Redundant on-board power system and motor vehicle

Abstract

Redundant on-board power system (2) for a motor vehicle (1), comprising a first sub-on-board power system (14) for supplying a first drive device (4) and a second sub-on-board power system (16) for supplying a second drive device (6), wherein - the first sub-vehicle network (14) comprises a first high-voltage network (22), a first low-voltage network (26) supplied from the first high-voltage network (22) and a first bus system (52) supplied from the first high-voltage network (22) or the first low-voltage network (26) for data transmission between components (34, 40) integrated into the first sub-vehicle network (14) in the intended operating state, - the second sub-vehicle network (16) comprises a second high-voltage network (24), a second low-voltage network (28) supplied from the second high-voltage network (24) and a second bus system (54) supplied from the second high-voltage network (24) or the second low-voltage network (28) for data transmission between components (34, 40) integrated into the second sub-vehicle network (16) in the intended operating state, - the first and second high-voltage networks (22, 24) each have an associated first and second energy storage device (18, 20), - for driving the motor vehicle (1), drive-relevant components (48) and safety-relevant components (50) are coupled to the first and second bus systems (52, 54) for data transmission purposes in the intended operating state, and - the first and second high-voltage networks (22, 24) are designed to be feedback-free to one another, at least during driving operation, wherein, in the intended state of use, control units of the respective further components (40) of the first and second sub-vehicle networks (14, 16) are each supplied with energy only from the first and second low-voltage networks (26, 28), respectively, and wherein, in the intended state of use, control units of the drive-relevant components (48) and of the safety-relevant components (50) are coupled to both the first and the second low-voltage networks (26, 28) for energy supply.

Description

[0001] The invention relates to a redundant on-board power supply system. Furthermore, the invention relates to a motor vehicle with such a redundant on-board power supply system.

[0002] An on-board electrical system is typically understood to be the electrical and / or electronic infrastructure of a vehicle, particularly a motor vehicle. This infrastructure serves to connect and, in particular, to supply electrical consumers with (operating) energy. While on-board electrical systems are also used in vehicles with combustion engines, their design is comparatively complex in vehicles with electric drive. In this case, there are usually at least two different voltage levels: a high-voltage level, which supplies an electric traction motor in particular, and a low-voltage level, which supplies other consumers, e.g., control units for sensors, comfort functions, but also safety-relevant components (e.g., airbags, electronic stability systems, etc.).

[0003] Redundancy structures are particularly interesting for electrically powered vehicles. These structures are activated if, for example, a fault occurs in an energy storage device, in one of the aforementioned consumers, in the infrastructure itself, or similar. Currently, efforts are underway, particularly in the area of ​​purely electric vehicles, to enable a relatively controlled coasting or shutting down of the vehicle in emergency mode.

[0004] For example, DE 10 2016 215 564 A1 discloses an on-board power system with two sub-networks, one of which contains components less relevant to the vehicle's safety. These components are more related to the comfort zone or normal operation. They are generally less safety-relevant. This division is chosen so that, in the event of emergency operation of the vehicle, this sub-network with the less safety-relevant components can be separated from the other sub-network and switched off.

[0005] DE 100 33 317 A1 discloses an on-board power system that features an emergency battery for safety-relevant loads. This battery is disconnected from these loads via a relay as long as a main battery is available to supply power. If the main battery fails, the emergency battery is connected to the safety-relevant loads, such as the drive, but not to non-critical loads.

[0006] DE 10 2017 216 635 A1 describes a vehicle having two first wheels spaced apart from one another in the transverse direction of the vehicle, two controllable electric drive units, each designed to drive one of the two first wheels, two second wheels spaced apart from one another in the transverse direction of the vehicle, two controllable electric steering units, each designed to steer one of the two second wheels, two controllable electric brake units, each designed to brake one of the two second wheels, a first electrical system having a first energy storage unit for electrically supplying one of the two drive units, one of the two steering units and one of the two brake units, and a second electrical system having a second energy storage unit for electrically supplying the other of the two drive units, the other of the two steering units and the other of the two brake units,and a control device designed to control the drive units, the steering units and the braking units.

[0007] DE 103 20 608 A1 describes a braking system for vehicles which has at least two electrical or electronic brake control circuits which are galvanically isolated from each other.

[0008] US 2008 / 0228350 A1 describes a communication system for a technical device, in particular for a motor vehicle, which contains a plurality of functional systems that serve to monitor and control various functions of the technical device. The functional systems each contain an evaluation unit and at least one functional component that is coupled to the evaluation unit to exchange signals. At least one of the functional systems is designed to detect a malfunction and / or a functional failure of at least one of the other functional systems and, in the event of a malfunction and / or a functional failure of the at least one other functional system, to assume at least part of the functionality of the at least one other functional system.

[0009] DE 10 2005 013 440 A1 describes a power supply circuit consisting of two on-board electrical systems and at least one energy generator, for example, a generator. Each on-board electrical system includes an energy storage device, preferably a battery, a charging separation module, and various electrical consumers. Furthermore, switching devices for activating, deactivating, or controlling the consumers are provided, which include a communication interface.

[0010] DE 10 2017 213 410 A1 describes a method for controlling the power consumption of a plurality of electrical consumers in an on-board power supply system of a motor vehicle, wherein the on-board power supply system is a multi-voltage on-board power supply system comprising a plurality of sub-on-board power supplies, wherein each sub-on-board power supply system contains a separate power supply in order to supply a number of electrical consumers belonging to the respective sub-on-board power supply system with electrical power, wherein at least some of the consumers of a respective sub-on-board power supply system are predetermined consumers which can be electrically coupled to at least one other sub-on-board power supply system via a DC / DC converter in order to draw electrical power from the other sub-on-board power supply system.During operation of the on-board power system, a control sequence is carried out in which an overall efficiency value of the on-board power system or at least a variable is determined which depends on the overall efficiency value, wherein the overall efficiency value is a measure of the efficiency which describes the power losses currently occurring in the on-board power system.

[0011] The invention is based on the object of enabling a particularly fail-safe vehicle system.

[0012] This object is achieved according to the invention by a redundant on-board power supply system having the features of claim 1. Furthermore, this object is achieved according to the invention by a motor vehicle having the features of claim 8. Advantageous and partly inventive embodiments and developments are set out in the subclaims and the following description.

[0013] The redundant on-board power supply system for a motor vehicle according to the invention has a first on-board power supply subsystem, which is designed and provided to supply a first drive device, which is integrated into the first on-board power supply subsystem in the motor vehicle's intended use state. Furthermore, the on-board power supply system has a second on-board power supply subsystem, which is designed and provided to supply a second drive device, which is integrated into the second on-board power supply subsystem, in particular, when the on-board power supply is in the motor vehicle's intended use state. The first on-board power supply subsystem has a first high-voltage network, a first low-voltage network supplied by the first high-voltage network, and a first bus system, which is supplied by the first high-voltage network or the first low-voltage network, for data transmission between components integrated into the first on-board power supply subsystem in the intended use state.The second sub-vehicle electrical system comprises a second high-voltage network, a second low-voltage network supplied from the second high-voltage network, and a second bus system supplied from the second high-voltage network or the second low-voltage network for data transmission between components integrated into the second sub-vehicle electrical system in the intended operating state. The first and second high-voltage networks also each have an associated first and second energy storage device, respectively. This means that the first high-voltage network has the first energy storage device, and the second high-voltage network has the second energy storage device. Furthermore, drive-relevant components for driving the motor vehicle and safety-relevant components (in particular also for driving operation) are coupled to the first and second bus systems for data transmission purposes in the intended operating state.In addition, at least the first and second high-voltage networks are designed to be feedback-free to each other, at least during driving operation.

[0014] The first and second drive devices are in particular each an electric drive, preferably an electric motor, preferably with an associated control unit and / or a converter, for example a pulse-controlled inverter, a frequency converter or the like.

[0015] The term “integrated” is understood here and in the following to mean in particular that the corresponding element, e.g. the drive device and / or the respective components, are connected (also: coupled) to the respective network in terms of energy and / or signal transmission.

[0016] Generally speaking, the redundant on-board power system according to the invention described here and below has two fundamentally independent and separate on-board power systems, namely the first and second sub-on-board power systems, which are each in turn divided into a high-voltage and a low-voltage network and have their own bus system. Because each of these separate sub-on-board power systems supplies an associated drive device, a high degree of redundancy is thus created. However, in order to avoid having to duplicate all vehicle components, many of these vehicle components are preferably still present in the usual way ("only") in single units, but the drive and safety-relevant components - e.g., airbag systems, steering systems, steering and driver assistance systems, anti-lock braking systems, other driving command input systems (e.g., accelerator and brake pedals), etc. - are coupled to the bus systems of both sub-on-board power systems.On the one hand, this saves energy, but on the other hand - at least in the event of a single fault that leads to the failure of one of the two sub-vehicle networks - it enables the vehicle to continue driving with only one drive device and thus the other sub-vehicle network.

[0017] Preferably, the first drive device is configured and provided as a drive for one of several driving axles, and the second drive device is configured and provided as a drive for another of the several driving axles of the motor vehicle. For example, one drive device forms a rear-wheel drive, the other a front-wheel drive. In this case, the motor vehicle according to the invention, which is described in more detail below, and which uses the redundant on-board power system, is preferably configured as an all-wheel drive (or at least having multiple drive axles) during normal driving operation, which can continue to drive as a single-axle driven motor vehicle (i.e., for example, with front-wheel drive or rear-wheel drive) in the event of a drive device failure—for example, due to a fault in one of the sub-on-board power systems.

[0018] This allows for a nearly normal continuation of the journey (apart from the loss of multi-axle drive), for example, to the nearest repair shop, even in the event of a failure of one of the drive systems, particularly compared to emergency operation of existing solutions, which often only allows for a relatively controlled coasting and / or parking of the vehicle on the side of the road or similar situations. This is particularly advantageous for fully autonomous vehicles, as it can prevent them from breaking down along relatively long stretches of highway or road.

[0019] In a preferred embodiment, the first and second high-voltage grids are galvanically isolated from each other to prevent feedback. This effectively prevents the impact of a failure in one of the two high-voltage grids, e.g., the first or second energy storage device, on the other high-voltage grid.

[0020] Preferably, the first and second bus systems are configured to be feedback-free to one another, at least in the intended driving state.

[0021] In a practical embodiment, the first and second bus systems are coupled to the drive-relevant components and the safety-relevant components in their intended use without feedback (in particular, galvanically isolated). This also prevents the impact of a failure in one of the two sub-vehicle networks from affecting the other sub-vehicle network via the respective components. For example, these components have at least two independent interfaces for the first and second bus systems (i.e., one assigned interface each). Additionally or alternatively, the components are combined into one or more groups (e.g., within so-called "bus levels"), and as such, each group is routed to an input of one of the two bus systems without feedback.

[0022] For example, the first and second bus systems are optically coupled for galvanic isolation (if necessary directly between each other and / or with the aforementioned drive and safety-relevant components).

[0023] A CAN bus can be used as an optional bus system.

[0024] In another practical embodiment, the first bus system is configured as the master for the drive-relevant components and the safety-relevant components, and the second bus system is configured as the slave for the drive-relevant components and the safety-relevant components. In this case, the first bus system communicates with these components during normal driving operation (also referred to as the "normal state"), while the second bus system only takes over communication if the first sub-system (and thus also the first bus system) fails.

[0025] Alternatively, the first bus system forms the master for a first part of the drive-relevant components and / or the safety-relevant components and the slave for the other, second part, whereby conversely the second bus system forms the master for the second part and the slave for the first part.

[0026] Preferably, in addition to the two main voltage networks, the first and the second low voltage network are also feedback-free to each other, at least in the intended driving state, in particular galvanically isolated from each other.

[0027] In their intended use, control units (or at least some of these control units) of the respective additional (i.e., non-safety-relevant) components of the first and second sub-vehicle electrical systems are each supplied with power only from the first and second low-voltage networks, respectively. In other words, these components are coupled to the respective low-voltage networks for power supply. Examples of such components include seat heaters, electric motors for moving vehicle parts (e.g., tailgate, doors, windows, and the like), audio and media playback devices, and the like.

[0028] The drive-relevant components as well as the safety-relevant components comprise, in particular, an element to be controlled, in the case of a steering system, for example, an electric motor generating the required steering force, as well as an associated control unit (in this case, the steering control unit).

[0029] In their intended use, the control units of the drive-relevant components and the safety-relevant components (and optionally also these components themselves) are connected to both the first and second low-voltage networks for power supply. In this case, too, the first and second low-voltage networks are expediently connected to each other without feedback, in particular, they are galvanically isolated from the respective control units. Thus, these components are connected redundantly not only in terms of data transmission, but also in terms of power supply.

[0030] In a practical variant, the above-mentioned control units of the drive-relevant components and the safety-relevant components have two galvanically isolated control units, i.e. specifically separate circuit logic (e.g. two circuit boards, each with a processor), which are arranged in a common housing or alternatively in a separately assigned housing. The control units therefore contain redundant circuit logic. These circuit logics are in turn connected separately from one another and thus galvanically isolated from one another to one of the two bus systems or low-voltage systems. This can prevent, for example, a short circuit in one of the two sub-vehicle networks from switching off the entire control unit for the respective drive-relevant or safety-relevant component, but rather only the correspondingly assigned circuit logic.

[0031] In an alternative variant, the aforementioned control units for the drive-relevant components and the safety-relevant components have only one circuit logic (forming a single control unit), which is electrically isolated from both sub-vehicle networks (specifically, both bus systems and low-voltage systems). In this case, this circuit logic preferably also includes a fault detection system that detects a fault in one of the two sub-vehicle networks and, in the event of a fault, switches to the other sub-vehicle network with as little delay as possible, i.e., switches off the supply from one sub-vehicle network and switches on the supply from the other.

[0032] In one expedient embodiment, in the intended state of use, an air conditioning device (in particular an electric air conditioning compressor and / or heater, e.g. a high-voltage heater) is only connected to the first partial on-board network for the energy supply, in particular - in deviation from the other components described above - to the high-voltage network. In particular, since cooling of the two energy storage devices (and / or the associated electric motors) is preferably also supplied by this air conditioning device in the intended state of use, a control unit of the second drive device is designed to reduce the power of the second drive device in the event of a failure of the first partial on-board network. This can prevent overheating or at least comparatively rapid heating of the second energy storage device (orof the assigned electric motor) can be prevented, so that the range can be kept as long as possible in the event of a failure of the first sub-vehicle network.

[0033] In an alternative embodiment, in the intended operating state, in addition to the aforementioned air conditioning unit, a further air conditioning unit is present, which in turn is (preferably only) linked to the second sub-vehicle network, in particular the second high-voltage network. This allows continued driving in the event of a failure of any sub-vehicle network and thus its air conditioning unit, even without a cooling-related (i.e., due to a lack of cooling) power reduction. Furthermore, a comparatively high level of occupant comfort is possible even in emergency operation (i.e., in the event of a failure of a sub-vehicle network).

[0034] Preferably, the respective low-voltage network is coupled to the high-voltage network via a DC-DC converter. For example, the respective high-voltage network has a nominal voltage of 400 or 800 volts, while the respective low-voltage network has a nominal voltage of 12, 24, or 48 volts.

[0035] The motor vehicle according to the invention has the above-described first and second (in particular fully electric) drive systems as well as the above-described redundant on-board power system. Thus, the motor vehicle has the same features and advantages as the above-described on-board power system.

[0036] Preferably, the motor vehicle is designed as a fully autonomous motor vehicle. Particularly preferably, the motor vehicle is a robot taxi, which a user can, for example, order to a pickup point and have driven to a destination. In this case, it is particularly advantageous that continued travel beyond the aforementioned, usual emergency operation is possible, as this can prevent people traveling alone, or those with disabilities, from becoming stranded, for example, on long stretches of motorway or country road due to a failure of the energy storage system or the like.

[0037] The conjunction “and / or” is to be understood here and in the following in particular in such a way that the features linked by means of this conjunction can be formed both together and as alternatives to one another.

[0038] An embodiment of the invention is explained in more detail below with reference to a drawing. In the drawings: Fig. 1 in a schematic side view of a motor vehicle with an on-board power system, Fig. 2 in a schematic diagram a high-voltage and a low-voltage area of ​​the on-board power system, Fig. 3 shows a schematic diagram of the high-voltage area of ​​the vehicle electrical system, and Fig. 4 shows a schematic diagram of a bus area of ​​the on-board power system.

[0039] Corresponding parts are always provided with the same reference symbols in all figures.

[0040] In Fig. 1, a motor vehicle 1 is shown schematically. The motor vehicle 1 is designed as an electric vehicle and has an on-board power supply system 2 that is designed and provided for providing energy. The motor vehicle 1 further comprises a first drive device 4 and a second drive device 6. The first drive device 4 has a first electric drive motor 8, and the second drive device 6 has a corresponding second electric drive motor 10. In addition, both drive devices 4 and 6 each have a pulse-controlled inverter 12 assigned to the corresponding drive motor 8 or 10 (see Fig. 3). The first drive device 4 is assigned to a rear axle of the motor vehicle 1 and accordingly forms a rear-wheel drive. Accordingly, the second drive device 6 forms a front-wheel drive.

[0041] To supply the first drive device 4, the on-board power system 2 has a first sub-system 14 and to supply the second drive device 6, a second sub-system 16. The first and second sub-systems 14 and 16 are constructed identically and independently with regard to energy provision. The first and second sub-systems 14 and 16 comprise a first and second (high-voltage) energy storage device 18 and 20, respectively, a first and second high-voltage network 22 and 24, respectively, and a first and second low-voltage network 26 and 28 respectively downstream of these. The two low-voltage networks 26 and 28 are each coupled to their respective associated high-voltage network 22 and 24 by means of a DC-DC converter 30. Optionally, both low-voltage networks 26 and 28 also have a low-voltage energy storage device 32.

[0042] High-voltage consumers 34 (also referred to as “high-voltage components”) are integrated into the high-voltage grids 22 and 24. In addition to the two drive motors 8 and 10, such high-voltage consumers 34 are Fig. 3 in the first high-voltage network 22, specifically an electric air conditioning compressor 36 and a high-voltage heater 38 (e.g., an interior heater). Low-voltage consumers 40 (also referred to as "low-voltage components") are integrated into the energy supply in the low-voltage networks 26 and 28. These low-voltage consumers 40 are, on the one hand, components that are not critical for the drive and safety of the motor vehicle 1, specifically, for example, a tailgate drive 42 and interior lighting 44, which are integrated into the first low-voltage network 26 when the on-board power supply system 2 is in the intended use in the motor vehicle 1, as well as seat heaters 46, which are integrated into the second low-voltage network 28.On the other hand, the low-voltage consumers 40 are also critical (or “relevant”) components for the drive and safety of the motor vehicle 1, specifically for driving operation, specifically an electronic stability system 48, which is integrated into the first low-voltage network 26, and driving lights 50, which are integrated into the second low-voltage network 28.

[0043] For data transmission, specifically to control units, which in turn comprise control devices, of the aforementioned components, the first sub-vehicle network 14 has a first bus system (“bus 52”), specifically designed as a CAN bus, and the second sub-vehicle network 16 has a second bus system (“bus 54”), also specifically designed as a CAN bus.

[0044] During normal driving operation, the first sub-on-board network 14 and the second sub-on-board network 16 are feedback-free, specifically, they are reversibly galvanically isolated from each other (indicated by connecting line 56 between the high-voltage networks 22 and 24, and optionally by connecting line 58 between the low-voltage networks 26 and 28). If one of the sub-on-board networks 14 and 16 fails, continued driving is still possible with only one of the two drive systems 4 or 6. For this purpose, the components critical for propulsion and safety are linked to both buses 52 and 54 for data transmission, so that the corresponding information is also available and usable for the other sub-on-board network 14 or 16.

[0045] As from Fig. 4, both buses 52 and 54 each have a bus control unit 60 and 62, respectively, which form a type of central computer or "gateway" and serve to route the signals of individual "bus levels" 64, in which components of different functional areas of the motor vehicle 1, for example, comfort functions (e.g. seat heating 46 and interior lighting 44), power supply, drive functions (e.g. electronic stability system 48), etc., are combined. Fig.4 shows that the corresponding control units of the components critical for the drive and safety are interconnected by means of additional signal lines 66 to the corresponding bus level 64 of the other bus 52 or 54, respectively. In a preferred embodiment (not shown in detail), these control units each comprise two control units or circuit logics, each interconnected to one of the two buses 52 or 54, respectively. The signal lines 66 are coupled to the other bus 52 or 54, respectively, without feedback, to the corresponding control units. Thus, if one of the sub-vehicle networks 14 or 16 fails, the other sub-vehicle network 16 or 14 can access the data relevant for the drive and safety.

[0046] A vehicle control unit (not shown in detail) is also configured to operate the motor vehicle 1 optionally (at least depending on the availability of the two sub-vehicle networks 14 and 16) with all-wheel drive, front-wheel drive or rear-wheel drive.

[0047] The on-board power system 2 also has a switching device 68, which serves to connect both high-voltage networks 22 and 24 to a power feed-in point, specifically a charging socket 70 of the motor vehicle 1, during charging operation when the motor vehicle 1 is not moving. For this purpose, the switching device 68 controls corresponding high-voltage contactors 72.

[0048] To disconnect the respective energy storage device 18 or 20 in the event of a short circuit or other fault, the two high-voltage networks 22 and 24 each have an explosion-proof fuse 74 and at least one additional fuse 76. For controlled disconnection, e.g., for maintenance, the two high-voltage networks 22 and 24 have contactors 78 upstream of the energy storage devices 18 and 20. List of reference symbols 1 motor vehicle 2 On-board power system 4 Drive device 6 Drive device 8 Drive motor 10 Drive motor 12 pulse inverters 14 Partial electrical system 16 partial electrical system 18 energy storage 20 energy storage units 22 High-voltage network 24 high-voltage network 26 Low-voltage network 28 Low-voltage network 30 DC-DC converters 32 low-voltage energy storage systems 34 high-voltage consumers 36 air conditioning compressor 38 high-voltage heaters 40 low-voltage consumers 42 Tailgate drive 44 Interior lighting 46 seat heaters 48 electronic stability system 50 driving lights 52 buses 54 buses 56 connecting line 58 connecting line 60 Bus control unit 62 Bus control unit 64 bus level 66 Signal line 68 Switching device 70 charging socket 72 high-voltage contactor 74 Explosive protection 76 Security 78 Schütz

Claims

[1] Redundant on-board power system (2) for a motor vehicle (1), comprising a first sub-on-board power system (14) for supplying a first drive device (4) and a second sub-on-board power system (16) for supplying a second drive device (6), wherein - the first sub-vehicle network (14) comprises a first high-voltage network (22), a first low-voltage network (26) supplied from the first high-voltage network (22) and a first bus system (52) supplied from the first high-voltage network (22) or the first low-voltage network (26) for data transmission between components (34, 40) integrated into the first sub-vehicle network (14) in the intended operating state, - the second sub-vehicle network (16) comprises a second high-voltage network (24), a second low-voltage network (28) supplied from the second high-voltage network (24) and a second bus system (54) supplied from the second high-voltage network (24) or the second low-voltage network (28) for data transmission between components (34, 40) integrated into the second sub-vehicle network (16) in the intended operating state, - the first and second high-voltage networks (22, 24) each have an associated first and second energy storage device (18, 20), - for driving the motor vehicle (1), drive-relevant components (48) and safety-relevant components (50) are coupled to the first and second bus systems (52, 54) for data transmission purposes in the intended operating state, and - the first and second high-voltage networks (22, 24) are designed to be feedback-free to one another, at least during driving operation, wherein, in the intended state of use, control units of the respective further components (40) of the first and second sub-vehicle networks (14, 16) are each supplied with energy only from the first and second low-voltage networks (26, 28), respectively, and wherein, in the intended state of use, control units of the drive-relevant components (48) and of the safety-relevant components (50) are coupled to both the first and the second low-voltage networks (26, 28) for energy supply. [2] Redundant on-board power system (2) according to claim 1, wherein the first and second high-voltage networks (22, 24) are galvanically isolated to avoid feedback. [3] Redundant on-board power system (2) according to claim 1 or 2, wherein the first and the second bus system (52, 54) are coupled to the drive-relevant components (48) and to the safety-relevant components (50) in the intended operating state without feedback. [4] Redundant on-board power system (2) according to one of claims 1 to 3, wherein the first bus system (52) is configured as a master for the drive-relevant components (48) and the safety-relevant components (50) and the second bus system (54) is configured as a slave for the drive-relevant components (48) and the safety-relevant components (50). [5] Redundant on-board power system (2) according to one of claims 1 to 4, wherein the first and second low-voltage networks (26, 28) are connected to each other without feedback, in particular galvanically isolated, with the respective control units. [6] Redundant on-board power system (2) according to one of claims 1 to 5, wherein in the intended state of use an air conditioning device (36) for supplying energy is only linked to the first partial on-board power system (14), wherein cooling of the two energy stores (18, 20) and / or associated electric motors (8, 10) is supplied by this air conditioning device (36) in the intended state of use, and wherein a control device of the second drive device (6) is designed to reduce the power of the second drive device (6) in the event of a failure of the first partial on-board power system (14). [7] Redundant on-board power system (2) according to one of claims 1 to 5, wherein, in the intended use state, an air conditioning device (36) for supplying energy is linked only to the first sub-on-board power system (14) and a further air conditioning device is linked only to the second sub-on-board power system (16). [8] Motor vehicle (1) with a first fully electric drive device (4) and a second fully electric drive device (6) and with a redundant on-board power supply system (2) according to one of claims 1 to 7. [9] Motor vehicle (1) according to claim 8, designed as a fully autonomous motor vehicle. [10] Motor vehicle (1) according to claim 9, designed as a robot taxi.

Images