Method, assistance system and motor vehicle for securing a vehicle in the event that permanent means for securing standstill fail

Abstract

The invention relates to a method (23) for securing a motor vehicle (1) in an automated operating mode in the event that permanent means (5, 9) for securing standstill fail. In said method, the motor vehicle (1) is brought to a standstill or slowed down to a speed range close to standstill by actuating a device (3) for generating a braking effect in order to slow down the motor vehicle (1). Once standstill or the speed range close to standstill has been reached, the braking effect is reduced again. The braking effect is then alternately increased and reduced on a continuing basis, according to a predetermined condition, in a slow manner such that, for example, the driver (2) can thereby be informed of the failed primary means (5, 9) for securing standstill. The invention also relates to an assistance system (12) for automatically carrying out the method (20) and to a correspondingly configured motor vehicle (1).

Description

[0001] 24-1437

[0002] 1

[0003] Method, assistance system and motor vehicle for vehicle safety in case of failure of permanent standstill protection

[0004] The present invention lies in the field of automotive engineering and relates to a method for securing or preventing a motor vehicle from standing still. The invention also relates to an assistance system for a motor vehicle designed to carry out this method and to a motor vehicle equipped with or configured for the method.

[0005] Modern motor vehicles are complex systems with a multitude of components and functions. This complexity also brings with it the risk of errors and failures. Since errors or failures of critical components or functions can have serious consequences, a robust and reliable approach to handling such situations is highly desirable.

[0006] For example, DE 102021 210 445 A1 describes a method for automatically initiating braking of a vehicle in the event of a brake system failure. If a brake system failure is detected based on a voltage value in a power supply falling below a predefined threshold, a chemical release element located in a brake circuit of the brake system is activated. Depending on the activated chemical release element, a volume change of a volume element within the brake circuit is then generated, thereby automatically initiating the vehicle's braking process. In this way, the problem of 24-1437 can be addressed.

[0007] 2. It should be noted that an electrically operated or powered brake can only be used for a limited time to safely hold the vehicle stationary, given the limited energy supply of the respective vehicle. On the other hand, restarting the vehicle can then be very complex and require extensive repairs. Therefore, there is still a need for improvements in this area.

[0008] The object of the present invention is to improve safety in the event of a failure of the permanent standstill protection of a motor vehicle.

[0009] This problem is solved by the subject matter of the main claim and the dependent claims or independent claims. Further possible embodiments of the invention are disclosed in the subclaims, the description, and the figures. Features, advantages, and possible embodiments set forth in the description for one of the subject matter of the independent claims are to be regarded, at least analogously, as features, advantages, and possible embodiments of the respective subject matter of the other independent claims, as well as of any possible combination of the subject matter of the independent claims, optionally in conjunction with one or more of the dependent claims.

[0010] The method according to the invention serves to secure a motor vehicle in an automated, in particular at least or exactly conditionally automated, operating mode when the permanent standstill protection system has failed. Such a permanent standstill protection system can, for example, be or comprise a parking brake, parking lock, transmission parking lock, worm gear, or primary brake module. The permanent standstill protection system can thus be a device or system that serves to keep the motor vehicle permanently stationary when parked, i.e., to secure it against rolling away. For example, the permanent standstill protection system can be supplied by a primary electrical system of the motor vehicle. The primary electrical system can comprise devices, equipment, or components at or within a primary level, or at least supply them with operating energy. The primary electrical system can therefore, in particular, be a primary electrical power supply or...Power supply, including or providing power supply. Accordingly, in the event of a failure of the primary electrical system, equipment, devices or components supplied by it, in particular the permanent standstill protection, can no longer be operated (24-1437).

[0011] 3. A corresponding primary level of devices, equipment, or components supplied by or via the primary electrical system can therefore include, for example, an electrically operated or actuated parking brake and transmission parking lock and / or the primary brake module or an integrated braking system. In a fault-free state, the primary brake module or the integrated braking system can, for example, control the parking brake and / or other actuators to generate a braking effect. Likewise, the primary brake module or the integrated braking system can be configured to amplify brake pressure applied by the driver of the vehicle, for example, by pressing a brake pedal, or to convert the brake pedal actuation into a suitable braking pressure, or include corresponding devices or components. With a failure of the primary brake module or...In the event of a failure of the integrated braking system or a failure of a supplying electrical system, such as the primary electrical system, automatic brake force assistance is no longer active and control of the parking brake is no longer possible. Likewise, various sensors and / or output devices, for example, for issuing visual or audible warnings or a takeover request to the driver or a vehicle occupant, and / or the instrument cluster, and / or an electrically operated primary power steering module, and / or similar components, may be located or operated in or on this primary level.

[0012] The method according to the invention can be used in particular when the motor vehicle is in an automated operating mode and the permanent standstill protection fails, for example due to a fault or damage to a corresponding component itself and / or an energy or...

[0013] Power supply or the like. It may be stipulated that the procedure is applied at least or only when the driver's level of attention regarding vehicle operation is unknown or when a predetermined criterion for minimum attention is not met, i.e., when the driver is distracted from driving.

[0014] According to the method according to the invention, the motor vehicle is then brought to a standstill or slowed down to a predetermined or predefined near-standstill speed range by automatically controlling or actuating a device for generating a braking effect or applying a braking force. Such a device can be 24-1437

[0015] 4 in particular a service brake of the motor vehicle or a device for controlling the service brake.

[0016] For example, if the primary brake module fails, the system or service brake can be replaced by a redundant or secondary brake module.

[0017] The brake control unit is activated to bring the vehicle to a stop or to decelerate it to near standstill. If the vehicle's electrical system is still functional, it can also supply power to the redundant brake module. Similarly, the redundant brake module—unlike the primary brake module or primary brake control unit—can be supplied with electrical current, voltage, or operating energy via a secondary electrical system. This secondary electrical system can be an independent or redundant power supply network for the vehicle, or it can include such a network. Various devices, equipment, or components of the vehicle can be powered via the secondary electrical system, serving as a fallback in case of a failure.However, other devices, equipment, or components can also be powered solely or partially by the secondary electrical system, such as one or more sensors, for example, environmental sensors and / or at least one wheel speed sensor or accelerometer, or similar devices. The environmental sensors can include, for example, lidar, radar, ultrasound, a camera, and / or other similar devices. The redundant brake module can, in particular, be a module or system that serves as a fallback for the braking function in at least conditionally automated operation of the vehicle, since in such operation the driver must not be the sole fallback in the event of a malfunction and is not responsible for the vehicle or its operation.At least conditionally automated operation can correspond to operation of the motor vehicle according to SAE J3016 Level 3 or higher. Other combinations are also possible. For example, if the primary standstill protection fails due to a failure of the primary electrical system, which in normal, fault-free operation supplies the primary brake module, the primary brake module may continue to use the primary brake module, but then be supplied via the secondary electrical system. 24-1437.

[0018] 5

[0019] However, if, for example, only the permanent standstill protection system fails (i.e., only the parking brake) but not the entire primary electrical system, and the primary brake module is still capable of activating the service brake, the vehicle can be brought to a standstill or to a near-standstill speed using the primary brake module. Depending on the situation, i.e., depending on which systems or functions of the vehicle have failed and which have remained functional, one or more other systems of the vehicle can be activated additionally or alternatively to bring the vehicle to a standstill or to a near-standstill speed.

[0020] The near-standstill speed range can, for example, include speeds between 0 km / h and a maximum of 5 km / h, or a maximum of 4 km / h, or a maximum of 3 km / h, or a maximum of 2 km / h.

[0021] In a further step of the inventive method, the braking effect is reduced again—partially or completely, i.e., completely or partially, down to zero—particularly immediately or directly after the initial achievement of standstill or near-standstill speed, or if the vehicle is already at standstill or near standstill speed when the permanent standstill protection fails or when the failure is detected. This can be achieved, for example, by completely or partially releasing the service brake or by initiating a corresponding control of the service brake. According to the inventive method, the braking effect is then subsequently increased and decreased continuously and alternately, i.e., completely or partially, as an indication of the failed primary standstill protection.This can, for example, alert the driver or a passenger of the vehicle, or a person outside the vehicle, to the failure of the vehicle's primary immobilizer. Hereinafter, the person in question can be referred to as the driver without restriction to the general public, in particular regardless of whether they are, for example, temporarily or partially inside or outside the vehicle. To be effective as a warning, the alternating increase and decrease of the braking force can, for example, be sufficiently slow, in particular slower, i.e., with a lower frequency and / or with larger amplitudes of, for example, the braking force and / or the vehicle's speed, than 24-1437.

[0022] 6 in a conventional speed control for error-free normal operation, such as that which can be used by an adaptive cruise control system.

[0023] The alternating increase and decrease of the braking effect can occur according to at least one predefined condition. For example, the braking effect can be increased or decreased, or the system can switch between a state or operation with higher braking effect and a state or operation with reduced braking effect, when a predefined state of motion of the vehicle or a predefined change in the state of motion of the vehicle is reached, and / or a predefined period of time has elapsed, and / or the vehicle has traveled a predefined distance or rolled a certain distance with reduced braking effect, and / or similar conditions. These possible conditions are explained in more detail elsewhere.

[0024] The service brake can therefore be continuously activated and fully or partially released, or modulated accordingly – in particular, repeatedly or until a predetermined or predefined termination condition is reached. In other words, the service brake can remain fully or partially released for a certain period of time or until a predetermined condition or criterion is met, and then be fully or partially activated or remain activated for a certain period of time or until a predetermined condition or criterion is met, and this can be repeated multiple times in alternating sequences.

[0025] The continuous, alternating increase and decrease of braking force can occur in a fixed, predetermined interval pattern or a dynamic, situation-dependent pattern. The interval length or cycle time between increasing and decreasing the braking force can be so long that the corresponding change is perceptible to the driver or vehicle occupants. Thus, the change between increased and reduced braking force can be significantly slower, particularly by one or more orders of magnitude, than, for example, in the flawless operation of an automatic cruise control system. The interval length or cycle time of the change between increasing and decreasing the braking force is determined by the 24-1437

[0026] 7

[0027] The braking effect can therefore last at least one second, and in particular several seconds.

[0028] In a fixed interval pattern, the braking effect can, for example, be alternately reduced or maintained for a fixed initial period, then increased or maintained for a fixed second period, and this cycle repeated multiple times. The initial and second periods can be the same or different. It can also be stipulated that, after each phase of reduced braking, the braking effect is increased or maintained until the vehicle has come to a complete stop or slowed down to a near-standstill speed. For instance, the braking effect can be increased—that is, the brakes can be reactivated or applied more forcefully—if the vehicle has been rolling for a predetermined period.

[0029] In a dynamic or situation-dependent interval pattern, the length of the phases or intervals with reduced and increased braking effect can vary from situation to situation and / or fluctuate or change over time during the continuous alternating increase and decrease of the braking effect. The increase and / or decrease can occur automatically or be triggered based on current sensor data or measurements and / or when at least one predefined condition or criterion is met. For example, the increase and / or decrease can be triggered by a rolling motion and / or by the specific environment, as explained in more detail elsewhere.

[0030] The continuous, alternating increase and / or decrease of the braking effect can be carried out, for example, until a predefined termination condition is met. This can occur, for instance, when a driver action, i.e., a corresponding interaction between the driver and the vehicle, is detected, or when increasing the braking effect is no longer possible, or when a predefined number of intervals or cycles of increasing and decreasing the braking effect have been reached or completed, or when the vehicle comes to a continuous standstill with the braking effect completely reduced, i.e., canceled, particularly in the case of fully 24-1437

[0031] 8. The service brake has been released or opened, or similar conditions have been reached. It can be inferred from a corresponding operating action or interaction by the driver, or a corresponding operating action or interaction can be used as an indication that the driver of the motor vehicle has assumed or is prepared to assume control of the vehicle. Accordingly, the responsibility for driving the vehicle and / or securing the vehicle can then be transferred to the driver. Increasing the braking effect may be impossible, for example, if the device for generating the braking effect and / or its control, such as the primary brake module or the redundant brake module, can no longer be supplied with current, voltage, or power, for example, if the vehicle's battery is discharged.

[0032] The present invention is based on the realization that a permanent standstill protection, in particular a permanent safe holding of the motor vehicle at a standstill by means of a hydraulic service brake, for which, for example, brake pressure is or must be built up by means of an electric pump and / or in which an energization of a valve is necessary to maintain the brake pressure, is not possible, since the available operating energy will necessarily be exhausted at some point.

[0033] In previous approaches, the brake could remain permanently active or engaged after the vehicle has initially come to a standstill in the described fault scenario. However, compared to the proposed method, this would result in higher energy consumption and thus reduce the time for which the vehicle can be automatically secured. Furthermore, a permanently increased braking effect, particularly one sufficient to hold the vehicle, or a corresponding activation or actuation of the service brake—i.e., a correspondingly continuous energization of, for example, an electric motor and / or at least a valve to build up or maintain the necessary hydraulic brake pressure—can lead to overheating and ultimately to damage or failure.Alternatively, another conventional approach could involve automatically and permanently releasing the brakes after a certain time following the initial achievement of a standstill, based on the assumption that the driver has then taken over vehicle control. This approach can be based on the fact that, according to the specifications for the conditionally automated operation of a motor vehicle, the driver 24-1437.

[0034] 9. In the event of a fault, the vehicle must take over control within a specified time period, for example, 30 seconds. However, especially with a failed primary electrical system, it is typically impossible to verify whether or when the driver actually did so, as the corresponding sensors are no longer powered. Therefore, with a failed primary electrical system, such a takeover, or the failure thereof, cannot typically be detected in the same way as it would be during normal, fault-free operation.

[0035] This can lead to a dilemma: on the one hand, if the service brake is released immediately upon coming to a standstill, the driver may not yet be ready to take over, and the vehicle could roll away uncontrollably and cause an accident. On the other hand, if the service brake remains active for a certain period or until failure, there is a risk that the driver will mistakenly assume the vehicle is permanently locked. In this case, there is a risk that the driver will leave the vehicle, which will then roll away again later and cause an accident.

[0036] The present invention can at least partially solve or mitigate this dilemma without necessarily causing damage to the motor vehicle or rendering the motor vehicle unusable and requiring a visit to a workshop, as is or may be the case with the use of the chemical triggering element described above.

[0037] The alternating increase and decrease of the braking effect provided for in the invention reduces energy consumption and thus places less strain on the vehicle's electrical system, enabling a longer operating period than, for example, with continuous activation or deactivation of the service brake. Furthermore, this protects the components involved, such as electric motors and / or valves, from overheating. In addition, the fact that the vehicle can roll forward during phases with reduced braking effect, i.e., with the service brake fully or partially released, provides the driver with a simple and effective indication that the vehicle does not have an automatic permanent standstill protection system. On the other hand, the repeated increase of the braking effect can also...

[0038] 10

[0039] Braking effect, i.e., the repeated activation or closing of the service brake, prevents the vehicle from reaching a speed high enough to pose a serious hazard. Overall, the present invention thus achieves a particularly high level of safety in the event of a failure of the permanent standstill protection system without additional components or costs.

[0040] In one possible embodiment of the present invention, the braking effect is increased again only after a predetermined minimum time interval has elapsed since the last reduction of the braking effect, and / or the braking effect is reduced again only after a predetermined second minimum time interval has elapsed since the last increase of the braking effect. Such sufficiently long minimum time intervals allow the intermittent changes in the braking effect to be perceived particularly easily by the driver and thus serve as a particularly effective indicator of a failed primary standstill protection system. The first and second minimum time intervals can be of equal or different lengths.

[0041] In a possible further development of the present invention, the first minimum time interval and the second minimum time interval each last at least one second. In other words, during the alternating increase and decrease of the braking effect, the phases with increased braking effect and the phases with reduced braking effect can each last at least one second. This allows the change in braking effect to be reliably perceptible to the driver or other persons and distinguishable from a conventional speed control system, such as that used in normal, error-free operation.

[0042] In one possible embodiment of the present invention, the braking effect is continuously and alternately increased and decreased until an action by the driver of the motor vehicle or an interaction between the driver and the motor vehicle is detected. In other words, the braking effect can be alternately increased and decreased until the driver has taken control of the motor vehicle. From this point on, the driver is then responsible for securing the motor vehicle and ensuring it is stationary. Accordingly, the automatic control or actuation of the brake can then be discontinued. This saves energy and avoids further stress on the components involved. 24-1437

[0043] 11. Furthermore, this prevents the automatic control system from acting against the driver's wishes.

[0044] In a possible further development of the present invention, it is provided that the operating action must involve or include the manual actuation of a brake pedal of the motor vehicle. In other words, it can be provided that the alternating increase and decrease of the braking effect can only be terminated by the driver by actuating the brake pedal, or that the driver's assumption of control or guidance of the motor vehicle is only recognized by means of brake pedal actuation. Such brake pedal actuation can be detected by means of a suitable sensor, for example, by means of a pressure sensor or by means of a brake pedal travel sensor. Such a pressure sensor can, for example, be part of the redundant brake module mentioned elsewhere. The sensor can, for example, be supplied via the secondary vehicle electrical system mentioned elsewhere.This allows brake pedal actuation to be detected even in the event of a failure of the primary electrical system mentioned elsewhere. A corresponding pressure sensor can, for example, be arranged in a brake line, particularly in or near the redundant brake module. According to the further development of the present invention proposed here, it is not only possible to detect a takeover of control or guidance of the vehicle in general. Rather, the takeover can be detected based on an action by the driver that directly serves to keep the vehicle stationary. If the actuation of the brake pedal is detected by the pressure sensor, it can also be ensured that brake pressure is actually built up and thus the vehicle can be braked or held stationary. This allows the automatic control, i.e., the automated operating mode of the vehicle, to be terminated particularly safely.

[0045] Additionally or alternatively, another operating action by the driver could be detected and / or the driver's assumption of control of the vehicle could be detected in another way, for example by means of a movement or operation of a steering wheel, i.e. a steering movement or the like.

[0046] In a further possible embodiment of the present invention, automatic motion monitoring, i.e., monitoring for movement of the motor vehicle, for example relative to the environment or in a predetermined, fixed coordinate system, is also automatically activated. This motion monitoring can, in particular, be roll monitoring. The motion monitoring can be activated, in particular, at the latest when the brake is first released after the vehicle has come to a standstill or a near-standstill speed range following the failure of the permanent standstill protection system. Likewise, the motion monitoring can be activated at a different or later time, for example, only, and in particular immediately, after the vehicle has come to a standstill or a near-standstill speed range. This may save energy compared to earlier activation.Motion monitoring allows the vehicle's movement, particularly its rolling, to be detected and monitored. The continuous, alternating increase and decrease of the braking force is then controlled based on the results or signals from the motion monitoring system, such as those from a corresponding roll monitoring sensor, appropriately configured environmental sensors, and / or a satellite-based positioning system. In other words, the timing or intervals for the continuous, alternating increase and decrease of the braking force can be determined based on the results or signals from the motion monitoring system. For example, the relevant system, particularly the service brake, can be activated or reactivated to increase the braking force whenever movement or...The system detects the rolling of the vehicle and / or depends on at least one predefined motion or roll parameter that characterizes the movement of the vehicle or the rolling motion of at least one wheel of the vehicle. Therefore, at least one corresponding criterion or condition can be specified, which can be continuously or regularly checked, for example, using signals from a corresponding roll, motion, or acceleration sensor and / or environmental sensors, such as lidar sensors or devices, radar systems, ultrasonic devices, or cameras.The embodiment of the present invention proposed here is based on the understanding that uncontrolled movement of a motor vehicle, for example by rolling away, can in principle pose a significant safety risk to the motor vehicle, its occupants, and / or the surroundings. By responding to this by increasing the braking effect or reactivating the service brake, safety can thus be improved (24-1437).

[0047] 13 or a potential hazard is limited. On the other hand, if the vehicle does not move or roll even with reduced braking effect or with the service brake released or open, there is not necessarily a need to adjust the braking effect, i.e., to activate or close, or at least not to permanently activate or close, the service brake. Therefore, in such a case, the braking effect can be deactivated, i.e., the service brake can be permanently released or open, or remain open, or at least for longer time intervals or cycles. This saves energy, thus enabling longer vehicle safety and also preventing stress or damage to components.

[0048] In a possible embodiment of the present invention, the braking effect is always increased precisely or at the latest when, according to the motion monitoring system or its signals or results, the vehicle has traveled or rolled a predetermined first distance. This means, for example, the service brake is reactivated, further closed, or more strongly applied. Additionally or alternatively, it is provided that the braking effect is always reduced precisely or at the latest when, after the vehicle has traveled or rolled a predetermined second distance. For example, the predetermined first distance and / or the predetermined second distance can be approximately 5 cm, 10 cm, 15 cm, 20 cm, or 25 cm. Other values ​​are also possible. The first and second distances can be the same length or different lengths.That the vehicle has covered the predetermined distance can be detected, for example, by means of a wheel speed or wheel rotation sensor, particularly taking into account a specification regarding wheel or tire size, and / or by means of one or more of the environmental sensors mentioned elsewhere, which can be supplied, for example, via the secondary vehicle electrical system mentioned elsewhere. Data or signals from the satellite-based positioning system can also be evaluated for this purpose. By appropriately dimensioning the predetermined distance(s), even if the vehicle starts moving or rolling, the driver or other persons can still manually secure the vehicle, with only a negligible risk of significant danger or damage. Because a certain amount of movement or...Allowing a certain amount of rolling of the vehicle, the vehicle can, for example, approach a potential obstacle in the vicinity slowly and carefully. This also allows the driver and / or other persons to be alerted in a simple and effective way to the need for manual intervention to secure the vehicle. By specifying the second path, i.e., limiting the movement or the distance traveled under increased braking, it can be ensured that even if the vehicle does not come to a complete stop, an intermittent movement or an intermittently changing speed profile of the vehicle is achieved.

[0049] In a possible further development of the present invention, the braking effect is increased precisely or at the latest when, for example, the service brake is always reactivated or further closed or more strongly actuated, when, according to the motion monitoring or according to its signals or results, the motor vehicle has reached a predetermined first speed and / or a predetermined first change in speed and / or a predetermined first wheel speed and / or a predetermined first change in wheel speed.Additionally or alternatively, it is provided here that the braking effect is reduced precisely or at the latest when the motor vehicle reaches a predetermined second speed, in particular a lower speed than the first, and / or a predetermined second change in speed, and / or a predetermined second wheel speed, in particular a lower wheel speed than the first, and / or a predetermined second change in wheel speed. The respective change in speed or wheel speed can be based on the speed or wheel speed since the beginning of the respective reduction or increase of the braking effect. The further development of the present invention proposed here is based on the understanding that a danger can arise, in particular, from uncontrolled high speeds of the motor vehicle.Very low speeds, on the other hand, typically pose only a very small risk. Therefore, the permitted movement or rolling of the vehicle up to a certain speed and / or wheel speed can minimize the risk. At the same time, the time for which the described continuous, alternating increase and decrease of the braking effect, or the corresponding activation and release of the service brake, can be carried out automatically can be effectively and situationally extended, thus preventing component overload. By appropriately dimensioning the specified initial speed or wheel speed, even if the vehicle starts moving or rolling, the driver or other persons can still manually secure the vehicle. The specified initial speed or wheel speedThe speed change can be, for example, 1 km / h, 2 km / h, 3 km / h, 4 km / h, or 5 km / h. Other values ​​are also possible. The wheel speed or wheel speed change can be predefined to correspond to these speed values. By reducing the braking effect no later than when the second speed or wheel speed is reached, or when the corresponding changes occur, it can be ensured that the increased braking effect is not excessive or unnecessarily long. This can save energy, reduce component stress, and provide an effective warning effect through the alternating increase and decrease of the braking effect.

[0050] In a further possible embodiment of the present invention, the braking effect is always increased precisely, or at the latest when, a predetermined first maximum time interval has elapsed since the last reduction of the braking effect, and / or the braking effect is always reduced precisely, or at the latest when, a predetermined second maximum time interval has elapsed since the last increase of the braking effect. The first maximum time interval and the second maximum time interval can be of the same or different lengths. Such control of the alternating increase and decrease of the braking effect can be implemented particularly easily and with minimal effort and does not necessarily depend on other sensors or their functioning.Similarly, the time-based control of increasing and reducing the braking effect proposed here can represent a safeguard or fallback level, for example if a more complex control system or one that relies on sensors is also used or planned.

[0051] If several conditions or criteria are specified simultaneously, for example for the automatic increase and / or the automatic reduction of the braking effect, this can be carried out, for example, if exactly one or more or all of the specified conditions or criteria are met. 24-1437

[0052] 16

[0053] In a further possible embodiment of the present invention, the continuous alternating increase and / or decrease of the braking effect is controlled depending on a local gradient – ​​positive or negative – of a surface on which the vehicle is located, and / or depending on an acceleration of, for example, the vehicle or at least one wheel of the vehicle. This can be measured or detected, for example, by means of a rotation or wheel position sensor and / or by means of a position or acceleration sensor. Such a sensor can, for example, be part of the redundant brake module mentioned elsewhere and / or be supplied via the secondary electrical system mentioned elsewhere. Likewise, to determine the local gradient of the surface, i.e., the position or orientation of the vehicle relative to a local gravity vector, and / or to monitor the acceleration, a [missing information] can be used.The environmental sensors mentioned elsewhere are used. If available, the local gradient of the ground can also be determined using map data. In the embodiment of the present invention proposed here, the control can be implemented, or the dependency can be configured, such that a greater gradient in magnitude, as well as a greater acceleration, especially regardless of direction, leads to shorter durations or interval lengths or phases of reduced braking effect. For example, if the vehicle has come to a standstill on an incline, i.e., on a slope, or has reached the near-standstill speed range, the braking effect can be reduced or remain reduced for a shorter time than if the vehicle has come to a standstill or reached the near-standstill speed range on level or less steep, i.e., less inclined, ground.By using the gradient and / or acceleration as a criterion for increasing and / or reducing the braking effect, as proposed here, a high level of safety can be achieved, while at the same time maximizing the possible duration for which the alternating increase and reduction of the braking effect, i.e., the corresponding securing of the vehicle, can be maintained or carried out, adapted to the situation.

[0054] In another possible embodiment of the present invention, the continuous alternating increase and decrease of the braking effect is controlled by environmental sensors of the motor vehicle. These environmental sensors can be 24-1437

[0055] 17. For example, a lidar device and / or radar device and / or an ultrasound device and / or a camera. Such environmental sensors can detect and, in particular, quantify the movement of the motor vehicle relative to its surroundings by directly observing them. Accordingly, such environmental sensors or a control unit for these sensors can then dynamically or situationally adapt to the situation, i.e., in particular depending on the detected movement of the motor vehicle, control the increase and / or reduction of the braking effect or request it from a corresponding control unit, for example, the redundant brake module mentioned elsewhere. Since the environmental sensors typically already include all the necessary components, the method according to the invention can be implemented and used particularly easily and cost-effectively.The environmental sensors can, for example, be supplied with electrical current, voltage, or power via the secondary electrical system mentioned elsewhere. In this case, the embodiment of the invention proposed here can also be used in the event of a failure of the primary electrical system mentioned elsewhere.

[0056] The present invention also relates to a safety or assistance system for a motor vehicle. The safety or assistance system according to the invention comprises at least one control unit, i.e., control logic or control electronics for controlling a device for generating a braking effect to slow down the respective motor vehicle equipped with the safety or assistance system, i.e., for example, a brake module and / or a service brake of the respective motor vehicle. The control unit can therefore be part of the primary brake module or the redundant brake module mentioned in connection with the method according to the invention, or separate from it, for example, as part of the environmental sensors mentioned in connection with the method according to the invention, or the like. The safety or assistance system according to the invention is configured to execute the method according to the invention, in particular automatically. For this purpose, the assistance system can...whose control unit, for example, includes a process unit, such as a microprocessor, microchip, microcontroller, or the like, and a computer-readable data storage device coupled to it. This data storage device can then contain, for example, a corresponding operating or computer program that performs the functions associated with the 24-1437.

[0057] The process steps, measures, or operations described in the invention, or corresponding control instructions, are coded or implemented in the 18 process steps, measures, or operations described in the invention. This operating or computer program can then be executed by means of the process equipment to carry out the corresponding process or to effect its execution. If the assistance system is configured for direct control of the service brake, the control unit can, for example, be part of the primary brake module or part of the redundant brake module. If the assistance system is configured for indirect control of the service brake, in particular via corresponding control of the primary brake module or the redundant brake module, the control unit of the assistance system can be separate from the corresponding brake module. Depending on the configuration, the assistance system can therefore, for example, include the primary brake module and / or the redundant brake module or be configured for coupling with it.

[0058] The present invention also relates to a motor vehicle that can be operated or driven in an automated, in particular at least conditionally automated, operating mode and in a manual operating mode. Furthermore, the motor vehicle according to the invention has a permanent standstill protection system. The motor vehicle according to the invention is equipped for the execution, in particular automatically, of the method according to the invention and / or is equipped with the assistance system according to the invention. The motor vehicle according to the invention can therefore be, in particular, the motor vehicle mentioned in connection with the method according to the invention and / or in connection with the assistance system according to the invention, or correspond to it. Accordingly, the motor vehicle according to the invention can also have some or all of the properties or features mentioned in these contexts, such as the sensors mentioned and / or the environmental sensors and / or the like.

[0059] Further features of the invention may become apparent from the claims, the figures, and the description of the figures. The features and combinations of features mentioned above in the description, as well as the features and combinations of features shown below in the description of the figures and / or in the figures alone, may be used not only in the combinations specified, but also in other combinations or individually, without departing from the scope of the invention. 24-1437

[0060] 19

[0061] The drawing shows in:

[0062] Fig. 1 shows a schematic representation of a motor vehicle equipped for the longest possible standstill protection in the event of a failure of a permanent standstill protection system; and

[0063] Fig. 2 shows an exemplary schematic flow chart for a corresponding control procedure for securing the motor vehicle.

[0064] As conditionally automated driving develops, the question arises as to how a vehicle should behave appropriately when components or functions fail. This example considers the failure of a primary level of the vehicle, which would render classic stationary safety devices, such as a parking brake and a transmission parking lock, unavailable and therefore unusable.

[0065] Figure 1 shows a schematic representation of a motor vehicle 1. The motor vehicle 1 can be configured for conditionally automated operation, but manual operation, i.e., vehicle control or driving by a driver 2, remains possible. For example, a brake 3, which may be a hydraulic service brake, can be actuated automatically by a longitudinal control system of the motor vehicle 1 and manually by the driver 2 by pressing a brake pedal 4. The motor vehicle 1 shown here has, by way of example, a multitude of components, each of which is assigned to a primary electrical system 5 or a secondary electrical system 6 of the motor vehicle 1 according to its power supply.

[0066] The primary electrical system 5 includes, by way of example, a primary battery 7, a servo or primary steering module 8, a primary brake module 9, and, if applicable, other vehicle components 10, of which only a few are schematically indicated here. The primary battery 7 can be a traction battery. The primary steering module 8 can also be referred to as an EPS module (EPS: Electronic Power Steering). The primary brake module 9 can also be referred to as an integrated braking system (IB) or be part of such an integrated braking system. The other vehicle components 10 can, for example, be various sensors, such as 24-1437.

[0067] 20. This includes or encompasses interior or occupant monitoring equipment, a combination instrument, output or warning devices and / or the like.

[0068] The secondary electrical system 6 may include, for example, a secondary battery 11 and environmental sensors, which are exemplified here as a lidar unit 12. This lidar unit 12 comprises a lidar optics module 13, which is or includes an actual laser-based distance measuring unit, and lidar electronics or a lidar control unit 14, which is schematically represented here by a lidar processor 15 and a computer-readable lidar data storage device 16 coupled to it. Furthermore, the secondary electrical system 6 may include, or be comprised of, a secondary steering module 17, a secondary brake module 18, at least one pressure sensor 21 for monitoring pressure in a brake line, and several wheel sensors 22. The secondary steering module 17 can also be referred to as FOP-EPS (FailOP-EPS) and thus serves as a fallback for the steering functions in the event of a failure of the primary electrical system 5 or the primary steering module 8.The secondary brake module 18, shown schematically here as an example, comprises a brake module processor 19 and a computer-readable brake module data memory 20 coupled to it. The secondary brake module 18 can serve as a fallback in the event of a failure of the primary electrical system 5 or the primary brake module 9. Thus, even if the primary brake module 9 fails, and especially if the primary electrical system 5 fails, brake pressure can still be generated via the secondary brake module 18, thereby applying the brake 3 and bringing the vehicle 1 to a standstill or into a safe state. The pressure sensor 21 can be part of the secondary brake module 18 or connected to it.

[0069] The schematic connection lines between the various components can, for example, represent electrical connections or power supply lines and / or data or signal connections and / or brake lines, or these different types of connections or lines can be represented in the same way. For example, depending on the configuration, the primary electrical system 5 and the secondary electrical system 6, or the devices or components associated with them, can be completely separate from each other, or connected only by one or more data connections, or additionally or alternatively connected by one or more electrical connections. Likewise, deviating from 24-1437

[0070] 21

[0071] The representation in Fig. 1 may show that further and / or other connections are possible and / or that one or more of the connections shown may be optional or can be omitted.

[0072] Within the secondary electrical system 6, for example, the lidar device 12 or its lidar control unit 14 can detect movement of the vehicle 1 relative to its surroundings and request a specific deceleration from the secondary brake module 18. The secondary brake module 18 can then implement this requested deceleration by applying the brake 3. The wheel sensors 22 can, for example, directly or indirectly, particularly via the secondary brake module 18, transmit a detected movement, such as the rotational speed of the wheels of the vehicle 1 or a derived or calculated speed of the vehicle 1, to the lidar device 12 or its lidar control unit 14. Likewise, the lidar control unit 14 can be configured to determine the speed of the vehicle 1 based on sensor data from the wheel sensors 22.

[0073] To illustrate the functionality of the described components for securing the vehicle 1 in the event of a failure of a permanent standstill protection system, which here is exemplified by a failure of the primary electrical system 5, Fig. 2 shows an exemplary schematic flowchart 23 for a corresponding procedure. The procedure can be started in a process step S1. Here, for example, the vehicle 1 can be put into operation or placed in a conditionally automated operating mode. In a process step S2, fault monitoring can then be started and continuously performed. Here, the primary electrical system 5 can be monitored for faults or failures in particular.

[0074] If a fault, in this case specifically a failure of the primary electrical system 5, is detected, a continuous check can be initiated and carried out in process step S3a to determine whether a predefined termination condition for the process is met. Such a termination condition could be, for example, that an operator action by the driver 2 has been detected, such as the actuation of the brake pedal 4 or a corresponding build-up of brake pressure, and the driver 2 has thus taken over control of the vehicle 1, or that the secondary battery 11 is discharged, or that a predefined number of iterations of a subsequently described part of the process have been reached, or similar. If the termination condition is met, the process can be stopped in process step S4. This could, for example, mean that automatic control or automatic operation of the brake 3 is discontinued.

[0075] The ongoing verification of the termination condition according to procedure step S3a can be carried out in parallel with the further procedure steps of the process described below.

[0076] In the event of a detected fault or failure of the primary electrical system 5, the vehicle 1 can be automatically stopped in a process step S3b. Here, for example, the lidar device 12, which continues to be supplied via the secondary electrical system 6 or the secondary battery 11, can detect movement of the vehicle 1 and accordingly control the secondary brake module 18 to request a certain deceleration. The secondary brake module 18 can then control or actuate the brake 3.

[0077] In process step S5, it can be continuously checked whether standstill or a near-standstill speed range has been reached. As soon as this is the case, continuous roll monitoring can be started – provided it has not already been done or is not yet active. This monitoring can be carried out, for example, using the wheel sensors 22 that are still available or usable (i.e., supplied via the secondary electrical system 6) and / or by means of the lidar system 12, to determine whether and, if so, how – for example, with what acceleration and / or speed – the vehicle 1 is moving relative to its surroundings. Additionally or alternatively, the lidar system 12 can perform this roll monitoring by detecting the vehicle's surroundings and processing (i.e., evaluating) the corresponding lidar data in a known manner.

[0078] Subsequently, in process step S7, a continuous, alternating increase and decrease of the braking effect generated by the brake 3, i.e., a correspondingly modulated automatic actuation of the brake 3, can be initiated or carried out. In this process, the control of the respective deceleration to be applied by the brake 3, or of the secondary brake module 18 for implementing the respective deceleration, can be calculated by the lidar device 12 or the lidar control unit 14 and transmitted to the secondary brake module 18. Thus, a suitable control signal can be applied in the lidar device 12 or the lidar control unit 14. 24-1437

[0079] 23, which, for example, allows the motor vehicle 1 to roll slowly enough and only for so long that no or no significant danger or hazard is created and at the same time the driver 2 is made aware or can be made aware that no permanent automatic standstill protection is present or has been set or can be set.

[0080] This process step S7 can, in detail, comprise a repeatedly executed sequence of several process steps S7a to S7d. In process step S7a, after standstill or near-standstill speed has already been reached, the brake 3 can be fully or partially released or opened. In process step S7b, it can then be checked whether a predefined braking condition, i.e., a predefined condition for reactivating or applying more force to, or closing, the brake 3, is met. As long as this braking condition is not met, the brake 3 can remain released, so that no or only a reduced braking effect is applied or generated. If it is determined in process step S7b that the braking condition is met, the brake 3 can be reactivated or applied more forcefully in process step S7c.The brakes are closed, thus generating increased braking force to slow down the vehicle 1, in particular to bring it back to a standstill or to a near-standstill speed. In process step S7d, it can then be checked whether a predefined solution condition, i.e., a predefined condition for releasing or opening the brake 3 again and thus reducing the braking force, is met. As long as this solution condition is not met, the brake 3 can remain activated, i.e., the increased braking force can be maintained. If it is determined in process step S7d that the solution condition is met, the process can jump back to process step S7a, i.e., the brake 3 can be released again completely or partially, i.e., the braking force can be reduced. In this way, process steps S7a to S7d can be repeated several times – at least as long as the termination condition is not met.

[0081] The basic principle proposed here is a kind of stutter brake. After initially reaching a standstill or a near-standstill speed, the brake 3 is immediately released, but the roll monitoring is activated. As soon as the vehicle 1 starts rolling again, and as long as the driver 2 has not yet safely taken over control or guidance of the vehicle 1 (which can be detected, for example, by pressure sensor 21 indicating actuation of the brake pedal 4), the brakes are applied alternately, and the vehicle 1 is allowed to roll again. Thus, on the one hand, due to the low speed of the vehicle 1 – in particular, at most 10 km / h, 5 km / h, 3 km / h, or 2 km / h – there is no significant risk of an accident, while on the other hand, the driver 2 is aware that the vehicle 1 requires interaction, i.e., manual intervention.If necessary, when the vehicle 1 starts rolling again, the driver 2 may reflexively or provoke the application of the brake pedal 4, particularly while, for example, the instrument cluster or other systems of the vehicle 1 are recognizably deactivated. After the driver 2 has first applied the brake pedal, they are responsible for keeping the vehicle 1 stationary, and therefore the described control system, i.e., the stutter braking function, can be deactivated from this point onward.

[0082] The parameterization of the interval lengths or phases of braking and rolling, or of increasing and reducing the braking effect, can be implemented arbitrarily, i.e., variably according to needs or requirements, based on one or more criteria or parameters, for example, depending on a speed or wheel speed reached and / or depending on a distance rolled or a wheel angle turned and / or depending on a gradient of a surface or wheel or vehicle acceleration and / or depending on an elapsed time in the respective phase.

[0083] Overall, the examples described demonstrate how maximizing vehicle safety can be achieved when the permanent standstill protection fails, particularly when the primary electrical system fails, including the takeover request, during conditionally automated driving. 4-1437

[0084] 25

[0085] Reference symbol list

[0086] 1 motor vehicle

[0087] 2 drivers

[0088] 3 Brake

[0089] 4 Brake pedal

[0090] 5 Primary electrical system

[0091] 6 Secondary electrical system

[0092] 7 Primary battery

[0093] 8 Primary steering module

[0094] 9 Primary brake module

[0095] 10 vehicle equipment

[0096] 11 Secondary battery

[0097] 12 Lidar system

[0098] 13 Lidar optics module

[0099] 14 Lidar control unit

[0100] 15 LiDAR processor

[0101] 16 Lidar data storage

[0102] 17 Secondary steering module

[0103] 18 Secondary brake module

[0104] 19 Brake module processor

[0105] 20 Brake module data storage

[0106] 21 Pressure sensor

[0107] 22 wheel sensors

[0108] 23 Schedule

[0109] S1 - S7d process steps

Claims

24-1437 26 Patent claims 1. Method (23) for securing a motor vehicle (1) in an automated operating mode when the primary standstill protection (5, 9) has failed, wherein automatically - the motor vehicle (1) is brought to a standstill or slowed down to a near-standstill speed range by controlling a device (3) to generate a braking effect to decelerate the motor vehicle (1), - after reaching a standstill or a near-standstill speed range, the braking effect is reduced again, and then - the braking effect is continuously and alternately increased and decreased according to a given condition as an indication of the failed primary standstill protection (5, 9).

2. Method according to claim 1, characterized in that the braking effect is increased again at the earliest when a predetermined first minimum time period has elapsed since the last reduction of the braking effect, and / or the braking effect is reduced again at the earliest when a predetermined second minimum time period has elapsed since the last increase of the braking effect.

3. Method according to claim 2, characterized in that the first minimum time interval and the second minimum time interval each amount to at least one second.

4. Method (23) according to one of the preceding claims, characterized in that the primary standstill protection comprises a primary brake module (9) and, in the event of failure of the primary brake module (9), a redundant brake module (18) is used to 24-1437 27 The service brake (3) of the motor vehicle (1) is controlled as the device for generating the braking effect.

5. Method according to one of the preceding claims, characterized in that the motor vehicle (1) has a primary electrical system (5) for supplying electrical power to the primary standstill protection (5, 9) and a secondary electrical system (6) and then, when the failure of the primary standstill protection (5, 9) is caused by a failure of the primary electrical system (5), the device (3) for generating the braking effect is supplied electrically via the secondary electrical system (6).

6. Method (23) according to one of the preceding claims, characterized in that the braking effect is continuously alternately increased and reduced until an operating action of the driver (2) of the motor vehicle (1) to control the motor vehicle (1) is detected.

7. Method (23) according to claim 6, characterized in that the operating action must include actuation of the brake pedal.

8. Method (23) according to one of the preceding claims, characterized in that, at the latest with the first reduction of the braking effect after first reaching standstill or the near-standstill speed range, an automatic motion monitoring, in particular a roll monitoring, is also activated in order to monitor a movement, in particular a roll, of the motor vehicle (1), and the continuous alternating increase and / or reduction of the braking effect is controlled depending on signals from the motion monitoring.

9. Method (23) according to claim 8, characterized in that the braking effect is increased again precisely or at the latest when the motor vehicle (1) has covered a predetermined first distance, and / or 24-1437 28 the braking effect is reduced exactly or at the latest when the motor vehicle (1) has covered a predetermined second distance.

10. Method (23) according to one of the preceding claims, characterized in that - the braking effect is increased again exactly or at the latest when the motor vehicle (1) has reached a predetermined initial speed and / or a predetermined initial change in speed and / or a predetermined initial wheel speed and / or a predetermined initial change in wheel speed, and / or - the braking effect is reduced exactly or at the latest when the motor vehicle (1) has reached a predetermined lower second speed and / or a predetermined second change in speed and / or a predetermined lower second wheel speed and / or a predetermined second change in wheel speed.

11. Method according to one of the preceding claims, characterized in that the braking effect is always increased again at the latest when a predetermined first maximum time period has elapsed since the last reduction of the braking effect, and / or the braking effect is always reduced again at the latest when a predetermined second maximum time period has elapsed since the last increase of the braking effect.

12. Method (23) according to one of the preceding claims, characterized in that the continuously repeated increase and / or reduction of the braking effect is controlled depending on a local gradient and / or an acceleration, wherein in particular a larger gradient as well as a larger acceleration leads to shorter periods in which the braking effect is reduced.

13. Method (23) according to one of the preceding claims, characterized in that 24-1437 29. The continuous increase and decrease of the braking effect is controlled by an environmental sensor system (12) of the motor vehicle (1), in particular a lidar device (12).

14. Assistance system (12) for a motor vehicle (1), comprising at least one Control unit (14) for controlling a device (3, 9, 18) of the respective motor vehicle (1) for generating a braking effect to slow down the motor vehicle (1), wherein the assistance system (12) is configured to carry out the method (23) according to one of the preceding claims.

15. Motor vehicle (1) that can be operated in an automated and at least partially manual operating mode and has a permanent standstill protection (5, 9), wherein the motor vehicle (1) is set up to carry out the method (23) according to one of claims 1 to 13 and / or is equipped with the assistance system (12) according to claim 14.

Images