Method for operating a vehicle

Abstract

The invention relates to a method for operating a vehicle when stopping the vehicle and / or when holding the vehicle (F) at a standstill, in particular after a failure in a brake system (100), preferably a brake-by-wire system, of the vehicle (F), said vehicle (F) having an electric motor (103). The method has the steps of: - carrying out a deceleration, in particular a regenerative deceleration (30), of the vehicle (F), said deceleration preferably being initiated automatically, and - switching the electric motor (103) to an active short-circuit (AKS), preferably after a regenerative deceleration (30) of the vehicle (F), in order to prevent the vehicle (F) from rolling.

Description

[0001] Description

[0002] Method for operating a vehicle

[0003] The invention relates to a method for operating a vehicle when stopping the vehicle and / or when holding the vehicle at a standstill, for example, after a failure in a braking system, in particular a brake-by-wire system, of the vehicle. Furthermore, the invention relates to a corresponding use of an electric motor of a vehicle. Furthermore, the invention relates to a corresponding computer program product. Furthermore, the invention relates to a corresponding control unit for carrying out a corresponding method. Furthermore, the invention relates to a corresponding vehicle.

[0004] Brake-by-wire systems are generally well-known. Brake-by-wire systems can provide several advantages for both conventional vehicles and automated (Level 4 according to the SAE definition) to autonomous (Level 5 according to the SAE definition) vehicles.

[0005] For automated vehicles, brake-by-wire systems can allow the pedal assembly to be folded away and / or retracted. This creates more space for the driver, who becomes a passenger during fully automated driving, to engage in activities such as sleeping, reading the newspaper, surfing the internet, etc. Furthermore, the mechanical decoupling between the brake pedal and the brake actuator prevents inadvertent misoperation during fully automated driving: Even if the brake pedal were not retracted, accidental contact with the brake pedal during fully automated driving (e.g., if the driver is asleep) would not result in an unwanted vehicle reaction. Autonomous vehicles do not have a driver, so a brake-by-wire system is essential.

[0006] In conventional vehicles, brake-by-wire systems can make getting in and out easier by folding away and / or retracting the foot pedals. Braking behavior can be individually adapted and personalized to the driver. By electronically adjusting the brake characteristic (braking torque depending on pedal travel and / or pedal force), it can be modified so that the driver perceives the braking behavior as softer or harder, sporty or comfortable, direct or dampened. These settings can be transferred from vehicle to vehicle for the individual driver. Environmental protection advantages are also conceivable. By increasing the clearance between the brake disc and the brake pad, residual braking torque can be reduced. This enables a reduction in CO2 and brake dust emissions and an increase in battery-electric range.

[0007] Furthermore, safety benefits are possible. By breaking the mechanical connection between the brake pedal and the brake control system via a push / pull rod, pedal intrusion can be reduced in the event of a crash.

[0008] In addition, the vehicles can be easily adapted to be accessible for people with disabilities. For people with a physical disability that makes operating the pedals difficult or impossible, alternative operating concepts can be offered without complex vehicle modifications when by-wire braking systems are installed as standard.

[0009] Furthermore, this reduces the number of variants. A virtually uniform pedal assembly can now be installed across all vehicle classes.

[0010] With brake-by-wire systems, the driver's mechanical fallback function is eliminated. A fallback function can be provided to enable continued driving in a degraded driving mode (e.g., reduced speed) and / or limited driving mode (e.g., only for a limited time or a limited distance) in a vehicle with a brake-by-wire system after an initial failure.

[0011] DE 102009 047612 A1 discloses a method for braking a vehicle with an electric drive motor. In this method, the electric drive motor is converted to generator mode to brake the vehicle if a malfunction occurs in the mechanical braking system.

[0012] DE 102018 217 740 A1 discloses a method for holding a motor vehicle during a stop phase. To hold the motor vehicle in the stop position during a stop phase, the stator winding is kept completely or at least partially short-circuited by means of a short circuit. Furthermore, DE 10 2017 209 655 A1 discloses a method in which, when a malfunction of the braking system occurs, the drive motor is at least temporarily used to hold the motor vehicle in its position.

[0013] The disadvantage of known systems is that after a second fault and / or after the primary braking system and the secondary braking system fail, continued driving and safety in the operation of the vehicle can no longer be guaranteed.

[0014] If the unlikely event occurs that both the primary and secondary braking systems fail during vehicle operation, the present method can be used to automatically decelerate the vehicle using generator power, ideally to a standstill. Generator deceleration can also be referred to as recuperation. Generator deceleration to a standstill can also be understood as generator-motor deceleration to a standstill. In this case, the vehicle is first decelerated using generator power to the low-speed range and then decelerated from the low-speed range to a standstill using motor power.

[0015] In vehicles with an electronic parking brake, the electronic parking brake is also controlled via the primary and secondary braking systems. However, if both braking systems fail, and in particular if regenerative deceleration to a standstill has been performed, the electronic parking brake can no longer be used to prevent the vehicle from rolling.

[0016] The object of the invention is therefore to provide an improved method for operating a vehicle when stopping the vehicle and / or when holding the vehicle at a standstill, for example after a failure in a braking system, in particular a brake-by-wire system, of the vehicle. In particular, the object of the invention is to provide a method for operating a vehicle which enables increased safety in the operation of the vehicle and which creates improved customer comfort. Furthermore, the object of the invention is to provide an advantageous use of an electric motor of a vehicle. Furthermore, the object of the invention is to provide a corresponding computer program product. Furthermore, the object of the invention is to provide a corresponding control unit. In addition, the object of the invention is to provide a corresponding vehicle.

[0017] The object of the invention is achieved by: a method for operating a vehicle when stopping the vehicle and / or when holding the vehicle at a standstill, e.g. after a failure in a braking system, in particular a brake-by-wire system, of the vehicle, having the features of the independent method claim. Furthermore, the invention relates to a corresponding use of an electric motor of a vehicle having the features of the independent use claim. The object of the invention is likewise achieved by: a method for operating a vehicle when stopping the vehicle and / or when holding the vehicle at a standstill, e.g. after a failure in a braking system, in particular a brake-by-wire system, of the vehicle, having the features of the co-ordinate independent method claim, which represents a genuine alternative to the solution according to the independent method claim.Furthermore, the invention relates to a corresponding use of an electric motor of a vehicle having the features of the independent use claim. Furthermore, the invention relates to a corresponding computer program product having the features of the independent product claim. Furthermore, the invention relates to a corresponding control unit having the features of the independent device claim. In addition, the invention relates to a corresponding vehicle having the features of the co-ordinate device claim. Features described in connection with individual aspects and / or embodiments of the invention naturally also apply in connection with the other aspects and / or embodiments, and vice versa, so that with regard to the disclosure, reciprocal reference is or can always be made to the individual aspects and / or embodiments of the invention.

[0018] The invention provides: a method for operating a vehicle when stopping the vehicle and / or keeping the vehicle stationary, for example, after a failure in a braking system, in particular a brake-by-wire system, of the vehicle. The vehicle may have an electric motor, for example, a synchronous motor, in particular a permanently excited, preferably permanent magnet synchronous motor, or an asynchronous motor, and at least one battery, for example, a high-voltage battery, in particular a traction battery. The method comprises:

[0019] Deceleration, in particular generator-based deceleration, of the vehicle, which is preferably initiated automatically if, for example, a critical secondary fault has been detected in a braking system, such as, for example, a brake-by-wire system, of the vehicle and / or if a non-critical fault in the braking system has not been remedied, switching the electric motor into an active short circuit, preferably after generator-based deceleration of the vehicle, in order to provide anti-roll protection for the vehicle. The vehicle in which the method according to the invention can be used can, for example, have a traction battery, e.g. a high-voltage battery that can be operated with direct voltages of approximately 60 V to approximately 1.5 kV. The vehicle can also have an electric motor. Furthermore, the vehicle can have at least one central control unit. Furthermore, the vehicle can have a driver-vehicle interface, e.g.in the form of an interactive input and output unit, e.g. comprising a display, an acoustic output device, etc.

[0020] The vehicle in which the method according to the invention can be used can preferably be designed as a fully automated vehicle (Level 4 according to SAE definition) or an autonomously driving vehicle (Level 5 according to SAE definition).

[0021] If the driver is in control, the braking request can come from the driver, for example, by applying an electronic brake pedal. If the vehicle is in control, the braking request comes from the vehicle.

[0022] In a fully automated vehicle (Level 4 according to the SAE definition), the driver can become a passenger or user of the vehicle. A fully automated vehicle can feature a driver-vehicle interface. In an autonomous vehicle (Level 5 according to the SAE definition), there is no driver involved. Only users are involved. An autonomous vehicle can feature a user-vehicle interface.

[0023] The vehicle in which the method according to the invention can be used can have a braking system, a so-called brake-by-wire system, in which detection devices and implementation devices for a braking request (which can come, for example, from the driver or from the vehicle) can be mechanically decoupled from one another. The brake-by-wire system can have the following subsystems: a first (or primary) braking system (so-called autonomous braking system) for providing a braking function, which is designed autonomously and / or is supplied with electrical energy via a first (or primary) energy supply, a second (or secondary) braking system (so-called autonomous braking system) for providing a first fallback level for the braking function, which is designed autonomously and / or has a second (or secondary) energy supply.secondary) energy supply with electrical energy, and a third braking system (at least partially indirect and / or functionally implemented braking system) for providing a second fallback level for the braking function, in particular via an electromechanical drive system of the vehicle, e.g. by means of generator deceleration.

[0024] The brake-by-wire system provides two redundant autonomous braking systems that are self-sufficient and can function independently of each other and of other functional systems of the vehicle.

[0025] Each of these two braking systems can also have multiple subsystems, such as a braking request detection system (or detection device for detecting the braking request) and a braking request implementation system (or implementation device for implementing the braking request). In both autonomous braking systems, the braking request can be transmitted from the respective detection system to the respective implementation system via a corresponding transmission system, such as a bus system or a data bus, e.g., using a CAN or SENT protocol.

[0026] The respective braking request detection system can be implemented as an electronic brake pedal. The driver's actuation of the brake pedal can be detected, for example, via force and / or displacement sensors or similar devices. Control electronics for the braking request detection system, comprising, for example, appropriate electronics and / or software, can passively receive the sensor data, actively query it, and, if necessary, evaluate it. Furthermore, the control electronics for the respective braking request detection system can transmit the sensor data and / or the evaluation results to the corresponding braking request implementation via an associated transmission system. The respective braking request implementation system can also have control electronics, comprising, for example, appropriate electronics and / or software.The evaluation of sensor data from the respective braking request detection can be performed in the control electronics for the braking request detection and / or in the control electronics for the braking request implementation. The control electronics for the braking request detection and the control electronics for the braking request implementation can be provided as separate control electronics or as a single control electronics unit.

[0027] At least one or each brake request implementation can be implemented as a so-called "wet" by-wire braking system. The respective brake request implementation can comprise an electric motor, various sensors, and hydraulic valves. The brake calipers of the wheels contain brake pads, which are pressed against the brake discs by hydraulic pressure. Control electronics for the brake request implementation and the brake calipers are connected via hydraulic lines (for hydraulic valves). The control electronics actuate the electric motor to generate a specific hydraulic pressure and thus a specific braking torque, which corresponds to the detected braking request. The pressure at the four wheels can be set, adjusted, and / or modulated via the hydraulic valves.

[0028] At least one or each braking request implementation can be implemented as a so-called "dry" by-wire braking system. The respective braking request implementation can comprise an electric motor, various sensors, and mechanical actuators. The brake calipers of the wheels contain brake pads, which are pressed against the brake discs via electric motors and mechanical actuators. The control electronics and the brake calipers are connected via power lines (for the electric motors) and data lines (for the sensors). The control electronics controls the electric motors in the brake calipers to generate a specific braking torque that corresponds to the braking request. The braking torque at the four wheels can be modulated by appropriately controlling the electric motors.

[0029] In addition to the first and second autonomous braking systems, which can have their own long-term energy supply, a short-term energy supply can also be provided. The third braking system uses the generator-driven electric motor and the control unit of the electric motor. The electric motor is directly connected to the high-voltage battery, in particular the traction battery. The high-voltage battery, in particular the traction battery, feeds the first energy supply and the second energy supply. The control unit of the electric motor is connected to the first energy supply and to the short-term energy supply. The short-term energy supply can represent part of the third braking system. The respective long-term energy supply can, for example, be provided via a DC / DC converter, which can be connected to a corresponding high-voltage battery. The short-term energy supply can, for example,via a low-voltage battery and / or a supercapacitor, so-called ultra-cap, or similar. The operating voltage of the low-voltage battery can be between 12 V and 14 V.

[0030] If a so-called "wet" by-wire braking system is used, this braking system, equipped with hydraulic valves, can advantageously be connected to the short-term energy supply. This allows basic braking functions such as braking the vehicle to a standstill, as well as safety-relevant brake control functions such as ABS and ESC, to be maintained, at least for a short time, even if the primary and secondary long-term energy supplies fail simultaneously.

[0031] The third braking system can be provided at least partially as an indirect or dependent and / or functionally implemented or indirect braking system (or deceleration system) for providing a second fallback level for the braking function, for example, via another functionally essential system of the vehicle, such as an electromechanical drive system, e.g., through regenerative deceleration. An electric motor of the electromechanical drive system, which is operated in a generator mode for regenerative deceleration, acts as a third braking request implementation (or implementation device for implementing the braking request).

[0032] The third braking system can advantageously include a third braking request detection system. The braking request detection can be carried out, for example, via a button on an electronic parking brake. The button can be connected directly to the electronics of the primary and secondary braking request implementation via a signal line (i.e., no data bus). The third braking request detection system can deliver the detection results to the first and / or second autonomous braking system.

[0033] The braking system may have its own control unit, which may communicate with a central control unit of the vehicle. Furthermore, the braking system may have a control unit that may be integrated into the central control unit of the vehicle via software and / or hardware.

[0034] Since the subsystems have multiple components, the failure of one of these components can lead to the failure of the respective subsystem. Failure of the primary or secondary brake request sensing can be caused, for example, by a failure of electronics, a sensor, or software. Failure of the primary or secondary brake request implementation can be caused, for example, by a failure of electronics, a sensor, software, or an electric motor. Failure of the primary or secondary power supply can be caused, for example, by a failure of a power line, a battery, a DC / DC converter, a fuse, an electronic component, or software. Failure of a data bus, for example the failure of the data bus between brake request sensing and brake request implementation, can also lead to the failure of the primary or secondary braking system. If at least one braking system fails, it can be said that there is a failure in the braking system orBrake-by-wire system, according to which the method according to the invention can be initiated in an advantageous manner.

[0035] The control unit can receive diagnostic messages, "alive" signals, and / or error states from the first and second autonomous braking systems and from the third indirect braking system, as well as from the first and second energy supplies and from the third energy supply, for example via a suitable transmission system, such as a bus system or a data bus, e.g. with a CAN or SENT protocol, e.g. via CAN bus, and / or a wireless transmission, such as a radio transmission. The control unit can receive the operating parameters, such as the state of charge and the temperature, from the high-voltage battery, in particular the traction battery, for example via a suitable transmission system, such as a bus system or a data bus, e.g. with a CAN or SENT protocol, e.g. via CAN bus, and / or a wireless transmission, such as a radio transmission.

[0036] Based on these input signals (diagnostic messages and / or error states and / or operating parameters), the control unit can decide whether regenerative deceleration is possible at all, to what extent, and / or until a standstill. Furthermore, the control unit can decide whether continued travel is possible after a first or second fault in the respective braking systems and / or power supplies. Furthermore, the control unit can decide whether automatic deceleration and / or emergency braking must be requested, and / or whether the automatic deceleration and / or emergency braking should be carried out regeneratively using the electric motor and / or via the first braking request implementation and / or via the second braking request implementation using the brake calipers.

[0037] The control unit can request a control unit of the electric motor to perform regenerative deceleration. The control unit can request deceleration using the brake calipers from the first braking request implementation and / or the second braking request implementation. Furthermore, the control unit can control the driver-vehicle interface to inform and / or warn the driver about the errors and / or to issue a suggestion for further operation of the vehicle, such as visiting a workshop. Furthermore, the control unit can inform the driver about the remaining distance and / or the remaining driving time. The control unit of the brake-by-wire system and the control unit of the electric motor can be provided as a single unit (e.g., integrated into the central control unit of the vehicle) or as two separate control units.

[0038] After an initial fault in the braking system, particularly in the brake-by-wire system, the initial fault can be assessed with regard to whether it is critical or non-critical for the safest possible continuation of the vehicle's journey.

[0039] • A first fault in a brake-by-wire system is critical if, after a subsequent second fault, the vehicle can neither be decelerated to a standstill by the driver (detection or implementation of the braking request is no longer possible) nor automatically. Continuing the journey is then no longer possible.

[0040] • A first fault in a brake-by-wire system is not critical if, after a subsequent second fault, the vehicle can be decelerated to a standstill either by the driver (detection and implementation of the braking request is still possible) or automatically. Continuing to drive is then possible, at least to a limited extent.

[0041] Example: After a failure of the primary detection device for a

[0042] If the secondary braking request detection device fails, the braking request can be detected via the third detection device (e.g., a button on the electronic parking brake). Consequently, a failure of the primary braking request detection device is not critical as a first-time failure.

[0043] Example: After a failure of the primary transfer device for a

[0044] If a braking request fails, automatic deceleration to a standstill via generator deceleration would still be possible after a subsequent failure of the secondary implementation device for a braking request - provided that the charge level and / or temperature of the high-voltage battery, in particular the traction battery, permits this - i.e., the traction battery is not too fully charged and not too cold, for example. Consequently, a failure of the primary implementation device for a braking request is not critical as an initial fault if the charge level and / or temperature of the high-voltage battery, in particular the traction battery, permits generator deceleration to a standstill. Otherwise, this initial fault is critical. A failure of the secondary

[0045] The implementation device for a braking request can be evaluated as either non-critical or critical using the same logic. Example: After a failure of the primary long-term power supply, and a subsequent failure of the secondary long-term power supply, both the detection device and implementation device for the braking request, as well as the automatic deceleration to a standstill, could be implemented using the short-term power supply. Consequently, a failure of the primary long-term power supply is non-critical as the first fault. A failure of the secondary long-term power supply as the first fault can also be evaluated as non-critical using the same logic.

[0046] The following defines when a secondary fault in a brake-by-wire system and / or steer-by-wire system is critical or non-critical, and provides examples of critical and non-critical secondary faults.

[0047] • A second fault in a brake-by-wire system is critical if, following a subsequent third fault, the vehicle can either be automatically decelerated to a standstill by the driver (detection or implementation of the braking request is no longer possible) or by the driver. Further travel is then no longer possible.

[0048] • A second fault in a brake-by-wire system is not critical if, after a subsequent third fault, the vehicle can be decelerated to a standstill either by the driver (detection or implementation of the braking request is possible) or automatically. Continuing the journey is then possible to a limited extent.

[0049] Example: After failure of the primary braking system (failure of the primary

[0050] If a failure of the secondary braking system (e.g., failure of the secondary braking system detection or implementation, or of the primary long-term energy supply) also occurs, the secondary braking system also fails (failure of the secondary braking system detection or implementation, or of the secondary long-term energy supply). If a third fault in another system were to prevent regenerative deceleration to a standstill, the vehicle would not be able to decelerate to a standstill either with the help of the driver or automatically. Consequently, a failure of the secondary braking system as a secondary fault with a preceding failure of the primary braking system as the primary fault is critical.

[0051] Example: Following a failure of the primary brake request detection system, the primary brake request implementation also fails. If the secondary braking system were to fail due to a third-party fault (e.g., failure of the secondary brake request detection or implementation, or of the secondary long-term energy supply), the vehicle could continue to be automatically decelerated to a standstill using generator technology. However, if a third-party fault in another system were to inhibit generator deceleration, the driver could continue to decelerate the vehicle to a standstill using the secondary braking system. Consequently, a failure of the primary brake request implementation as a secondary fault, preceded by a failure of the primary brake request detection system as the primary fault, is not critical.

[0052] The criticality of further combinations of first and second errors can be assessed according to the same logic.

[0053] Advantageously, when evaluating the first error and / or the second error, at least one operating parameter of a high-voltage battery, in particular a traction battery, of the vehicle, including in particular state of charge, temperature, etc.

[0054] In this way, it can be assessed whether the second fallback level for the braking function or the third level for the braking function or, in other words, a regenerative deceleration can be ensured.

[0055] Furthermore, after the occurrence of a critical first error, at least one of the following actions can be carried out when operating the vehicle, in particular in the specified order:

[0056] Issuing a second warning to a user of the vehicle with a request to take action, in particular to stop the vehicle,

[0057] Setting a timer (approx. 1 min) to implement the request by the vehicle user according to the second warning, automatic deceleration (especially moderate deceleration, preferably via a regenerative deceleration of the vehicle, e.g. with an acceleration of approx. 1 to 2 m / s 2 ) and / or braking the vehicle, in particular to a standstill, if the request in accordance with the second warning has not been implemented by the user of the vehicle after the timer has expired.

[0058] Furthermore, after the occurrence of a non-critical first error, at least one of the following actions can be carried out when operating the vehicle, in particular in the specified order:

[0059] Issuing a first warning to a user of the vehicle with a recommendation to take action, in particular to visit a workshop, automatic deceleration (in particular moderate deceleration, preferably via a generator-based deceleration of the vehicle, e.g. with an acceleration of approx. 1 to 2 m / s 2) and / or braking the vehicle, in particular to a limited speed, preferably after the non-critical first error has been detected, operating the vehicle in a limited operating mode, in particular at a limited speed, e.g. 130 km / h, preferably for a limited time, e.g. 40 minutes, and / or a limited distance, e.g. 25 km, issuing a second warning to a user of the vehicle with a request to act, in particular to stop the vehicle, setting a timer for the user of the vehicle to implement the request in accordance with the second warning, and / or automatic deceleration (in particular moderate deceleration, preferably via a generator-based deceleration of the vehicle F, e.g. with an acceleration of approx. 1 to 2 m / s 2) and / or braking the vehicle, in particular to a standstill, if the first error detected has not been remedied after the expiry of the limited time and / or the limited distance.

[0060] In addition, after the occurrence of a critical first error, at least one of the following actions can be performed when operating the vehicle, in particular in the specified order:

[0061] Monitoring the detected non-critical first error for conversion into a critical first error,

[0062] Detecting a conversion of the detected non-critical first error into a critical first error,

[0063] Issuing a second warning to a user of the vehicle with a request to act, in particular to stop the vehicle, setting a timer (approx. 1 min) for the user of the vehicle to implement the request according to the second warning, automatic deceleration (in particular moderate deceleration, preferably via a generator-based deceleration of the vehicle, e.g. with an acceleration of approx. 1 to 2 m / s 2 ) and / or braking the vehicle, in particular to a standstill, if the request according to the second warning has not been implemented by the vehicle user after the timer has expired. Furthermore, after the occurrence of a non-critical first error and a critical second error, at least one of the following actions can be performed while operating the vehicle, in particular in the specified sequence:

[0064] Issuing a second warning to a user of the vehicle with a request to take action, in particular to stop the vehicle,

[0065] Setting a timer (approx. 1 min) to implement the request by the vehicle user according to the second warning, automatic deceleration (especially moderate deceleration, preferably via a regenerative deceleration of the vehicle, e.g. with an acceleration of approx. 1 to 2 m / s 2 ) and / or braking the vehicle, in particular to a standstill, if the request in accordance with the second warning has not been implemented by the user of the vehicle after the timer has expired.

[0066] In addition, after the occurrence of a non-critical first error and a non-critical second error, at least one of the following actions can be carried out when operating the vehicle, in particular in the specified order: reissuing a first warning to a user of the vehicle with a recommendation to take action, in particular to visit a workshop, operating the vehicle in a limited operating mode, in particular at a limited speed, e.g. 130 km / h, preferably for a limited time, e.g. 40 minutes, and / or a limited distance, e.g. 25 km, preferably measured since the detection of the non-critical first error, and / or automatic deceleration (in particular moderate deceleration, preferably via a regenerative deceleration of the vehicle, e.g. with an acceleration of approx. 1 to 2 m / s 2) and / or braking the vehicle, in particular to a standstill, if after the expiry of the limited time and / or the limited distance, the first error detected and the second error have not been remedied.

[0067] The concept of the invention is described below. The invention provides two solutions for stopping the vehicle or for holding the vehicle at a standstill, in particular after the "regenerative deceleration" function has been activated, for example, as a second fallback level in a brake-by-wire system. This function can be activated, for example, if the primary braking system and the secondary braking system have failed. This can be referred to as a critical fault, in particular a critical secondary fault, in the brake-by-wire system. In vehicles with an electronic parking brake, the electronic parking brake is also controlled via the primary and secondary braking systems. Consequently, after regenerative deceleration to a standstill, it is often no longer possible to secure the vehicle against rolling using the electronic parking brake.However, the “generator deceleration” function can also be activated if the driver does not follow the request to select a workshop or to rectify the error after an initial error.

[0068] Within the scope of the invention, a failure in a braking system, in particular a brake-by-wire system, of the vehicle can be referred to at least when a critical secondary fault has been detected in the braking system or in the brake-by-wire system of the vehicle or when a non-critical fault in the braking system has not been remedied.

[0069] The invention proposes that the vehicle's electric motor assumes the role of anti-rolling. For this purpose, the electric motor, particularly in the form of a permanent-magnet or permanent-magnet synchronous motor, can be switched to an active short circuit, known as an active short circuit. The switch to the active short circuit can advantageously occur below a certain speed limit, known as the active short circuit speed limit. The active short circuit torque then prevents the vehicle from rolling.

[0070] Active short circuit or AKS means: The stator windings of the synchronous motor are short-circuited at the connecting cables, for example by a switch, such as an electronic switch (e.g. a field-effect transistor, such as a MOSFET transistor) which can be provided, for example, in the power electronics.

[0071] The AKS torque means that when the vehicle rolls forward or backward, the movement of the permanent magnet in the rotor of the synchronous motor induces a voltage in the stator windings. A current then flows in the short-circuited stator windings, resulting in an AKS torque that counteracts the direction of rotation of the synchronous motor and thus decelerates the vehicle.

[0072] The speed limit, or AKS speed limit, means that the AKS torque increases steeply with the speed of the electric motor, then reaches a maximum, and then steadily decreases. Below the AKS speed limit, the AKS torque is so low that it is no longer sufficient to prevent the vehicle from rolling.

[0073] The advantage here is that if the vehicle rolls from a standstill after the generator-induced deceleration, the maximum speed of the vehicle when rolling is limited to a few km / h by the active short circuit, preferably below walking speed, preferably below 1 km / h.

[0074] Another advantage is that the vehicle is not actively kept at a standstill after the generator-driven deceleration into a standstill, meaning that little to no power is consumed.

[0075] Furthermore, it can be provided that a generator-based deceleration is carried out to decelerate the vehicle, which deceleration is preferably initiated automatically, in particular if a critical secondary fault has been detected in a braking system, preferably a brake-by-wire system, of the vehicle, or if a non-critical primary fault in a braking system, preferably a brake-by-wire system, of the vehicle has not been remedied. This can mean that both a primary braking system and the secondary braking system of the vehicle have failed, or that a failure of a primary braking system or a secondary braking system has not been remedied, or similar. Advantageously, the switching of the electric motor to the active short circuit can be carried out after a generator-based deceleration of the vehicle.In this way, the advantages of the roll-lock system can be achieved using the electric motor if an electronic parking brake is not available on the vehicle or cannot be implemented using the braking system and the secondary braking system.

[0076] As already mentioned above, the electric motor can be switched to active short circuit below a certain speed limit of the electric motor, in particular a so-called AKS speed limit. The speed limit of the electric motor for switching to active short circuit can advantageously be determined depending on the weight, in particular the load weight, of the vehicle and / or the topology, in particular the gradient, of a road surface on which the vehicle is brought to a stop. In this way, the anti-roll device can keep the vehicle at a rolling speed with the help of the electric motor.

[0077] When the electric motor is switched into active short circuit, stator windings of the electric motor can be short-circuited to connecting lines, in particular by a switch, preferably an electronic switch, preferably a field-effect transistor.

[0078] Advantageously, when the electric motor is switched to active short circuit mode, the vehicle's rolling speed can be limited to a few km / h, particularly below walking speed, preferably below 1 km / h. Due to the low rolling speed, the vehicle itself can be operated safely despite a braking system failure. Other road users can safely avoid the vehicle, so that the vehicle can be perceived almost as a stationary obstacle.

[0079] Advantageously, the anti-roll device of the vehicle can be implemented passively by switching the electric motor into the active short circuit, in particular without energizing the stator windings of the electric motor.

[0080] In principle, it is conceivable that after the electric motor is switched to the active short circuit, accelerator pedal operation is disabled, interrupted, or not permitted. This prevents the driver from using the electric motor to deactivate the roll-off protection and accelerate the vehicle again.

[0081] It is also conceivable that the electric motor's active short circuit could be interrupted during accelerator pedal operation. This would allow the driver to operate the accelerator pedal, at least in unusual situations, such as rolling backward uphill, to avoid confusing the driver and make these unusual situations easier and more intuitive to manage.

[0082] Advantageously, the accelerator pedal actuation can be disabled or permitted depending on the topology, in particular the gradient, of the roadway on which the vehicle is brought to a stop. In principle, it is conceivable that accelerator pedal actuation could be permitted on a downhill roadway, and that accelerator pedal actuation would be disallowed on a more level or uphill roadway.

[0083] Furthermore, it is conceivable that after the electric motor is switched to the active short circuit, a steering function of the vehicle would be permitted. This would allow the driver to avoid obstacles.

[0084] The invention further provides for the use of an electric motor of a vehicle in an active short circuit to provide anti-roll protection for the vehicle. In this way, the electric motor of the vehicle can be advantageously used to provide passive anti-roll protection. This can be particularly advantageous if an electronic parking brake is not available for the vehicle or cannot be implemented using the braking system and the secondary braking system.

[0085] The invention further provides: a method for operating a vehicle when stopping the vehicle and / or keeping the vehicle stationary, for example, after a failure in a braking system, in particular a brake-by-wire system, of the vehicle. The vehicle may have an electric motor, for example, a synchronous motor, in particular a permanently excited, preferably permanent magnet synchronous motor, or an asynchronous motor, and at least one battery, for example, a high-voltage battery, in particular a traction battery. The method comprising:

[0086] Deceleration, in particular generator deceleration, of the vehicle, which is preferably initiated automatically if, for example, a critical secondary fault in a braking system, such as a brake-by-wire system, of the vehicle has been detected and / or if a non-critical fault in the braking system has not been remedied, energizing a stator winding of the electric motor, if necessary with a phase switch of stator windings of the electric motor, in order to provide anti-roll protection for the vehicle.

[0087] In this way, a roll-prevention system can be enabled using the electric motor, which operates under power. This allows for active stopping of the vehicle and / or holding it in a stationary state. This consumes electrical energy. However, it allows for high braking torques. This represents an alternative solution to the method described above, which enables passive stopping of the vehicle and / or holding it in a stationary state.

[0088] The invention also provides: using an electric motor of a vehicle by energizing a stator winding of the electric motor, optionally with a phase switch of stator windings of the electric motor, to provide anti-roll protection for the vehicle. In this way, the electric motor of the vehicle can also be used to provide active anti-roll protection. This can also be advantageous if an electronic parking brake of the vehicle is not available or cannot be implemented using the braking system and the secondary braking system, and if sufficient energy is available, for example, if at least one battery, such as the high-voltage battery or the traction battery, is fully charged.

[0089] The invention further provides: a computer program product comprising instructions which, when the computer program product is executed by a computer, cause the computer to carry out one of the methods described above. With the aid of the computer program product according to the invention, the same advantages can be achieved which were described above in connection with the respective method according to the invention. These advantages are fully incorporated herein by reference. The invention further provides: a control unit having a computing unit and a memory unit in which a code is stored which, when at least partially executed by the computing unit, carries out one of the methods described above. With the aid of the control unit according to the invention, the same advantages can be achieved which were described above in connection with the respective method according to the invention.These advantages are fully referred to here.

[0090] The control unit for implementing the respective method according to the invention can be implemented as a separate control unit or integrated in a central control unit of the vehicle and / or in a control unit for an electric motor of the vehicle, using software and / or hardware. The control unit for implementing the respective method according to the invention can also comprise a control unit for the braking system.

[0091] The invention further provides a vehicle having a corresponding control unit. The vehicle according to the invention can achieve the same advantages as those described above in connection with the respective method according to the invention. These advantages are incorporated herein by reference.

[0092] The invention is further illustrated in more detail with reference to the figures. It should be noted that the figures are merely descriptive and are not intended to limit the invention in any way. They show:

[0093] Fig. 1 is a schematic representation of a braking system,

[0094] Fig. 2 Vehicle behavior after a non-critical first error and when reaching a distance or time limit,

[0095] Fig. 3 Vehicle behavior after a non-critical first fault and a critical second fault, and

[0096] Fig. 4 is an overview of possible uses of a roll lock within the scope of the present disclosure.

[0097] Figs. 1 to 4 serve to describe a method within the scope of the present disclosure. The method serves to operate a vehicle F when stopping the vehicle F and / or when holding the vehicle F at a standstill, for example, after a failure in a braking system 100, in particular a brake-by-wire system, of the vehicle F. The method thus serves to provide a roll-preventing device for the vehicle F.

[0098] As Fig. 1 indicates, the vehicle F can have an electric motor 103, for example a synchronous motor, in particular a permanently excited, preferably permanent magnet excited synchronous motor, or an asynchronous motor, and at least one battery 104, for example a high-voltage battery, in particular a traction battery.

[0099] The procedure provides for the following procedural steps / actions:

[0100] Deceleration, in particular generator-based deceleration, of the vehicle F, which is preferably initiated automatically if, for example, a critical secondary fault has been detected in a braking system 100 or a brake-by-wire system of the vehicle F and / or if a non-critical primary fault in the braking system 100 has not been remedied, switching the electric motor 103 into an active short circuit AKS, preferably after a generator-based deceleration of the vehicle F, in order to provide anti-roll protection for the vehicle F.

[0101] As Fig. 1 further indicates, the vehicle F, in which the method according to the invention can be used, can have a braking system 100, a so-called brake-by-wire system, in which detection devices and implementation devices for a braking request (which can come, for example, from the driver or from the vehicle) can be mechanically decoupled from one another. The braking system 100 can have the following subsystems: a first (or primary) braking system 10 (so-called autonomous braking system) for providing a braking function, which is designed autonomously and / or is supplied with electrical energy via a first (or primary) energy supply E1, a second (or secondary) braking system 20 (so-called autonomous braking system) for providing a first fallback level for the braking function, which is designed autonomously and / or has a second (orsecondary) energy supply E2 is supplied with electrical energy, and a third braking system (at least partially indirect and / or functionally implemented braking system) for providing a second fallback level for the braking function, in particular via an electromechanical drive system 103, 104 of the vehicle, e.g. by a generator-based deceleration 30.

[0102] The braking system 100 comprises two redundant autonomous braking systems 10, 20 which are self-sufficient or independent and which can function independently of one another and of other functional systems of the vehicle F.

[0103] Each of these two braking systems 10, 20 can also have multiple subsystems, such as a braking request detection unit (or detection device for detecting the braking request) and a braking request conversion unit (or conversion device for converting the braking request). In both autonomous braking systems, the braking request can be transmitted from the respective detection unit to the respective conversion unit via a corresponding transmission system, such as a bus system or a data bus, e.g., with a CAN or SENT protocol. The individual subsystems are not shown for the sake of simplicity.

[0104] The third braking system can be provided at least in part as an indirect or dependent and / or functionally implemented or indirect braking system (or deceleration system) for providing a second fallback level for the braking function, for example, via another functionally essential system of the vehicle F, such as an electromechanical drive system 103, 104, for example, through regenerative deceleration. An electric motor 103 of the electromechanical drive system 103, 104, which is operated in a generator mode G for regenerative deceleration 30, acts as a third braking request conversion device (or conversion device for converting the braking request). The electric motor 103 generates a charging current I for the at least one battery 104, comprising, for example, a high-voltage battery, such as a traction battery, and optionally at least one further auxiliary battery.

[0105] Furthermore, the braking system 100 can have a control unit 101, which can be integrated into the central control unit of the vehicle F in terms of software and / or hardware, as schematically indicated in Fig. 1. However, the braking system 100 can also have its own control unit 101, which can be in communication with a central control unit of the vehicle F.

[0106] Since the subsystems of the first braking system 10 and the second braking system 20 comprise multiple components, the failure of one of these components can lead to the failure of the respective system 10, 20. A failure of at least one braking system 10, 20 can be referred to as a failure in the braking system 100 or brake-by-wire system, after which the method according to the invention can be initiated.

[0107] The control unit 101 of the braking system 100 can receive input signals D1, D2, D3. DE1, DE2, DE3 (diagnostic messages, “alive” signals and / or error states) from the first and second autonomous braking systems 10, 20 and from the third indirect braking system 30 as well as from the first and second energy supplies E1, E2 and from the third energy supply E3, for example via a suitable transmission system, such as a bus system or a data bus, for example with a CAN or SENT protocol, for example via a CAN bus, and / or a wireless transmission, such as a radio transmission. The control unit 101 can receive the operating parameters, such as the state of charge and the temperature, from the at least one battery 104, for example via a suitable transmission system, such as a bus system or a data bus, for example. B. with a CAN or SENT protocol, e.g. via CAN bus, and / or a wireless transmission, such as a radio transmission.

[0108] Based on these input signals D1, D2, D3, DE1, DE2, DE3 (diagnostic messages, "alive" signals and / or error states and / or operating parameters), the control unit 101 of the braking system 100 can decide whether regenerative deceleration 30 is possible at all, to what extent and / or until the vehicle F comes to a standstill. Furthermore, the control unit 101 can decide whether the vehicle F can continue to travel after a first error F1 and / or a second error F2 in the respective braking systems 10, 20, 30 and / or in the energy supplies E1, E2, E3. In addition, the control unit 101 can decide whether an automatic deceleration, braking and / or emergency braking must be requested, and / or whether the automatic deceleration, braking and / or emergency braking should be carried out regeneratively using the electric motor 103 and / or via the first braking request implementation and / or via the second braking request implementation using the brake calipers.

[0109] The control unit 101 of the braking system 100 can request a control unit 102 of the electric motor 103 to perform a regenerative deceleration 30. The control unit 101 can request deceleration using the brake calipers from the first braking request implementation and / or the second braking request implementation. Furthermore, the control unit 101 can control a driver-vehicle interface to inform and / or warn the vehicle user about the errors and / or to issue a suggestion for further operation of the vehicle F, such as visiting a workshop (cf. a first warning W1 in Figs. 2 and 3). Furthermore, the control unit 101 can inform the driver about the remaining distance and / or the remaining driving time.

[0110] The control unit for carrying out the respective method according to the invention can be embodied as a separate control unit or integrated in a central control unit 110 of the vehicle F and / or in the control unit 102 of the electric motor 103 of the vehicle F, using software and / or hardware. The control unit for carrying out the respective method according to the invention can also include the control unit 101 for the braking system 100.

[0111] With the help of Fig. 2 and 3, the basic behavior after first fault F1 and second fault F2, and in particular the function “Generator Deceleration 30”, if possible to standstill, is described as the second fallback level for the braking function.

[0112] Fig. 2 shows possible vehicle behavior after a non-critical first fault F1 without a subsequent second fault F2 using a function of a speed V of the vehicle F as a function of time t. After a non-critical first fault F1, the user of the vehicle F can receive a first warning W1, e.g. "visit workshop". The vehicle F can, however, continue driving for a limited time T1 (e.g. 40 min) or for a limited distance S1 (e.g. 25 km), in particular at a limited speed V1 (e.g. 130 km / h) (see Fig. 2). The further travel of the vehicle F is therefore limited in order to avoid a so-called "hard breakdown" of the vehicle F, which would be unsafe and / or uncomfortable for the user of the vehicle F. A "hard breakdown" means that the vehicle F can no longer drive to a workshop under its own power and must therefore be towed.

[0113] If no further critical K errors F1, F2 occur while vehicle F continues driving, the user of vehicle F will be warned again shortly before, during, or after reaching the time limit T1 or the distance limit S1. A second warning W2, e.g., "Stop immediately," may be issued.

[0114] If the user of the vehicle F does not react to the second warning W2, e.g. within a timer t1 (e.g. of approx. 1 min), then the vehicle F is automatically decelerated, preferably by a generator-based deceleration 30, preferably moderate, e.g. at speeds V between approx. 1 m / s 2 and approx. 2 m / s 2 , preferably to a standstill. An automatic, preferably generator-based deceleration 30 of vehicle F is initiated because it is not safe for vehicle F to continue driving indefinitely after an initial fault F1 in the brake-by-wire system.

[0115] Fig. 3 shows a possible vehicle behavior after an uncritical U first error F1 and a critical K second error F2 using a function of a speed V of the vehicle F as a function of time t.

[0116] If, after a non-critical U first error F1, a critical K second error F2 occurs while the vehicle F is continuing to drive, the user of the vehicle F can be warned again. For this purpose, a second warning W2, e.g., "Stop immediately," can be issued. The vehicle F is then automatically decelerated 30, preferably moderately, e.g., at speeds between approximately 1 m / s. 2 and approx. 2 m / s 2 , preferably to a standstill, delayed.

[0117] A secondary fault F2 in the brake-by-wire system is critical if, following a subsequent third fault, the vehicle F cannot be decelerated to a standstill either by the user of the vehicle F or automatically. Further travel of the vehicle F is then no longer possible. The following examples are conceivable: The primary braking system 10 and the secondary braking system 20 fail, or the primary energy supply E1 and the secondary energy supply E2 fail, or similar.

[0118] The simultaneous failure of the primary braking system 10 and the secondary braking system 20 is detected by the control unit 101 of the braking system 100. This can be detected, for example, by a missing "alive" signal and / or a corresponding diagnostic message, see the input signals D1, D2, D3, DE1, DE2, DE3 (diagnostic messages, "alive" signals and / or error states and / or operating parameters) in Fig. 1.

[0119] In this situation, the central control unit 110 of the vehicle F can request from the control unit 102 of the electric motor 103 an automatic deceleration of the vehicle F via generator deceleration 30, which is implemented by the electric motor 103 and leads to a charging of the at least one battery 104, in particular a high-voltage battery, preferably a traction battery, and possibly at least one further auxiliary battery.

[0120] The invention provides a method for stopping the vehicle or for keeping the vehicle stationary, in particular after the "regenerative deceleration 30" function has been activated, for example, as a second fallback level in the brake-by-wire system. Within the scope of the invention, a failure in the braking system 100 or in the brake-by-wire system of the vehicle F can be considered to have occurred at least if a critical K secondary fault F2 has been detected in the braking system 100 (see Fig. 3) or if a non-critical U fault (see Fig. 2) has not been remedied.

[0121] The concept of the invention lies in the fact that the electric motor 103 assumes the role of anti-rolling of the vehicle F. For this purpose, the electric motor 103, particularly in the form of a permanent magnet synchronous motor, can be switched into an active short circuit (AKS), known as an AKS. Switching to the active short circuit (AKS) can advantageously occur below a certain speed limit, known as the AKS speed limit. The AKS torque then prevents the vehicle from rolling.

[0122] Active short circuit or AKS means: The stator windings of the synchronous motor are short-circuited at the connecting cables, for example by a switch, such as an electronic switch, for example a field-effect transistor, such as a MOSFET transistor, which can be provided, for example, in the power electronics.

[0123] The AKS torque means: When the vehicle F rolls forward or backward, the movement of the permanent magnet in the rotor of the synchronous motor induces a voltage in the stator windings. A current then flows in the short-circuited stator windings, resulting in an AKS torque that counteracts the direction of rotation of the synchronous motor and thus decelerates the vehicle F.

[0124] The speed limit or the AKS speed limit means: The AKS torque increases steeply with the speed of the electric motor 103, then reaches a maximum, and then decreases steadily. Below the AKS speed limit, the AKS torque is so low that it is no longer sufficient to prevent vehicle F from rolling.

[0125] The advantage here is that if the vehicle F should roll from standstill after the generator deceleration 30, then the maximum speed Vroll of the vehicle F when rolling is limited by the active short circuit AKS to a few km / h, preferably below walking speed, preferably below 1 km / h.

[0126] It is also advantageous that the vehicle F is not actively held at a standstill after the generator-based deceleration to a standstill, i.e., power may be consumed in the process. As an alternative solution A2, the vehicle F is actively held at a standstill after the, in particular generator-based, deceleration to a standstill. This can be achieved, for example, by energizing at least one stator winding and / or by switching the phases of stator windings. In this case, the permanently excited rotor of the electric motor 103 is held in the same position by energizing one phase of the stator, which prevents the vehicle F from rolling. In order to prevent the electric motor 103 from overheating, switching between the phases of the stator can be carried out. This leads to a slight rolling movement of the vehicle F.

[0127] The vehicle F can be kept stationary for a limited time by energizing at least one stator winding and / or by switching the phases.

[0128] With the help of the invention, different scenarios Z (see Fig. 4) can be mastered depending on the topology, such as the gradient of the road.

[0129] When driving on a level road, vehicle F can be operated as follows:

[0130] • The vehicle F is decelerated by generator, if possible to a standstill.

[0131] • The electric motor 103 of vehicle F is then switched to active short-circuit mode (AKS for short), for example, below the AKS speed limit. The AKS torque advantageously prevents the vehicle F from rolling.

[0132] • Furthermore, it can be provided that the anti-roll device is not interrupted when the driver presses the accelerator pedal. However, it is also conceivable that the anti-roll device is interrupted as long as the driver presses the accelerator pedal. Continuing the vehicle's travel by pressing the accelerator pedal would, however, be limited.

[0133] • The steering function L can still be permitted.

[0134] When driving downhill, vehicle F can be operated as follows:

[0135] • The vehicle F is decelerated by generator, if possible to a standstill.

[0136] • The electric motor 103 of vehicle F is then switched to the active short-circuit AKS mode, for example, below the AKS speed limit. The AKS torque advantageously prevents the vehicle F from rolling.

[0137] • The inclination of the road can be estimated, for example, from recuperation moments.

[0138] Advantageously, rolling down a hill is limited to a few km / h by the vehicle's rolling speed Vroll. • Furthermore, it can be provided that the anti-roll protection is not interrupted when the driver presses the accelerator pedal.

[0139] • The steering function L can still be permitted. The driver can advantageously further influence the rolling direction of the vehicle F, for example, to steer the vehicle F against an obstacle (e.g., a curb) if necessary, to bring the vehicle F to a standstill, and to keep it stationary.

[0140] • When the downhill journey is over, vehicle F can be operated again as described above under “Driving on a level road”.

[0141] When driving uphill, vehicle F can be operated as follows:

[0142] • The vehicle F is decelerated by generator, if possible to a standstill.

[0143] • The electric motor 103 of vehicle F is then switched to active short-circuit mode (AKS for short), for example, below the AKS speed limit. The AKS torque advantageously prevents the vehicle F from rolling.

[0144] • The gradient of the road can be estimated, for example, from recuperation moments.

[0145] • When driving uphill, vehicle F rolls backwards slowly, e.g. at a few km / h, due to the anti-roll device.

[0146] • The driver can be allowed to press the accelerator pedal to drive slowly up the slope, for example, at a few km / h. This makes the situation easier for the driver to control.

[0147] • When the downhill drive is completed, the vehicle can be operated as described under “Driving on a level road” or as described under “Driving downhill”, depending on the topography of the road.

[0148] The table in Fig. 4 shows an overview of different scenarios Z.

[0149] After switching the electric motor 103 to the active short circuit AKS, accelerator pedal actuation FP can be deactivated, interrupted, or not permitted (see the situations "driving on a level road" and "downhill driving"). This prevents the driver from deactivating the anti-roll device using the electric motor 103 and accelerating the vehicle F again.

[0150] In unusual situations, such as driving uphill, the active short circuit AKS of the electric motor 103 can be interrupted during accelerator pedal operation, allowing accelerator pedal operation. This can be advantageous to avoid confusing the driver and make the situation easier and more intuitive to manage. As illustrated in Fig. 4, the accelerator pedal operation FP can be disabled or permitted depending on the topology, in particular the gradient, of a roadway on which the vehicle F is brought to a stop.

[0151] As Fig. 4 also illustrates, after switching the electric motor 103 into the active short circuit AKS, a steering function L of the vehicle F can be permitted.

[0152] List of reference symbols

[0153] F vehicle

[0154] F1 first error, first error

[0155] F2 second error, second error

[0156] U uncritical

[0157] K critical

[0158] AKS active short circuit

[0159] A2 alternative solution

[0160] FP accelerator pedal operation

[0161] L Steering function

[0162] 100 Brake system structure

[0163] 101 Control unit

[0164] 102 Control unit

[0165] 103 Electric motor

[0166] 104 Battery

[0167] 110 Control unit

[0168] 10 first braking system

[0169] 20 second braking system

[0170] 30 regenerative deceleration

[0171] E1 first energy supply

[0172] E2 second power supply

[0173] D1 input signal

[0174] D2 input signal D3 input signal

[0175] DE1 input signal

[0176] DE2 input signal

[0177] DE3 input signal

[0178] G Generator mode

[0179] I Charging current

[0180] V speed

[0181] Vroll Roll speed, maximum speed t Time t1 Timer

[0182] V1, T1, S1 limited operating mode

[0183] S1 limited route

[0184] T 1 limited time

[0185] VI limited speed

[0186] W1 first warning

[0187] W2 second warning

[0188] Z Scenario

Claims

Patent claims Method for operating a vehicle when the vehicle is stopped and / or when the vehicle (F) is held in a standstill, wherein the vehicle (F) has an electric motor (103), comprising the method: Deceleration of the vehicle (F), Switching the electric motor (103) into an active short circuit (ACS) to provide roll-away protection for the vehicle (F); wherein, when switching the electric motor (103) into the active short circuit (ACS), the roll speed (Vroll) of the vehicle (F) is limited to a few km / h. A method according to claim 1, wherein regenerative deceleration is performed to decelerate the vehicle (F), which is preferably initiated automatically, particularly if a critical secondary fault in a braking system (100), preferably a brake-by-wire system, of the vehicle (F) has been detected, or if a non-critical primary fault in a braking system (100), preferably a brake-by-wire system, of the vehicle (F) has not been rectified. A method according to claim 1 or 2, wherein the switching of the electric motor (103) into the active short circuit (ACS) is performed after regenerative deceleration (30) of the vehicle (F).A method according to any of the preceding claims, wherein the electric motor (103) is switched to active short circuit (AKS) below a certain speed limit of the electric motor (103), in particular a so-called AKS speed limit, wherein in particular the speed limit of the electric motor (103) for switching to active short circuit (AKS) is determined as a function of a weight, in particular a load weight, of the vehicle (F) and / or a topology, in particular a gradient, of a road surface on which the vehicle (F) is brought to a stop. A method according to any of the preceding claims. wherein, when the electric motor (103) is switched into active short circuit (ACC), stator windings of the electric motor (103) are short-circuited to connecting lines, in particular by a switch, preferably an electronic switch, preferably a field-effect transistor. Method according to one of the preceding claims, wherein, when the electric motor (103) is switched into active short circuit (ACC), the rolling speed (Vroll) of the vehicle (F) is limited to below walking speed, preferably below 1 km / h. Method according to one of the preceding claims, wherein the vehicle (F) is passively stopped and / or held at a standstill by switching the electric motor (103) into active short circuit (ACC), in particular without energizing the stator windings of the electric motor (103).A method according to any one of the preceding claims, wherein, after switching the electric motor (103) into active short circuit (ACS), accelerator pedal actuation (AP) is deactivated, or wherein the active short circuit (ACS) of the electric motor (103) is interrupted during accelerator pedal actuation (AP), wherein, in particular, the accelerator pedal actuation (AP) is deactivated or enabled depending on the topology of a road surface on which the vehicle (F) is brought to a stop. A method according to any one of the preceding claims, wherein, after switching the electric motor (103) into active short circuit (ACS), a steering function (L) of the vehicle is enabled. Using an electric motor (103) of a vehicle (F) in an active short circuit (ACS) to provide roll-away protection for the vehicle (F), wherein the vehicle is operated according to a method according to any one of claims 1 to 9. Method for operating a vehicle when the vehicle is stopped and / or when the vehicle is held in a standstill (F) of the vehicle (F), wherein the vehicle (F) has an electric motor (103), comprising the method: Deceleration of the vehicle (F), Energizing a stator winding of the electric motor (103) under a phase switching of the stator windings of the electric motor (103) to provide a roll-away protection for the vehicle (F). Using an electric motor (103) of a vehicle (F) by energizing a stator winding of the electric motor (103) under a phase switching of the stator windings of the electric motor (103) to provide a roll-away protection for the vehicle (F). Computer program product comprising instructions which, when executed by a computer, cause the computer to perform a method according to any of the preceding claims 1 to 9 or 11. Control unit (110) comprising an arithmetic unit and a storage unit in which a code is stored which, when at least partially executed by the arithmetic unit, performs a method according to any of the preceding claims 1 to 9 or 11.Vehicle (F) comprising a control unit (110) according to the preceding claim.

Images