Safety system for electrically drivable motor vehicle, motor vehicle and method for operating safety system

Abstract

The invention relates to a safety system (100) for an electrically drivable motor vehicle (200). The safety system (100) has a primary brake system (102), a secondary brake system (104) and a tertiary brake system (106). The safety system (100) also has a monitoring device (108) for detecting operating faults in the primary brake system (102) and / or the secondary brake system (104). The safety system (100) also has a detection unit (110) for detecting the motor vehicle data and an evaluation unit (112) which is designed to evaluate an achievable deceleration potential of the three-stage brake system (106) of the motor vehicle (200) using the motor vehicle data. The safety system (100) further comprises a comparison unit (114) for comparing the evaluated deceleration potential of the three-stage brake system of the motor vehicle (200) with at least one defined safety criterion, and a control unit (116), the control device is configured to control the electrically drivable motor vehicle (200) on the basis of an identification of an operating fault and / or on the basis of a comparison between the evaluated deceleration potential and a defined safety criterion.

Description

Technical Field

[0001] The invention relates generally to the field of at least partially electrically operated motor vehicles and to the field of brake-by-wire braking systems and conventional coupled braking systems. In particular, the invention relates to a safety system for an electrically drivable motor vehicle, a motor vehicle having such a safety system and a method for operating such a safety system. Background Art

[0002] In the automotive industry, brake-by-wire technology refers to the feasibility of controlling the brakes by electrical means. It can be designed as a supplement to ordinary mechanically coupled operating brakes or as an independent braking system.

[0003] In a brake-by-wire braking system, the braking force may be built up by hydraulic pressure, for example by a pump. Such a braking system may be referred to as an electro-hydraulic braking system. Alternatively, in a brake-by-wire braking system, conventional components, such as pumps, hoses, fluids, belts, and master cylinders, may be replaced by electronic sensors and actuators. Such a braking system may be referred to as an electromechanical braking system.

[0004] However, the use of a brake-by-wire braking system instead of a conventional coupled braking system is associated with significant disadvantages. Namely, a fallback stage is required by law so that the brakes can still be actuated in the event of a failure of the electronics. In certain circumstances, even a second fallback stage is required to ensure the safety of the vehicle occupants.

[0005] In an electrohydraulic brake, an additional valve that is open when not energized can be provided as a fallback stage. Thus, the coupling between the brake pedal and the hydraulic circuit can be reestablished.

[0006] In electromechanical brakes, additional energy stores can form a backup stage, thus providing redundancy in the signal transmission. The presence of an additional or second energy store represents a considerable difference in weight, installation space and cost. Summary of the invention

[0007] The object of the present invention is to at least partially overcome the above disadvantages. In particular, the object of the present invention is to increase the safety of motor vehicle passengers and other traffic participants in a motor vehicle.

[0008] The above-mentioned object is achieved by a safety system having the features of claim 1, a vehicle having the features of claim 7, a method having the features of claim 8, a computer program product having the features of claim 11 and a computer-readable medium having the features of claim 12. Further features and details of the invention are derived from the dependent claims, the description and the drawings. Here, the features and details described in connection with the safety system according to the invention naturally also apply in connection with the vehicle, method, computer program product and / or computer-readable medium according to the invention, and vice versa, respectively, so that reference is always made to each other or can be made to each other with respect to the disclosure of the individual inventive aspects.

[0009] Embodiments of the present invention can advantageously provide an improved safety system, which can increase the safety of vehicle passengers and traffic participants.

[0010] One aspect of the disclosure relates to a safety system for an electrically drivable motor vehicle. The safety system has a primary braking system, a secondary braking system and a tertiary braking system. The safety system also has a monitoring device for identifying an operating fault in the primary braking system and / or the secondary braking system. The safety system also has a detection unit for detecting motor vehicle data and an evaluation unit configured to evaluate the achievable deceleration potential of the tertiary braking system of the motor vehicle using the motor vehicle data. The safety system also has a comparison unit for comparing the evaluated deceleration potential of the tertiary braking system of the motor vehicle with at least one defined safety standard, and a control unit configured to control the electrically drivable motor vehicle based on the identification of the operating fault and / or based on the comparison between the evaluated deceleration potential and the defined safety standard.

[0011] In other words, a safety system with three brake systems is provided, wherein the secondary brake system can form a first backup stage and the tertiary brake system can form a second backup stage. Possible operating faults can be detected via the monitoring device. This can be a malfunction of the primary, secondary and / or tertiary brake system. If an operating fault in the primary brake system is to be detected, the secondary brake system can be used. If an operating fault is to occur in the secondary brake system, the tertiary brake system can be used. In this case, the primary brake system can be a brake-by-wire brake system. The secondary brake system can also be a brake-by-wire brake system, but can also be a conventional hydraulic brake system. It is also conceivable that the primary brake system and / or the secondary brake system is a coupled brake system.

[0012] The motor vehicle can be a hybrid vehicle or an electric vehicle. Generally speaking, in the context of the present invention, it is a motor vehicle that can be driven at least partially using electrical energy and has a battery for this purpose.

[0013] It should be noted that the designations "primary braking system", "secondary braking system" and "tertiary braking system" do not indicate a determined priority between the braking systems. The concepts of "primary", "secondary" and "tertiary" should only indicate different braking systems. In addition, the designations "primary", "secondary" and "tertiary" may indicate a priority order in normal operation, i.e. in operation without operating faults. Thus, the primary braking system may be a braking system that ensures a braking effect in normal operation. In the first fault operation, the secondary braking system ensures a braking effect. Therefore, if the secondary braking system suffers a fault, the primary braking system may be referred to as the secondary braking system below.

[0014] Furthermore, in normal operation, the primary, secondary and tertiary braking systems can jointly produce a braking effect. In secondary operation, i.e. after a first operating fault, the secondary and tertiary systems can jointly produce a braking effect. In particular in normal operation, such a joint production may be desirable in order to recover as much braking energy as possible in a generator-like manner for further use and to operate the motor vehicle as energy-efficiently as possible.

[0015] In the context of the present disclosure, the concept of "operational fault" should be understood broadly and may, for example, refer to a malfunction in an electronic component of the corresponding brake system and / or an abnormal behavior of a mechanical component of the corresponding brake system. In the context of the present disclosure, an operation fault in a primary brake system may be referred to as a first fault, and an operation fault in a secondary brake system may be referred to as a second fault.

[0016] The safety system can have an evaluation unit, which can be set up to evaluate the achievable deceleration potential of the three-stage brake system. For example, if the primary brake system should no longer be usable due to an operating fault, the motor vehicle may be in an operating state in which only the three-stage brake system provides a backup stage. In the event of an operating fault in the secondary brake system, the three-stage brake system can be used to stop the motor vehicle as safely as possible or to ensure braking performance. In order to be able to ensure a certain safety for the motor vehicle passengers, it can prove to be advantageous to evaluate or estimate the achievable deceleration potential of the three-stage brake system. This can estimate, evaluate or calculate the maximum braking distance that the three-stage brake system can ensure or another safety standard to be achieved. Such an evaluation can already be carried out by the evaluation unit when an operating fault in the primary brake system is detected.

[0017] It should be noted that the concept "motor vehicle passenger" in the context of the present disclosure may refer to any person or animal located in a motor vehicle.

[0018] In the context of the present disclosure, the deceleration potential may be the braking distance of the motor vehicle or the stopping distance of the motor vehicle. It may be the braking distance that the corresponding braking system can or can achieve under current and / or future conditions to bring the motor vehicle to a complete stop. Here, it may be a shorter braking distance that the braking system can or can achieve currently or within a preset time and / or distance. In addition, it may be a braking time to be maintained, an average deceleration level, a collision probability or a failure rate in the second fault operation.

[0019] The deceleration potential may depend on many factors. The deceleration potential may depend, for example, on vehicle data. It may therefore prove advantageous to have a detection unit which is configured to detect vehicle data. The vehicle data may, for example, include the vehicle mass, the vehicle speed and / or the tire temperature. The evaluation unit may therefore evaluate, based on the detected vehicle data, the deceleration potential that the tertiary braking system can achieve or will achieve in the event of an operational fault in the secondary braking system.

[0020] The three-stage braking system may interact with the motor vehicle's electric machine (also referred to as an electric motor). In other words, the motor vehicle's electric machine may be used for the three-stage braking system. This may result in the deceleration potential that can be achieved by the three-stage braking system depending on the motor vehicle's electric machine. The achievable deceleration potential of the three-stage braking system may, for example, depend on the battery temperature of the motor vehicle and / or the state of charge (also referred to as SoC) of the battery of the motor vehicle. Therefore, the motor vehicle data may include data containing information, factors and / or parameters of the battery and the electric motor.

[0021] The comparison unit of the safety system can compare the assessed achievable deceleration potential of the three-stage brake system with at least one defined safety criterion.

[0022] In other words, the comparison unit can determine whether the achievable deceleration potential is able to ensure the preset safety of the motor vehicle occupants. In general, the comparison unit can determine whether the assessed achievable deceleration potential, for example, represents a stopping distance of the motor vehicle that is sufficient for the safety of the motor vehicle occupants. In the context of the present disclosure, the concept "safety standard" can be understood broadly. In general, a safety standard can represent an operating strategy of a motor vehicle. It can be one or more standards on which the continued driving of the motor vehicle may depend. The safety standard may include conditions under which the motor vehicle must stop. Exemplary safety standards can be a stop of the motor vehicle, which must be achieved within a predefined time, and / or can be a stop of the motor vehicle, which must be achieved with a predefined deceleration.

[0023] Based on the recognition of an operating fault and / or a comparison of the estimated deceleration potential with a defined safety standard, the control unit can control the electrically drivable motor vehicle. In other words, the control unit can control the motor vehicle in such a way that the defined safety standard is maintained and / or met. For example, if the safety standard should already be met, the control by the control unit of the safety system does not represent an intervention in the operation of the motor vehicle. The control by the control unit of the motor vehicle can generally represent a direct and / or indirect intervention in the operating strategy of the motor vehicle and / or the driving behavior of the motor vehicle.

[0024] The control unit can be set up, for example, to control pedals of the motor vehicle, a motor vehicle drive and / or a display of the motor vehicle. The control unit can in principle be set up to control components or elements of the motor vehicle that may have an influence on the operation and / or driving behavior of the motor vehicle. This can further improve the reliability of the safety system.

[0025] The motor vehicle can be controlled by the safety system and in particular by the evaluation unit of the safety system in such a way that the safety of the motor vehicle passengers and / or the driving safety can be increased.

[0026] According to one embodiment of the safety system, the control unit is further configured to control the secondary brake system and / or the tertiary brake system based on the detection of the operating fault and / or based on a comparison of the assessed deceleration potential with a defined safety criterion.

[0027] In other words, the control unit can be configured to intervene in the driving behavior of the vehicle based on the recognition of the operating fault and / or based on the comparison of the estimated deceleration potential with a defined safety standard in such a way that the motor vehicle is decelerated by means of the secondary braking system. For example, it can be determined that the motor vehicle should be driven slower in order to be able to meet the safety standard. In this case, the control unit can control the secondary braking system and / or the motor vehicle drive.

[0028] The control unit can also control the three-stage brake system. This is particularly useful when an operating fault in the secondary brake system is detected, because the motor vehicle must now be stopped. If the motor vehicle is already in the second fallback stage of operation, it must be stopped as reliably as possible. This can be achieved by the control unit.

[0029] According to one embodiment of the safety system, the detection unit is further configured to detect and / or receive driving environment information, in particular via an interface. In this case, the motor vehicle data includes the driving environment information.

[0030] The achievable deceleration potential of the three-stage braking system may also depend on the driving environment information. It may depend, for example, on the rise or fall of the road, the outside temperature, the wind and / or the quality or structure of the ground. Therefore, it may prove to be advantageous to have driving environment information in order to be able to further improve the safety of the vehicle occupants. As a result, the assessment of the achievable deceleration potential can be performed more accurately. As a result, the reliability of the safety system can be improved.

[0031] The driving environment information can be detected by a detection unit, for example by means of a sensor that can be arranged at or in the motor vehicle. Alternatively or additionally, the driving environment information can be detected by an external sensor and received by the detection unit.

[0032] For example, route-related driving environment information can be detected, for example, by a route planner and transmitted to a detection unit of the safety system.

[0033] According to one embodiment of the safety system, the detection unit is also configured to detect and / or receive vehicle status information, in particular via an interface. In this case, the vehicle data includes the vehicle status information.

[0034] The achievable deceleration potential of the three-stage braking system may also depend on vehicle state information. Thus, the vehicle data may have vehicle state information that can be detected and / or received by the detection unit. The vehicle state information may, for example, include vehicle mass, tire temperature and / or battery and engine characteristic curve information. Therefore, it may prove to be advantageous to have vehicle state information in order to be able to further increase the safety of the vehicle occupants. Thus, the assessment of the achievable deceleration potential can be performed more accurately.

[0035] According to one embodiment of the safety system, the control unit is also configured to control the secondary braking system and / or the tertiary braking system in such a way that a deceleration of the motor vehicle, a determination of a maximum permissible motor vehicle speed, a deceleration time for stopping the motor vehicle and / or a determination of a remaining driving time of the motor vehicle can be triggered.

[0036] In other words, depending on the comparison between the assessed achievable deceleration potential and the defined safety criterion, the control unit can initiate measures and control the secondary brake system and / or the tertiary brake system for this purpose.

[0037] Based on the comparison described above and below, the control unit can control the secondary brake system in such a way that the motor vehicle can be decelerated. If necessary, the motor vehicle can continue to decelerate once the maximum speed has been exceeded. Alternatively or additionally, the drive power can be limited on the software side to prevent acceleration to a higher driving speed. This may represent an intervention in the vehicle drive.

[0038] For example, the safety criterion may have a maximum value for the deceleration potential. In addition, the comparison unit may be designed to recognize that the assessed deceleration potential reaches the maximum value for the deceleration potential.

[0039] The control unit can also be configured to allow the motor vehicle to continue to travel only if the estimated deceleration potential is less than a maximum value. If this should not be the case, the control unit can control the secondary braking system to stop the motor vehicle. If the safety criteria are met, the motor vehicle can continue to travel and / or the secondary braking system does not need to be actuated.

[0040] If the safety standard is not met, the speed of the motor vehicle can be reduced, for example dynamically depending on the characteristics of the motor vehicle.

[0041] According to one embodiment of the safety system, the three-stage brake system is an electric motor brake system.

[0042] In other words, the three-stage brake system can interact with the battery of the motor vehicle. In general, the energy generated by the three-stage brake system during braking can be converted into electrical energy and received in an energy storage device of the motor vehicle. For this purpose, it can prove to be advantageous to evaluate the availability of the energy storage device of the motor vehicle for receiving energy. The motor vehicle status information may include the availability of the energy storage device.

[0043] It is also conceivable that the secondary brake system is an electric motor brake system.

[0044] A second aspect of the disclosure relates to a motor vehicle having a safety system which is connected to the motor vehicle in data communication and is designed as described above and below.

[0045] As a result, a motor vehicle can be provided with a reliable braking behavior.

[0046] A third aspect of the present disclosure relates to a method for operating a safety system, in particular a method for operating a safety system as described above and below, comprising the following steps:

[0047] Identify operational faults in the primary brake system through the safety system's monitoring device;

[0048] Detection of vehicle data, in particular vehicle data comprising driving environment information and / or vehicle status information, by a detection unit of the safety system;

[0049] An evaluation unit of the safety system evaluates the achievable deceleration potential of a three-stage braking system of the motor vehicle using the motor vehicle data;

[0050] Comparison of the assessed deceleration potential with safety standards by means of a comparison unit of the safety system;

[0051] Controlling an electrically drivable motor vehicle, in particular a secondary brake system and / or a tertiary brake system;

[0052] In this case, the control includes triggering of the first safety measure.

[0053] By means of the embodiment of the method, an improved and reliable operation of the safety system can be advantageously provided. By means of the method, the safety of the vehicle occupants and the traffic participants can be increased.

[0054] According to a preferred embodiment of the method, as described above and below, the method further comprises one of the following steps:

[0055] Identify operational faults in the secondary brake system;

[0056] Control three-level braking system;

[0057] Therein, the three-stage brake system is controlled with the triggering of the second safety measure.

[0058] According to another embodiment of the method, as described above and below, the first safety measure of the method has a deceleration of the motor vehicle. Alternatively or additionally, as described above and below, the second safety measure of the method includes a complete braking of the motor vehicle.

[0059] Other or additional safety measures are also conceivable which influence the driving behavior of the motor vehicle.

[0060] This further increases the reliability of the braking performance of the motor vehicle, thereby increasing the safety of the motor vehicle passengers and traffic participants.

[0061] A fourth aspect of the present disclosure relates to a computer program product comprising instructions which, when executed by a computing unit, cause the computing unit to implement a method as described above and in the following.

[0062] It should be noted that the computer unit can be assigned not only to the safety system but also to the motor vehicle.

[0063] A final aspect of the present disclosure relates to a computer-readable medium having stored thereon a computer program product as described above.

[0064] All disclosures described above and below with respect to one aspect of the disclosure apply equally to all further aspects of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Embodiments of the present invention are described below with reference to the accompanying drawings.

[0066] Figure 1 schematically illustrates a security system according to an embodiment,

[0067] Figure 2 Schematically shows an exemplary course of an operating strategy of a motor vehicle according to an embodiment,

[0068] Figure 3 An exemplary evaluation of the deceleration potential is schematically shown, and

[0069] Figure 4 A flow chart of a method according to one embodiment is shown.

[0070] Similar, similarly acting, identical or identically acting elements are provided with similar or identical reference symbols in the figures. The figures are merely schematic and not to scale. DETAILED DESCRIPTION

[0071] Figure 1 A safety system 100 according to one embodiment is shown. The safety system 100 has three brake systems: a primary brake system 102, a secondary brake system 104, and a tertiary brake system 106. Figure 1 The safety system 100 also has a monitoring device 108, a detection unit 110, an evaluation unit 112, a comparison unit 114 and a control unit 116. The monitoring device 108 can detect operating faults, i.e. malfunctions or abnormal behaviors in all three brake systems, and report them if necessary. The vehicle data can be detected by the detection unit 110 and / or received if necessary. These vehicle data can be used by the evaluation unit 112 to evaluate the achievable deceleration potential of the three-stage brake system 106. The three-stage brake system 106 can be an electric motor or generator brake system. In general, it should be noted that the electric machine can have the operating modes of "motor" and "generator". The vehicle deceleration can be achieved by means of generator operation. However, in the low speed range, due to the motor characteristic curve, it may be necessary to switch to motor operation to achieve deceleration to a stop. Therefore, the braking performance of the three-stage brake system 106 may depend, for example, on the charge state of the battery 202 (also called energy storage 202) of the motor vehicle 200 and the temperature of the battery 202 of the motor vehicle 200. The battery 202 may be electrically connected to the tertiary braking system 106 and the vehicle drive 204. The faster and more efficiently the battery 202 of the vehicle 200 can absorb electrical energy, the more efficient the tertiary braking system 106 may be.

[0072] After an operational fault or any type of malfunction in the primary brake system 102 has been detected by the monitoring device 108, the evaluation unit 112 can evaluate the achievable deceleration potential of the tertiary brake system 106 using the vehicle data. Once an operational fault, i.e., a first fault, has been detected in the primary brake system 102, the secondary brake system 104 can be used to decelerate the vehicle. However, if an operational fault occurs in the secondary brake system 104, the tertiary brake system 106 will be responsible for or used to decelerate the motor vehicle 200. When a second fault is detected, the motor vehicle 200 is controlled by the control unit 116 to achieve a complete braking of the motor vehicle 200. Therefore, if an operational fault occurs in the secondary brake system 104, it must be ensured that the tertiary brake system 106 can achieve the necessary deceleration to stop the motor vehicle 200 according to the defined safety standard. If, when the first fault occurs, it has been determined by the comparison unit 114 that the safety standard cannot be met, the control unit 116 can control the motor vehicle 200 in such a way that the safety standard is now met after adapting the driving behavior 300 of the motor vehicle 200.

[0073] In other words, the deceleration potential of three-stage brake system 106 can be evaluated by evaluation unit 112 to estimate the performance capacity of the second backup stage. Motor vehicle 200 can be prepared for a possible second fault, wherein control unit 116 can control it accordingly.

[0074] Furthermore, it is conceivable that, as soon as a first fault in primary brake system 102 is detected, vehicle 200 is controlled in such a way that the performance capacity of tertiary brake system 106 is increased, without, however, restricting the driving capability of motor vehicle 200. Such a process may be referred to as conditioning of motor vehicle 200 and may condition or prepare motor vehicle 200 for a possible second fault.

[0075] Figure 2 2 shows an exemplary course of an operating strategy of a motor vehicle 200 according to an embodiment. Such a motor vehicle 200 has a safety system 100 according to an embodiment, for example Figure 1Safety system 100. On the vertical axis, i.e. the y-axis, the speed of the motor vehicle 200 is shown in [km / h]. On the horizontal axis, i.e. the x-axis, the time is shown in seconds [s]. The curve with reference symbol 300 represents the possible course of speed over time, in which the operating fault is not detected or has been detected by the monitoring device 108, i.e. in normal operation Z0. Therefore, curve 300 can represent driving behavior 300. A first fault F1, i.e. an operating fault in the primary brake system 102, can be detected. The motor vehicle 200 thus transitions to the operating state of the first backup level Z1. In preparation for a possible second fault F2, the evaluation unit 112 can evaluate the achievable deceleration potential of the three-stage brake system 106. For this purpose, the motor vehicle data is detected and / or received by the detection unit 110. The motor vehicle data can be received, for example, via an interface 118. The interface 118 can be a radio interface. Based on this, the deceleration potential of the three-stage brake system 106 can be estimated or evaluated. Specifically, the evaluation unit 112 can calculate and / or predict the expected stopping distance of the motor vehicle when using the three-stage braking system 106. The achievable deceleration potential can be approximately x1 m, x2 m or x3 m. Based on the comparison between the evaluated deceleration potential and the defined safety criteria, the control unit 116 can control the motor vehicle 200 accordingly. In other words, the control unit 116 can take one or more safety measures to ensure the safety of the motor vehicle passengers.

[0076] Figure 2 The curve 302 of FIG. 302 shows an exemplary course of the speed of the motor vehicle 200, in which a first fault occurs, wherein the safety standard is nevertheless met. Therefore, the curve 302 can represent an undisturbed driving behavior 302. This results in no need for any intervention in the driving behavior 300 of the motor vehicle 200 by the control unit 116. In the exemplary course of the curve 302, no second fault F2 occurs.

[0077] The curve 304 shows the course in which the control unit 116 has to take safety measures after the first fault F1. Therefore, the curve 304 can represent a controlled driving behavior 304. In the case of the curve 304, the motor vehicle 200 slows down until the maximum permissible speed is reached. The safety measures carried out by the control unit 116 can consist in slowing down the motor vehicle 200 to a given speed and / or, if necessary, allowing continued driving for a maximum time of about y1 min, y2 min or y3 min and / or allowing continued driving for a maximum distance of about z1 km, z2 km or z3 km. If the safety measures are carried out after the first fault F1, it is not necessary to force the occurrence of a second fault F1 to allow the use of the three-stage brake system 106. For example, if the safety measures consist in allowing continued driving, for example, only for another z1 km, then after z1 km, the motor vehicle 200 can be slowed down to a stop by means of the secondary brake system 106. This can trigger the control unit 116.

[0078] Such safety measures may be determined based on a comparison between an assessed achievable deceleration potential and defined safety criteria.

[0079] After the first fault F1, the maximum permissible speed can alternatively only be specified by the control unit 116. If the second fault F2 occurs, the motor vehicle 200 is not allowed to continue driving and must stop for safety reasons. Preferably, this is achieved by means of a moderate deceleration of the motor vehicle 200 that is comfortable for the vehicle passengers.

[0080] Figure 3 An exemplary evaluation of the deceleration potential is shown. The deceleration distance is shown in [m] on the vertical axis. The generator power is shown in [kW] on the horizontal axis. The generator power can correspond to or be related to the braking power of the three-stage braking system 106. The generator power can be related to the energy availability of the battery of the motor vehicle 200. For the power L*, a deceleration distance of V* can be achieved. The three curves G1 to G3 show speed contours. Curve G1 can approximately correspond to a constant vehicle speed of 80 km / h, curve G2 can approximately correspond to a constant vehicle speed of 100 km / h, and curve G4 can approximately correspond to a constant vehicle speed of 130 km / h.

[0081] Figure 4A flow chart of a method for operating a safety system 100 according to an exemplary embodiment is shown. In a first step S1, an operating fault of the primary brake system 102 is detected by a monitoring device 108 of the safety system 100. In a second step S2, vehicle data, in particular vehicle data with driving environment information and / or vehicle state information, are detected by a detection unit of the safety system 100. In a further third step S3, the achievable deceleration potential of the tertiary brake system 106 of the motor vehicle 200 is evaluated by an evaluation unit of the safety system 100 using the vehicle data. In a fourth step S4, the evaluated deceleration potential is compared with a safety standard by a comparison unit of the safety system 100. Finally, in a further step S5, the electrically drivable motor vehicle 200, in particular the secondary brake system 104 and / or the tertiary brake system 106, is controlled by a control unit 116. Control S5 includes the triggering of a first safety measure.

[0082] In addition, it should be noted that the concepts "comprising" and "having" do not exclude other elements, and the indefinite article "a" or "an" does not exclude a plurality. In addition, it should be noted that features and steps described with reference to one of the above embodiments can also be used in combination with other features and steps of other embodiments described above. Reference signs in the claims should not be considered as limitations.

[0083] Reference Symbols List

[0084] 100 Security System

[0085] 102 Primary braking system

[0086] 104 Secondary braking system

[0087] 106 Three-stage braking system

[0088] 108 Monitoring Device

[0089] 110 Detection Unit

[0090] 112 evaluation units

[0091] 114 Comparison unit

[0092] 116 Control Unit

[0093] 118 Interface

[0094] 200 Motor Vehicles

[0095] 202 Energy storage

[0096] 204 Motor vehicle drivers

[0097] 300 Driving Behavior

[0098] 302 Uninterrupted Driving Behavior

[0099] 304 Controlled Driving Behavior

[0100] Z0 Normal operation

[0101] Z1 First Reserve Level

[0102] Z2 Second Reserve Level

[0103] F1 first fault

[0104] F2 Second fault

[0105] G1, G2, G3 speed contours

[0106] V*Maximum deceleration distance

[0107] L*Minimum generator power

Claims

1. A safety system (100) for an electrically drivable motor vehicle (200), comprising: A primary braking system (102), a secondary braking system (104), and a tertiary braking system (106); A monitoring device (108) for identifying an operating fault in the primary brake system (102) and / or the secondary brake system (104); A detection unit (110), used for detecting motor vehicle data; an evaluation unit (112) which is configured to evaluate, using vehicle data, an achievable deceleration potential of a three-stage brake system (106) of the vehicle (200); a comparison unit (114) for comparing the estimated deceleration potential of the three-stage brake system (106) of the motor vehicle (200) with at least one defined safety criterion; as well as A control unit (116) is configured to control the electrically drivable motor vehicle (200) based on the detection of an operating error and / or based on a comparison of an assessed deceleration potential with a defined safety standard.

2. The security system (100) according to claim 1, in, The control unit (116) is further configured to control the secondary brake system (104) and / or the tertiary brake system (106) based on the detection of an operating fault and / or based on a comparison of the assessed deceleration potential with a defined safety criterion.

3. The safety system (100) according to any one of the preceding claims, in, The detection unit (110) is further configured to detect and / or receive driving environment information, in particular via an interface (118); and The motor vehicle data includes driving environment information.

4. The safety system (100) according to any one of the preceding claims, in, The detection unit (110) is also configured to detect and / or receive vehicle status information, in particular via an interface (118); and The motor vehicle data includes motor vehicle status information.

5. The safety system (100) according to any one of the preceding claims, in, The control unit (116) is also configured to control the secondary braking system (104) and / or the tertiary braking system (106) in such a way that a deceleration of the motor vehicle (200), a determination of a maximum permissible motor vehicle speed, a deceleration time for stopping the motor vehicle (200) and / or a determination of a remaining driving time of the motor vehicle (200) can be triggered.

6. The safety system (100) according to any one of the preceding claims, in, The three-stage braking system (106) is an electric motor braking system, in particular a generator braking system.

7. A motor vehicle (200) having a safety system (100), in, The safety system (100) is connected to the motor vehicle (200) for data communication and is designed according to any one of claims 1 to 6.

8. A method for operating a safety system (100), in particular a safety system (100) according to any one of claims 1 to 6, comprising the following steps: (S1) identifying an operational fault of the primary braking system (102) by a monitoring device (108) of the safety system (100); (S2) detecting motor vehicle data, in particular motor vehicle data having driving environment information and / or motor vehicle status information, by a detection unit of the safety system (100); (S3) evaluating, by means of an evaluation unit (112) of the safety system (100), an achievable deceleration potential of a three-stage braking system (106) of the motor vehicle (200) using motor vehicle data; (S4) comparing the assessed deceleration potential with a safety standard by a comparison unit of the safety system (100); (S5) controlling the electrically drivable motor vehicle (200), in particular the secondary braking system (102) and / or the tertiary braking system (106); In this case, the control includes the triggering of a first safety measure.

9. The method according to claim 8, further comprising one of the following steps: Identifying an operational fault in the secondary brake system (104); controlling the three-stage braking system (106); in, The three-stage brake system (106) is controlled to include triggering of a second safety measure.

10. The method according to any one of claims 8 and 9, in, The first safety measure comprises a deceleration of the motor vehicle (200); and / or The second safety measure comprises a complete braking of the motor vehicle (200).

11. A computer program product comprising instructions which, when executed by a computer unit, cause the computer unit to carry out the method according to any one of claims 8 to 10.

12. A computer readable medium having stored thereon a computer program product according to claim 11.

Images