SAFETY DEVICE, VEHICLE AND PROCEDURES

Description

[0001] The invention relates to a safety device according to claim 1, a vehicle according to claim 11 and a method according to claim 14.

[0002] This patent application claims priority over German patent application 10 2018 120 599.6 dated August 23, 2018.

[0003] For the electrical protection of electrical lines in motor vehicles, fuses or circuit breakers are generally used. These trip when an overcurrent occurs in a power transmission and interrupt the current flow through the electrical line. Depending on the tripping characteristics, the fuse or circuit breaker interrupts the current transmission within a very short time, for example, 30 ms, without warning. Therefore, to maintain reliable autonomous or semi-autonomous driving operation in autonomous or semi-autonomous vehicles, redundant systems are necessary. These systems ensure that if the circuit breaker or fuse in one system trips, autonomous or semi-autonomous driving operation is maintained by the other system.

[0004] From DE 10 2013 006 092 A1, a control unit and a method for reducing the impact of coupling effects on the user experience within an electrical network, in particular the electrical system of a vehicle, are known. In this process, a requirement for a change in electrical power consumption for a first consumer within the network is detected. Furthermore, the perceptible effect on the operation of a second consumer, if the requirement is met and the user reacts to the detection result, is determined. The user experience is further reduced by gradually introducing the effect on the operation of the second consumer and / or by changing the power consumption of the second consumer. The first consumer is a rear window defroster and the second consumer is a rear wiper.

[0005] From US 2014 / 145849 A1, a method for monitoring the operating condition of an electrical component is known. In this method, an ambient temperature associated with the electrical component is measured using a temperature sensor. Furthermore, a set of load currents of an electrical conductor of the electrical component is measured. An expected temperature curve, indicating the expected temperature over time, is determined based on a linear regression model using the ambient temperature and the set of load currents. A warning threshold curve is then determined based on the first standard deviation from the expected temperature curve. Finally, a set of temperatures associated with the electrical conductor is monitored based on the warning threshold curve to determine an operating condition of the electrical component.

[0006] From EP 2 319 153 B, a device and a method for optimized energy management of an electrical system are known.

[0007] The object of the invention is to provide an improved safety device, an improved vehicle and an improved method for operating such a vehicle.

[0008] This task is accomplished by means of a safety device according to patent claim 1, of an improved vehicle according to claim 11 and of an improved method according to claim 14. Advantageous embodiments are specified in the dependent claims.

[0009] It was recognized that an improved safety device for a motor vehicle can be provided by the safety device comprising a control unit, a detection unit, and an electrical line with an electrical conductor, wherein the control unit comprises a control unit and an interface connected to the control unit, wherein the electrical line is configured to transmit electrical energy to a safety-critical consumer, wherein the detection unit is connected to the control unit and configured to determine information about an operating parameter of the electrical conductor and to provide the information to the control unit, wherein the control unit is configured to record the determined information, wherein the control unit is configuredBased on information from the operating parameter and a predefined parameter model, an equilibrium temperature of the electrical conductor is calculated, wherein the control unit is configured to compare the determined equilibrium temperature with a predefined threshold value, and wherein the control unit is configured to provide a warning signal with warning information at the interface when the predefined threshold value is exceeded.

[0010] The control unit has at least one data storage device, wherein at least one first conductor temperature window and one second conductor temperature window are stored in the data storage device, wherein the first conductor temperature window correlates with continuous operation of the electrical conductor, wherein the second conductor temperature window is above the first conductor temperature window, wherein the control unit is configured to determine, based on information about the operating parameter, a predefined parameter and an upper limit temperature of the second conductor temperature window for the electrical conductor, a first prediction time interval in which a conductor temperature of the electrical conductor is expected to reach the upper limit temperature of the second conductor temperature window, wherein the control unit is configured to provide first time interval information about the first prediction time interval at the interface.The first prediction interval can be used to warn the driver of the impending failure. Furthermore, the driver can perform a desired action within this first prediction interval without further impacting the vehicle. For example, in autonomous or semi-autonomous driving mode, the driver can take over control of the vehicle within the first prediction interval.

[0011] This design has the advantage that a warning signal is provided before the transmission of electrical energy via the electrical conductor is interrupted, which can then be taken into account when controlling other vehicle components. In particular, this prevents the immediate failure of the safety-critical device supplied with electrical energy. It also eliminates the need for redundant safety-critical devices.

[0012] In another embodiment, the interface is configured to acquire information about the ambient temperature of the vehicle, wherein the control unit is configured to determine a conductor temperature based on the acquired information, the ambient temperature and another predefined parameter.

[0013] In a further embodiment, the detection unit comprises a temperature sensor, wherein the temperature sensor is arranged on or at least partially in the electrical conductor and measures a conductor temperature of the electrical conductor as an operating parameter of the electrical conductor, wherein the temperature sensor provides temperature information correlating to the conductor temperature as information about the operating parameter of the electrical conductor to the control unit.

[0014] In a further embodiment, at least a third conductor temperature window is stored in the data memory, wherein the third conductor temperature window is located above the second conductor temperature window, wherein the control unit is configured to determine a second prediction time interval based on the information of the operating parameter, the predefined parameter and a further upper limit temperature of the third conductor temperature window for the electrical conductor, in which the conductor temperature of the electrical conductor is expected to reach the further upper limit temperature, wherein the control unit is configured to provide a second time interval information about the second prediction time interval at the interface.

[0015] In a further embodiment, the safety device has a switching device, wherein the switching device is electrically connected to the electrical conductor, wherein the control unit is connected to the switching device, wherein in a first switching state the switching device allows the transmission of electrical energy via the electrical conductor, wherein in a second switching state the switching device interrupts the transmission of electrical energy via the electrical conductor, wherein the control unit is configured to compare the determined conductor temperature with the further upper limit temperature, wherein if the further upper limit temperature is exceeded the control unit controls the switching device in such a way that the switching device changes from the first switching state to the second switching state.

[0016] In a further embodiment, the detection unit has a switching device, wherein the switching device is electrically connected to the electrical conductor, wherein the control unit is connected to the switching device, wherein in a first switching state the switching device allows a transmission of electrical energy via the electrical conductor, wherein in a second switching state the switching device interrupts the transmission of electrical energy via the electrical conductor, wherein the switching device is configured to determine an electric current transmitted via the switching device as an operating parameter of the electrical conductor and to provide the control unit with the information about the transmitted electric current of the operating parameter of the electrical conductor.

[0017] In a further embodiment, the control unit is configured to compare the determined current conductor temperature with a lower limit temperature of the second conductor temperature window. The control unit is configured to provide a further warning signal at the interface when the lower limit temperature of the second conductor temperature window is exceeded, along with additional warning information about the exceedance of the lower limit temperature of the second conductor temperature window. This allows for a particularly clear indication of the impending thermal overload of the electrical conductor.

[0018] In a further embodiment, the control unit is configured to determine the service life of the electrical conductor within the second conductor temperature window based on the determined current conductor temperature. The control unit is configured to sum the determined service life with a total service life stored in the data memory to obtain an updated total service life. The control unit is configured to provide information about the updated total service life at the interface. This allows the current Away The usage / wear of the electrical line is determined based on the total service life.

[0019] In a further embodiment, the control unit is configured to compare the determined current conductor temperature with a predefined recovery temperature after the upper limit temperature of the third conductor temperature window has been exceeded, wherein the predefined recovery temperature is preferably lower than the upper limit temperature of the second conductor temperature window or the first conductor temperature window, and wherein the control unit is configured to control the switching device when the recovery temperature is undershot in such a way that the switching device switches from the second switching state to the first switching state.

[0020] In a further embodiment, the control unit is configured to compare the determined total service life with a maximum operating time of the electrical conductor in the second conductor temperature window. The control unit is configured to control the switching device in such a way that, if the maximum operating time is exceeded by the updated total service life after the recovery temperature has fallen below the threshold, the switching device remains in the second switching state. This ensures that the operation of the safety-critical device can only be resumed once the electrical conductor has cooled down.

[0021] A vehicle comprises a safety device, a safety-critical consumer, a vehicle control unit, and a component, wherein the safety device is configured as described above, wherein the electrical conductor is electrically connected to the safety-critical consumer and configured to transmit electrical energy to the safety-critical consumer, wherein the vehicle control unit is connected to the interface and to the safety-critical consumer, wherein the vehicle control unit is configured to control the component based on information from the safety-critical consumer, and wherein the vehicle control unit is configured to detect the warning signal with the warning information and to take the warning information into account when controlling the component.

[0022] In a further embodiment, the vehicle has an output device, the vehicle control unit being connected to the output device. The vehicle control unit is configured to control the output device based on the warning information, such that the output device issues a warning message to the driver of the vehicle. Additionally, or alternatively, and / or the warning information can be taken into account by the vehicle control unit when controlling the vehicle, particularly during autonomous or semi-autonomous driving. For example, the vehicle control unit can control the vehicle so that, after receiving the warning information, it heads for the nearest parking space.

[0023] In a further embodiment, the vehicle has an input device, wherein the input device is connected to the vehicle control unit, wherein the vehicle control unit is configured to control the output device based on the warning information in such a way that the output device provides a user query for the driver, wherein the input device is configured to detect an input from the driver in response to the user query, and wherein the vehicle control unit is configured to Away dependence of the input to control the switching device.

[0024] A particularly good method for operating the safety device and / or vehicle described above can be provided by transmitting electrical energy via an electrical line to a safety-critical consumer for the purpose of supplying energy to the safety-critical consumer, wherein during the transmission of the electrical energy the electrical line heats up at least in sections, wherein an operating parameter of an electrical conductor of the electrical line is determined, wherein, based on the information of the operating parameter and a predefined parameter model, an equilibrium temperature of the electrical conductor is calculated, the determined weight temperature is compared with a predefined threshold value, wherein, if the predefined threshold value is exceeded, a warning signal with warning information is provided at the interface.

[0025] Based on the information, an initial prediction time interval is determined using the operating parameter, a predefined parameter, and the upper limit temperature of the second conductor temperature window for the electrical conductor. This initial prediction interval is used to determine when the conductor temperature is expected to reach the upper limit of the second conductor temperature window. This initial time interval information is provided at the interface. This information can be used to warn the driver and / or to perform other necessary actions within the time interval. For example, the control unit can also transmit information to another control unit within the time interval to prevent data loss. This also enables distributed computing across multiple control units.If a redundant component exists for the failing component, the redundant component can be activated within the first time interval.

[0026] The invention is explained in more detail below with the aid of figures. These show: Figure 1 a schematic representation of a vehicle according to a first embodiment; Figure 2 a schematic representation of a first electrical line and an investigative unit of the in Figure 1 vehicle shown; Figure 3 a flowchart of a procedure for operating the in Figure 1 vehicle shown; Figure 4 A current profile of a current in an electrical conductor plotted over time; Figure 5 a conductor temperature profile as a function of the in Figure 4 current waveform shown, plotted against time; Figure 6 a schematic representation of a vehicle according to a second embodiment; and Figure 7a schematic representation of a vehicle according to a third embodiment.

[0027] Figure 1 Figure 1 shows a schematic representation of a vehicle 10 according to a first embodiment.

[0028] The vehicle 10 is preferably designed as an autonomous vehicle and includes, for example, a safety device 15, a vehicle control unit 20, an electrical power source 25, and at least one safety-critical component 30. Of course, the vehicle 10 can have multiple safety-critical components 30. Safety-critical is understood to mean that a failure or malfunction of a component 30 not only results in the function of the component 30 itself being restricted or failing, but also in the failure or restricted operation of other functional systems.

[0029] In this embodiment, the consumer 30 is configured as a sensor device, in particular as a radar or lidar sensor, and is configured to scan a driving area 35 in front of the vehicle 10 and to acquire information about objects located in the driving area 35, such as vehicles, persons, signs, or the like. The safety-critical consumer 30 can also be configured as a camera, for example. Alternatively, the consumer 30 could be, for example, an electric vehicle brake or a control unit of the vehicle 10.

[0030] The electrical energy source 25 can comprise a generator and / or an electrical energy storage device, in particular a vehicle battery. Additionally, the vehicle 10 has an output device 40 and an input device 45. In this embodiment, the output device 40 is configured as a touch-sensitive monitor, so that the input device 45 and the output device 40 are combined in one device. The input device 45 could also include a microphone with a speech recognition device. Alternatively, the input device 45 could also be a sensor device that detects whether the driver 180 is holding the steering wheel of the vehicle 10. Of course, it is also conceivable that the output device 40 and the input device 45 are configured separately.

[0031] The vehicle 10 also includes further components such as a drive unit 46 and a steering unit 47. The drive unit 46 is designed to provide a driving force for propelling the vehicle 10. The drive unit 46 can, for example, comprise an internal combustion engine with a transmission device that acts on the wheels of the vehicle 10. The drive unit 46 can also be designed as a hybrid engine. Alternatively, it would also be conceivable that the drive unit 46 includes at least one electric machine, which is, for example, designed as a wheel hub motor.

[0032] The steering device 47 is designed to control the direction in which the vehicle 10 is being moved. The steering device 47 may, for example, include a steering actuator that interacts with a power steering system to turn the front wheels of the vehicle 10 in that direction.

[0033] The safety device 15 comprises a control unit 50, a detection unit 55, a first electrical line 60, and a switching device 91. The switching device 91 can, for example, comprise a switch or a semiconductor component, in particular a smart high-side power switch. Another semiconductor component, such as a MOSFET, would also be conceivable. The switching device 91 has at least a first switching state and a second switching state.

[0034] The control unit 50 has a first interface 65, a first control unit 70, and a first data storage device 75. The vehicle control unit 20 has a second interface 80, a second control unit 85, and a second data storage device 90.

[0035] The investigation unit 55 is connected to the first interface 65 via a first connection 95. Furthermore, the first interface 65 is connected to the first control unit 70 via a second connection 100. The first control unit 70 is further connected to the first data storage 75 via a third connection 105.

[0036] The first electrical line 60 connects the safety-critical load 30 electrically to the switching device 91. Furthermore, the second interface 80 is connected to the second control unit 85 via a fourth connection 110, and the second control unit 85 is further connected to the second data storage device 90 via a fifth connection 115. Additionally, the first interface 65 is connected to the second interface 80 via a sixth connection 116. The drive unit 46 is connected to the second interface 80 via a seventh connection 117. The steering unit 47 is connected to the second interface 80 via an eighth connection 118. The switching device 91 is connected to the second interface 80 via a ninth connection 119.In addition to or as an alternative to the ninth connection 119, the switching device 91 can be connected to the first interface 65 by means of a tenth connection 121 (dashed in . Figure 1 (as shown). An eleventh connection 122 connects the safety-critical consumer 30 to the second interface 80. A twelfth connection 123 connects the input / output device 40, 45 to the second interface 85. Furthermore, an ambient temperature sensor may be provided, which is connected to interface 80 via a thirteenth connection.

[0037] The switching device 91 is furthermore electrically connected to the electrical power source 25 by means of a second electrical line 120. The second electrical line 120 can be protected by an additional safety device 125. The additional safety device 125 provides, for example, galvanic isolation. The additional safety device 125 can be, for example, a fuse or a circuit breaker.

[0038] The first electrical line 60 and the second electrical line 120 are configured to transmit electrical energy between the energy source 25 and the safety-critical load 30 to supply power to the electrical load 30. The first through twelfth connections 95, 100, 105, 110, 115, 116, 117, 118, 119, 121, 122, 123 are configured as data connections. The first through twelfth connections 95, 100, 105, 110, 115, 116, 117, 118, 119, 121, 122, 123 can be wired or wireless. The first to twelfth connection 95, 100, 105, 110, 115, 116, 117, 118, 119, 121, 122, 123 can also be formed by a bus system, for example a CAN bus of vehicle 10.

[0039] The first data memory 75 stores a predefined threshold S1, at least one first conductor temperature window 140, a second conductor temperature window 145, and a predefined recovery temperature TE. It is also conceivable that at least one third predefined conductor temperature window 146 is stored in the first data memory 75. The number of conductor temperature windows 140, 145, 146 is exemplary. The number of conductor temperature windows 140, 145, 146 can also be chosen differently. Furthermore, a parameter model and a predefined parameter are stored in the data memory 75. The parameter model and / or the predefined parameter can comprise a predefined algorithm, a tabular assignment, a computer program, a mathematical formula, and / or a characteristic map.

[0040] The second data storage unit 90 contains a predefined control procedure, for example a computer program, on the basis of which and on the basis of information from the safety-critical consumer 30 the second control unit 85 controls the drive device 46 and / or the steering device 47.

[0041] In this embodiment, the control method is designed such that the vehicle 10 is controlled by the control method in semi-autonomous and / or autonomous driving modes. In autonomous driving mode, the driver 180 is relieved of driving the vehicle 10, thus gaining freedom and not having constant control over the vehicle 10. Semi-autonomous driving mode can be considered an intermediate step between manual driving and autonomous driving mode. In semi-autonomous driving mode, in a predefined situation, such as driving on a highway or in a traffic jam, the vehicle control unit 20 takes over driving at the instruction of the driver 180.Using the input device 45, the driver 180 can also switch the vehicle control in autonomous or semi-autonomous driving mode to manual driving mode and end the (semi-)autonomous driving mode.

[0042] Regardless of whether the vehicle 10 is operating in semi-autonomous or autonomous driving mode, the vehicle control unit 20 is designed to transfer responsibility for vehicle operation back to the driver 180 if a fault occurs that the vehicle control unit 20 cannot readily compensate for. In autonomous driving mode, the driver 180 is not continuously involved in vehicle operation. Therefore, the driver 180 requires a longer time interval to take over vehicle operation than when taking over from semi-autonomous driving mode. The transfer from autonomous driving mode to manual driving mode can occur, for example, after a user query from the output device 40 and by answering the user query via the input device 45.

[0043] In semi-autonomous or autonomous driving mode, a low failure probability of the safety-critical components of the vehicle 10 must be ensured. This can be achieved, for example, by providing redundant components. Robustness and redundancy are particularly important for the power supply in the vehicle 10, so that in the event of a fault, the most important functions, such as the safety-critical consumer 30, the steering system 47, and the drive direction 46, remain available.

[0044] Figure 2 shows a schematic representation of the first electrical line 60 and the investigation unit 55.

[0045] The first electrical line 60 comprises an electrical conductor 126 and a sheath 130. The electrical conductor 126 is electrically conductive and may consist of one or more strands, which may be bundled together. The electrical conductor 126 may also consist of a single wire. The sheath 130 encloses the electrical conductor 126 and electrically insulates it from its surroundings 135. The sheath 130 is made of a non-conductive material, which often also has a lower thermal conductivity than the electrical conductor 126. The electrical conductor 126 is designed to transmit electrical energy to supply the safety-critical load 30. Data transmission can also occur via the electrical conductor 126. However, data transmission can also take place separately from the electrical conductor 126.

[0046] In this embodiment, the detection unit 55 includes a temperature sensor 139. The temperature sensor 139 is, for example, embedded in the sheathing 130 and preferably arranged directly adjacent to the electrical conductor 126. The temperature sensor 139 is configured to measure the conductor temperature T of the electrical conductor 126 as an operating parameter. Depending on the measured conductor temperature T of the electrical conductor 126, the temperature sensor 139 provides information about the operating parameter, in this embodiment temperature information, via the first connection 95 of the first interface 65.

[0047] Investigation Unit 55 could also be structured differently. In particular, it is conceivable that instead of the one in Figure 2In the arrangement shown, the temperature sensor 139 is directly adjacent to the electrical conductor 126, and the temperature sensor 139 is also arranged in the casing 130 adjacent to it, for example at a short distance from the electrical conductor 126, so that at least one layer of the casing 130 is arranged between the temperature sensor 139 and the electrical conductor 126.

[0048] Alternatively, the temperature sensor 139 is arranged on the outside of the sheathing 130. However, this more cost-effective and simpler design, compared to the arrangement of the temperature sensor 139 directly adjacent to the electrical conductor 126 described above, has the disadvantage that the conductor temperature T is measured with a time delay compared to the preferred arrangement described above, where the temperature sensor is directly adjacent to the electrical conductor 126. The temperature sensor 139 is preferably arranged in a region (in the longitudinal direction) of the first electrical conductor 60 that is subject to the highest temperature load.

[0049] Depending on its material, the sheathing 130 has a predefined temperature resistance, which is divided into different temperature classes according to the standard (e.g., ISO 6722). Each temperature class has a maximum sheathing temperature that should not be exceeded to avoid irreparable damage to the sheathing 130. The temperature-critical element of the first electrical conductor 60 is therefore essentially not the electrical conductor 126 itself (e.g., if the electrical conductor 126 has copper or aluminum as its conductor material), but rather the material of the sheathing 130.

[0050] The temperature class itself is subdivided into the aforementioned conductor temperature windows 140, 145, and 146. The first conductor temperature window, 140, is limited by a first lower limit temperature TUG1 and a first upper limit temperature TOG1. The second conductor temperature window, 145, is located above the first conductor temperature window, 140, and has a second lower limit temperature TUG2. Additionally, the second conductor temperature window, 145, may have a second upper limit temperature TOG2, which defines its upper boundary. The third conductor temperature window, 146, is located above the second conductor temperature window, 145, and has a third lower limit temperature TUG3. Additionally, the third conductor temperature window, 146, may have a third upper limit temperature TOG3, which defines its upper boundary.The first upper limit temperature TOG1 can be equal to the second lower limit temperature TUG2. The second upper limit temperature TOG2 can be equal to the third lower limit temperature TUG3. The first lower limit temperature TUG1 is lower than the first upper limit temperature TOG1. The second lower limit temperature TUG2 is lower than the second upper limit temperature TOG2. The third lower limit temperature TUG3 is lower than the third upper limit temperature TOG3.

[0051] For example, the first lower limit temperature T UG1 = -40° C and the first upper limit temperature T OG1 = +105° C, the second lower limit temperature T UG2 = +105° C and the second upper limit temperature T OG2 = +130° C, the third lower limit temperature T UG3 = +130° C and the third upper limit temperature T OG3 = +155° C.

[0052] Each conductor temperature window 140, 145, 146 is further assigned a maximum operating time during which the first electrical conductor 60 may be operated. If the first electrical conductor 60 is operated beyond one of the maximum operating times, the first electrical conductor 60 is damaged and must be replaced. The first conductor temperature window 140 is assigned a first maximum operating time tB1, the second conductor temperature window 145 a second maximum operating time tB2, and, if applicable, the third conductor temperature window 146 a third maximum operating time tB3. The first maximum operating time tB1 is longer than the second and third maximum operating times tB2 and tB3, respectively. The second maximum operating time tB2 is longer than the third maximum operating time tB3. The first maximum operating time tB1 can also be referred to as the continuous operating time.The first maximum operating time t B1 can be, for example, 3000 h, the second maximum operating time t B2 can be 240 h, and the third maximum operating time t B3 can be 6 h. The third maximum operating time t B3 for the third conductor temperature window 146 is particularly short because the high temperature of the first electrical conductor 60 when operated in the third conductor temperature window 146 causes the sheathing 130 to wear out particularly quickly, for example, if plasticizers present in the sheathing 130 leach out of the sheathing 130 or if polymer chains of a plastic in the sheathing 130 are destroyed by the high temperature of the first electrical conductor 60.

[0053] Figure 3 The diagram shows a flowchart for the operation of the safety device 15 and the vehicle 10. The diagram includes... Figure 3 The fulfillment of a condition is symbolically marked by a checkmark and the non-fulfillment of the condition by a cross.

[0054] Figure 4 shows an exemplary current profile of a current I in the first electrical line 60 plotted against time t. Figure 5 shows a curve T(t) of the conductor temperature T as a function of the in Figure 4 The current waveform I(t) shown is plotted against time t. The current in Figure 3 methods shown based on the in Figure 4 shown current profile and the one in Figure 5 The illustrated course of the conductor temperature T is explained using an example. The following refers generally to the process shown in Figure 3 The described method and the method are discussed in relation to the current profile shown in Figures 4 and 5 in particular.

[0055] The current profile in Figure 4This example has four consecutive time intervals: 150, 155, 160, and 165. In the first time interval, 150, a first current, I₁, is constant over time t. This first current, I₁, could be, for example, 6 A. In the second time interval, 155, which follows the first, 150, a second current, I₂, is constant over time t, but lower than in the first, 150. For example, the second current, I₂, could be 3 A. In the third time interval, 160, which follows the second, 155, a third current, I₃, is constant over time and larger than the first and second currents, I₁ and I₂. For example, the third current, I₃, is three times larger than the second current, I₂, and is, for example, 9 A. The first current, I₁, is, for example, twice larger than the second current, I₂. However, the current profile can also be different.In particular, a current I can vary over time t in at least one of the first to third time intervals 150, 155, 160. In the fourth time interval 165, which follows the third time interval 160, current transmission via the electrical conductor 126 is deactivated and a fourth current I 4 = 0.

[0056] Electrical energy, dependent on the current I(t) and the electrical resistance of the conductor 126, introduces heat into the conductor 126. This heat is dissipated from the conductor 126 to the surroundings 135 via the sheath 130. This heat transfer causes the sheath 130 to heat up. The heat transfer depends on the temperature difference between the conductor 126 and the surroundings 135, the geometry of the conductor 126, and the surface area of ​​both the sheath 130 and the conductor 126. The conductor temperature Tconductor of the conductor 126 is not identical to the temperature of the sheath 130. The temperature of the sheath 130 lags behind the conductor temperature Tconductor and is typically lower.

[0057] In a first process step 200, for example, autonomous or semi-autonomous driving operation of the vehicle 10 is activated, and the second control unit 85 controls the safety-critical load 30 based on the control procedure stored in the second data memory 90. In this example, the semi-autonomous or autonomous driving operation is maintained over the first to third time intervals 150, 155, 160. During this time, the switching device 91 is switched to its first switching state, in which the switching device 91 electrically connects the safety-critical load 30 to the electrical energy source 25, and the safety-critical load 30 is supplied with electrical energy from the electrical energy source 25.

[0058] The safety-critical load 30 is operated in normal operation with the first and second currents I₁ and I₂ during the first and second time intervals 150 and 155, respectively. The second current I₂ may be reduced, for example, by a reduced power consumption of the safety-critical load 30 compared to the first current I₁. Due to the electrical resistance of the electrical conductor 126, the first electrical conductor 60 heats up during the first time interval 150 from a conductor start temperature TS (which may correspond to the ambient temperature of the first electrical conductor 60, see Figure 5) at the beginning of the normal operation of the load 30 to a first conductor temperature T₁ at the end of the first time interval 150. The initial increase in the conductor temperature T over time t decreases with increasing time t.Since the first conductor temperature TL1 at the end of the first time interval 150 is lower than the first lower limit temperature TUG1, the first electrical conductor 60 is not damaged by the first current I1 to be transmitted in the first time interval. The conductor temperature T remains within the first conductor temperature window 140 during the first time interval 150.

[0059] In a specific example, the safety-critical consumer 30 is designed as a radar sensor and scans the driving area 35 in front of the vehicle 10. The safety-critical consumer 30 provides the acquired information about the driving area 35 to the second control unit 85 via the eleventh connection 122 and the second interface 80. The second control unit 85 receives the information from the safety-critical consumer 30 and, based on this information, controls the vehicle 10, in particular the drive unit 46 and / or the steering unit 47, for example in autonomous or semi-autonomous driving mode.

[0060] In the second process step 205, the temperature sensor 139 measures the conductor temperature T of the first electrical conductor 60, in particular of the electrical conductor 126, as an operating parameter of the electrical conductor 126, and provides a temperature signal with temperature information correlating to the conductor temperature T via the first connection 95 of the first interface 65 as information about the operating parameter. The first interface 65 acquires the temperature information, which is configured as information about the operating parameter, and provides the temperature information to the first control unit 70 via the third connection 105.

[0061] In the Figure 4In the example shown, at the beginning of the first time interval 150, the temperature sensor 139 detects the starting temperature TS of the electrical conductor 126 as the conductor temperature T(t 1 ), which essentially corresponds to the ambient temperature of the first electrical conductor 60. The starting temperature TS is provided as temperature information by the temperature sensor 139 of the first interface 65 via the first connection 95.

[0062] In a third process step 210, the first control unit 70 monitors the operating parameter of the electrical conductor 126, in this example the conductor temperature T, over time. t.For example, the first control unit 70 can store the conductor temperature T(t 1 ) determined at a first time t 1, along with time information, in the first data memory 75. The second and third process steps 205, 210 are repeated after a predefined repetition interval, for example, after 0.1 seconds. The information about the operating parameter determined at a second time t 2, in this example the conductor temperature T(t 2 ), is also stored by the first control unit 70 in the first data memory 75.

[0063] The first current I1, transmitted in the first time interval 150, heats up the first electrical conductor 126 over time t. When the second and third process steps 205 and 210 are repeated, the temperature sensor 139 measures a higher conductor temperature T(t2) at the second time t2 than at the first time t1 when the second process step 205 is repeated. The conductor temperatures T(t1) and T(t2) recorded at the first and second times t1 and t2 are stored by the first control unit in the first data memory 75.

[0064] Furthermore, in the third process step 210, the first control unit 70 determines an equilibrium temperature TG based on the information stored in the first data memory 75 about the operating parameter (in this embodiment, the conductor temperatures T(t1), T(t2), for example, at the first time t1 and the second time t2 immediately following the first time t1) and the predefined parameter model. The equilibrium temperature TG corresponds to the conductor temperature T to which the electrical conductor 126 heats up while maintaining the ambient conditions of the electrical conductor 126 and the current I transmitted through the electrical conductor 126. The conductor temperature T asymptotically approaches the determined equilibrium temperature TG over the time t in the first time interval 150.

[0065] In the Figures 4 and 5The conductor temperature T approaches a determined first equilibrium temperature TG1, for example, at the end of the first time interval 150, during the first time interval 150. At the end of the first time interval 150, the first conductor temperature TL1 corresponds, for example, to the first equilibrium temperature TG1.

[0066] In a fourth process step 215, the first control unit 70 compares the equilibrium temperature TG determined in the third process step 210 with the predefined threshold value S1. The predefined threshold value can correspond to the second upper limit temperature T10 ...

[0067] If the equilibrium temperature TG exceeds the predefined threshold S1, the first control unit 70 proceeds to the fifth process step 220. If the determined equilibrium temperature falls below the predefined threshold S1, the process continues with the second process step 205. The second and third process steps 205 and 210 can also be carried out at regular time intervals even after the fifth and subsequent process steps have been completed, thus providing up-to-date information on the operating parameter.

[0068] In Figures 4 and 5 For example, if the first equilibrium temperature T G1 falls below the predefined threshold S 1 in the first time interval 150, the first control unit 70 continues with the second process step 205 after the second time t 2.

[0069] In the Figures 4 and 5Over time t, the conductor temperature T of the first electrical conductor 60 rises from the starting temperature TS to the first conductor temperature TL1 within the first time interval 150. The first conductor temperature TL1 is reached at the end of the first time interval 150. If the first time interval 150 is long enough, the first conductor temperature TL1 corresponds to the first equilibrium temperature TG1 determined at the beginning of the first time interval 15.

[0070] Due to the simultaneous dissipation of heat from the electrical conductor 126 to the environment 135, a temperature gradient dT / dt decreases in the first time interval 150 as time t increases. The behavior of the conductor temperature T resembles an exponential function.

[0071] At the end of the first time interval 150 and at the beginning of the second time interval 155, as explained above, the vehicle control unit 20 reduces the power consumption of the safety-critical consumer 30, so that the safety-critical consumer 30 consumes the second current I2, which is lower than the first current I1. The second current I2 is, for example, constant over the second time interval 155.

[0072] Due to the lower current consumption in the second time interval 155 with the second current I 2, the conductor temperature T drops from the first conductor temperature T L1 during the second time interval 155. By repeating the second to fourth process steps 205 - 215, the first control unit 70 detects the drop in conductor temperature T at the beginning of the second time interval 155.

[0073] Since the second to fourth process steps 205 to 215 are continuously repeated as long as the determined equilibrium temperature TG does not exceed the first threshold S1, the determined equilibrium temperature TG becomes more precise with increasing time t. Furthermore, at the beginning of the second time interval 155, the first control unit 70 also determines a second equilibrium temperature TG2, assuming that the second current I2 continues to be maintained. At the end of the second time interval 155, the conductor temperature TL2 has dropped to the second conductor temperature TL2, which corresponds to the second equilibrium temperature TG2 determined by the second control unit 70 at the end of the second time interval 155.

[0074] At the beginning of the third time interval 160 – hereinafter referred to as time t3 – a fault occurs in the safety-critical load 30. The fault could, for example, be a creeping short circuit in the load 30. The fault causes the current I(t) transmitted by the electrical conductor 126 to increase from the second current I2 to the third current I3. Figure 4 For example, the third current I(t 3 ) suddenly triples at the beginning of the third time interval 160 at the third time point t 3 compared to the second current I 2. The third current I 3 introduces increased heat power into the first electrical conductor 60. This increased heat power causes a temperature rise starting from the second conductor temperature T L2 at the beginning of the third time interval 160. At a fourth time point t 4, which follows the third time point t 3, the conductor temperature T(t 4 ) is higher than at the third time point t 3.

[0075] At the beginning of the third time interval 160, the first control unit 70 determines a third equilibrium temperature T G3 in the third process step 210 for the third and fourth time t 3 , t 4 .

[0076] In the fourth process step 215, the control unit 70 compares the determined third equilibrium temperature T G3 with the predefined threshold S 1 and detects that the third equilibrium temperature T G3 exceeds the first predefined threshold S 1.

[0077] In the fifth process step 220, the first control unit 70 provides a first warning signal with initial warning information at the first interface 65. The first warning signal is transmitted from the first interface 65 via the fourth connection 110 to the second interface 80. The second interface 80 provides the first warning signal to the second control unit 85 via the third connection 105. The second control unit 85 receives the first warning signal.

[0078] Based on the first warning information, the second control unit 85 activates the output device 40 to display an initial warning message indicating that a failure of the safety-critical consumer 30 is imminent. The initial warning message may also contain information that the failure of the safety-critical consumer 30 will necessitate the termination of the autonomous or semi-autonomous driving operation of the vehicle 10 and that the driver 180 must take over control of the vehicle 10.

[0079] The second control unit 85 can also, based on the warning information, guide the vehicle in autonomous or semi-autonomous driving mode to, for example, the nearest parking space or change to a right lane of a multi-lane road.

[0080] Furthermore, the second control unit 85 can control the output device 40 based on the first warning information for a user query. The driver 180 can answer the user query by means of the input device 45 by either ending the autonomous or semi-autonomous driving operation and taking over control of the vehicle 10, or not taking over control, or by not answering the user query.

[0081] The input device 45 detects the user's response and, depending on the input, provides an input signal containing input information. This input signal is transmitted via the twelfth connection 123 to the second interface 80. The second interface 80 then forwards the input signal to the second control unit 85.

[0082] The second control unit 85 controls the switching device 91 based on the input signal. In particular, when the second control unit 85 detects an input indicating the readiness of the driver 180 to take over driving the vehicle, it controls the switching device 91 in such a way that the switching device 91 changes from the first switching state to the second switching state and thereby de-energizes the safety-critical consumer 30.

[0083] The following procedural steps 220 to 280 are carried out until the driver 180 answers the user query by indicating that the driver 180 is taking over control of the vehicle. The user query of the output device 40 remains active until the driver 180 has answered it.

[0084] In a sixth process step 225 following the fifth process step 220, the first control unit 70 determines a first prediction time interval tV1 after the (third) equilibrium temperature TG3 exceeds the predefined threshold S1 by the (third) equilibrium temperature TG3 until the expected exceedance of the second upper limit temperature TOG2, based on the determined current conductor temperature T, the conductor temperature T(t) over time t, the second upper limit temperature TG2, and a predefined parameter, for example, a prediction model. The predefined parameter can be, for example, a mathematical model, an algorithm, a characteristic curve, or a tabular assignment. The predefined parameter can also be part of the predefined parameter model for determining the equilibrium temperature TG.In particular, the parameter model can be a mathematical formula, where the predefined parameter is a transformed form of the mathematical formula of the parameter model.

[0085] In the sixth process step 225, the first control unit 70 determines, for example, for the in Figure 4 The current profile shown is based on the determined conductor temperatures T(t 3 ), T(t 4 ) at the beginning of the third time interval 160 and the predefined parameter developed as a mathematical model, the first prediction time interval t V1 until the expected exceedance of the second upper limit temperature T OG2 .

[0086] The first control unit 70 provides a first information signal with a first time interval information correlating to the first prediction time interval t V1 at the first interface 65.

[0087] The first time interval information is transmitted via the fourth connection 110 to the second interface 80 of the vehicle control unit 20. The second control unit 85 records the first time interval information. The second control unit 85 can take the first time interval information into account during user queries and, for example, output it to the output device 40 indicating when the failure of the safety-critical consumer 30 is expected, and / or indicating when only autonomous or semi-autonomous driving operation will be available, and / or when the driver 180 must take over control of the vehicle 10.

[0088] Additionally, as time t increases until the end of the first prediction time interval T V1, the graphical representation of the output device 40 can be made increasingly clear, thus emphasizing to the driver 180 the urgency of taking over manual vehicle control. Furthermore, acoustic warning signals can be emitted as the end of the first prediction time interval T V1 approaches.

[0089] In a seventh process step 230, which follows the sixth process step 225, the first control unit 70 can additionally determine a second prediction time interval t V2 after exceeding the predefined threshold S 1 and on the basis of the determined conductor temperature T (for example in the time step before exceeding the predefined threshold S 1), the course of the conductor temperature T(t) over the time t, the first upper limit temperature T OG1 and on the basis of the predefined parameter.

[0090] The first control unit 70 can provide a second time interval information correlating with the second prediction time interval t V2 to the second control unit 85 via the interfaces 65, 80, whereby the second control unit 85 can also take the second prediction time interval t V2 into account during the user query.

[0091] This can be done, for example, by displaying the second prediction interval t V2 instead of the first prediction interval t V1, until the driver has to respond to the user query or until the handover from autonomous / semi-autonomous driving operation to manual driving operation takes place.

[0092] In an eighth process step 235, which follows the seventh process step 230, the first control unit 70 compares the determined current conductor temperature T with the second lower limit temperature TUG2. If the current conductor temperature T falls below the second lower limit temperature TUG2, the first control unit 70 proceeds to the ninth process step 240. If the current conductor temperature T exceeds the second lower limit temperature TUG2 (in Figure 5 at a fifth time t5), the first control unit 70 proceeds to a tenth process step 245.

[0093] In the ninth process step 240, the first control unit 70 waits for the next determination of the current conductor temperature T(t) and then repeats the second to eighth process steps 205-235. Because the conductor temperature T is lower than the second lower limit temperature T UG2, the first electrical conductor 60 is operated in the first conductor temperature window 140.

[0094] In the tenth process step 245, the first control unit 70 provides a second warning signal with a second warning message to the second control unit 85 via interfaces 65 and 80, indicating that the conductor temperature T has exceeded the second lower limit temperature TUG2. Upon exceeding the second lower limit temperature TUG2, the first electrical conductor 60 is now operated within the second conductor temperature window 145, in which the second maximum operating time tB2 of the first electrical conductor 60 is significantly reduced compared to the first maximum operating time tB1. Furthermore, the second control unit 85 controls the switching device 91 such that the switching device 91 remains in its first switching state.

[0095] In an eleventh process step 250, which follows the tenth process step 245, the second control unit 85, based on the second warning information at the output device 40, displays an additional second warning informing the driver 180 that they must now respond to the user query via the input device 45 within a very short period and take over driving, as the imminent failure of the safety-critical component 30 is expected. The audible warning can also be emphasized, for example, by increasing the volume of a warning tone.

[0096] In a twelfth process step 255, which follows the eleventh process step 250, the first control unit 70 checks, by comparing the current conductor temperature T with the second upper limit temperature T OG2, whether the current conductor temperature T is (still) within the second conductor temperature window 145. Furthermore, the first control unit 70 determines an initial operating time since exceeding the second lower limit temperature T UG2 and sums this initial operating time with an initial total operating time already stored in the first data memory 75 to obtain an updated initial total operating time for which the first electrical conductor 60 has been operated within the second conductor temperature window 145. The updated initial total operating time overwrites the stored initial total operating time.

[0097] In a thirteenth process step 260, the first control unit 70 provides the second control unit 85 with initial usage time information via interfaces 65 and 80. This information concerns the updated initial total service life of the first electrical conductor 60 within the second conductor temperature window 145. The second control unit 85 can store this initial usage time information in the second data storage device 90 and retrieve it during fault analysis and / or vehicle 10 maintenance to draw conclusions about wear and tear on the first electrical conductor 60. If necessary, this allows for early warning of a potential failure of the first electrical conductor 60 during maintenance, enabling timely replacement of the first electrical conductor 60 and preventing, for example, a cable fire or a failure of the first electrical conductor 60 while the vehicle 10 is in operation.

[0098] In a fourteenth process step 265, the first control unit 70 compares the currently determined conductor temperature T with the second upper limit temperature TOG2. If the current conductor temperature T(t) falls below the second upper limit temperature TOG2, the process continues with the eleventh process step 250. If the current conductor temperature T(t) exceeds the second upper limit temperature TOG2 (in Figure 5 at the sixth time point t6), the process continues with a fifteenth process step 270.

[0099] In the fifteenth process step 270, which follows the fourteenth process step 265, the first control unit 70 checks, by comparing the current conductor temperature T with the third upper limit temperature TOG3, whether the current conductor temperature T is within the third conductor temperature window 146. Furthermore, the first control unit 70 determines a second service life since exceeding the third lower limit temperature TUG3 and sums this second service life with a second total service life already stored in the first data memory 75 to obtain an updated second total service life, representing the period during which the first electrical conductor 60 has been operated within the third conductor temperature window 146. The updated second total service life overwrites the stored second total service life.

[0100] If the first control unit 70 determines in the fifteenth process step 270 that the current conductor temperature T is above the third upper limit temperature T OG3 (in Figure 5At the sixth time point t6, the first control unit 70 provides a shutdown signal with shutdown information to the second control unit 85 via interfaces 65 and 80. Based on this shutdown information, the second control unit 85 switches the switching device 91 from the first switching state to the second switching state. In the second switching state, the switching device 91 electrically disconnects the safety-critical load 30 from the electrical energy source 25, thereby deactivating it. If necessary, the driver 180 is also informed of the deactivation of the safety-critical load 30 via the output device 40. Furthermore, the second control unit 85 switches from autonomous or semi-autonomous driving mode to manual driving mode, in which the driver 180 controls the vehicle 10 manually.Alternatively, it would also be conceivable that the second control unit 85 initiates an emergency braking of the vehicle 10, provided that the second control unit 85 detects that the driver 180 has not taken over manual vehicle control.

[0101] By switching off the current to the first electrical conductor 60 at the beginning of the fourth time interval 165, the first electrical conductor 60 cools down in the fourth time interval 165 after the end of the third time interval 160. However, since the temperature of the sheathing 130 lags behind the current conductor temperature T of the electrical conductor 126 in terms of time, the current conductor temperature T of the sheathing 130 can briefly rise at the beginning of the fourth time interval 165 and reaches its maximum temperature at the temperature sensor 139 at the seventh time t 7. Due to the arrangement of the temperature sensor 139 directly at the electrical conductor 126, the sixth time t 6 and the seventh time t 7 coincide.

[0102] In a sixteenth process step 275, which can be performed simultaneously with the fifteenth process step 270 or after the fourteenth or fifteenth process steps 265, 270, the first control unit 70 provides a second usage time information about the updated second total usage time of the first electrical conductor 60 in the third conductor temperature window 146 via interfaces 65, 80. The second control unit 85 can store the first usage time information in the second data memory 90 and retrieve it during fault analysis and / or vehicle maintenance 10 in order to draw conclusions about wear of the first electrical conductor 60 based on the second usage time information. If necessary, an early warning of a failure of the first electrical conductor 60 can be issued during maintenance.For example, the first electrical line 60 can be replaced early, thus preventing, for example, a cable fire or a failure of the first electrical line 60 during the operation of the vehicle 10.

[0103] In a seventeenth process step 280, which can be performed simultaneously with the sixteenth process step 275 or after the fifteenth or sixteenth process steps 270 and 275, the first control unit 70 compares the current conductor temperature T with the predefined recovery temperature TE, which preferably lies within the first conductor temperature window 140 and is therefore lower than the first lower limit temperature TUG1. The recovery temperature TE is preferably higher than the first lower limit temperature TUG1 and closer to the first upper limit temperature TOG1 than to the first lower limit temperature TUG1. The recovery temperature TE can, for example, be 85°C.

[0104] If the determined current conductor temperature T falls below the recovery temperature TE, the first control unit 70 provides an all-clear signal with all-clear information via interfaces 65, 80 to the second control unit 85. Based on this all-clear information, the second control unit 85 can reactivate the consumer 30 and / or provide the driver 180 of the vehicle 10 with information via output device 40 that autonomous or semi-autonomous driving operation is available again. If the current conductor temperature T(t) exceeds the recovery temperature TE, the first control unit 70 proceeds to the eleventh process step 250.

[0105] Additionally, in the seventeenth process step 280, the first control unit 70 can compare the determined first updated total service life with the second maximum service life t B2 of the first electrical conductor 60 in the second conductor temperature window 145 and / or the determined second updated total service life with the third maximum service life t B3 of the first electrical conductor 60 in the third conductor temperature window 146.If the second maximum operating time t B2 is exceeded by the updated first total service life and / or the third maximum operating time t B3 is exceeded by the updated second total service life, the first control unit 70 can, after the recovery temperature TE is undershot by the current conductor temperature T, control the switching device 91, or the vehicle control unit 20 can control the switching device 91, such that the switching device 91 remains in the second switching state until the first electrical conductor 60 is replaced. This prevents a cable fire in the first electrical conductor 60.

[0106] In a Figure 1 The further training shown is the switching device 91 by means of the in Figure 1The tenth connection 121, shown with a dashed line, is connected to the first interface 65. In this case, the ninth connection 119 is omitted. The switching device 91 is controlled by the first control unit 70 instead of the second control unit 85. The second control unit 85 can then control the first control unit 70 accordingly.

[0107] Fig. 6 shows a schematic representation of a vehicle 10 according to a second embodiment.

[0108] Vehicle 10 is essentially a combination of the one in Figure 1 Vehicle 10 shown and the one in Figure 1The further development of the vehicle 10 shown is such that the vehicle 10 has both the ninth connection 119 and the tenth connection 121. The temperature sensor 139 and the first connection 95 are omitted. In this embodiment, the switching device 91 is part of the detection unit 55 and includes a (smart) semiconductor component. In particular, the (smart) semiconductor component can be a smart high-side power switch. The safety device 15 and the vehicle 10 are connected according to the [reference to be added]. Figure 3The described procedure is controlled. Instead of measuring the conductor temperature T in the second process step 210, the switching device 91 provides information about an operating parameter, preferably the current I(t) transmitted via the switching device 91, to the first control unit 70 via the tenth connection 121. The first control unit 70 acquires the information about the operating parameter, for example, the transmitted electric current I(t), and determines the equilibrium temperature TG of the electrical conductor 126 based on the information about the operating parameter, in particular the transmitted electric current I(t), and the parameter model. The determined operating parameter can be stored in the data memory 75.Furthermore, the first control unit 70 determines the current conductor temperature based on a predefined additional parameter, which is stored in the first data memory 75, and an ambient temperature determined by the ambient temperature sensor. T.

[0109] The additional parameter can be, for example, a mathematical model, an algorithm, a characteristic map, or a tabular assignment. This design has the advantage that the temperature sensor 139 and the first connection 95 can be omitted. As a result, the safety device 15 and the vehicle 10 are designed to be particularly simple and cost-effective. The subsequent process steps are carried out as described in Figure 3 explained in detail.

[0110] Figure 7 shows a schematic representation of a vehicle 10 according to a third embodiment.

[0111] Vehicle 10 is essentially identical to the one in Fig. 6The vehicle 10 shown is designed accordingly. In contrast, the control unit 50 is integrated into the vehicle control unit 20. The data storage devices 75, 90, the interfaces 65, 80, and the control units 70, 85 are combined. This allows access to the... Figure 1 The second connection shown (100), the third connection (105) and the sixth connection (116) are omitted.

[0112] The in Figure 7 Vehicle 10 shown can also be used with the one in Figure 3 The described procedures are operated, with reference to the procedural steps for transferring information between the in Figure 1 The described control units 70, 85 can be dispensed with.

[0113] The above-described method, the above-described safety device 15, and the vehicle 10 ensure that the first electrical line 60 can be operated with overtemperature (above the second lower limit temperature T UG2) without damaging the sheathing 130. Furthermore, it is also possible to provide a delayed response to a fault in the safety-critical load 30, i.e., when the current I to the load 30 rises to, for example, the third current I 3, and thus, instead of damaging the first electrical line 60 or risking an accident, only the first electrical line 60 is briefly overloaded.

[0114] By storing the first and second total service life with which the first electrical line 60 is operated in the second and third line temperature windows 145, 146, diagnostic information can be provided for maintenance or improved vehicle design based on the total service life above the second lower limit temperature T UG2.

[0115] It is also conceivable that if the total service life of the first and / or second exceeds the maximum service life of the second and / or third t B2, t B3, the use of the first electrical line 60 can be prevented by permanently switching the switching device 91 to the second switching state (until the first electrical line 60 is replaced). This can prevent a cable fire in the first electrical line 60.

[0116] Furthermore, the procedure described above provides the possibility of an early warning in the event of a fault in the safety-critical device 30. It also enables a delayed fault response to the damaged safety-critical device 30 and provides reaction time in the event of a fault in the safety-critical device 30, while simultaneously estimating a damage potential, for example, a time / frequency in the second and / or third conductor temperature window 145, 146. AwayAn estimate of the maximum load on the first electrical line 60 is given. Furthermore, the vehicle 10 is more robust than previously known vehicles. In particular, the requirements in an ASIL analysis for the supply systems of the vehicle 10 can be easily met by the vehicle 10 and procedure described above. Furthermore, a redundant design of the safety-critical load 30 can be dispensed with, so that in the event of a fault of the safety-critical load 30, the vehicle 10 can be designed in a particularly simple manner by having the driver 180 take over the tasks of the safety-critical load 30.

[0117] Especially the in Figure 7Furthermore, the described safety device 15 is particularly easy and inexpensive to retrofit. In addition, the safety device 15 described in the figures allows the first electrical conductor 60 to have a particularly small cross-section, resulting in a particularly low overall weight for the safety device 15.

[0118] It is also conceivable that the ones in the Figure 6 and 7 described safety device 15 with the in Figure 1 shown safety device 15 is combined, wherein the temperature sensor 139 is advantageously arranged on the first electrical line 60 in the area where the first electrical line 60 is subject to the greatest thermal stress. Reference symbol list

[0119] 10 Vehicle 15 Fuse 20 Vehicle control unit 25 Power source 30 Consumer 35 Passenger compartment 40 Output device 45 Input device 46 Drive device 47 Steering device 50 Control unit 55 Temperature measuring unit 60 First electrical line 65 First interface 70 First control unit 75 First data storage 80 Second interface 85 Second control unit 90 Second data storage 91 Switching device 95 First connection 100 Second connection 105 Third connection 110 Fourth connection 115 Fifth connection 116 Sixth connection 117 Seventh connection 118 Eighth connection 119 Ninth connection 120 Second electrical line 121 Tenth connection 122 Eleventh connection 123 Twelfth connection 125 Further fuse 126 Electrical conductor 130 Sheathing 135 Environment 139 Temperature sensor 140 First conductor temperature window 145 Second conductor temperature window 146 Third conductor temperature window 150 First time interval 155 Second time interval 160 Third time interval 165 Fourth time interval180 drivers 200 first process step 205 second process step 210 third process step 215 fourth process step 220 fifth process step 225 sixth process step 230 seventh process step 235 eighth process step 240 ninth process step 245 tenth process step 250 eleventh process step 255 twelfth process step 260 thirteenth process step 265 fourteenth process step 270 fifteenth process step 275 sixteenth process step 280 seventeenth process step 285 eighteenth process step TS conductor start temperature TE recovery temperature T UG1 first lower limit temperature T OG1 first upper limit temperature T UG2 second lower limit temperature T OG2 second upper limit temperature T UG3 third lower limit temperature T OG3 third upper limit temperature T conductor temperature T L1 first conductor temperature T L2 second conductor temperature T(t1) conductor temperature at first time point T(t2) conductor temperature at second time point T(t3) conductor temperature at third time point T(t4) conductor temperature at fourth time point T(t) conductor temperature profile over time t V1 first prediction time interval t V2 second prediction time interval t B1 first maximum operating time t B2 second maximum operating time t B3 third maximum operating time t1 first time point t2 second time point t3 third time point t4 fourth time point t5 fifth time point t6 sixth time point t7 seventh time point tTime TS starting temperature S1 predefined threshold Icurrent I(t)current profile I1 first current I3 third current I1 first current I2 second current I3 third current dT / dt temperature gradient

Claims

1. Safety device (15) for an autonomous or a semi-autonomous motor vehicle (10), - having a control device (50), an ascertainment unit (55), and an electrical line (60) with an electrical conductor (126), - wherein the control device (50) has a control unit (70) and an interface (65) connected to the control unit (70), - wherein the electrical line (60) is designed to transmit an electrical energy to a safety-critical load (30), - wherein the ascertainment unit (55) is connected to the control unit (70) and is designed to ascertain information about an operating parameter of the electrical conductor (126) and to supply the control unit (70) with the information, - wherein the control unit (70) is designed to acquire the ascertained information, - wherein the control unit (70) is designed to calculate an equilibrium temperature (TG) of the electrical conductor (126) on the basis of the information of the operating parameter and a predefined parameter model, - wherein the equilibrium temperature (TG) corresponds to a conductor temperature (T) to which the electrical conductor (126) heats up while maintaining the ambient conditions of the electrical conductor (126) and a current (I) transmitted via the electrical conductor (126), - wherein the control unit (70) is designed to compare the ascertained equilibrium temperature(TG) with a predefined threshold value (S1), - wherein the control unit (70) is designed to supply a warning signal containing warning information at the interface (65) when the ascertained equilibrium temperature (TG) exceeds the predefined threshold value (S1), characterized in that, - the control device (50) has at least one data memory (75), - wherein at least a first conductor temperature window (140) and a second conductor temperature window (145) are stored in the data memory (75), - wherein the first conductor temperature window (140) correlates with continuous operation of the electrical line (60), - wherein the second conductor temperature window (145) lies above the first conductor temperature window (140), - wherein the control unit (70) is designed to ascertain a first forecast time interval (tV1) for the electrical conductor (126) on the basis of the information about the operating parameter, a predefined parameter and an upper limit temperature (TOG2) of the second conductor temperature window (145), in which first forecast time interval a conductor temperature (T) of the electrical conductor (126) is expected to reach the upper limit temperature (TOG2) of the second conductor temperature window (145), - wherein the control unit (70) is designed to supply the interface (65) with a first item of time interval information about the first forecast time interval (tV1).

2. Safety device (15) according to Claim 1, - wherein the interface (65) is designed to acquire an item of information about an ambient temperature of the vehicle (10), - wherein the control unit (70) is designed to ascertain a conductor temperature (T) on the basis of the ascertained information, the ambient temperature and a further predefined parameter.

3. Safety device (15) according to Claim 1 or 2, - wherein the ascertainment unit (55) comprises a temperature sensor (139), - wherein the temperature sensor (139) is arranged on or at least in sections in the electrical line (60) and measures a conductor temperature (T) of the electrical conductor (126) as the operating parameter of the electrical conductor (126), - wherein the temperature sensor (139) supplies the control unit (70) with an item of temperature information correlating to the conductor temperature (T) as the information about the operating parameter of the electrical conductor (126).

4. Safety device (15) according to one of Claims 1 to 3, - wherein at least a third conductor temperature window (146) is stored in the data memory (75), - wherein the third conductor temperature window (146) lies above the second conductor temperature window (145), - wherein the control unit (70) is designed to ascertain a second forecast time interval (tV2) for the electrical conductor (126) on the basis of the information of the operating parameter, the predefined parameter and a further upper limit temperature (TOG3) of the third conductor temperature window (146), in which second forecast time interval the conductor temperature (T) of the electrical conductor (126) is expected to reach the further upper limit temperature (TOG3), - wherein the control unit (70) is designed to supply the interface (70) with a second item of time interval information about the second forecast time interval (tV2).

5. Safety device (15) according to Claim 4, - having a switching device (91), - wherein the switching device (91) is electrically connected to the electrical conductor (126), - wherein the control unit (70) is connected to the switching device (91), - wherein, in a first switching state, the switching device (91) allows electrical energy to be transmitted via the electrical conductor (126), - wherein, in a second switching state, the switching device (91) interrupts the transmission of electrical energy via the electrical conductor (126), - wherein the control unit (70) is designed to compare the ascertained conductor temperature (T) with the further upper limit temperature (TGO3), - wherein, when the further upper limit temperature (TOG3) is exceeded, the control unit (70) controls the switching device (91) in such a way that the switching device (91) changes from the first switching state to the second switching state.

6. Safety device (15) according to any one of the preceding claims, - wherein the ascertainment unit (55) has a switching device (91), - wherein the switching device (91) is electrically connected to the electrical conductor (126), - wherein the control unit (70) is connected to the switching device (91), - wherein, in a first switching state, the switching device (91) allows electrical energy to be transmitted via the electrical conductor (126), - wherein, in a second switching state, the switching device (91) interrupts the transmission of electrical energy via the electrical conductor (126), wherein the switching device (91) is designed to ascertain an electric current (I) transmitted via the switching device (91) as the operating parameter of the electrical conductor (126) and to supply the control unit (70) with the information about the transmitted electric current (I) of the operating parameter of the electrical conductor (26).

7. Safety device (15) according to any one of the preceding claims, - wherein the control unit (70) is designed to compare the ascertained present conductor temperature (T) with a lower limit temperature (TUG2) of the second conductor temperature window (145), - wherein the control unit (70) is designed to, when the lower limit temperature (TUG2) of the second conductor temperature window (145) is exceeded, supply the interface (65) with a further warning signal containing a further item of warning information about the lower limit temperature (TUG2) of the second conductor temperature window (145) being exceeded.

8. Safety device (15) according to Claim 7, - wherein the control unit (70) is designed to ascertain a useful life of the electrical line (60) within the second conductor temperature window (145) on the basis of the ascertained present conductor temperature (T), - wherein the control unit (70) is designed to add the ascertained useful life to a total useful life stored in the data memory (75) to give an updated total useful life, - wherein the control unit (70) is designed to supply the interface (65) with an item of information about the updated total useful life.

9. Safety device (15) according to any one of Claims 6 to 8, - wherein the control unit (70) is designed to compare the ascertained present conductor temperature (T) with a predefined recovery temperature (TE) temporally after the upper limit temperature (TOG3) of the third conductor temperature window (146) has been exceeded, - wherein the predefined recovery temperature (TE) is preferably lower than the upper limit temperature (TOG2) of the second conductor temperature window (145) or of the first conductor temperature window (140), - wherein the control unit (70) is designed to, when the recovery temperature (TE) is fallen below, control the switching device (91) in such a way that the switching device (91) changes from the second switching state to the first switching state.

10. Safety device (15) according to Claim 9, - wherein the control unit (70) is designed to compare the ascertained total useful life with a maximum operating life (tB2) of the electrical line (60) in the second conductor temperature window (145), - wherein the control unit (70) is designed to, when the updated total useful life exceeds the maximum operating life (tB2) after the recovery temperature (TE) has been fallen below, control the switching device (91) in such a way that the switching device (91) remains in the second switching state.

11. Autonomous or semi-autonomous vehicle (10), - having a safety device (15), a safety-critical load (30), a vehicle control device (20) and a component (46, 47), - wherein the safety device (15) is designed according to any one of the preceding claims, - wherein the electrical conductor (126) is electrically connected to the safety-critical load (30) and is designed to transmit electrical energy for the safety-critical load (30), - wherein the vehicle control device (20) is connected to the interface (65) and to the safety-critical load (30), - wherein the vehicle control device (20) is designed to control the component (46, 47) on the basis of an item of information of the safety-critical load (30), - wherein the vehicle control device (20) is designed to acquire the warning signal containing the warning information and to take the warning information into account when controlling the component (46, 47).

12. Vehicle (10) according to Claim 11, - having an output device (40), - wherein the vehicle control device (20) is connected to the output device (40), - wherein the vehicle control device (20) is designed to control the output device (40) on the basis of the warning information in such a way that the output device (40) outputs a warning message for a vehicle driver (180) of the vehicle (10) - and / or - wherein the vehicle control device (20) takes into account the warning information when controlling the vehicle (10).

13. Vehicle (10) according to Claim 12, - having an input device (45), - wherein the input device (45) is connected to the vehicle control device (20), - wherein the vehicle control device (20) is designed to actuate the output device (40) on the basis of the warning information in such a way that the output device (40) supplies a user query for the vehicle driver (180), - wherein the input device (45) is designed to acquire an input by the vehicle driver (180) in response to the user query, - wherein the vehicle control device (20) is designed to control the switching device (91) in dependence on the input.

14. Method for operating a safety device (15) according to any one of Claims 1 to 10 and / or an autonomous or a semi-autonomous vehicle (10) according to any one of Claims 11 to 13, - wherein an electrical energy is transmitted to a safety-critical load (30) via an electrical line (60), for the purpose of supplying energy to the safety-critical load (30), - wherein the electrical line (60) heats up at least in sections when the electrical energy is transmitted, - wherein an operating parameter of an electrical conductor (126) of the electrical line (60) is ascertained, - wherein an equilibrium temperature (TG) of the electrical conductor (126) is calculated on the basis of the information of the operating parameter and a predefined parameter model, - wherein the equilibrium temperature (TG) corresponds to a conductor temperature (T) to which the electrical conductor (126) heats up while maintaining the ambient conditions of the electrical conductor (126) and a current (I) transmitted via the electrical conductor (126), - wherein the ascertained equilibrium temperature (TG) is compared with a predefined threshold value (S1), - wherein, when the ascertained equilibrium temperature (TG) exceeds the predefined threshold value (S1), the interface (65) is supplied with a warning signal containing an item of warning information. characterized in that, - a first forecast time interval (tV1) for the electrical conductor (126) is ascertained on the basis of the information about the operating parameter, a predefined parameter and an upper limit temperature (TOG2) of the second conductor temperature window (145), in which first forecast time interval a conductor temperature (T) of the electrical conductor (126) is expected to reach the upper limit temperature (TOG2) of the second conductor temperature window (145), wherein the interface (65) is supplied with a first item of time interval information about the first forecast time interval (tV1).