a fault the electronic functions are available. Here, redundancy has a dual function, namely to detect faults and to increase the availability of the functions. This is especially the case in longitudinal and lateral movement functions, for example the implementation of brake systems and steering systems, which are particularly at risk during driving, since (in the event of a failure of important associated functions and components) the vehicle suddenly becomes unable to brake, steer, etc. The communication and the voltage supply should be largely able to be switched over without interruption, so that the performance of the vehicle functions does not suddenly decrease or so that the vehicle functions do not cause vibrations in the brakes, steering and drive functions. SUMMARY

[0006] It is the task of the present application to provide an improved control system for a vehicle.

[0007] According to a first aspect, this task is solved by a controller for a vehicle, the controller having:

[0008] an interface for connecting to two independently redundant communication networks, wherein messages can be passed to and from the control device by the second communication network in the event of a failure of the first communication network; and

[0009] an interface for supplying the control device with power by two independently redundant low-voltage networks, wherein in the event of a fault in the first low-voltage network, the supply of the control device can be carried out by the second low-voltage network and vice versa.

[0010] A control device is thereby achieved, which can still be supplied with electrical energy and can pass messages in the event of a fault in one of the networks. With this independently redundant control device, the transfer of the vehicle into a safe state is supported in the event of a fault.

[0011] According to a second aspect, this task is solved by a control system for a vehicle, the control system having:

[0012] two independently redundant high-voltage networks for providing electrical energy;

[0013] two independently redundant low-voltage networks for providing electrical control voltages; and

[0014] two independently redundant communication networks for passing messages between control devices connected to the communication networks; and

[0015] a degradation device for diagnosing a fault in the network and for selectively degrading a control device connected to the network, wherein the control system provides sufficient functionality for a safe driving operation of the vehicle.

[0016] According to a third aspect, the task is solved by a method for operating a vehicle, the method having the following steps:

[0017] diagnosing an electrical high-voltage network, a low-voltage network and an electrical communication network of a control system of the vehicle, the electrical high-voltage network, the low-voltage network and the electrical communication network being constructed redundantly independently of one another and being functionally connected to one another;

[0018] passing the diagnosis result to a battery management device of the control system, wherein a fault in a first battery management device does not impede the functionality of a second battery management device and vice versa; and

[0019] selectively degrading a control device connected to the electrical high-voltage network, the electrical control voltage network and the electrical communication network depending on the diagnosis result, such that the control device connected to the electrical high-voltage network, the electrical control voltage network and the electrical communication network still has sufficient functionality for a safe driving operation of the vehicle.

[0020] Thus, by means of the proposed method, an independent, fully redundant energy concept, supply voltage concept and communication concept for a vehicle is provided, which can partially evacuate a fault situation and provide the required functionality for a safe driving operation of the vehicle. Thus, by means of the proposed method, a so-called "soft degradation" of functionality is provided, such that sudden functional influences or functional losses do not occur. The proposed method is suitable for all vehicle types, however, is particularly useful for purely battery electric vehicles, since these vehicles do not have an electrical energy generation system coupled to an internal combustion engine and are therefore particularly affected in the event of a complete failure of the high-voltage network.

[0021] Advantageously, by means of the proposed method, a minimum functionality (sufficient functionality) of systems important for safety for the vehicle is maintained. Thus, it is thereby possible to provide a supply voltage for the controllers and actuators and electrical energy for driving, steering or braking of the vehicle in the long term.

[0022] The task is solved according to a fourth aspect by means of a computer program.

[0023] Advantageous refinements of the method and of the control system are the subject matter of the dependent claims.

[0024] An advantageous further development of the control system provides that the degrading device comprises a diagnostic module for performing the diagnosis and a battery management device for selectively degrading the control device. In this way, a central intelligence for the control system is achieved to some extent, which performs the diagnosis and initiates and performs the degradation.

[0025] A further advantageous further development of the control system provides that, by means of the diagnostic module, a preventive diagnosis and / or an actual diagnosis of the lines connected to the network and a selective switching off of the control devices connected to the network can be initiated and performed. In this context, an "actual diagnosis" is understood to be a diagnosis based on the measured values and message information obtained. Depending on the safety strategy selected, it is thus possible to degrade the devices and the network in a highly dynamic and flexible manner.

[0026] A further advantageous further development of the control system provides that, in the event of a fault in the high-voltage network, the DC / DC converter can be switched off and the battery can be connected for supplying power to one of the low-voltage networks. This is particularly useful if only the DC / DC converter for generating a 12 V control voltage is provided for supplying power to the electronic control.

[0027] A further advantageous further development of the control system provides that the diagnostic module and the battery management device are configured to be able to monitor one another. In this way, monitoring "over cross" is achieved, which advantageously increases the safety level of the control system.

[0028] A further advantageous further development of the control system provides that the state of the network can be obtained by means of the battery management device, wherein the corresponding data can be transmitted via a communication interface. Advantageously, a "central intelligence" of the control system is thus achieved, which supports a rapid exchange of information.

[0029] A further advantageous further development of the method provides that the selective switching off of the electrical consumers is performed in a delayed manner or using a predefined degradation control signal. In this way, a temporally delayed degradation is achieved for performing a "soft degradation".

[0030] A further advantageous further development of the method provides that at least one of the control devices remains in a state of readiness for the driving operation of the vehicle: a brake controller, a steering controller, a controller for a driver assistance system, a controller for motor management. For this purpose, at least two, better a plurality, preferably all, of the controllers are connected into a system, by means of which the basic functions of the vehicle are obtained. For example, a failure of the electrical control voltage of a low-voltage network does not result in a failure of the electronic controllers connected to the low-voltage network.

[0031] A further advantageous extension of the method provides that the selective switching off of the electrical consumers connected to the network performed on the basis of the diagnosis leads to a soft switchover in which the vehicle does not carry out sudden movements. Thereby, it is advantageously possible to maintain a high level of driving comfort and safety even in the event of disturbances of the vehicle.

[0032] A further advantageous extension of the control system provides that one of the high-voltage networks can be connected to another high-voltage network by means of a coupling switch. This can advantageously be used for mutual charging of high-voltage batteries, series connection of high-voltage batteries, energy balancing of high-voltage batteries, etc. BRIEF DESCRIPTION OF DRAWINGS

[0033] In the following, the application is described in detail on the basis of the drawings by means of further features and advantages. The drawings are primarily intended to illustrate the principles important for the application.

[0034] The disclosed features of the method are derived in an analogous manner by corresponding disclosed features of the device, and vice versa. This means, in particular, that features, technical advantages and embodiments relating to the control system are derived in an analogous manner by corresponding embodiments, features and advantages relating to the method for operating a control system for a vehicle, and vice versa.

[0035] In the drawings:

[0036] Figure 1 Block circuit diagram of an embodiment of the proposed control system for a vehicle;

[0037] Figure 2 Principle block circuit diagram of the proposed control device; and

[0038] Figure 3 Principle diagram of the proposed method for operating a control system for a vehicle. DETAILED DESCRIPTION

[0039] In the following, the term "automated vehicle" is used synonymously in terms of meaning with fully automated vehicle, partially automated vehicle, fully autonomous vehicle and partially autonomous vehicle (synonym: SAE levels 2 / 3, 4 / 5).

[0040] Most faults endangering the safe vehicle guidance of an automated vehicle are based on cascades in which a fault in, for example, a high-voltage battery leads to a switchoff which can involve a 12V battery by means of a DC / DC converter. If the 12V voltage supply or the communication with the control electronics of the electric motor (inverter) is interrupted, the control electronics can open the battery contactors and attenuate the high-voltage network energy through the windings of the electric motor. Due to a variety of pre-given high-voltage regulations, the following switchoff cascade leading to a high-voltage switchoff must be implemented:

[0041] Terminal 15 failure, fuse blown, high voltage enable circuit, wire disconnection;

[0042] - Communication failure with the inverter, battery management system, controller (VCU) for receiving driver intentions, etc.;

[0043] - High voltage (HV-) interlock (a safety function used to protect against high voltage);

[0044] - Inverter failure, high-voltage battery failure, failure of other loads (such as cooling / ventilation devices, etc.);

[0045] - Key EMV impacts;

[0046] - A state with a fault (e.g., a collision detection with a fault).

[0047] All the aforementioned faults, before triggering active shutdown, can essentially cause strong pulses in both the high-voltage and low-voltage networks of the vehicle. These pulses are typically tolerant of inertia due to the shutdown components (e.g., fuses, thresholds in the software, etc.). These pulses undesirably load the 12V battery and can significantly reduce its lifespan. Many 12V loads, such as cooling fan motors, EPS motors, ESP motors, or actuators, also have the potential to feed electrical power into the vehicle network under certain conditions, which in turn amplifies the pulses in the vehicle network. Additionally, the vehicle may become unstable due to vibrations in the drivetrain, and / or the driver may become highly disoriented due to pedal or steering wheel movements.

[0048] Since such faults can occur in all loads and the wiring connected to them, a selective shutdown of components or devices in the vehicle's control system is proposed. Here, the causes of interference are identified or preventatively diagnosed, and thus the selective shutdown of components or devices in the control system is performed, ensuring that the vehicle's basic driving functions are still provided.

[0049] This is achieved by transmitting interference information diagnosed by the diagnostic module to the battery management system, which, in conjunction with the diagnostic module, shuts down the affected circuits and switches the energy supply from the low-voltage network to a usable DC / DC power source or other electrical energy source. This is achieved by the diagnostic module acting as a selective shutdown or conversion device.

[0050] Figure 1An electrical-electronic architecture (E / E architecture) of the proposed control system 100 for a vehicle is shown, which is able to provide the proposed functionality. Two independently redundant high-voltage batteries 1a, 1b (with a direct current voltage of, for example, 400 V) can be seen, which are respectively fed by a high-voltage network HN1, HN2 and are respectively connected or disconnected from the high-voltage network HN1, HN2 by means of an associated battery management device 2a, 2b. Furthermore, a switch S can be actuated by means of the battery management device 2a, 2b, which is used to actuate (for example, charging, charge energy balancing, series connection, etc.) the high-voltage batteries 1a, 1b in a defined manner. The electric motors M1, M2 of the high-voltage networks HN1, HN2 are respectively actuated by means of one power electronics device 11a, 11b.

[0051] Furthermore, a first low-voltage network NV1 and a second low-voltage network NV2 can be seen in the control system 100, to which a DC / DC converter 3a, 3b respectively feeds 12 V electrical energy (electrical control voltage). Advantageously, in the event of a fault, a 12 V battery 4 can be connected to one of the low-voltage networks NV1, which is particularly interesting, for example, in the event that, due to a failure of the high-voltage batteries 1a, 1b, the DC / DC converters 3a, 3b no longer provide a 12 V supply voltage for the low-voltage networks NN1, NN2. Furthermore, it is also possible to connect a charging device 12, instead of the DC / DC converter 3b, to the low-voltage network NN2. By means of the charging device 12, the 12 V battery 4 can be charged.

[0052] In the control system 100, furthermore, a first communication network KN1 and a second communication network KN2 are provided, which can be configured, for example, as a CAN bus, Ethernet, etc. A central communication interface 9a, 9b (gateway) and a brake controller 8 (for example, integrated power brake, IPB) are connected to the communication networks KN1, KN2, which is used to locally regulate the line control braking or deceleration of the vehicle. By means of the mentioned communication networks KN1, KN1, messages for actuating the electronic controllers of the control system 100 are transmitted. Here, it is possible to provide a steering controller 5, a controller 6 for receiving a driving intention, a controller 7 for automated driving and the brake controller 8 as electronic controllers. Furthermore, it is also possible to consider further, not mentioned electronic controllers, which are connected to the communication networks KN1, KN2. Figure 1The so-called "degradability" of the network and the loads of the control system 100 is controlled in particular by the diagnostic module 10, which, in cooperation with the battery management systems 2a, 2b, performs a preventive diagnosis of all lines of all networks HN1, HN2, NN1, NN2, KN1, KN2 (for example, the resistance change is determined due to line disconnection, aging effects, vibrations, temperature effects, short-term critical voltage requirements, etc.), and thus causes a selective switching of the loads and generators or control devices connected to the control system 100, so that after a defect has occurred, the basic driving functions of the vehicle (for example, steering, braking, control, navigation, etc.) are still provided.

[0053] Thus, with the proposed control system 100 for a vehicle, the following advantageous functions mentioned below are only exemplary:

[0054] The electrical control voltage of the 12V low-voltage networks NN1, NN2 is assigned to a communication level with a communication network KN1, KN2 and a redundancy available. This means that, due to the two independently redundant low-voltage networks NN1, NN2 and the two independently redundant communication networks KN1, KN2, the electronic controllers are each hung on the same branch (low-voltage network and communication network), because otherwise, in the event of a 12V power and communication failure, the availability is reduced. With the proposed method, for example, although one electronic controller can fail completely, the remaining available controllers can maintain the nominal functions of the failed controller (mostly with reduced performance) or can provide a degraded function of the failed function. Due to the independent redundancy, in this way it can be advantageously achieved that a fault in one of the networks NN1, NN2, KN1, KN2, HN1, HN2 does not hinder the functionality of the other network NN1, NN2, KN1, KN2, HN1, HN2, respectively, assigned to the corresponding network NN1, NN2, KN1, KN2, HN1, HN2.

[0055] Important vehicle systems for ensuring driving until a safe parking or state (fault state or fault operating state), for example brakes and steering devices, are each connected to the two communication networks KN1, KN2 and the two 12V low-voltage networks NN1, NN2, which are each electrically separated from each other or "sufficiently safe" from each other.

[0056] All high-voltage consumers are preferably connected to both high-voltage networks HN1, HN2, so that a high-voltage shutdown only has an effect on one branch (with high-voltage network, low-voltage network and communication network), and thus, in the event of a complete shutdown of one high-voltage network, the high-voltage consumers remain functional. The respective branch is preferably assigned to the first low-voltage network and the first communication network once and to the second low-voltage network and the second communication network once, so that a fault in the high-voltage network and a shutdown of the high-voltage operation cannot lead to a fault in the other networks.

[0057] The diagnostic module 10 is in particular designed for preventive diagnostics of the lines of all networks by means of detection and / or simulation of line resistance and current, and can provide corresponding information to the consumers connected to the networks, so that the defined consumers can be shut down or removed from the assigned network preventively before a fault occurs.

[0058] The degradable consumers include, for example, a controller 7 for a driver assistance system, which is preferably connected to the further low-voltage network NN1, NN2 as a controller 6 for motor management and thermal management. Advantageously, this supports the case that a failure or shutdown of the controller 7 for the driver assistance system can be at least partially compensated by the controller 6 for motor management and thermal management, and vice versa.

[0059] It can thus be seen that the controllers, energy systems, drives and networks in the proposed system 100 are arranged and functionally connected to one another in such a way that in the event of a fault in the vehicle (for example due to an accident), all controllers, energy systems, drives and networks can never be damaged or fail at the same time.

[0060] The line diagnostics by the diagnostic module 10 should therefore not only implement the diagnostics of the high-voltage networks HV1, HV2, but additionally also the diagnostics of the low-voltage networks NV1, NV2, and this should be incorporated as a possible degradation. By means of the diagnostic module 10, it is possible to prospectively switch and shut down all devices connected to the networks (predictive maintenance).

[0061] Diagnostic information relating to the low-voltage network and the high-voltage network are provided to the battery management devices 2a, 2b in real time as far as possible, so that these diagnostic information are learned together with the battery status of the high-voltage battery 1a, 1b. In this way, the battery management devices 2a, 2b are able to selectively separate or switch off the respective high-voltage network HN1, HN2 by means of the contactors and / or power switches 12a, 12b, in order to avoid the propagation of faults. The battery management devices 2a, 2b are controllers which are connected to other controllers by means of different fixed-wiring signals and by means of a bus system, for example a CAN bus or the like. Faults in the high-voltage network, connections, communication, cooling water or the like generally result in the generation of a requirement that the battery management devices 2a, 2b open the contactors and thus disconnect the circuit.

[0062] In addition, a so-called "degradation manager" (not shown) can be provided for controlling the proposed selective degradation.

[0063] By means of the proposed monitoring system, it is possible to identify and selectively switch off critical loads in the low-voltage network NN1, NN2, without the availability of important vehicle driving functions thereby being endangered. Since all vehicle driving functions nowadays already have a redundant 12V supply, it is possible, by means of the battery management devices 2a, 2b, to switch off critical circuits, as required for the emergency operation of an automated vehicle.

[0064] In addition, the battery management devices 2a, 2b can thus also switch off critical circuits, as required for the emergency operation of the control system 100. By means of the battery management devices, it is possible to maintain the 12V supply by means of the DC / DC converter 3a, 3b, as long as the high-voltage battery 1a, 1b is able to maintain a low level of electrical energy supply.

[0065] In addition, depending on the cause of the fault, the battery management devices 2a, 2b can also initiate a selective switch-off of the high-voltage network HN1, HN2 and of the low-voltage network NN1, NN2.

[0066] By means of the proposed control system 100, it is possible to perform the degradation of the network and of the devices connected to the network in such a way that the vehicle equipped with the control system 100 is able to move into a safe state.

[0067] To this end, the messages passed on to the control device are checked in terms of their consistency and plausibility with regard to the functionality of the vehicle driving functions.

[0068] Figure 2A schematic block diagram of a control or control device, in this case a steering controller 5 of a vehicle, is shown. Two inputs 5a, 5b for connection to two communication networks KN1, KN2 and two inputs 5c, 5d for connection to low-voltage networks NN1, NN2 for providing a 12 V voltage supply can be seen. The interfaces 5a, 5b or 5c, 5d are each implemented independently redundantly, which means that a failure of the connected networks KN1, KN2, NN1, NN2 cannot adversely affect the mode of operation of the controller. In Figure 2 The electrical separation of the inputs 5a, 5c from the inputs 5b, 5d, which supports the functional independence of the mentioned inputs, is indicated in the diagram by a separation line. It is thereby ensured that at all times, i.e. even in the event of a fault in the vehicle, not only the messages transmitted via the communication networks KN1, KN2, but also the power supply via the low-voltage networks NN1, NN2, is guaranteed.

[0069] Figure 3 A schematic flow diagram of an embodiment of the proposed method is shown.

[0070] In step 200, the electrical high-voltage network, the low-voltage network and the electrical communication networks HN1, HN2, NN1, NN2, KN1, KN2 of the control system 100 of the vehicle are diagnosed, which are each constructed independently redundantly and are functionally connected to one another.

[0071] In step 210, the diagnosis results are transmitted to the independently redundant battery management devices 2a, 2b of the control system 100, wherein a fault in the first battery management device does not impede the functionality of the second battery management device and vice versa.

[0072] In step 220, the devices of the electrical high-voltage network, the electrical control voltage network and the electrical communication networks HN1, HN2, NN1, NN2, KN1, KN2 are selectively degraded in accordance with the diagnosis results, such that the devices connected to the electrical energy supply network, the electrical control voltage network and the electrical communication networks HN1, HN2, NN1, NN2, KN1, KN2 still have sufficient functionality.

[0073] Advantageously, the proposed method can be implemented in the form of a software program with suitable program code units, which is run on the diagnosis module 10 and the battery management devices 2a, 2b. In this way, simple adaptability of the method can be achieved.

[0074] Thus, it is possible to realize a system composed of controllers connected to each other, which, for a defined functionality, comprises at least one controller providing assigned information or data via a communication network and an assigned controller receiving the information via the communication network and transforming it into an Aktuation for the vehicle.

[0075] A typical application scenario of the present application can be an automated vehicle with a functionality higher than SAE level 2, in which the driver is replaced by a machine system for a limited period of time during the driving operation.

[0076] The person skilled in the art can make suitable modifications and / or combinations of features of the present application without departing from the core of the present application.

Claims

1. A control device for a vehicle, the control device having an interface for connection to two independently redundant communication networks, which are electrically separated from each other, respectively, wherein, The control device is able to be supplied with power by two independently redundant low-voltage networks, which are electrically separated from one another, respectively, wherein in the event of a fault in the first low-voltage network, the supply of the control device can be carried out by the second low-voltage network, and vice versa, wherein the control device comprises a diagnostic module, wherein the diagnostic module carries out a preventive diagnosis of all lines of all networks of the vehicle in cooperation with a battery management system of the vehicle, and as a result of which the electrical loads and generators of the vehicle are able to be selectively switched depending on the diagnostic information about the networks transmitted by the interface, wherein by selectively switching the electrical loads a minimum functionality for safety-relevant systems of the vehicle is maintained.

2. A control system for a vehicle, the control system having: two independently redundant high voltage networks for providing electrical energy; two independently redundant low voltage networks for providing electrical control voltages, wherein, The two low-voltage networks are electrically separated from one another, respectively, wherein a fault in one of the low-voltage networks does not hinder the functionality of the other low-voltage network; and two independently redundant communication networks for transmitting messages between control devices connected to the communication networks, wherein the two communication networks are electrically separated from one another, respectively, wherein a fault in one of the communication networks does not hinder the functionality of the other communication network; and a degradation device for diagnosing faults in the networks and for selectively degrading control devices connected to the networks, wherein the control system provides sufficient functionality for a driving operation of the vehicle, wherein the control devices are control devices according to claim 1, respectively.

3. The control system of claim 2, wherein, The degradation device comprises a diagnostic module for carrying out the diagnosis and a battery management device for selectively degrading the control devices, wherein the control devices are switched off depending on the diagnosis result in such a way that they still have sufficient functionality for a safe driving operation of the vehicle.

4. The control system of claim 3, wherein, By means of the diagnostic module, a preventive diagnosis and / or an actual diagnosis of lines connected to the networks and a selective switching off of control devices connected to the networks can be initiated and carried out, wherein the preventive diagnosis is understood to be a diagnosis before a fault in the network to which it is assigned occurs, and the actual diagnosis is understood to be a diagnosis based on measured values and message information ascertained.

5. The control system of any one of claims 2 to 4, wherein, In the event of a fault in the high-voltage network, a DC / DC converter can be switched off and a battery can be connected for supplying one of the low-voltage networks.

6. The control system of any one of claims 3-4, wherein, The diagnostic module and the battery management device are configured to be able to monitor one another.

7. The control system of any one of claims 3-4, wherein, The state of the networks can be ascertained by means of the battery management device, wherein the corresponding data can be transmitted by a communication interface. The control device is able to be supplied with power by two independently redundant low-voltage networks, which are electrically separated from one another, respectively, wherein in the event of a fault in the first low-voltage network, the supply of the control device can be carried out by the second low-voltage network, and vice versa, wherein the control device comprises a diagnostic module, wherein the diagnostic module carries out a preventive diagnosis of all lines of all networks of the vehicle in cooperation with a battery management system of the vehicle, and as a result of which the electrical loads and generators of the vehicle are able to be selectively switched depending on the diagnostic information about the networks transmitted by the interface, wherein by selectively switching the electrical loads a minimum functionality for safety-relevant systems of the vehicle is maintained. The two low-voltage networks are electrically separated from one another, respectively, wherein a fault in one of the low-voltage networks does not hinder the functionality of the other low-voltage network; and two independently redundant communication networks for transmitting messages between control devices connected to the communication networks, wherein the two communication networks are electrically separated from one another, respectively, wherein a fault in one of the communication networks does not hinder the functionality of the other communication network; and a degradation device for diagnosing faults in the networks and for selectively degrading control devices connected to the networks, wherein the control system provides sufficient functionality for a driving operation of the vehicle, wherein the control devices are control devices according to claim 1, respectively. The degradation device comprises a diagnostic module for carrying out the diagnosis and a battery management device for selectively degrading the control devices, wherein the control devices are switched off depending on the diagnosis result in such a way that they still have sufficient functionality for a safe driving operation of the vehicle. By means of the diagnostic module, a preventive diagnosis and / or an actual diagnosis of lines connected to the networks and a selective switching off of control devices connected to the networks can be initiated and carried out, wherein the preventive diagnosis is understood to be a diagnosis before a fault in the network to which it is assigned occurs, and the actual diagnosis is understood to be a diagnosis based on measured values and message information ascertained. In the event of a fault in the high-voltage network, a DC / DC converter can be switched off and a battery can be connected for supplying one of the low-voltage networks. The diagnostic module and the battery management device are configured to be able to monitor one another. The state of the networks can be ascertained by means of the battery management device, wherein the corresponding data can be transmitted by a communication interface.

8. A method for operating a vehicle, the method having the steps of diagnosing a high-voltage network, a low-voltage network and a communication network of a control system of the vehicle, the high-voltage network, the low-voltage network and the communication network being constructed independently redundantly and functionally interconnected, wherein, two low-voltage networks are electrically separated from each other, wherein the two communication networks are electrically separated from each other; the diagnostic results are passed to independently redundant battery management devices of the control system, wherein a malfunction in the first battery management device does not impede the functionality of the second battery management device and vice versa; and the control devices connected to the high-voltage network, low-voltage network and communication network are selectively degraded in accordance with the diagnostic results such that the control devices connected to the high-voltage network, low-voltage network and communication network still have sufficient functionality for a safe driving operation of the vehicle, wherein the control devices are switched off by selective degradation of the control devices in accordance with the diagnostic results such that a minimum functionality for safety-relevant systems of the vehicle is maintained.

9. The method of claim 8, wherein, The selective switching off of the electrical consumers is performed in a delayed manner or using a predefined degradation control signal.

10. The method of claim 8 or 9, wherein, The selective switching off is performed on electrical devices that are not necessary for the necessary driving functions of the vehicle.

11. The method of claim 10, wherein, At least one of the following control devices remains in a state of readiness for operation for the driving operation of the vehicle: brake controller, steering controller, controller for a driver assistance system, controller for motor management.

12. The method of claim 8 or 9, wherein, One of the high-voltage networks can be connected to the other high-voltage network by means of a coupling switch.

13. The method of claim 9, wherein, The selective switching off of the electrical consumers performed on the basis of the diagnosis results leads to a soft switchover in which the vehicle does not carry out sudden movements.

14. Computer program having program code means which are designed to perform the method according to any one of claims 8 to 13 when the computer program runs on a degradation device or is stored on a computer-readable data carrier.

Images