Onboard electrical system and procedures for its operation

Abstract

On-board electrical system (52) for a motor vehicle (50), comprising a vehicle battery (54) having at least two partial batteries (26, 28) and at least one conventional supply connection (46) electrically coupled to the vehicle battery (54) such that the vehicle battery (54) provides electrical energy from more than one of the at least two partial batteries (26, 28) at the at least one conventional supply connection (46), with a coupling device (10, 40) connected to the vehicle battery (54) and at least one first and one second safety supply connection (42, 44), wherein the safety supply connections (42, 44) are connected to the coupling device (10, 40), wherein the coupling device (10, 40) is configured to connect the at least one first and second safety supply connection (42, 44) to exactly one of the at least two partial batteries (26, 28) depending on a coupling state of the coupling device (10, 40).28) to electrically couple, wherein the coupling device (10, 40) is connected to the vehicle battery (54) without interruption, so that the coupling device (10, 40) remains electrically coupled to the respective sub-batteries (26, 28) of the vehicle battery (54) regardless of the switching state of a battery contactor (18) or several battery contactors.

Description

The invention relates to an electrical system for a motor vehicle, comprising a vehicle battery with at least two battery sections and at least one conventional power supply connection electrically coupled to the vehicle battery such that the vehicle battery provides electrical energy from more than one of the at least two battery sections at at least one conventional power supply connection. Furthermore, the invention also relates to a motor vehicle with an electrical system. Finally, the invention also relates to a method for operating an electrical system for a motor vehicle, in which electrical energy from more than one of the at least two battery sections is provided by a vehicle battery of the electrical system, which comprises at least two battery sections, at a conventional power supply connection of the electrical system that is electrically coupled to the vehicle battery. Vehicle electrical systems of a specific type, motor vehicles with such systems, and methods for their operation are extensively known in the prior art, so that a separate printed reference is not required. In a motor vehicle, the electrical system serves to distribute electrical energy between electrical devices connected to the system at at least one supply connection. The supply connection can be a local point within the electrical system, located at a specific position in the vehicle. However, the electrical system can also be distributed throughout the vehicle, meaning that even a conventional supply connection can have more than just a single connection point for connecting electrical devices. These connection points can be distributed throughout the vehicle. Furthermore, the vehicle's electrical system includes at least one battery for supplying electrical energy. In this context, "supplying electrical energy" refers not only to the delivery of electrical energy to electrical components of the vehicle's electrical system or to electrical components connected to the electrical system, but also to the absorption of electrical energy. This occurs, for example, when, during braking in an electrically powered vehicle, kinetic energy is converted into electrical energy by a corresponding electrical device and fed back into the vehicle's electrical system as part of a recuperation process. This also applies, of course, to the term "supplying."For example, a vehicle electrical system of a generic type is disclosed in DE 10 2014 201 360 A1, DE 10 2012 003 309 A1, which discloses an electrical energy system in a motor vehicle and a method for operating an energy system, and DE 10 2005 038 746 A1, which discloses a method and a device for supplying voltage in a motor vehicle. Nowadays, it is common for motor vehicles to be equipped with steering and / or braking systems that provide at least partial assistance to the driver in critical driving situations. Such steering and / or braking systems often utilize electrical energy, thus eliminating the need for direct driver input. However, if a fault occurs in such a steering and / or braking system or in the power supply of one of these systems, a mechanical or hydraulic backup system is provided to allow the driver to continue steering and / or braking the vehicle. For example, DE 10 2019 007 956 A1 discloses an electronic power supply system. Furthermore, DE 10 2018 100 746 A1 discloses a fault-tolerant battery storage system and an on-board electrical system. DE 10 2015 200 124 A1 also discloses a method for supplying power to at least one consumer.Finally, WO 2018 / 163751 A1 discloses a control device for a vehicle-side power supply unit and a vehicle-side power supply unit. The increasing automation of driving, particularly with regard to automated driving, and especially highly automated driving (HAD), enables novel concepts for the interiors of future vehicles, allowing occupants, including the driver, to assume a wide variety of positions. For example, it may be possible to allow for a sleeping position or a swivel seat. However, this also necessitates new concepts for steering and / or braking systems, because, on the one hand, mechanical or hydraulic controls may no longer be accessible to the driver, or, for example, automated, and especially autonomous, driving of the vehicle may be required, independent of driver intervention.In such systems, there is typically only a purely electrical or electronic connection, for example, between a sensor on one side, such as a steering wheel or brake pedal, and an actuator on the other, such as a steering motor, brake motor, or similar component. This is also known as X-by-Wire. Therefore, highly available vehicle systems are required that need a reliable electrical power supply for proper operation and meet the requirements of the highest safety standard according to Automotive Safety Integrity Level D (ASIL D according to ISO 26262) and related regulations, such as ECE R 13 and ECE R 79 for steer-by-wire. Therefore, current technology requires particular attention to the electrical power supply of systems, especially safety-critical systems. It becomes clear that simply providing two redundant power supply paths is insufficient. For example, if a short circuit occurs, a redundant power supply path can also be affected by feedback, potentially preventing the intended operation of the safety-critical system. Other such problems cannot be mitigated by current technology. Therefore, current technology is not suitable for providing the necessary safe and reliable power supply, particularly for autonomous driving. The invention addresses the problem of improving the reliability of the energy supply, particularly for the autonomous operation of a motor vehicle. The invention proposes a solution comprising vehicle electrical systems, a motor vehicle, and methods according to the independent claims. Advantageous further training opportunities arise from the characteristics of the dependent requirements. With regard to a generic vehicle electrical system, the invention, according to a first aspect, particularly proposes that the vehicle electrical system has a coupling device connected to the vehicle battery and at least one first and one second safety supply connection, wherein the safety supply connections are connected to the coupling device, and wherein the coupling device is configured to electrically couple the at least one first and second safety supply connection to exactly one of the at least two partial batteries, depending on a coupling state of the coupling device. For a generic vehicle electrical system, it is further proposed, in accordance with a second aspect, that the vehicle electrical system has a coupling device connected to the vehicle battery and at least one first and one second safety supply connection which are connected to the coupling device, wherein the coupling device has a third connecting switching element and is configured to electrically couple one first or second safety supply connection to one of the at least two partial batteries depending on a coupling state of the coupling device and to electrically couple at least one other of the safety supply connections to the conventional supply connection via the third supply switching element depending on a switching state of the third supply switching element. With regard to a motor vehicle of the type described, the invention specifically proposes that it has an on-board electrical system according to the invention. With regard to a generic method, the invention, according to the first aspect, particularly proposes that at least one first and one second safety supply connection of the vehicle electrical system be supplied with electrical energy via a coupling device of the vehicle electrical system connected to the vehicle battery, wherein the coupling device electrically couples the at least one first and second safety supply connection to exactly one of the at least two partial batteries depending on a coupling state of the coupling device. Finally, with regard to a generic method according to the second aspect, it is proposed that at least one first or one second safety supply connection of the vehicle electrical system is supplied with electrical energy via a coupling device of the vehicle electrical system connected to the vehicle battery, wherein the coupling device electrically couples the first or the second safety supply connection to one of the at least two partial batteries depending on a coupling state of the coupling device and electrically couples the at least one other of the safety supply connections to the conventional supply connection via the third connecting switching element depending on a switching state of a third connecting switching element of the coupling device. The invention is based, among other things, on the idea that a partitioned energy storage device, in particular a vehicle battery comprising at least two sub-batteries, enables new safety concepts. Within the framework of partitioning, sub-batteries can be formed, each comprising at least one single battery cell. Preferably, however, each sub-battery comprises a plurality of battery cells, which can be connected in series and / or parallel, depending on requirements and function. The sub-batteries can be essentially identical with regard to the battery cells and their interconnection. However, this is not mandatory. Depending on requirements, the sub-batteries can also have different numbers of battery cells. The same principle applies to the interconnection of the battery cells within the respective sub-batteries.The individual battery modules within the vehicle battery can be connected in parallel and / or in series. However, a series connection is preferred. The vehicle battery is preferably designed to reversibly store electrical energy electrochemically. It can, for example, be a high-voltage battery. In this context, high voltage refers to a direct current (DC) voltage greater than approximately 60V. Preferably, high voltage conforms to the ECE R 100 standard or the like. The vehicle electrical system is preferably a DC system supplied with DC voltage. However, the vehicle electrical system need not be supplied with a single DC voltage. Preferably, the vehicle electrical system can be supplied with both a high-voltage DC voltage and a low-voltage DC voltage. The term "low voltage" here refers to a DC voltage that is lower than a high-voltage voltage. However, the invention is not limited to at least one of the DC voltages being a high-voltage voltage.It is also possible that both DC voltages are low-voltage or high-voltage voltages. The vehicle battery is electrically coupled to the conventional power supply connection and provides electrical energy from more than one of the at least two sub-batteries at this connection. Preferably, an electrical voltage is provided at the conventional power supply connection that corresponds to the series connection of a plurality of the sub-batteries, preferably all of the sub-batteries. The conventional power supply connection is therefore preferably supplied with an electrical voltage that corresponds to the rated voltage of the vehicle battery. In principle, however, it is also possible for the conventional power supply connection to be electrically coupled to the vehicle battery via a DC-DC converter. The DC-DC converter or energy converter is preferably part of the coupling device.This makes it possible to adjust the electrical voltage at the conventional supply connection as needed, deviating from the rated voltage of the vehicle battery. The energy converter can be designed as a unidirectional energy converter, allowing only an energy flow from the vehicle battery to electrical devices connected to the conventional power supply. Preferably, however, it is designed as a bidirectional energy converter, so that a reverse energy flow from one or more of the electrical devices connected to the conventional power supply to the vehicle battery is also possible. The vehicle battery is preferably a lithium-ion battery, that is, a battery whose battery cells are based on a corresponding cell chemistry. However, the invention is not limited to this. Other cell chemistries can equally be used to implement the invention, for example, lead-acid, nickel-cadmium, and / or the like. The invention is based, among other things, on the further concept that individual electrical devices, in particular electrical consumers or even complete power supply networks, can be supplied with electrical energy from at least two redundantly provided energy sources. These energy sources can be implemented by different sub-batteries of the vehicle battery. By means of the vehicle electrical system designed according to the invention, feedback between the electrical devices or energy sources can be largely avoided. For this purpose, a coupling device connected to the vehicle battery and at least two backup power supply connections are provided. The backup power supply connections are, in turn, connected to the coupling device. The coupling device is designed, according to the first aspect, to electrically couple the at least one first and second safety supply connection to exactly one of the at least two sub-batteries, depending on a coupling state of the coupling device. For this purpose, it may be provided that each of the at least two safety supply connections is electrically coupled to a different sub-battery. Furthermore, it may also be provided that at least two of the at least two safety supply connections are electrically coupled to exactly the same sub-battery. The safety supply connections are thus provided in addition to the at least one conventional supply connection. Electrical devices whose operation is essential for the proper functioning of the vehicle are preferably connected to the safety supply terminals. Examples include an electric braking system, an electric steering system, and / or similar devices. The electrical connection can be achieved in a predefined manner via the coupling device. For this purpose, the coupling device can have one or more switching elements that can be switched appropriately to achieve the desired functionality. For example, it can be provided that the electrical connection to the single battery sub-unit is made via a respective switching element to ensure the power supply to the electrical devices.The switching elements ensure that a malfunction in one battery sub-unit does not affect the other connected energy sources and, in particular, the entire power supply to the electrical equipment, especially the electrical equipment connected to the emergency power supply terminals. Suitable switching measures allow the at least two emergency power supply terminals to be decoupled from each other in terms of their power supply. This improves the reliability and safety, particularly of electrical equipment essential for the safe operation of the vehicle. The same principle applies to the safety supply connections to which safety-relevant electrical equipment may be connected. Preferably, only electrical equipment that meets specific electrical safety requirements according to the aforementioned standard is connected to these connections. This means, for example, that such electrical equipment should be capable of largely preventing any feedback from a fault occurring in the electrical equipment itself to the safety supply connection to which it is connected. The reason for this is that mechanical safety devices such as fuses are often unsuitable for this purpose due to their slow switching response. Fuses typically serve as line protection and therefore generally cannot provide the desired functionality.Therefore, electronic fuses, which may also include a switching element, are particularly common as safety devices. However, a fuse can also be omitted if, for example, the design of a particular electrical device prevents a short circuit in its power supply. This can be achieved, for instance, by connecting multiple capacitors in series instead of a single capacitor between the supply voltage potentials, so that a short circuit in this capacitor does not lead to a short circuit in the supply voltage. Furthermore, it can be provided that a fuse can be triggered in the event of a fault at the safety supply connections. Of course, other relevant electrical characteristics can also be incorporated for safety reasons.For example, if redundancy is required with respect to the braking system, two independent braking systems can be provided, with one braking system connected to the first safety supply connection and the second braking system connected to the second safety supply connection. If a fault occurs in one of the two safety supply connections that affects a braking system connected to that safety supply connection, the coupling device according to the invention can deactivate the fault so that the other braking system can continue to operate as intended. For this purpose, corresponding switching elements are provided that make it possible to deactivate the respective safety supply connection in the event of a fault, depending on its switching state.Furthermore, it is possible to supply power to both braking systems via the coupling device and corresponding switching states of the switching elements from only one of the two power sources. This means that even a malfunction in one of the two power sources need not impair the function of the braking systems. This also applies, of course, to any other electrical equipment that may be connected to the safety power supply connections. It should also be noted that the electrical installations do not necessarily have to consist solely of electrical loads; additional electrical energy sources may also be provided, or an electrical installation may consume or provide electrical energy depending on its operating state. Preferably, however, only electrical loads are connected to the safety supply connections. The switching element can be formed by one or more semiconductor switching elements. Furthermore, the switching element can also include at least one electromechanical switching element, such as a relay, a contactor, and / or the like. In principle, the semiconductor switching element can also be formed by an electromechanical switching element or any other suitable switching element. The switching element can be designed, in particular, as a semiconductor switching element, for example by a transistor, especially a field-effect transistor, preferably a metal oxide field-effect transistor (MOSFET), an insulated-gate bipolar transistor (IGBT), but also by a gate turn-off thyristor (GTO) and / or the like, or any other type of switching element. These switching elements are preferably integrated into the coupling device. To provide the desired switching functionality via the coupling device, the semiconductor switching elements are operated in switching mode. With regard to a semiconductor switching element using a transistor, switching mode means that in an on-state, a very low electrical resistance is present between the transistor's terminals forming the switching path, allowing for a high current flow at a very low residual voltage. In an off-state, however, the transistor's switching path has a high resistance, meaning it presents a high electrical resistance, so that even with a high voltage applied to the switching path, there is essentially no current flow or only a very small, in particular negligible, current flow. This differs from linear operation of transistors. The switching elements are preferably connected to at least one control unit, which provides corresponding control signals to the switching elements so that they assume the desired switching state. The control unit is connected at least to the switching elements, in particular the semiconductor switching elements of the current distribution device. Preferably, the control unit is at least partially integrated into the coupling device. Furthermore, the coupling device, in particular the control unit, can have a communication interface through which it communicates with a higher-level control system, for example, a vehicle control system. To control a switching element, the control unit is at least partially integrated into the coupling device because the switching operations, for example in the event of a hard short circuit, should occur very quickly, for example, faster than about 500 µs, preferably faster than about 100 µs. The communication interface can be wired and / or wireless. A wireless communication link can, for example, be based on radio, particularly short-range radio. Preferably, each switching element has its own communication interface through which it communicates with the control unit. In particular, the device-side communication interface can be connected to an integrated part of a switching element controller, which in turn is connected to at least the semiconductor switching elements in order to control their switching state in a predefinable manner. This allows the control unit to activate or deactivate the respective supply path. The control unit itself can be provided as a separate component. Preferably, however, it is part of the coupling device and, more preferably, integrated into it. The invention thus allows at least partial operation of the vehicle electrical system to be enabled in the event of a wide variety of malfunctions, ensuring the continued reliable operation of safety-critical systems. This also makes it possible to meet the safety requirements according to the standards specified above. This is further supported by the fact that, according to the invention, at least two safety power supply connections are provided. Of course, one or more conventional power supply connections can also be provided, but the focus with regard to the coupling device is particularly on the reliable functionality of the safety power supply connections. The coupling device may include one or more switching elements for realizing one or more specific coupling states that can be assumed. Furthermore, the coupling device may also include electrical lines, power distribution devices, and / or the like to establish an electrical connection to the electrical equipment connected or connectable to the respective terminals of the coupling device. In particular, it may of course be provided that the coupling device can also be connected to at least one conventional power supply connection. Furthermore, the coupling device may include one or more electrical energy converters to, for example, perform voltage adjustments as needed. The energy converter can be designed for unidirectional energy conversion, preferably for energy flow from the vehicle battery or the respective battery sub-connection to the respective emergency power supply connection. Of course, the energy converter can also be designed as a bidirectional energy converter, allowing energy flow in both directions, i.e., also from an electrical device connected to an emergency power supply connection to the vehicle battery or the respective battery sub-connection. Overall, the invention enables a permanently safe electrical power supply, especially for X-By-Wire systems, so that even the highest safety integrity according to ASIL D can be demonstrably achieved. Likewise, other requirements, such as ECE R 79, ECE R 13, and others, can also be met. Furthermore, the invention makes it possible to utilize economies of scale, particularly with regard to HAF and X-By-Wire, to, for example, reduce the need for energy storage in the low-voltage range. The invention thus makes it possible to supply electrical equipment connected to the emergency power supply connections with electrical energy particularly reliably and safely, even under adverse operating conditions. This applies not only to the first aspect, but equally to the second aspect, where an alternative energy supply can be implemented via the conventional power supply connection. Furthermore, the coupling device is designed to be connected to the vehicle battery without interruption. This design takes into account that the vehicle battery, especially if it is a high-voltage battery, may or should have one or more battery contactors to protect it from hazardous operating conditions. In such a case, the battery contactors are switched to an off state, which usually means that the conventional power supply connection can no longer be supplied with electrical energy. However, this is disadvantageous or even potentially dangerous for safety-relevant electrical equipment.Therefore, the coupling device is preferably connected directly to the vehicle battery or to the respective sub-batteries in order to maintain at least a partial electrical power supply even when the battery contactors are in the off state. "Uninterruptible" in this context means, in particular, that the coupling device can remain electrically coupled to the respective sub-batteries of the vehicle battery essentially independently of the switching state of the battery contactor(s).However, to protect the vehicle battery or its individual sub-batteries, the coupling device may be equipped with appropriate protective mechanisms. For example, a connected energy converter may be controlled by the control unit, non-essential electrical components at the safety supply connections may be largely deactivated, and / or similar measures may be taken. Furthermore, the vehicle's driving state can also be considered. If the vehicle is stationary, starting can be prevented, and the safety supply connections may be at least partially deactivated. Therefore, in a vehicle outside of its intended driving mode, components such as the braking or steering systems do not necessarily need to be continuously supplied with electrical energy. This can further improve safety and reliability. According to an advantageous embodiment, it is proposed that the vehicle electrical system has a first connecting switching element which is electrically coupled on one side to the first or second emergency power supply connection and on the other side to at least one conventional power supply connection, and which is configured to electrically couple the respective first or second emergency power supply connection to the conventional power supply connection depending on a switching state of the first connecting switching element. This embodiment allows for an alternative or supplementary power supply to the respective first or second emergency power supply connection to be provided via the conventional power supply connection if the power supply to the respective first or second power supply connection can otherwise no longer be guaranteed due to a fault.The first connecting switching element thus provides additional redundancy in the power supply system when required. This element also allows the electrical connection to the conventional supply connection to be interrupted if a fault occurs in the area of ​​the conventional supply connection or the electrical equipment connected to it, such as an electrical short circuit or similar event. By switching the first connecting switching element to the off state, feedback to the first or second emergency supply connection and the electrical equipment connected to it can be largely prevented. This improves the reliable operation of the electrical equipment connected to the respective emergency supply connection. Furthermore, it is proposed that the decoupling device comprises a power distribution device which is electrically coupled to the at least two sub-batteries and which provides the at least one first and second safety supply connection as well as the at least one conventional supply connection, wherein the power distribution device comprises a coupling unit for electrically coupling the connections and, for each of the at least two sub-batteries, a source switching element configured to electrically couple the respective sub-battery to the coupling unit depending on a switching state, wherein the power distribution device comprises a supply switching element for each of the at least two safety supply connections configured to electrically couple the respective safety supply connection to the coupling unit depending on a switching state.For this purpose, the coupling unit is designed to enable electrical coupling between the connections. The desired functionality can be achieved by using the switching elements and appropriate switching. Specifically, the two power sources connected to the respective power source terminals can be connected in parallel via the coupling unit when the source switching elements are energized, thus providing power to the electrical equipment. The at least one source switching element ensures that a fault in one of the power sources does not affect the entire power supply to the electrical equipment.If a fault occurs in one of the electrical power sources, such as a short circuit or similar, switching the corresponding source switching element to the off state can largely prevent the feedback effect on the rest of the power supply network. This makes it possible to improve the reliability and safety, especially of electrical equipment necessary for the safe operation of the vehicle. The same principle applies to the safety supply connections to which safety-relevant electrical equipment may be connected. Preferably, only electrical equipment that meets specific electrical safety requirements according to the aforementioned standard is connected to these connections. This means, for example, that such electrical equipment should be capable of largely preventing any feedback from a fault occurring in the electrical equipment itself to the safety supply connection to which it is connected. The reason for this is that mechanical safety devices such as fuses are often unsuitable for this purpose due to their slow switching response. Therefore, electronic safety devices, which may also include a switching element, are particularly suitable as safety devices.A fuse can also be omitted if, for example, the design of a particular electrical device prevents a short circuit in its power supply. This can be achieved, for instance, by using multiple capacitors in series instead of a single capacitor connected between the supply voltage's electrical potentials, so that a short circuit in this capacitor does not lead to a short circuit in the supply voltage. Furthermore, it can be provided that a fuse can be triggered in the event of a fault at the safety supply connections. Of course, other relevant electrical characteristics can also be incorporated for safety reasons. Furthermore, it is proposed that the vehicle electrical system include a second connecting switching element electrically coupled to the first and second safety power supply connections. This second element is configured to electrically couple the first and second safety power supply connections depending on the switching state of the second connecting switching element. This makes it possible to provide a parallel power supply for both safety power supply connections as needed. This can be advantageous if the power supply to one of the safety power supply connections can no longer be guaranteed.Furthermore, it can also be provided that a shared power supply for the first and second emergency power supply connections can be electrically isolated from one of the emergency power supply connections, for example, if a fault such as a short circuit or similar has occurred in the area of ​​that emergency power supply connection. This can further improve safety and reliability. According to an advantageous further development, it is proposed that a backup battery be connected to at least one of the at least two safety supply connections. The backup battery can provide additional safety. On the one hand, the backup battery can ensure that, in the event of a power failure at the respective safety supply connection, a power supply can be maintained, at least partially. Furthermore, the backup battery can also be useful for triggering a protective or safety function more effectively or quickly in the event of a fault occurring in one or more of the electrical devices connected to the respective safety supply connection, for example, in the case of a short circuit in the area of ​​the electrical device or the like.For example, the triggering of a safety element can be ensured or supported. Overall, reliability and safety can be further improved. Furthermore, it is proposed that the coupling device include at least one energy converter that electrically couples at least one of the safety power supply connections to the sub-battery. This allows the rated voltage of the sub-battery to be at least partially decoupled from the operating voltage of the respective safety power supply connection. This means that the connections of the vehicle electrical system, in particular the safety power supply connections and / or the at least one conventional power supply connection, do not need to operate at the same electrical voltage. Moreover, the energy converter allows the energy flow from the respective sub-battery to the respective safety power supply connection, or vice versa, to be controlled. This additionally enables at least partial balancing of the sub-batteries.For example, the coupling device can be designed with switching elements that allow the safety power supply connections to be electrically coupled to one of the vehicle battery sub-batteries as needed, in order to minimize or control deviations in the charge states of the sub-batteries. This means that a safety power supply connection does not need to be exclusively electrically coupled to a specific sub-battery. Rather, this electrical coupling can be designed to be variable over time, for example, by switching the coupling to the respective sub-battery at predefined times and / or charge states. The energy converter can be designed as a DC / DC converter. Preferably, it can be designed as a galvanically isolated energy converter.It is also possible for the safety supply connections and / or at least one conventional supply connection to use a common electrical reference potential. In such a case, it is advantageous for the energy converters to have galvanic isolation. However, one of the energy converters may also be designed without galvanic isolation. This allows the reference potential to be passed through to the vehicle battery. The energy converter is preferably electrically coupled to exactly one battery sub-unit. Alternatively, particularly with regard to the second aspect, it is also possible for the energy converter to be electrically coupled to two or more battery sub-units. According to a further development, it is proposed that the at least one energy converter be electrically isolated and connected to at least two battery sub-batteries. This allows the energy converter itself to be redundantly supplied with electrical energy from two independently operable battery sub-batteries, thus providing redundancy with regard to the energy supply functionality of the energy converter. "Electrically isolated" preferably means that electrical coupling between the electrical potentials of the battery sub-batteries connected to the at least one energy converter is essentially avoided. This prevents the battery sub-batteries from being electrically coupled to each other in an undesirable way. This allows for the selection of virtually any battery sub-batteries of the vehicle battery for coupling with the at least one energy converter.For this purpose, the energy converter can, for example, have galvanic isolation for each sub-battery connected to it. The vehicle battery is preferably designed such that the sub-batteries can be operated at least partially independently of one another. For this purpose, battery switching elements can be provided, for example, by means of which each of the sub-batteries can be activated or deactivated for its intended operation. The battery switching element can be a reversible switching element, such as an electromechanical switching element or an electronic switching element, as already explained above. However, the battery switching element can also be an irreversible switching element, such as a fuse or similar device, for example, a pyrolytic fuse, a fusible link, and / or the like. The advantages and effects specified for the electrical system of the first aspect naturally apply equally to the electrical system of the second aspect, insofar as applicable, and vice versa. Furthermore, the advantages and effects specified for the electrical systems of the first and / or the second aspect also apply to the motor vehicle equipped with the electrical system, and vice versa. This naturally also applies to the methods. Thus, device features can be formulated as method features and vice versa. The invention also includes the control unit for the vehicle electrical system or the motor vehicle. The control unit can comprise a data processing device or a processor unit configured to perform one embodiment of the control of the vehicle electrical system according to the invention. For this purpose, the processor unit can comprise at least one microprocessor and / or at least one microcontroller and / or at least one FPGA (Field Programmable Gate Array) and / or at least one DSP (Digital Signal Processor). Furthermore, the processor unit can comprise program code configured to control the vehicle electrical system according to the invention, in particular its coupling device, when executed by the processor unit. The program code can be stored in a data memory of the processor unit. The motor vehicle according to the invention is preferably designed as a motor vehicle, in particular as a passenger car or truck, or as a passenger bus or motorcycle. The invention also includes combinations of the features of the described embodiments. The invention therefore also includes realizations that each exhibit a combination of the features of several of the described embodiments, provided that the embodiments have not been described as mutually exclusive. The following are exemplary embodiments of the invention. Figure 1 shows a schematic side view of an electrically powered motor vehicle with an electrical system to which an electric drive unit and other electrical equipment are connected; Figure 2 shows a schematic block diagram of a lithium-ion battery as a high-voltage vehicle battery; Figure 3 shows a schematic block diagram of a first embodiment of an electrical system in which two safety supply connections are supplied with electrical energy from different sub-batteries of the high-voltage battery according to Figure 2; Figure 4 shows a schematic block diagram as in Figure 1.3 a second embodiment of an on-board electrical system in which a supply battery is connected to only one of the two safety supply connections and the two safety supply connections can be electrically coupled to each other by means of a connecting switching element; Fig. 5 in a schematic block diagram as in Fig. 4 a third embodiment of an on-board electrical system, which is based on the second embodiment without a connecting switching element; Fig. 6 in a schematic block diagram as in Fig. 3 a fourth embodiment of an on-board electrical system in which one of the two safety supply connections can be redundantly supplied from two partial batteries by an energy converter and the other of the two safety supply connections can be electrically coupled to a conventional supply connection or the other safety supply connection; Fig. 7 in a schematic block diagram as in Fig.6 a fifth embodiment of an on-board network without a connecting switching element between the two safety supply connections; and Fig. 8 in a schematic block diagram representation as in Fig. 3 a sixth embodiment of an on-board network in which a power distribution device is provided. The exemplary embodiments described below are preferred embodiments of the invention. In these exemplary embodiments, the described components each represent individual features of the invention, which can be considered independently of one another and each further develops the invention independently. Therefore, the disclosure is intended to include combinations of features of the embodiments other than those shown. Furthermore, the described embodiments can also be supplemented by further features of the invention already described. In the figures, identical reference symbols denote functionally equivalent elements. Fig. 1 shows a schematic side view of an electrically powered motor vehicle, which here is designed as an electric vehicle 50. The electric vehicle 50 has an electrical system 52 to which a synchronous machine 12 is connected for driving the electric vehicle 50 in normal operation. The synchronous machine 12 is designed here as a multiphase synchronous machine 12. A multi-phase inverter 56 is connected to the electrical system 52 and the synchronous machine 12 as an energy converter. Furthermore, a vehicle battery 54 is connected to the electrical system 52, which serves to supply the electrical power to the electrical system 52. The reference numeral 54 here represents a high-voltage battery. However, other combinations are also conceivable. In particular, one or more fuel cells can, of course, be provided. The fuel cells can also be combined with battery cells or partial batteries. Other electrical energy sources can also be provided alternatively or additionally. For the purpose of energy distribution, the vehicle electrical system 52 has a coupling device 10, which will be explained in more detail below. Electrical devices, collectively designated by reference numerals 14 and 16 in this figure, are also connected to the vehicle electrical system 52. Although the vehicle 50 is designed as an electric vehicle in this case, the invention is not limited to this and can equally be used, for example, in a vehicle powered by a conventional internal combustion engine. Fig. 2 shows a schematic block diagram of the structure of the vehicle battery 54 according to Fig. 1, which in this case is designed as a high-voltage battery or lithium-ion battery. However, the invention is not limited to high-voltage applications. In principle, it can also be used exclusively in the low-voltage range without departing from the concept of the invention. The block diagram shown in Fig. 2 illustrates that the high-voltage battery 54 comprises a plurality of sub-batteries, six of which—namely sub-batteries 26, 28, 32, and sub-batteries 34, 36, 38—are shown schematically in Fig. 2. Sub-batteries 26, 28, and 32 are representative of a plurality of sub-batteries, each of which in turn comprises a plurality of lithium-ion cells or battery cells, which are not labeled in the diagram in Fig. 2. The battery cells of each of the sub-batteries 26, 28, and 32 are partially connected in parallel and partially connected in series. The sub-batteries 26, 28, and 32, as well as any further sub-batteries provided in this branch, are themselves connected in series.Between each pair of directly electrically coupled sub-batteries 26, 28, 32, a connecting switching element 20 is interposed, allowing the sub-batteries 26, 28, 32 to be electrically isolated from one another. A further branch, comprising sub-batteries 34, 36, 38, is configured with sub-batteries 26, 28, 32 in accordance with the previously described battery branch. Sub-batteries 34, 36, 38 can be connected in parallel to the respective sub-batteries 26, 28, 32 via further battery switching elements 18. Additional corresponding strings of sub-batteries may also be provided. The sub-batteries may be connected at least partially in series or in parallel. The vehicle battery 54 also includes a control unit 22, which provides battery management. The control unit 22 controls, among other things, the connection switching elements 20. In addition, battery switching elements 18 are provided, which are supplied by a battery contactor. This allows battery terminals (not shown), where the vehicle battery 54 supplies high voltage, to be electrically disconnected from the sub-batteries or battery cells. Electrical devices 16 suitable for high voltage are connected to the battery terminals (not shown). In the present case, each sub-battery can be disconnected from the other sub-batteries without any negative feedback via corresponding switching elements 18, 20. Such a switching element can be, for example, a contactor, a relay, a pyrolytic disconnector, or an electronic switching element, which preferably has at least one semiconductor switch, and can be disconnected without any negative feedback from the other sub-batteries. A process for disconnecting a particular sub-battery can be triggered, for example, by a detected fault in a sub-battery, or by a conventional power supply connection 46, or by one of the two illustrated safety power supply connections 42, 44. For this purpose, the control unit 22 can be provided to trigger or control the respective switching elements by means of corresponding switching signals.For this purpose, the control unit 22 may also be provided to detect and evaluate electrical currents, electrical voltages, and also temperatures, particularly in the area of ​​the vehicle battery 54. However, this is not shown in the figures. In principle, a supply tap or a safety supply connection 42, 44 can be provided on each sub-battery 26, 28, 32, 34, 36, 38, to which either safety-relevant consumers or electrical equipment 14 can be connected directly or via an energy converter, as will be explained below. Depending on the desired fault tolerance, a multiple of virtually non-reactive safety supply connections can be implemented in this way. To meet the aforementioned safety requirements, a minimum configuration is provided in which each sub-battery comprises a plurality of battery cells, with the vehicle battery 54 having at least two sub-batteries 26, 28 (Fig. 3). The supply of electrical energy to other electrical devices 16, 86, which are not safety-relevant, is provided without feedback via the battery switching elements 18. The electrical devices 16 are designed for operation at high voltage and are directly connected to the high-voltage terminal of the vehicle battery 54, whereas the electrical devices 86 are designed for operation at low voltage. The electrical devices 86 are electrically coupled to the high-voltage terminal via a DC / DC converter 72.The battery switching elements 18 therefore also indirectly control the conventional supply connection 46, to which the electrical equipment 86 is connected. Figure 2 further shows that a safety power supply connection 42 is directly connected to the sub-battery 34. The safety power supply connection 42 is thus connected to the sub-battery 34 without interruption, meaning that no electrical isolation by means of the battery switching elements 18 is provided between the safety power supply connection 42 and the sub-battery 34. Furthermore, a second safety power supply connection 44 is connected to the sub-battery 28 in the same way without interruption, i.e., directly. The safety power supply connections 42 and 44 are power supply connections where, with regard to availability according to ASIL-D, safety-relevant functions can be implemented via two independent redundant power supply paths. Fig. 3 shows a schematic block diagram of a first embodiment of an on-board electrical system 52, in which the two safety supply connections 42, 44 are supplied with electrical energy from separate sub-batteries 26, 28 of the high-voltage battery 54 according to Fig. 1. A supply battery 64, 66 is also connected to each of the safety supply connections 42, 44, by means of which a quiescent current supply for the electrical devices 14 connected to the respective safety supply connection 42, 44 can be implemented. In this embodiment, it is provided, among other things, that the safety supply connection 42 is electrically coupled to the sub-battery 26 via a unidirectional DC / DC converter 68 as an energy converter. The safety supply connection 44 is connected to the sub-battery 28 via a unidirectional DC / DC converter 70.Both energy converters 68, 70 are designed as galvanically isolated energy converters, so that the corresponding sub-batteries 24, 26 are electrically isolated from each other, even though the two safety supply connections 42, 44 use the same electrical reference potential on the secondary side as the conventional supply connection 46. An electrical connection between the two sub-batteries 24, 26 via the DC / DC converters 68, 70 and the secondary-side reference potential can thus be avoided. This allows virtually any pair of sub-batteries from the vehicle battery 54 to be used for the safety supply connections 42, 44. The control unit 22 is redundantly powered from the safety power supply connections 42, 44 via diodes 76, 78, which are connected in series to a respective switching element 80, 82. This ensures, if necessary, the control of the battery switching elements 18, 20 in accordance with ASIL-D, which is required to guarantee the non-reactive isolation of the individual sub-batteries 26, 28. Optionally, the supply batteries 64, 66 used per path can support the power supply of the safety-relevant power sources or sub-batteries 26, 28. Furthermore, a coupling device 10 is continuously connected to the vehicle battery 54, and the first and second safety supply connections 42, 44 are also connected to this device. The coupling device 10 is configured to electrically couple the first and second safety supply connections 42, 44 to exactly one of the sub-batteries 26, 28, depending on the coupling state of the coupling device 10. This coupling is achieved via the DC / DC converters 68, 70. That is to say, the coupling device 10 also includes the DC / DC converters 68, 70. For the purpose of energy transmission, power distribution devices can be used – as will be explained in more detail below – which can be implemented using conventional elements such as fuses, hybrid elements such as fuses plus supplementary electronics such as relays, semiconductor switching elements, PTEs, or the like, or even fully electronically. The power distribution devices, as well as the electrical equipment, can be supplied from different supply connections 42, 44. A lack of feedback at the supply connections 42, 44 can be ensured by the power distribution device or the electrical equipment itself, for example, by means of feedback-free isolating elements, continuous galvanic isolation, and / or the like. The two safety supply connections 42, 44 can optionally be electrically coupled to each other via a first connecting switching element 60, depending on its switching state. Electrical devices not relevant to safety availability, such as seat heating, a navigation system, a radio, and / or the like, are preferably connected as electrical devices 86 to the conventional supply connection 46. They can be electrically connected to one of the two safety supply connections 42, 44 via a non-reactively disconnectable connecting switching element 48. In this case, such an electrical connection to the safety supply connection 44 is provided.The connecting switching element 48 is preferably switched to the off switching state before a safety-critical undervoltage or overvoltage can be caused by an electrical device 86 at the conventional supply connection 46. Furthermore, a bidirectional DC / DC converter 72 is connected to the battery switching elements 18, providing the conventional power supply connection 46, to which at least some of the electrical equipment 86 can also be connected. Optionally, low voltage can be provided at the conventional power supply connection 46 by means of the energy converter 72. The DC / DC converters 68, 70, 72 serve in this case to provide a DC voltage of approximately 12 V on their low-voltage side, so that no voltage conversion is required when coupled via one of the connecting switching elements 60, 48. Fig. 4 shows another schematic block diagram, similar to Fig. 3, for a second embodiment of an on-board electrical system 52, in which the supply battery 64 is omitted. The function of the on-board electrical system 52 according to Fig. 4 is based on the function of the on-board electrical system 52 according to Fig. 3, which is why reference is made to the corresponding explanations. Only the differences are explained below. The on-board electrical system 52 according to Fig. 4 differs from the on-board electrical system 52 according to Fig. 3 in that the second connecting switching element 60, which is only optional in the embodiment according to Fig. 3, is mandatory in this embodiment. This allows a quiescent current supply for the electrical devices 14, which are connected to the first safety supply connection 42, to be provided via the supply battery 66, so that the supply battery 64 according to the embodiment according to Fig. 3 can be omitted without compromising safety or reliability. Fig. 5 shows, in a schematic block diagram as in Fig. 4, a third embodiment of an on-board electrical system 52, which is based on the second embodiment of the on-board electrical system 52 according to Fig. 4. The embodiment of the on-board electrical system 52 according to Fig. 5 differs from the embodiment of the on-board electrical system 52 according to Fig. 4 in that the second connecting switching element 60 is no longer provided. In this variant, a quiescent current supply for the electrical devices 14 connected to the safety supply terminal 44 can either be provided via the partial battery 24 and the DC / DC converter 68, or it can be omitted entirely in the case of cold-start optimized electrical devices 14. In this case, the power supply at the first safety supply terminal 42 can be started by the partial battery 24 when the vehicle is started. Fig. 6 shows, in a further schematic block diagram as in Fig. 3, a fourth embodiment of an on-board electrical system 52, in which one of the two safety supply connections 42, 44, in this case safety supply connection 42, can be redundantly supplied by two partial batteries 26, 28 from an energy converter 74. The other of the two safety supply connections 44 is electrically coupled to the other safety supply connection 42 via the first connecting switching element 60. In addition, the supply battery 66 is connected to the safety supply connection 44. The energy converter, or DC / DC converter 74, has a safety integrity rating according to ASIL-x(D). For this purpose, the DC / DC converter 74 is connected to both the sub-battery 26 and the sub-battery 28. This allows the power supply for the safety power supply connection 42 to be provided by either sub-battery 26 or sub-battery 28, depending on the operating state of the DC / DC converter 74. Of course, a simultaneous power supply from both sub-batteries 26 and 28 is also possible. This can be controlled by the control unit 22. Preferably, the DC / DC converter 74 is designed as a galvanically isolated energy converter, so that the electrical potentials on the primary and secondary sides of the DC / DC converter 74 can be separated from each other. However, a circuit structure that eliminates the need for galvanic isolation is also possible. The second connecting element 60 can also supply electrical energy to the safety power supply connection 44. Safety power supply connections 42 and 44 can be connected in parallel via the second connecting element 60. Furthermore, the second safety power supply connection 44 can also be electrically connected to the conventional power supply connection 46 via the connecting element 62. In addition, it is provided that the second safety power supply connection 44 can also provide power to the control unit 22 and control the DC / DC converter 74. However, the power supply is provided via the first safety power supply connection 42. Furthermore, the aforementioned explanations regarding the energy distribution and the connected electrical equipment apply as already described in the preceding embodiments, and reference is therefore made to those explanations. This applies in particular to the electrical equipment 14 connected to the safety supply terminals 42 and 44. The second connecting switching element 60 also allows for charging the supply battery 66 and providing a quiescent current supply to the electrical equipment connected to the safety supply terminal 42. Fig. 7 shows another schematic block diagram, similar to Fig. 6, for a fifth embodiment of an on-board power supply 52, in which the second connecting switching element 60 is not provided or has been omitted. In this embodiment, a quiescent current supply for the electrical devices 14 connected to the first safety supply terminal 42 can either be achieved via the DC / DC converter 74 or, in the case of cold-start optimized electrical devices 14, can be omitted entirely, as already explained with reference to Fig. 5, for which reason reference is made to the corresponding explanations. Fig. 8 shows, in a further schematic block diagram as in Fig. 3, a sixth embodiment of an on-board electrical system 52, in which a power distribution device 58 is provided. The on-board electrical system 52 here has a coupling device 40, which in turn has a power distribution device 58 that is electrically coupled to the two partial batteries 26, 28. The power distribution device 58 provides the first and second safety supply connections 42, 44 as well as the conventional supply connection 46, as already explained in the preceding examples. The power distribution device 58 itself has a coupling unit (not shown) for electrically coupling the connections 42, 44, 46, and for each of the two partial batteries 26, 28, a source switching element configured to electrically couple the respective partial battery 26, 28 to the coupling unit depending on a switching state.The power distribution device 58 has a supply switching element for each of the safety supply connections 42, 44, configured to electrically couple the respective safety supply connection 42, 44 to the coupling unit depending on a switching state. For this purpose, the coupling unit can, for example, comprise at least one busbar, electrical conductors, and / or the like. Of course, corresponding electrical conductors can also be included in the coupling unit. Through a suitable circuit structure and the corresponding switching elements, it can be achieved that, for example, the DC / DC converter 68 can be connected either to the safety supply connection 42 or to the safety supply connection 44. Furthermore, it can, of course, also be provided that both safety supply connections 42, 44 can be connected to it. The same applies in principle to the DC / DC converter 70.Furthermore, additional switching elements can be provided to supply power to the conventional supply connection 46, either additionally or alternatively. Optionally, the supply batteries 64, 66 can also be connected to the safety supply connections 42, 44, as already explained with reference to the first embodiment shown in Fig. 3. The respective DC / DC converter 68, 70 can be implemented with its own control from the respective safety supply connection 42, 44. A redundant power supply for the safety supply connections 42, 44 can therefore be achieved in order to ensure, if necessary, the actuation of the internal switching elements in accordance with ASIL-D to ensure the non-reactive separation of the individual sub-batteries 26, 28. For power supply, a safety-related main power distribution unit is preferably used, which can distribute the electrical energy or electrical power from the two sub-batteries 26, 28 to the safety supply connections 42, 44 and the conventional supply connection 46. An ASIL-D composition with respect to the power supply from the safety-related safety supply connections 42, 44 with ASIL-x(D) and ASIL-Dx(D) can be decoupled from a necessary decomposition of the safety-related electrical equipment 14 to be supplied, according to ASIL-y(D) and ASIL-Dy(D). Overall, it may be possible to use additional potential distribution boards, as previously explained, for additional safety supply connections. Regarding the electrical equipment 14 connected to the safety supply connections, please refer to the preceding explanations. Any necessary standby current supply can be provided by, for example, a standby-current-optimized energy storage device such as the supply battery 64, 66, or by a supply battery 84 connected to the conventional supply terminal 46. For further details regarding the characteristics of this circuit, please refer to the preceding explanations. The preceding examples demonstrate how, by using a predefined safety circuit structure, increased safety in the electrical power supply of safety-relevant electrical equipment in motor vehicles can be achieved or even improved. The exemplary embodiments serve solely to illustrate the invention and are not intended to limit it.

Claims

On-board electrical system (52) for a motor vehicle (50), comprising a vehicle battery (54) having at least two partial batteries (26, 28) and at least one conventional supply connection (46) electrically coupled to the vehicle battery (54) such that the vehicle battery (54) provides electrical energy from more than one of the at least two partial batteries (26, 28) at the at least one conventional supply connection (46), with a coupling device (10, 40) connected to the vehicle battery (54) and at least one first and one second safety supply connection (42, 44), wherein the safety supply connections (42, 44) are connected to the coupling device (10, 40), wherein the coupling device (10, 40) is configured to connect the at least one first and second safety supply connection (42, 44) to exactly one of the at least two partial batteries (26, 28) depending on a coupling state of the coupling device (10, 40).28) to electrically couple, wherein the coupling device (10, 40) is connected to the vehicle battery (54) without interruption, so that the coupling device (10, 40) remains electrically coupled to the respective sub-batteries (26, 28) of the vehicle battery (54) regardless of the switching state of a battery contactor (18) or several battery contactors. On-board network according to claim 1, characterized by a first connecting switching element (48) which is electrically coupled on the one hand to the first or the second safety supply connection (42, 44) and on the other hand to the at least one conventional supply connection (46) and is designed to electrically couple the respective first or second safety supply connection (42, 44) to the conventional supply connection (46) depending on a switching state of the first connecting switching element (48). On-board electrical system according to one of the preceding claims, characterized in that the coupling device (10, 40) has a power distribution device (58) which is electrically coupled to the at least two partial batteries (26, 28) and which provides the at least one first and one second safety supply connection (42, 44) as well as the at least one conventional supply connection (46), wherein the power distribution device (58) has a coupling unit for electrically coupling the connections (42, 44, 46) and, for each of the at least two partial batteries (26, 28), a source switching element configured to electrically couple the respective partial battery (26, 28) to the coupling unit depending on a switching state, wherein the power distribution device (58) has a supply switching element for each of the at least two safety supply connections (42, 44) configured to connect the respective safety supply connection (42,44) to couple electrically with the coupling unit depending on a switching state. On-board network according to one of the preceding claims, characterized by a second connecting switching element (60) electrically coupled to the first and the second safety supply connection (42, 44), which is configured to electrically couple the first and the second safety supply connection (42, 44) depending on a switching state of the second connecting switching element (60). On-board electrical system (52) for a motor vehicle (50), comprising a vehicle battery (54) having at least two partial batteries (26, 28) and at least one conventional supply connection (46) electrically coupled to the vehicle battery (54) such that the vehicle battery (54) provides electrical energy from more than one of the at least two partial batteries (26, 28) at the at least one conventional supply connection (46), comprising a coupling device (30) connected to the vehicle battery (54) and at least one first and one second safety supply connection (42, 44) connected to the coupling device (30), wherein the coupling device (30) has a third connecting switching element (62) and is configured to connect a first or second safety supply connection (42, 44) depending on a coupling state of the coupling device (30) with one of the at least two partial batteries (26, 28).28) to electrically couple and to electrically couple at least one other of the safety supply connections (42, 44) via the third connecting switching element (62) to the conventional supply connection (46), depending on a switching state of the third connecting switching element (62), wherein the coupling device (30) is connected to the vehicle battery (54) without interruption, so that the coupling device (30) remains electrically coupled to the respective sub-batteries (26, 28) of the vehicle battery (54) regardless of the respective switching state of a battery contactor (18) or several battery contactors. On-board electrical system according to one of the preceding claims, characterized in that a supply connection battery (64, 66) is connected to at least one of the at least two safety supply connections (42, 44). On-board electrical system according to one of the preceding claims, characterized in that the coupling device (10, 30, 40) has at least one energy converter (68, 70, 74) which electrically couples at least one of the safety supply connections (42, 44) with the partial battery (26, 28). On-board electrical system according to claim 7, characterized in that the at least one energy converter (74) is electrically separated and connected to at least two partial batteries (26, 28). Motor vehicle (50) with an on-board electrical system (52), characterized in that the on-board electrical system (52) is designed according to one of the preceding claims. Method for operating an on-board electrical system (52) for a motor vehicle (50), in which electrical energy from more than one of the at least two partial batteries (26, 28) is supplied by a vehicle battery (54) of the on-board electrical system (52), which has at least two partial batteries (26, 28), to a conventional supply connection (46) of the on-board electrical system (52) electrically coupled to the vehicle battery (54), wherein at least one first and one second safety supply connection (42, 44) of the on-board electrical system (52) are supplied with electrical energy via a coupling device (10, 40) of the on-board electrical system (52) connected to the vehicle battery (54), wherein the coupling device (10, 40) electrically couples the at least one first and second safety supply connection (42, 44) to exactly one of the at least two partial batteries (26, 28) depending on a coupling state of the coupling device (10, 40), wherein the Coupling device (10,40) is continuously connected to the vehicle battery (54), so that the coupling device (10, 40) remains electrically coupled to the respective sub-batteries (26, 28) of the vehicle battery (54) regardless of the switching state of a battery contactor (18) or several battery contactors. Method for operating an on-board electrical system (52) for a motor vehicle (50), in which electrical energy from more than one of the at least two partial batteries (26, 28) is supplied by a vehicle battery (54) of the on-board electrical system (52), which has at least two partial batteries (26, 28), to a conventional supply connection (46) of the on-board electrical system (52) electrically coupled to the vehicle battery (54), wherein at least one first and one second safety supply connection (42, 44) of the on-board electrical system (52) are supplied with electrical energy via a coupling device (30) of the on-board electrical system (52) connected to the vehicle battery (54), wherein the coupling device (30) electrically couples the first or the second safety supply connection (42, 44) to one of the at least two partial batteries (26, 28) depending on a coupling state of the coupling device (30) and supplies the at least one other of the safety supply connections (42,44) depending on a switching state of a third connecting switching element (62) of the coupling device (30), electrically couples via the third connecting switching element (62) to the conventional supply connection (46), wherein the coupling device (30) is connected to the vehicle battery (54) without interruption, so that the coupling device (30) remains electrically coupled to the respective sub-batteries (26, 28) of the vehicle battery (54) regardless of the respective switching state of a battery contactor (18) or several battery contactors.

Images