Methods and devices for controlling an electric drive system and for operating a drive control unit

Abstract

The invention relates to a method for controlling an electric drive system (100) comprising an electric drive (10) and a drive control unit (2), wherein the electric drive (10) comprises an electric machine (1) and a power converter circuit (3), and wherein the drive control unit (2) and the power converter circuit (3) are connected to each other via a data bus (4) for data transmission. The drive control unit (2) sends at least one torque request to the power converter circuit (3), and the power converter circuit (3) supplies the electric machine (1) with electrical power such that the electric machine (1) generates the requested torque.In the method, the converter circuit (3) determines (S120) whether valid data is being received from the drive control unit (2), and if the converter circuit (3) determines that no valid data is being received from the drive control unit (2), the converter circuit (3) puts the electric machine (1) into a safe state (S130). The invention further relates to a method for operating a drive control unit (2), a drive control unit (2), a converter circuit (3), and a drive system (100).

Description

[0001] The present invention relates to a method for controlling an electric drive system, a method for operating a drive control unit as well as a drive control unit, a power converter circuit, an electric drive system and a computer program for carrying out the methods. Background of the invention

[0002] Electric drive systems comprising an electric drive and a drive control unit are used, for example, in vehicles as traction drives or to support an internal combustion engine. An electric drive comprises an electric motor and a power converter circuit (so-called inverter). In vehicles, drive control units are also referred to as VCUs (vehicle control units).

[0003] As is known, a power converter or inverter circuit is used to connect the AC voltage terminals of the electrical machine to the DC voltage terminals of the supply network. The inverter circuit has a number of semiconductor switches, each of which can be opened (non-conductive) and closed (conductive) in accordance with a control signal. The semiconductor switches can comprise metal-oxide-semiconductor field-effect transistors (MOSFETs) and insulated-gate bipolar transistors (IGBTs), for example, gallium nitride (GaN) or silicon carbide (SiC) FETs. The control signal is generated by a logic unit of the power converter circuit, which can be, for example, a microcontroller, an integrated circuit, etc. The logic unit receives control signals from the drive control unit, for example, concerning a torque.

[0004] Data transmission between the drive control unit and the converter circuit of the electric machine or its logic unit can take place via a data bus, for example, a CAN (Controller Area Network) bus. The drive control unit can, for example, send a request for a torque to be generated as well as torque limits, i.e., a maximum and minimum permissible torque, to the converter circuit of the electric machine via the data bus.

[0005] Faults can occur in both the drive control unit and the converter circuit of the electric machine. If a fault is detected in the drive control unit or the converter circuit, the electric machine and thus the drive system should be put into a safe state in which no torque is generated.

[0006] If a fault is detected in the power converter circuit, the power converter circuit can react directly and place the electric machine in the safe state, i.e. the electric machine does not generate any torque. If a fault occurs in the drive control unit, the drive control unit must tell the power converter circuit of the electric machine to generate zero torque or place the electric machine in a safe state. However, this is only possible if the fault is detected by the drive control unit software and the software can still send a torque request for the safe state to the power converter circuit. However, if the drive control unit software fails, safe torque cannot be requested. Disclosure of the invention

[0007] According to the invention, a method for controlling an electric drive system, a method for operating a drive control unit, a drive control unit, a power converter circuit, an electric drive system, and a computer program for implementing the methods are proposed, each having the features of the independent patent claims. Advantageous embodiments are the subject of the dependent claims and the following description.

[0008] The invention is based on a drive system, for example in a hybrid or electric vehicle, which has an electric drive comprising an electric machine and a power converter circuit for supplying the electric machine with current or electrical power and a drive control unit for controlling the electric drive.

[0009] The core of the invention is that the power converter circuit transfers the electric machine and thus the electric drive system into a safe state if the power converter circuit does not receive valid data from the drive control unit. If an error is detected in the drive control unit, a torque request is no longer sent from the drive control unit to the power converter arrangement, through which the power converter arrangement puts the electric machine into the safe state, but rather the reception of valid data by the power converter arrangement is interrupted. If the power converter arrangement determines that no valid data is being received from the drive control unit, the power converter arrangement puts the electric machine into the safe state without a corresponding torque request from the drive control unit being necessary.

[0010] By using the existing hardware concept consisting of drive control unit and power converter circuit, the safety of the drive system can be increased in a simple and cost-effective manner.

[0011] In a first aspect, the invention relates to a method for controlling an electric drive system, in particular a hybrid or electric vehicle, which has an electric drive and a drive control unit. The electric drive comprises an electric machine and a power converter circuit, which can in particular be an inverter circuit. The drive control unit and the power converter circuit are connected to one another for data transmission via a data bus, which is in particular a CAN bus, a LIN bus (Local Interconnect Network Bus), or an SPI (Serial Peripheral Interface). The drive control unit sends at least one torque request to the power converter circuit, and the power converter circuit supplies the electric machine with electrical power such that the electric machine generates the requested torque.

[0012] The power converter circuit determines whether valid data is being received from the drive control unit, and if it is determined that no valid data is being received from the drive control unit, the power converter circuit transfers the electric machine to a safe state. When transferring the electric machine to the safe state, the power converter circuit controls the electric machine, in particular, such that the electric machine generates zero torque. This can be achieved, for example, by the power converter circuit breaking the connection between the AC terminals of the electric machine and the DC terminals of the high-voltage network and / or short-circuiting the AC terminals of the electric machine.

[0013] In one embodiment, to determine whether valid data is being received from the drive control unit by the power converter circuit, it is determined whether data, such as the torque request, is being received from the drive control unit. If no valid data is received from the drive control unit within a predetermined period of time, it is determined that no valid data is being received. The predetermined period of time has a length that depends, for example, on the power of the electric machine and can range from 50 ms to several seconds.

[0014] In one embodiment, to determine whether valid data is being received by the power converter circuit from the drive control unit, it is determined whether the files are being received in a predetermined format and / or with a predetermined content. To this end, the received data can be checked, in particular, using a cyclic redundancy check (CRC), or an "alive counter" can be used to check whether any messages or frames are missing from the transmission. If it is determined that data is being received in a format other than the predetermined format and / or with a content other than the predetermined content, the power converter circuit determines that no valid data is being received from the drive control unit.

[0015] The invention further relates to a method for operating a drive control unit. The drive control unit has at least one hardware component and is configured to be connected to a power converter circuit via a data bus for data transmission and to send at least one torque request to the power converter circuit via the data bus. In particular, one of the at least one hardware component is a microcontroller on which the software of the drive control unit is executed. The drive control unit interrupts the receipt of valid data by the power converter circuit if an error is present in the drive control unit, in particular if an error is present in one or more of the at least one hardware component.

[0016] In one embodiment, interrupting the reception of valid data by the power converter circuit comprises receiving, by a monitoring unit, which may be part of the drive control unit or provided outside the drive control unit, status information of each of the at least one hardware component. If the monitoring unit is part of the drive control unit, the monitoring unit is in particular different from the aforementioned hardware components or the microcontroller and can be implemented, for example, as an integrated circuit.

[0017] In one embodiment, the monitoring unit uses the received status information to determine overall status information that indicates whether a fault is present in the drive control unit. If the overall status information indicates that a fault is present in the drive control unit, the drive control unit interrupts the reception of valid data by the power converter circuit.

[0018] The overall status information can be determined from the received status information according to a suitable determination rule. The determination rule can contain OR, AND, or NAND logic. In particular, it is possible that the overall status information does not indicate a fault in the drive control unit, even though one of the components transmits status information indicating a fault in the component. In particular, the monitoring unit can determine whether the faulty components are leading to a failure of the drive control unit or whether the drive control unit can continue to operate despite the faults of one or more components.

[0019] This allows the method to particularly effectively detect errors in the drive control unit and interrupt the reception of valid data by the power converter circuit, so that the electrical machine is transferred to a safe state in the event of serious errors in the drive control unit.

[0020] In one embodiment, the drive control unit further comprises a data transmission unit configured to transmit data to the data bus and, in particular, also to receive data from it. The reception of valid data by the power converter circuit is interrupted by disabling the data transmission unit. This can be done by interrupting a power supply to the data transmission unit, in particular by a first switch, and / or by deactivating the data transmission unit, in particular via a pin configured to activate and deactivate the data transmission unit.

[0021] In one embodiment, the reception of valid data by the power converter circuit is interrupted by, in particular by the software of the drive control unit, stopping the transmission of valid data from the drive control unit to the power converter circuit and / or by transmitting invalid data. Invalid data is, for example, data that has an incorrect format or incorrect content. For example, the data can be generated with an incorrect format, encrypted with an incorrect encoder, or frames can be removed from the data that the drive control unit transmits to the power converter circuit. In particular, the drive control unit stores information about the fact that invalid data was transmitted in a memory of the drive control unit. This makes it possible to subsequently trace the reason why invalid data was transmitted and thus determine the correct error.

[0022] In one embodiment, the reception of valid data by the power converter circuit is interrupted by a data receiving unit of the power converter circuit, which is configured to receive data from the data bus, being rendered inoperative by the drive control unit.

[0023] In one embodiment, the drive control unit further comprises a connection via which the drive control unit can be connected to a second switch in order to control the latter. The second switch is configured to interrupt a power supply to the data receiving unit of the power converter circuit. The reception of valid data by the power converter circuit is then interrupted by interrupting a power supply to the data receiving unit of the power converter circuit by opening the second switch.

[0024] The first and / or second switch may in particular be an electronic circuit breaker or a relay.

[0025] The options mentioned for interrupting the reception of valid data by the power converter circuit make it easy to ensure that the electrical machine is transferred to a safe state if there is a fault in the drive control unit.

[0026] In particular, it is also conceivable for several, in particular two, three, or all embodiments for interrupting the reception of valid data by the power converter circuit to be combined with one another, i.e., applied simultaneously. This increases, in particular, redundancy in interrupting the reception of valid data by the power converter circuit, thereby ensuring that the electric machine is transferred to a safe state in the event of a fault in the drive control unit.

[0027] Furthermore, it should be noted that the method for controlling the electric drive system and the method for operating the drive control unit can be combined into one method. In particular, the method for operating the drive control unit can be integrated into the step of interrupting the reception of valid data by the power converter circuit.

[0028] The invention further relates to a drive control unit for controlling an electrical machine, comprising at least one hardware component and a data transmission unit configured to transmit data to a data bus via which the drive control unit can communicate with at least one power converter circuit. One of the at least one hardware components is, in particular, a microcontroller that executes the software of the drive control unit. The drive control unit is configured to interrupt the reception of valid data by the power converter circuit if an error is present in the drive control unit. The drive control unit is, in particular, configured to interrupt the reception of valid data by the power converter circuit by carrying out the previously described method for operating the drive unit.

[0029] In one embodiment, the drive control unit further comprises a monitoring unit configured to receive status information from each of the at least one hardware component and, based on the received status information, in particular in accordance with a suitable determination rule, to determine overall status information indicating whether a fault is present in the drive control unit.

[0030] In one embodiment, the drive control unit further comprises a first switch configured to interrupt the power supply of the data transmission unit and / or a pin configured to activate or deactivate the data transmission unit.

[0031] In one embodiment, the drive control unit has a terminal via which the drive control unit can be connected to a second switch in order to control the second switch, wherein the second switch is configured to interrupt a power supply to a data receiving unit of the power converter circuit which is configured to receive data from the data bus.

[0032] The invention further relates to a power converter circuit for controlling an electrical machine, which comprises a data receiving unit configured to receive data from a data bus via which the power converter circuit can exchange data at least with the drive control unit. The power converter circuit is configured to transfer the electrical machine to a safe state if the power converter circuit, in particular a control unit of the power converter circuit, determines that no valid data is being received from the drive control unit.

[0033] The converter circuit, in particular the data receiving unit of the converter circuit, is supplied with current or electrical power externally, for example, via an on-board electrical system of the electric drive system. In order to adapt an externally applied voltage to a voltage that can be used for the data receiving unit, the converter circuit can, in particular, comprise a voltage regulator.

[0034] The invention further relates to an electric drive system, in particular for a hybrid or electric vehicle, which has an electric drive and a drive control unit according to one of the preceding embodiments. The electric drive comprises an electric machine and a power converter circuit as described above. The drive control unit and the power converter circuit are connected to one another for data transmission via a data bus, in particular via a CAN bus, a LIN bus, or an SPI, and the drive control unit sends at least one torque request to the power converter circuit, which supplies the electric machine with electrical power such that the electric machine generates the requested torque. The drive system is configured to carry out a method for controlling an electric drive system as set out above and / or a method for operating a drive control unit as set out above.

[0035] In one embodiment, the drive system further comprises a second switch configured to interrupt a power supply to a data receiving unit of the power converter circuit. The drive control unit has a connection via which the monitoring unit can be connected to the second switch in order to control it.

[0036] By means of the drive control unit, the power converter circuit and the drive system as set out above, the method described above can be implemented in a simple and cost-effective manner and therefore the advantages described above in connection with the method for controlling a drive system and the method for operating a drive control unit can be achieved in a simple and cost-effective manner.

[0037] The implementation of a method according to the invention in the form of a computer program or computer program product with program code for carrying out all method steps is also advantageous, as this entails particularly low costs, in particular if an executing drive control unit is also used for other tasks and is therefore already present. Finally, a machine-readable storage medium is provided with a computer program stored thereon, as described above. Suitable storage media or data carriers for providing the computer program are, in particular, magnetic, optical, and electrical memories, such as hard disks, flash memories, EEPROMs, DVDs, and others. Downloading a program via computer networks (Internet, intranet, etc.) is also possible. Such a download can be wired or cable-based or wireless (e.g., via a WLAN network, a 3G, 4G, 5G, or 6G connection, etc.).

[0038] Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

[0039] The invention is illustrated schematically in the drawing using an embodiment and is described below with reference to the drawing. Short description of the drawings Fig. 1 shows a block diagram of an electric drive system with a drive control unit and a power converter circuit, which are connected to each other via a data bus for data transmission, and which is designed to carry out an embodiment of a method according to the invention, and Fig. 2 shows a flowchart of a combination of embodiments of the methods according to the invention. Embodiment of the invention

[0040] Fig. Figure 1 shows a block diagram of an electric drive system 100 with a drive control unit 2 and an electric drive 10, which is designed to carry out embodiments of the method according to the invention. The electric drive 10 has a power converter circuit 3, which is connected to the drive control unit 2 via a data bus 4 for data transmission, and an electric machine 1. Fig. Figure 2 shows a flowchart of an embodiment of the method according to the invention. Both figures are described together below.

[0041] The electric drive system 100 comprises the drive control unit 2, which sends requests for the torque to be generated by the electric machine 1, as well as, for example, torque limits, i.e., the maximum and minimum permissible torque, to the power converter circuit 3 via the data bus 4, which is in particular a CAN bus, a LIN bus, or an SPI. The power converter circuit 3 supplies the electric machine 1 with electrical power based on the received torque request, possibly within the torque limits, such that the electric machine 1 generates the requested torque.

[0042] The drive control unit 2 has at least one hardware component HW1, HW2, ..., HWN, wherein in particular one of the hardware components HW1, HW2, ..., HWN is a microcontroller on which the regular functionality of the drive control unit 2, i.e., the control of the electric drive 10, is implemented, in particular, in the form of software. The other hardware components HW1, HW2, ..., HWN can, in particular, be safety-relevant hardware components, such as an integrated circuit for power management or the like. If errors occur in one or more of the hardware components HW1, HW2, ..., HWN, the electric machine 1 should be transferred to a safe state by the power converter circuit 3 for safety reasons, even if a torque request for the safe state cannot be sent to the power converter circuit 3 due to a fault in the drive control unit 2.

[0043] Furthermore, the drive control unit 2 has a data transmission unit 2b, via which data, such as the torque request, is transmitted to the data bus 4. In the figure shown, the data transmission unit 2b is supplied with electrical power (voltage U1 of, for example, 5V) from an on-board electrical system of a vehicle having the drive system 100.

[0044] The power converter circuit 3 has a data receiving unit 3a, via which the power converter circuit 3 can receive data from the data bus 4. The data receiving unit 3a is supplied with electrical power (voltage U3 of, for example, 5V) by a voltage regulator 3b, with a voltage U2 of, for example, 12V being applied to the voltage regulator 3b from the vehicle electrical system. The electrical power supplied by the vehicle electrical system to supply the data receiving unit 3a can be interrupted, for example, by a second switch 6, which is controlled by the drive control unit 2.

[0045] If there is an error in the drive control unit 2, in particular in one or more of the hardware components HW1, HW2, ..., HWN, for example the microcontroller, of the drive control unit 2, in step S110 of the method, the drive control unit 2 interrupts the reception of valid data by the power converter circuit 3.

[0046] To determine whether a fault is present in one or more of the hardware components HW1, HW2, ..., HWN, the drive control unit 2 has a monitoring unit 5, in which, for example, a "safe state aggregator" can be implemented as a hardware and / or software module. While the monitoring unit 5 is shown here as part of the drive control unit 2, it can also be provided outside the drive control unit 2.

[0047] In step S111, the monitoring unit 5 receives from each of the hardware components HW1, HW2, ..., HWN, which are each connected to the monitoring unit 5 for data transmission, state information indicating the state of the hardware components HW1, HW2, ..., HWN.

[0048] In step S112, the monitoring unit 5 uses the received status information to determine overall status information that indicates whether an error is present in the drive control unit 2. If an error occurs in one of the hardware components HW1, HW2, ..., HWN, the status information of the respective hardware component HW1, HW2, ..., HWN indicates that an error has occurred. The monitoring unit 5 receives the status information of the hardware components HW1, HW2, ..., HWN and determines overall status information from it. The monitoring unit 5 uses, in particular, OR, AND, or NAND logic for this purpose. The overall status information does not necessarily indicate an error in the drive control unit 2 if one of the hardware components HW1, HW2, ..., HWN exhibits an error.Rather, the monitoring unit 5 can also consider whether the function of the drive control unit 2 is impaired by the error, and only output overall status information indicating an error in the drive control unit 2 if errors occur in several or critical components.

[0049] In step S113, the drive control unit 2 interrupts the reception of valid data by the power converter circuit 3 when the overall status information indicates that there is an error in the drive control unit 2.

[0050] The reception of valid data by the converter circuit 3 can be interrupted in various ways.

[0051] For example, the power supply to the data transmission unit 2b of the drive control unit 2 can be interrupted. For this purpose, the drive control unit 2 can have a first switch 2c, which is opened based on the overall status information output by the monitoring unit 5 if the overall status information indicates that a fault is present in the drive control unit 2. This interrupts the power supply to the data transmission unit 2b, so that the data transmission unit 2b is inoperable and can no longer send data to the data bus 4 and thus also no longer send data to the power converter circuit 3.

[0052] Furthermore, it is possible to interrupt the reception of valid data by the power converter circuit 3 by deactivating the data transmission unit 2b. For this purpose, the data transmission unit 2b has, for example, a pin 2d that can be switched based on the overall status information and sets the data transmission unit 2b to an activated and a deactivated state. If the overall status information indicates that an error is present in the drive control unit 2, pin 2d sets the data transmission unit 2b to a deactivated and thus non-functional state, so that it can no longer transmit data to the data bus 4.

[0053] Furthermore, it is possible to interrupt the reception of valid data by the power converter circuit 3 by stopping the transmission of valid data from the drive control unit 2 to the power converter circuit 3. The data transmission unit 2b is configured, for example, to no longer transmit data to the data bus 4 if it receives overall status information indicating that an error is present in the drive control unit 2. Additionally or alternatively, the drive control unit 2 can also transmit invalid data to the power converter circuit 3. Invalid data is, for example, data that has an incorrect format, for example, due to encryption with an incorrect encoder, or incorrect content, for example, due to the deletion of one or more frames.

[0054] Furthermore, it is possible to interrupt the reception of valid data by the power converter circuit 3 by disabling the data receiving unit 3a of the power converter circuit 3, for example, by interrupting the power supply to the data receiving unit 3a. For this purpose, the second switch 6, which is arranged between the power supply of the power converter circuit 3 and the voltage regulator 3b, can be opened by the safe-state aggregator 5. As a result, no voltage is applied to the voltage regulator 3b, and the data receiving unit 3a is disabled.

[0055] In particular, it is also conceivable that the reception of valid data by the power converter circuit 3 is not only stopped by one of the described possibilities, but several, for example two, three or all possibilities are used.

[0056] The power converter circuit 3 determines in step S120 whether valid data is received from the drive control unit 2.

[0057] To this end, the power converter circuit determines in step S121 whether data is regularly received from the drive control unit 2, and further determines in step S122 that no valid data is being received from the drive control unit 2 if no data is received from the drive control unit 2 within a predetermined period of time. Alternatively or additionally, the existence of the data transmission can also be monitored electrically, for example, by monitoring the presence of certain voltages.

[0058] Furthermore, in step S123, the power converter circuit 3 determines whether data in a predetermined format is being received from the drive control unit 2. Alternatively or additionally, in step S124, it is determined whether data with a predetermined content is being received from the drive control unit 2. In step S125, it is subsequently determined that no valid data is being received from the drive control unit 2 if data in a format other than the predetermined format and / or with a content other than the predetermined format is being received.

[0059] If it is determined that the reception of valid data by the power converter circuit 3 is interrupted, the power converter circuit 3 transfers the electric machine 1 to a safe state. To do this, the power converter circuit 3 controls the electric machine 1, for example, so that it generates zero torque. This can be achieved, for example, by the power converter circuit 3 disconnecting the AC voltage terminals of the electric machine 1 from the DC voltage terminals of the high-voltage network of the electric drive system 100 and / or short-circuiting the AC voltage terminals.

[0060] This ensures that the electric machine 1 of the electric drive system 100 is transferred to the safe state even if the drive controller 2 is unable to send a torque request for the safe state to the power converter circuit 3 due to a fault.

Claims

[1] Method for controlling an electric drive system (100) comprising an electric drive (10) and a drive control unit (2), wherein the electric drive (10) comprises an electric machine (1) and a converter circuit (3), wherein the drive control unit (2) and the one converter circuit (3) are connected to each other via a data bus (4) for data transmission, wherein the drive control unit (2) sends at least one torque request to the power converter circuit (3) and wherein the power converter circuit (3) supplies the electric machine (1) with electrical power such that the electric machine (1) generates the requested torque, the method comprising the following steps: Determining (S120), by the power converter circuit (3), whether valid data is received from the drive control unit (2), and Transferring (S130) the electrical machine into a safe state if the converter circuit (3) determines that no valid data is received from the drive control unit (2). [2] Method according to claim 1, wherein, when transferring (S130) the electrical machine into the safe state, the power converter circuit (3) controls the electrical machine (1) such that the electrical machine (1) generates a torque of zero. [3] Method according to one of the preceding claims, wherein determining (S120) whether valid data is received from the drive control unit (2) comprises: Determining (S121) whether data is received from the drive control unit (2), and determining (S122) that no valid data is received from the drive control unit (2) if no valid data is received from the drive control unit (2) within a predetermined period of time. [4] Method according to one of the preceding claims, wherein determining (S120) whether valid data is received from the drive control unit (2) further comprises: Determining (S123) whether data in a predetermined format is received from the drive control unit (2), and / or determining (S124) whether data with a predetermined content is received from the drive control unit (2), and Determining (S125) that no valid data is received from the drive control unit (2) when data in a format other than the predetermined format and / or with a content other than the predetermined format is received from the drive control unit (2). [5] Method for operating a drive control unit (2), wherein the drive control unit has at least one hardware component (HW1, HW2, ..., HWN) and is configured to be connected to a power converter circuit (3) via a data bus (4) for data transmission and to send at least one torque request to the power converter circuit (3) via the data bus (4), and wherein the method comprises: Interrupting (S110) a reception of valid data by the power converter circuit (3) if an error is present in the drive control unit (2), in particular in one or more of the at least one hardware component (HW1, HW2, ..., HWN). [6] The method of claim 5, wherein interrupting (S110) the reception of valid data by the power converter circuit (3) further comprises: Receiving (S111), by a monitoring unit (5), status information of each of the at least one hardware component (HW1, HW2, ..., HWN), Determining (S112), by the monitoring unit (5), based on the received status information, an overall status information indicating whether there is a fault in the drive control unit (2), and Interrupting (S113) the reception of valid data by the power converter circuit (3) when the overall status information indicates that there is an error in the drive control unit (2). [7] Method according to one of claims 5 or 6, wherein the drive control unit (2) further comprises a data transmission unit (2b) configured to transmit data to the data bus (4), and wherein interrupting (S113) the reception of valid data by the power converter circuit (3) comprises: Making the data transmission unit (2b) inoperable, in particular by interrupting a power supply to the data transmission unit (2b), in particular by a first switch (2c), and / or by the data transmission unit (2b), in particular by a pin (2d) which is designed to activate and deactivate the data transmission unit (2b). [8] Method according to one of claims 5 to 7, wherein interrupting (S113) the reception of valid data by the power converter circuit (3) comprises: Terminating a transmission of valid data from the drive control unit (2) to the converter circuit (3), and / or Transferring invalid data. [9] Method according to one of claims 5 to 8, wherein interrupting (S113) the reception of valid data by the power converter circuit (3) comprises: Disabling a data receiving unit (3a) of the power converter circuit (3) which is configured to receive data from the data bus (4). [10] The method according to claim 9, wherein the drive control unit (2) further comprises a terminal via which the drive control unit (2) can be connected to a second switch (6) to control the second switch (6), wherein the second switch (6) is configured to interrupt a power supply to the data receiving unit (3a) of the power converter circuit (3), and wherein interrupting (S113) the reception of valid data by the power converter circuit (3) comprises: Open the second switch (6). [11] Method according to one of claims 5 to 10 in combination with one of claims 1 to 4. [12] Drive control unit (2) for controlling an electrical machine, comprising at least one hardware component (HW1, HW2, ..., HWN) and a data transmission unit (2b) which is designed to transmit data to a data bus (4) via which the drive control unit (2) can exchange data with at least one power converter circuit (3), wherein the drive control unit (2) is designed to interrupt the reception of valid data by the power converter circuit (3) if an error is present in the drive control unit (2). [13] Drive control unit (2) according to claim 12, wherein the drive control unit (2) further comprises a monitoring unit (5) which is configured to receive status information from each of the at least one hardware component (HW1, HW2, ..., HWN) and to determine, based on the received status information, an overall status information indicating whether a fault is present in the drive control unit (2). [14] Drive control unit (2) according to claim 12 or 13, wherein the drive control unit (2) comprises a first switch (2c) configured to interrupt the power supply to the data transmission unit (2b) and / or a pin (2d) configured to activate and / or deactivate the data transmission unit (2b). [15] Drive control unit (2) according to one of claims 12 to 14, wherein the drive control unit (2) has a terminal via which the drive control unit (2) can be connected to a second switch (6) which is configured to interrupt a power supply to a data receiving unit (3a) of the power converter circuit (3) which is configured to receive data from the data bus (4), in order to control the second switch (6). [16] Drive control unit (2) according to one of claims 12 to 15, which is arranged to carry out a method according to one of claims 5 to 11. [17] Converter circuit (3) for controlling an electrical machine (1) comprising: a data receiving unit (3a) which is designed to receive data from a data bus (4) via which the converter circuit (3) can exchange data at least with the drive control unit (2), wherein the power converter circuit (3) is configured to transfer the electrical machine (1) into a safe state if the power converter circuit (3) determines that no valid data is received from the drive control unit (2). [18] Power converter circuit (3) according to claim 17, which is arranged to carry out a method according to one of claims 1 to 4. [19] Electric drive system (100) comprising an electric drive (10) and a drive control unit (2) according to one of claims 12 to 16, wherein the electric drive (10) comprises an electric machine (1) and a converter circuit (3) according to claim 17 or 18, wherein the drive control unit (2) and the power converter circuit (3) are connected to one another for data transmission via a data bus (4). [20] Drive system (100) according to the preceding claim, wherein the drive system (100) further comprises a second switch (6) which is configured to interrupt a power supply to the data receiving unit (3a) of the power converter circuit (3) and which is connected to the drive control unit (2). [21] Computer program which causes an electric drive system to carry out all the method steps of a method according to one of claims 1 to 4 and / or according to one of claims 5 to 11 when it is executed on the computing unit. [22] A machine-readable storage medium having stored thereon a computer program according to the preceding claim 14.

Images