DE102022116727A1 - Safety arrangement for a gas supply system for providing a vehicle containing gaseous fuel, in particular commercial vehicle, security method, computer program and/or computer-readable medium, vehicle, in particular commercial vehicle - Google Patents

Abstract

Safety arrangement (100) for a vehicle (200a), in particular commercial vehicle (200b), having a gas supply system (160) for providing a gaseous fuel (161), comprising: an input interface (110), a risk assessment module (120), and an output interface (130 ), wherein the input interface (110) is set up to receive (310) input data (111), the input data (111) being sensor data (111a) recorded by a sensor (140) and/or functional data (111a) transmitted by a driving assistance system (141). 111b) and/or vehicle-related status data (111c), the output interface (130) is set up to transmit (330) an output signal (131) to a control device (151) for controlling the gas supply system (160), and wherein the risk assessment module (120) is set up to use the input data (111) to determine a risk variable (121) relating to a future security risk and to determine the output signal (131) depending on the risk variable (121).

Description

The invention relates to a safety arrangement for a vehicle, in particular a commercial vehicle, which has a gas supply system for providing a gaseous fuel. The invention further relates to a security method, a computer program and/or a computer-readable medium, and a vehicle, in particular a commercial vehicle.

Gaseous fuels can be used in vehicles, in particular commercial vehicles, in order to convert energy from the fuel into mechanical energy for moving the vehicle, in particular commercial vehicles, through a reaction and optionally a further energy conversion. A conversion of a gaseous fuel may in particular include an oxidation in which thermal energy is generated, the thermal energy being further converted into mechanical energy. Such a conversion takes place in a vehicle, in particular a commercial vehicle, with an internal combustion engine for burning, in particular, autogas (liquefied petroleum gas, LPG), liquefied natural gas (liquefied natural gas, LNG) and/or compressed natural gas (compressed natural gas, CNG) as fuel. Alternatively or additionally, conversion of the gaseous fuel may include an electrochemical reaction. Such a conversion takes place in a vehicle, in particular a commercial vehicle, with a fuel cell for converting in particular hydrogen, methanol, butane and/or natural gas as fuel. The gaseous fuel can be stored on the vehicle side in a liquid and/or gaseous phase in a gas storage device that can be fluidly connected to the gas supply system or is included in the gas supply system.

A gaseous fuel can therefore be used to operate vehicles, especially commercial vehicles. A gaseous fuel, especially hydrogen, is highly flammable. If an accident occurs with such a vehicle, especially a commercial vehicle, the fuel or gas can escape and possibly ignite. Escaping fuel and possible ignition of the fuel can pose a safety risk.

Applications and techniques are known from the prior art for switching off the hydrogen supply and thus reducing safety risks.

US 2020/0119378 A1 discloses a fault diagnosis system for the hydrogen supply to a fuel cell. The system includes a plurality of fuel tanks storing hydrogen therein to supply the hydrogen, and a fuel tank valve disposed on each of the fuel tanks and configured to be opened or closed to supply or shut off the hydrogen to the fuel tanks. A supply amount estimator estimates a supply amount of hydrogen supplied to the fuel cell stack, and a consumption amount estimator estimates a consumption amount of hydrogen consumed in or discharged from a fuel cell stack in a reaction. A fault detector then detects a hydrogen supply condition.

KR 20050042662A discloses a post-accident safety system of a fuel cell vehicle and control methods therefor. An airbag module emits a collision safety signal when an airbag is triggered by a collision or collision. The collision safety signal is output from the airbag module to transmit an emergency stop signal to a hydrogen system controller and an engine controller.

DE 10 2015 222 219 A1 discloses a safety device of a fuel cell vehicle and a method for controlling the safety device. The safety device uses a fuel cell and a high-voltage battery as a power source, and includes: a first voltage sensor that measures a voltage of a positive side of a voltage bus; a second voltage sensor that measures a voltage of a negative side of the voltage bus; and a controller that determines electrical isolation between the positive side of the voltage bus and the electrical chassis based on the voltage of the positive side of the voltage bus and electrical isolation between the negative side of the voltage bus and the electrical chassis based on the voltage of the negative side of the voltage bus. Thus, an electric shock accident can be prevented by determining whether electrical insulation is maintained between a power source and an electrical chassis.

This means that safety measures immediately after an accident, for example triggered by an airbag signal and/or by a voltage signal, are known. However, such safety measures only take effect, for example, after a leak occurs. However, this leaves the possibility that a fuel or hydrogen will escape in the time between the occurrence of the leak, for example in an accident, and the intervention of the safety measure. Furthermore, it is possible that valves and actuators are required to take the safety measure after an accident took no longer function properly, for example to turn off a fuel supply. A residual risk therefore remains.

The invention is therefore based on the object of enriching the prior art and providing an improved security arrangement that overcomes the disadvantages of the prior art. In particular, the task may be to further improve the safety of a vehicle comprising a gas supply system, in particular a commercial vehicle.

The task is solved by a method according to claim 1 and the subjects according to the further independent claims. The subclaims indicate preferred developments of the invention.

According to the invention, a safety arrangement is provided for a vehicle, in particular a commercial vehicle, which has a gas supply system for providing a gaseous fuel. The safety arrangement comprises an input interface, a risk assessment module, and an output interface, wherein the input interface is set up to receive input data, the input data comprising sensor data detected by a sensor and/or functional data transmitted by a driving assistance system and/or vehicle-related status data, the output interface for transmitting an output signal to a control device for controlling the gas supply system is set up, and wherein the risk assessment module is set up to use the input data to determine a risk size relating to a future security risk and to determine the output signal depending on the risk size.

The vehicle, in particular a commercial vehicle, is referred to below as a vehicle. The vehicle is a vehicle with a fuel cell and/or a so-called gas vehicle with an internal combustion engine for burning the gaseous fuel, which means that safety measures may have to be taken due to the use of the gaseous fuel. The vehicle includes the safety arrangement, which is set up to transmit an output signal to the control device via the output interface in order to take or initiate a safety measure. The control device is set up to control the gas supply system and/or a component of the gas supply system.

The input data includes sensor data that has been recorded by one or more vehicle-mounted sensors and is transmitted to the input interface of the security arrangement for further processing by the risk assessment module. Alternatively or additionally, the input data includes functional data and/or status data that has been recorded, received or determined by a vehicle-mounted driver assistance system and is transmitted to the input interface of the safety arrangement for further processing by the risk assessment module.

It was recognized that data available or available on the vehicle makes it possible to recognize critical or safety-relevant driving situations, for example before an accident, and to intervene accordingly. For this purpose, the risk assessment module is set up to receive the input data through the input interface and to determine the risk size based on the input data. The risk size can include a number or a numerical value and/or a Boolean size that indicates whether a security risk exists and/or how big a security risk is. The future security risk describes a security risk that can arise at one or more points in time after the sensor data, the functional data and/or the status data have been acquired from the sensor data, the functional data and/or the status data acquired at a current point in time, without there currently being a security-relevant one Condition, such as a leak and/or uncontrolled release of gas, exists.

The risk size relates to the safety risk in a current state of the vehicle that can be characterized by the input data, in a future state that can be predicted by the input data and / or in a future scenario in which the vehicle is located that can be predicted by the input data. The condition can characterize the vehicle as such, including technical features, parameters and conditions of the vehicle, and the scenario can characterize the driving situation of the vehicle, including an environment and/or traffic in the area surrounding the vehicle. Based on the input data, the risk assessment module can optionally carry out a forecast of the state and/or the scenario relating to the point in time(s) in order to determine the risk size.

This makes it possible to use an evaluation of existing data to take a predictive safety measure, for example before a possible accident. This allows, for example, a hydrogen supply to be switched off and/or a fuel cell system to be evacuated in a predictive manner. The same applies to other gas vehicles where a predictive switch-off th of a fuel supply and/or an evacuation of the gas supply system can be carried out. This means less fuel can escape and the safety of the vehicle is improved. Since a fuel cell vehicle typically has a backup battery, the vehicle can be moved despite the hydrogen supply and thus the fuel cell being switched off. The same applies to hybrid electric vehicles (Hybrid Electric Vehicle, HEV), which have an internal combustion engine for burning the gaseous fuel and an electric drive. By switching off predictively, the buffer battery can even be relieved and there is more buffer for electrical braking interventions by an electric drive of the vehicle that is set up for regenerative braking, which enables finer control than with a friction brake.

Preferably, the risk assessment module is set up to determine the output signal based on a threshold condition relating to the risk size. For example, the output signal can be determined such that a safety measure is triggered by the control device if the risk size satisfies the threshold condition, or vice versa. The risk size can be compared with a threshold value defining the threshold condition. For example, if the risk size is below the threshold value, it can be concluded that there is little or no security risk and possibly no security measure needs to be taken. Otherwise, if the risk size is above the threshold value, it can be concluded that a security risk exists and a security measure must be taken. This makes it possible to reliably classify the risk size in order to indicate in a well-defined manner whether a security measure should be taken or not. Optionally, the output signal can be determined based on a plurality of threshold conditions. This makes it possible for the risk size to be compared, for example, in a staggered manner with different threshold values in order to be able to initiate different, for example staggered, security measures.

Preferably, the risk size comprises a sum of summands relating to the input data. The risk size can be effectively characterized using various input data. Each of the summands can relate to one of the sensor data, the functional data and/or the status data. For example, one summand can relate to sensor data as image data, another summand can relate to functional data as data from a brake control system and so on.

Preferably the sum is a weighted sum. In other words, the summands can be weighted in order to give different weights to different input data and to be able to determine the risk size in a differentiated manner. To do this, a sum is calculated in which the addends are weighted to calculate the sum, i.e. have a factor called weight.

Preferably, the risk assessment module is set up to determine the output signal based on a threshold condition relating to one of the summands. This means that the summand can be taken into account individually and thus lead to a security measure. For example, the summand threshold condition may trigger a security action if the summand threshold condition is met, even though the risk magnitude may not meet the risk magnitude threshold condition.

The sensor data preferably includes an articulation angle between a tractor and a trailer, speeds affecting several wheels of the vehicle, a yaw rate, an inclination angle, a steering angle, an acceleration, a plurality of pressures relating to different chassis elements, and / or a pedal actuation signal. In particular, an actual state of the vehicle and/or a dynamic or a temporal change in the state of the vehicle can be characterized using the aforementioned variable. The dynamics of the sensor data can be determined by repeatedly recording the sensor data and/or evaluating a time series of the sensor data. Based on the dynamics of the vehicle, conclusions can be drawn from the current state of the vehicle to a future state of the vehicle. The current state, the dynamics and/or the future state of the vehicle can be evaluated to determine the risk size. The aforementioned sensor data includes sensor data that is typically recorded by the vehicle anyway and is therefore present anyway. This means that there is no need for special adaptation of sensors to determine the risk size. The articulation angle is only relevant for multi-section vehicles. All other sensor data mentioned are also relevant for single-unit vehicles.

The sensor data preferably includes image data and/or distance data. Based on the image data and/or the distance data, the dynamics of the vehicle and events in the vehicle's surroundings can be determined, which enables a particularly effective and reliable determination of the risk size. The image and/or distance data can be used, for example, to predict a traffic jam that the vehicle will encounter approximated. The image data can additionally or alternatively relate to conditions internal to the vehicle, for example fatigue and/or attention of a driver and/or monitoring of the vehicle's load.

Preferably, the functional data and/or status data include an emergency brake signal, an evasive maneuver signal and/or an error signal. Functional data from a driving assistance system can, for example, be used to draw conclusions about events or interventions by the driving assistance system in the operation of the vehicle and thus about a possible risk. In particular, a driving assistance system can initiate emergency braking and/or an evasive maneuver, which are typically initiated to minimize a safety risk. The error signal can include information about the functionality of the vehicle and/or a component of the vehicle.

Preferably, the risk assessment module is set up to determine the output signal in such a way that the control device causes a valve control, a pump control and/or a compressor control of the gas supply system to be operated. This makes it possible to effectively take safety measures such as controlling a valve through the valve control, a pump through the pump control and/or a compressor through the compressor control in order to ensure that as much fuel as possible can be removed from the gas supply system in a targeted manner and not in an uncontrolled manner enters an environment. The amount of fuel in the gas supply system or lines can thus be reduced and/or the gas supply system or lines can be flushed.

Preferably, the safety arrangement is a safety arrangement for a vehicle having a fuel cell. This sets up the safety arrangement for a fuel cell vehicle. Because of the chemical properties of hydrogen in particular, the risk assessment module can carry out a more conservative determination of the risk size for a fuel cell vehicle than for another gas vehicle in order to be able to take a suitable safety measure.

Preferably, the risk assessment module is set up to determine the output signal for switching off the fuel cell. The output signal can be determined in such a way as to switch off the fuel cell and thus stop the hydrogen supply in time to take an appropriate safety measure.

According to one aspect of the invention, a safety method is provided for a vehicle, in particular a commercial vehicle, having a gas supply system for providing a gaseous fuel. The security method comprises: receiving input data, wherein the input data includes sensor data detected by a sensor, functional data transmitted by a driving assistance system and/or vehicle-related status data; Determining a risk size relating to a future security risk and determining an output signal depending on the risk size; and transmitting an output signal to a control device for controlling the gas delivery system. The security method can include one or more further steps and/or have features that correspond to the features of the security arrangement described as optional and/or advantageous in order to achieve an associated technical effect.

According to one aspect of the invention, a computer program and/or a computer-readable medium is provided. The computer program and/or the computer-readable medium comprise instructions which, when the program or instructions are executed by a computer, cause the computer to carry out the method according to the invention and/or steps thereof. Optionally, the computer program and/or the computer-readable medium includes commands which, when the program or commands are executed by a computer, cause the computer to carry out the method steps described as advantageous or optional in order to achieve an associated technical effect.

According to one aspect of the invention, a vehicle, in particular a commercial vehicle, is provided, comprising a safety arrangement according to the invention, a gas supply system for providing a gaseous fuel and a control device for controlling the gas supply system. Optionally, the security arrangement includes a feature described as advantageous or optional in order to achieve an associated technical effect.

Preferably, the vehicle, in particular a commercial vehicle, is a multi-part vehicle, a towing vehicle of a multi-part vehicle and/or a trailer. Data to determine the risk size from the towing vehicle and/or the trailer can be transmitted to the risk assessment module in order to effectively determine dangerous situations in advance.

The vehicle preferably has a braking system and the safety arrangement and/or the risk assessment module is part of the braking system. Optionally, the safety arrangement and/or the risk assessment module is comprised of a braking system on the towing vehicle. Alternatively or additionally, a trailer-side trailer braking system includes the safety arrangement and/or the risk assessment module. Furthermore, the safety arrangement and/or the risk assessment module can be included in another vehicle-side control unit. For example, the safety arrangement and/or the risk assessment can be included in the control device, whereby the output signal is transmitted within the control device. Alternatively, the safety arrangement and/or the risk assessment module can be included in a dedicated trailer-side control unit.

The vehicle, in particular a commercial vehicle, preferably has a fuel cell, wherein the control device is set up to evaluate and/or further process the output signal in order to switch off the fuel cell and/or control and/or close components of the fuel cell and/or the gas supply system regulate. The fuel is therefore hydrogen. The vehicle, in particular a commercial vehicle, is a so-called fuel cell vehicle. The control device is comprised by the fuel cell and/or can be connected to the fuel cell or a component of the fuel cell in order to control, regulate and/or switch off the fuel cell or the component.

• 1 eine schematische Darstellung eines Fahrzeugs, insbesondere Nutzfahrzeugs, gemäß einer Ausführungsform der Erfindung;
• 2 eine schematische Darstellung eines mehrgliedrigen Fahrzeugs gemäß einer Ausführungsform der Erfindung;
• 3 eine schematische Darstellung einer Sicherheitsanordnung gemäß einer Ausführungsform der Erfindung; und
• 4 einen schematischen Ablaufplan eines Sicherheitsverfahrens gemäß einer Ausführungsform der Erfindung.

Further advantages and features of the invention as well as their technical effects result from the figures and the description of the preferred embodiments shown in the figures. Show it

• 1 a schematic representation of a vehicle, in particular a commercial vehicle, according to an embodiment of the invention;
• 2 a schematic representation of a multi-unit vehicle according to an embodiment of the invention;
• 3 a schematic representation of a security arrangement according to an embodiment of the invention; and
• 4 a schematic flowchart of a security method according to an embodiment of the invention.

1 shows a schematic representation of a vehicle 200a, in particular commercial vehicle 200b, according to an embodiment of the invention. The vehicle 200a, in particular commercial vehicle 200b, is referred to below as vehicle 200a, 200b.

The vehicle 200a, 200b is set up with reference to 4 carry out procedure 300 described. For this purpose, the vehicle includes 200a, 200b according to 1 a gas supply system 160 for providing a gaseous fuel 161, a control device 151 for controlling the gas supply system 160 and a safety arrangement 100. The vehicle 200a, 200b includes a fuel cell 150, which can be connected to the gas supply system 160 via a fuel line 162. A fluidic connection for providing fuel 161 or for guiding fuel 161 from the gas supply system 160 to the fuel cell 150 can be established and/or prevented, for example via a valve (not shown). In another embodiment, not shown, the control device 151 can be included in the fuel cell 150.

The gas supply system 160, the control device 151 and the implementation of safety measures are related to 3 further described. Furthermore, the vehicle includes 200a, 200b according to 1 a braking system 250. The braking system 250 may be an electronic braking system (EBS).

The safety arrangement 100 includes an input interface 110, a risk assessment module 120 and an output interface 130. The safety arrangement 100 and the risk assessment module 120 are included in the braking system 250. In other words, a control unit of the brake system 250 can have the risk assessment module 120.

The input interface 110 is set up to receive 310 input data 111. The input data 111 can thus be processed and/or evaluated by the risk assessment module 120.

The vehicle 200a, 200b includes a sensor 140 and a driving assistance system 141. In an embodiment not shown, the vehicle 200a, 200b includes a plurality of sensors 140 or sensor devices. The sensor 140 is set up to record sensor data 111a. The sensor 140 is connected to the input interface 110 in order to transmit the sensor data 111a as input data 111 to the input interface 110 and thus to the security arrangement 100 for processing by the risk assessment module 120. The input data 111 thus includes sensor data 111 a detected by the vehicle-side sensor 140. The sensor 140 is connected directly to the risk assessment module 120 via the input interface 110.

The sensor data 111a include an articulation angle 215 between a tractor 210 and a trailer 220, several wheels 230 of the vehicle 200a, in particular commercial vehicle 200b, relevant speeds 231 and / or speed differences, a steering angle 237, an acceleration 238 and a plurality of different chassis elements 240 Press 241 (see also 2 ). For this purpose, the sensor 140 can include an articulation angle sensor, several speed sensors, a steering angle sensor, an acceleration sensor and several pressure sensors (each not shown).

The sensor data 111a includes a pedal actuation signal 239. For this purpose, the sensor 140 can include a pedal actuation sensor (not shown). Emergency braking can be detected by evaluating the brake pedal, more precisely via the pedal actuation signal 239 or the temporal development of the pedal actuation signal 239. If the brake pedal is actuated very quickly, i.e. above a pedal actuation threshold and/or completely, an emergency braking is detected. This signal can be used to initiate a security measure.

The sensor data 111a includes a yaw rate 235 and an inclination angle 236. For this purpose, the sensor 140 may include a yaw rate sensor and an inclination angle sensor (each not shown). Based on the yaw rate 235 and the inclination angle 236, a “rocking” of the vehicle 200a, 200b or a multi-unit vehicle 200c (see 2 ). Using a yaw rate sensor that measures in three directions, the rocking of the vehicle 200a, 200b can be determined by evaluating a dynamic. Particularly in the case of an empty vehicle 200a, 200b, a caravan or caravan combination in strong winds and/or a tanker truck, the rocking can lead to the vehicle 200a, 200b tipping over. The yaw rate sensor detects the rocking as rolling along the vehicle's longitudinal axis. Based on the yaw rate 235, a safety-relevant situation can be identified, for example if the yaw rate 235 exceeds a yaw rate threshold value. The vehicle 200a, 200b can also tip over due to incorrect operation. If the vehicle 200a, 200b, in particular a tractor, is operated on a slope, for example, the vehicle 200a, 200b can tip over. In order to detect rolling on the slope, an acceleration must occur. However, this acceleration cannot be easily detected, for example when the vehicle 200a, 200b is traveling along the slope at a comparatively low speed. For this purpose, an inclination sensor is provided which detects the inclination angle 236 of the vehicle 200a, 200b. Based on the inclination angle 236, a safety-relevant situation can be identified, for example if the inclination angle 236 exceeds an inclination angle threshold value, for example at a gradient of 29% transverse to a longitudinal axis.

The sensor data 111a includes image data 112 and distance data 113. For this purpose, the sensor 140 has an image sensor (not shown) and a distance sensor (not shown). The sensor 140 includes, for example, a camera device, a LIDAR device, a radar device and/or an ultrasonic distance sensor device.

The driving assistance system 141 is set up to carry out one or more vehicle functions, to monitor operation of the vehicle 200a, 200b and/or to receive data from a second vehicle and/or from an infrastructure element (each not shown). When performing a vehicle function, the driving assistance system 141 generates functional data 111b that characterize the vehicle function or the implementation of the vehicle function. For example, the driving assistance system 141 generates corresponding functional data 111 b when an intervention in the actuation of the brake system 250 occurs. The driving assistance system 141 is set up to determine status data 111c relating to the vehicle 200a, 200b and/or operation of the vehicle 200a, 200b. For example, the status data 111c relates to the functionality and/or functionality of the vehicle 200a, 200b. The functional data 111b and the status data 111c can alternatively or additionally correspond to the received data and/or be determined taking the received data into account.

The functional data 111b and the status data 111c may include an emergency brake signal 114, an evasive maneuver signal 115 and an error signal 116.

The emergency brake request 114 can be recognized and determined based on the sensor 140. For example, if a traffic jam into which the vehicle 200a, 200b is driving is detected in the vicinity of the vehicle 200a, 200b, automatic emergency braking can be carried out by the driving assistance system 141 and corresponding functional data 111b can be generated and transmitted to the input interface 110.

The evasive maneuver signal 115 is generated by the driving assistance system 141 with regard to carrying out an automatic evasive maneuver (so-called evasive maneuver assist). for example, if an impact cannot or can hardly be prevented by emergency braking.

An error signal 116 is present, for example, if a vehicle malfunction occurs, for example a steering failure. Then the driving assistance system 141 can safely bring the vehicle 200a, 200b onto a hard shoulder, for example (so-called rescue lane assist). The error signal 116 can in particular be independent of the driving dynamics of the vehicle 200a, 200b and can be based on a vehicle malfunction that represents a significant safety risk. For example, if a steering system of the vehicle 200a, 200b outputs an error signal 116, for example a timeout on a CAN bus, the brake system 250 can steer using a negative steering roll radius.

The driving assistance system 141 is connected to the input interface 110 in order to transmit the functional data 111b and the vehicle-related status data 111c to the input interface 110 and thus to the safety arrangement 100 for processing by the risk assessment module 120. The input data 111 thus includes functional data 111b transmitted by the driving assistance system 141 and vehicle-related status data 111c.

The sensor 140 and the driving assistance system 141 are connected to one another (not shown) so that sensor data 111 can be transmitted to the driving assistance system 141 for determining a function of the driving assistance system 141.

The risk assessment module 120 is set up to determine an output signal 131 taking the input data 111 into account. For this purpose, the risk assessment module 120 is set up to use the input data 111 to determine a risk variable 121 relating to a future security risk and to determine the output signal 131 depending on the risk variable 121. For this purpose, the risk assessment module 120 includes a processor, not shown, for data processing and a memory, not shown, for buffering and/or storing data. To determine 320 the risk variable 121 relating to the future safety risk, the risk assessment module 120 evaluates a state and/or a scenario of the vehicle 200a, 200b based on the input data 111 recorded at a current point in time. The state characterizes the vehicle 200a, 200b including technical features, parameters and Conditions of the vehicle 200a, 200b as such based on the input data 111 and the scenario characterizes the driving situation of the vehicle 200a, 200b based on the input data. Optionally, the risk assessment module 120 carries out a forecast or a forecast of a temporal development of a state of the vehicle 200a, 200b and/or a scenario in order to determine the risk variable 121.

The risk variable 121 can also be referred to as a risk factor and relates to a potential risk for the vehicle 200a, 200b and/or operation of the vehicle 200a, 200b without there currently being a safety-relevant condition, such as a leak and/or uncontrolled ride Gas is present. In particular, the risk factor 121 concerns the risk that fuel 161 will escape in an uncontrolled manner. The risk size 121 is, for example, a numerical value that is determined by the risk assessment module 120 based on the input data 111.

The output signal 131 is determined by the risk assessment module 120 depending on the risk size 121. The value of the risk variable 121 can influence the output signal 131 in such a way that no security measures have to be taken for a specific risk variable 121 and security measures have to be taken for another specific risk variable 121. The respective risk size 121 is determined by a threshold condition 122.

The applicable security measures can depend on the value of the risk variable 121 and/or the output signal 131.

The risk assessment module 120 is set up to determine the output signal 131 based on the threshold condition 122 relating to the risk variable 121. The threshold condition 122 includes a threshold value relating to the risk variable 121. When determining the output signal 131, the risk assessment module 120 checks whether the risk variable 121 satisfies the threshold condition 122, i.e. whether the risk variable 121 is larger or smaller than the threshold value. The threshold value can be different depending on the type of vehicle 200a, 200b. For example, the threshold value may be greater for a vehicle 200a, 200b with an internal combustion engine (not shown) than for a vehicle 200a, 200b with a fuel cell 150 and/or a hybrid electric vehicle in order to initiate a safety measure. This takes into account the fact that a vehicle 200a, 200b with only one internal combustion engine may not have an electrical energy storage device, i.e. no battery, which can serve as an energy buffer for an electric drive. Depending on whether the risk variable 121 satisfies the threshold condition, i.e. the risk variable 121 is larger or smaller than the threshold value, the output signal 131 is determined accordingly (see also 3 ).

The risk variable 121 comprises a sum 123 of summands 124 relating to the input data 111. The sum 123 can, for example, have one summand 124 corresponding to the sensor data 111a, the functional data 111b and/or the error data 111c. The summands 124 can be weighted differently in order to give the input data 111 different weights when determining the risk variable 121; in other words, in order to be able to take the input data 111 into account in a differentiated manner when determining the risk size 121.

The risk assessment module 120 is set up to determine the output signal 131 based on a threshold condition 122 'related to one of the summands 124. The risk variable 121 is determined in the risk assessment module 120 for each sensor 140 or for each sensor assembly and for the driving assistance system 141. This means that the risk variable 121 is determined via a fixed or variable assignment of the respective input data 111 to corresponding threshold values 122 '. For example, if a tilt sensor determines a tilt value of 20%, a summand 124 relating to the tilt has a value between 15% and 25% or between 0.15 and 0.25. From this it is concluded that there is an increased risk, which means that the risk value 121 is set to 0.2. The smaller the risk size 121, the more dangerous the situation. This results in a safety of 0.8 for the inclination sensor with the calculation: Safety = (1 - risk size 121). The greater the value of security, the more dangerous the situation. The calculation method is carried out analogously for the other sensors 140, sensor assemblies and the driving assistance system 141.

The risk variable 121, the threshold condition 122, the summands 124, the sum 123 and the threshold value conditions 122' relating to the summands 124 can be processed, stored and/or retrieved in the risk assessment module 120, as schematically illustrated by a box with a dashed line.

The output signal 131 is determined depending on the risk variable 121. The output interface 130 is set up to transmit 330 the output signal 131 to the vehicle-side control device 151. For this purpose, the output interface 130 is connected to the control device 151. The risk assessment module 120 and thus the security arrangement 100 is set up to transmit the output signal 131 to the control device 151 via the output interface 130. The output signal 131 triggers a security measure when the output signal 131 is received by the control device 151 (see also 3 ).

The vehicle 200a, 200b includes an energy storage device, not shown, for storing electrical energy. In other words, the vehicle 200a, 200b includes a buffer battery that provides enough energy for safe stopping, for example on a hard shoulder, even when the fuel cell 150 is switched off.

2 shows a schematic representation of a multi-unit vehicle 200c according to an embodiment of the invention. The multi-unit vehicle 200c is a vehicle 200a, in particular commercial vehicle 200b, as referred to 1 described. 2 is made with reference to 1 as well as the description of the 1 described.

The multi-part vehicle 200c according to 2 includes a towing vehicle 210 and a trailer 220. The towing vehicle 210 and the trailer 220 are each also a vehicle 200a, in particular a commercial vehicle 200b. In particular, the towing vehicle 210 can be a vehicle 200a, 200b as referred to 1 be described. The multi-unit vehicle 200c includes those related to 1 and 3 described security arrangement 100 (not in 2 shown). In particular, the towing vehicle 210 includes the safety arrangement 100. The input data 111, for example driving dynamics data and data from the trailer 220, are transmitted to the safety arrangement 100.

As in 2 shown, the towing vehicle 210 includes several schematically shown wheels 230, several chassis elements 240 and a braking system 250.

The trailer 220 includes a plurality of schematically shown wheels 230, a plurality of chassis elements 240 and a trailer braking system 255. The trailer braking system 255 is in particular an electrical braking system (Trailer EBS, EBS).

A wheel speed sensor (not shown) is assigned to each of the wheels 230. Each of the wheel speed sensors is set up to detect a speed 231 of the respective wheel 230. In particular, a speed can also be determined in this way. The speed 231 can be transmitted to the safety arrangement 100 via a vehicle bus, for example a CAN bus. The safety arrangement 100 can determine speed differences from the speeds 231 in order to be able to draw conclusions about the stability of the vehicle 200a, 200b. This means that a potentially safety-relevant situation can possibly be recognized early if, for example, the vehicle 200a, 200b exhibits deteriorating stability.

Multiple wheels 230 of the multi-unit vehicle 200c may be steerable by a vehicle-side steering device (not shown). A steering system is characterized by a steering angle 237 that is shown schematically and can be detected by a sensor 140. If a safety-relevant situation arises, “hasty” steering movements can be made beforehand. The steering angle sensor can be used to evaluate the steering movements, i.e. a temporal development or dynamics of the steering angle. If the steering frequency at which the steering angle 237 changes is above a steering frequency threshold value, for example higher than average, it can be concluded that a critical situation is imminent. Here, the steering angle 237 is evaluated over time. In particular, when defining the steering frequency threshold, driver-specific and/or historical data can be taken into account.

The multi-unit vehicle 200c has a plurality of chassis elements 240. A state of one of the chassis elements 240 can be characterized in particular by a hydraulic and/or pneumatic pressure 241. The chassis elements 240 are, for example, hydraulic and/or pneumatic suspension and/or damping elements. The pressure 241 can be detected, for example, by a sensor 140 and transmitted to the safety arrangement 100 via a vehicle bus, for example the CAN bus. The pressures 241 and their dynamics can provide information about rocking and thus a safety-relevant situation.

The multi-unit vehicle 200c has an articulation angle sensor, not shown. The articulation angle sensor is set up to determine an articulation angle 215 that arises between the towing vehicle 210 and the trailer 220. The articulation angle 215 is an angle that describes, for example, a difference between the orientation of the towing vehicle 210 and the orientation of the trailer 215. By reading out a rotational movement of the articulation angle sensor between towing vehicle 210 and trailer 220, any swinging of the trailer or multi-part vehicle 200c can be detected at an early stage. The bend angle 215 or its dynamics can flow into the risk variable 121 as input data 111. Furthermore, buckling, i.e. exceeding a buckling angle threshold value, can also be detected. The articulation angle 215 can be considered together with the speed of the vehicle 200a, 200b, 200c to determine the risk size 121. Large articulation angles 215 between the towing vehicle 210 and the trailer 240 are normal when maneuvering and do not pose any danger. However, if the multi-unit vehicle 200c drives at a speed above a threshold speed of, for example, 20 km/h and the articulation angle 215 is, for example, over 45° to the perpendicular, a safety-relevant situation can be assumed. This can be particularly the case with turntable trailers. This can cause the turntable and thus the drawbar to buckle. If, for example, the multi-part vehicle 200c is braked on a slippery surface and the multi-part vehicle 200c is not kept stretched, this results in an unsafe situation. Alternatively or additionally, lurching can also be recognized from the difference in wheel speeds 231. For example, if the trailer 210 begins to lurch, the measured speeds 231 of the trailer 210 no longer match the speeds 231 of the wheels 230 of the towing vehicle 210.

3 shows a schematic representation of a security arrangement 100 according to an embodiment of the invention. This showed 3 another representation of the security arrangement 100, which has already been referred to 1 is described. On 1 and 2 as well as the description of the 1 and 2 is used when describing the 3 Referenced.

The sensor 140 and the driving assistance system 141 transmit sensor data 111a, functional data 111b and status data 111c to the braking system 250 and to the trailer braking system 255. The sensor data 111a, functional data 111b and Status data 111c Input data 111 for the safety arrangement 100 comprised by the braking system 250. The trailer braking system 255 can process the sensor data 111a, functional data 111b and status data 111c transmitted by the sensor 140 and the driving assistance system 141 and/or with data recorded and/or determined on the trailer side prepare and transmit as input data 111 to the safety arrangement 100 comprised by the brake system 250. Conversely, the trailer braking system 255 can receive exchange information 117 from the braking system 250. One or more sensors 140 can each be installed in the tractor 210 and/or the trailer 220.

The safety arrangement 100 and the risk assessment module 120 included therein (not shown) determines the output signal 131 and transmits the output signal 131 to the control device 151. If the risk assessment module 121 determines that there is too high a risk, a warning signal is sent to the control device 151 (fuel cell controller) is output as output signal 131. The control device 151 is set up to evaluate and/or further process the output signal 131 in order to control and/or regulate components of the fuel cell 150 and/or the gas supply system 160 in order to take one or more safety measures corresponding to the output signal 131 and thus minimize a risk. The control device 151 is set up to shut down or switch off the fuel cell 150, the gas supply system 160, components of the fuel cell 150 and/or components of the gas supply system 160. For this purpose, the gas supply system 160 includes a valve control 152, a pump control 153 and a compressor control 154.

The control device 151 is connected to the valve control 152, the pump control 153 and the compressor control 154. The control device 151 is set up to determine a respective control signal 132 for controlling the valve control 152, the pump control 153 and the compressor control 154 based on the output signal 131 received from the safety arrangement 100. A security measure can be initiated by the respective control signal 132.

For example, the control device 151 can cause an increase in the speed of a compressor controlled by the compressor control 154 and at the same time cause a shut-off valve that can be controlled by the valve control 152 to close. This prevents fuel 161 from remaining in a line of the fuel cell 150, because in this case an oxygen supply increases while the fuel supply is stopped. This results in an “evacuation” of the fuel cell 150. A recirculation pump can be switched off by the pump control 153. In the case of a fuel cell vehicle, for example, this ensures that unused hydrogen from the anode exhaust gas gets back into the fuel cell 150 instead of into the exhaust tract. When the system is switched off, the unused hydrogen is released into the environment. The concentration is so low that there is no danger to the surrounding area.

In another embodiment, not shown, the safety arrangement 100 and/or the risk assessment module 120 may be included in the trailer braking system 255. Alternatively or additionally, the safety arrangement 100 and/or the risk assessment module 120 can be comprised by the control device 151 or the fuel cell controller and/or the compressor control 154 or power electronics of the fuel cell compressor.

4 shows a schematic flowchart of a security method 300 according to an embodiment of the invention. The security method 300 is for a vehicle 200a, in particular commercial vehicle 200b, having a gas supply system 160 for providing a gaseous fuel 161. Such a vehicle 200a, in particular commercial vehicle 200b, is related to the 1 until 3 described. 4 is made with reference to the 1 until 3 and their description are described.

The method 300 has the following steps: receiving 310 of input data 111, wherein the input data 111 includes sensor data 111a detected by a sensor 140 and/or functional data 111b transmitted by a driving assistance system 141 and/or vehicle-related status data 111c.

A risk variable 121 relating to a future security risk is determined 320 and an output signal 131 is determined depending on the risk variable 121.

An output signal 131 is transmitted 330 to a control device 151 for controlling the gas supply system 160.

Reference symbols (part of the description):

100

Security arrangement

110

Input interface

111

Input data

111a

Sensor data

111b

Functional data

111c

Status data

112

Image data

113

Distance data

114

Emergency brake signal

115

Evasive maneuver signal

116

Error signal

117

Exchange information

120

Risk assessment module

121

Risk size

122

Threshold condition

122'

Threshold condition

123

total

124

summand

130

Output interface

131

Output signal

132

Control signal

140

sensor

141

Driving assistance system

150

Fuel cell

151

Control device

152

Valve control

153

Pump control

154

Compressor control

160

Gas delivery system

161

fuel

162

Fuel line

200a

vehicle

200b

Commercial vehicle

200c

multi-part vehicle

210

tractor

215

Bend angle

220

Trailer

230

wheel

231

number of revolutions

235

Yaw rate

236

Angle of inclination

237

Steering angle

238

acceleration

239

Pedal operation signal

240

Chassis element

241

Pressure

250

Braking system

255

Trailer braking system

300

Security procedures

310

Received

320

Determine

330

To transfer

QUOTES INCLUDED IN THE DESCRIPTION

This list of documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• US 20200119378 A1 [0005]
• KR 20050042662 A [0006]
• DE 102015222219 A1 [0007]

Claims (17)

Safety arrangement (100) for a vehicle (200a), in particular commercial vehicle (200b), having a gas supply system (160) for providing a gaseous fuel (161), comprising: - an input interface (110), a risk assessment module (120), and an output interface ( 130), wherein - the input interface (110) is set up to receive (310) of input data (111), the input data (111) being transmitted by sensor data (111a) detected by a sensor (140) and/or by a driving assistance system (141). Functional data (111b) and/or vehicle-related status data (111c), - the output interface (130) is set up to transmit (330) an output signal (131) to a control device (151) for controlling the gas supply system (160), characterized in that - the risk assessment module (120) is set up to use the input data (111) to determine a risk variable (121) relating to a future security risk and to determine the output signal (131) depending on the risk variable (121). Safety order according to Claim 1 , wherein the risk assessment module (120) is set up to determine the output signal (131) based on a threshold condition (122) relating to the risk variable (121). Security arrangement according to one of the preceding claims, wherein the risk variable (121) comprises a sum (123) of summands (124) relating to the input data (111). Safety order according to Claim 3 , where the sum (123) is a weighted sum (123). Security arrangement according to one of the Claims 3 or 4 , wherein the risk assessment module (120) is set up to determine the output signal (131) based on a threshold condition (122') relating to one of the summands (124). Safety arrangement according to one of the preceding claims, wherein the sensor data (111a) relates to a bending angle (215) between a tractor (210) and a trailer (220), several wheels (230) of the vehicle (200a), in particular commercial vehicle (200b), speeds (231), a yaw rate (235), an inclination angle (236), a steering angle (237), an acceleration (238), pressures (241) relating to a plurality of different chassis elements (240), and/or a pedal actuation signal (239) include. Security arrangement according to one of the preceding claims, wherein the sensor data (111a) comprises image data (112) and/or distance data (113). Safety arrangement according to one of the preceding claims, wherein the functional data (111b) and/or status data (111c) comprise an emergency brake signal (114), an evasive maneuver signal (115) and/or an error signal (116). Safety arrangement according to one of the preceding claims, wherein the risk assessment module (120) is set up to determine the output signal (131) in such a way that the control device (151) operates a valve control (152), a pump control (153) and / or a compressor control (154) of the gas supply system (160). Security arrangement according to one of the preceding claims, wherein the security arrangement (100) is a security arrangement (100) for a vehicle (200a), in particular commercial vehicle (200b), having a fuel cell (150). Safety order according to Claim 10 , wherein the risk assessment module (120) is set up to determine the output signal (131) for switching off the fuel cell (150). Security method (300) for a vehicle (200a), in particular commercial vehicle (200b), having a gas supply system (160) for providing a gaseous fuel (161), the security method (300) having: - Receiving (310) of input data (111), the input data (111) being sensor data (111a) recorded by a sensor (140) and/or functional data (111b) transmitted by a driving assistance system (141) and/or vehicle-related status data (111c) include; - Determining (320) a risk size (121) relating to a future security risk based on the input data (111) and determining an output signal (131) depending on the risk size (121); and - Transmitting (330) an output signal (131) to a control device (151) for controlling the gas supply system (160). Computer program and/or computer-readable medium, comprising instructions which, when the program or instructions are executed by a computer, cause the computer to carry out the method and/or the steps of the method according to one of the Claim 12 to carry out. Vehicle (200a), in particular commercial vehicle (200b), comprising a gas supply system (160) for providing a gaseous fuel (161), a control device (151) for controlling the gas supply system (160) and a safety arrangement (100) according to one of Claims 1 until 11 . Vehicle (200a), in particular commercial vehicle (200b), according to Claim 14 , wherein the vehicle (200a), in particular commercial vehicle (200b), is a multi-part vehicle (200c), a towing vehicle (210) of a multi-part vehicle (200c) and / or a trailer (220). Vehicle (200a), in particular commercial vehicle (200b), according to one of Claims 14 or 15 , wherein the vehicle has a braking system (250) and the safety arrangement (100) and / or the risk assessment module (120) is part of the braking system (250). Vehicle (200a), in particular commercial vehicle (200b), according to one of Claims 14 until 16 , wherein the vehicle (200a), in particular commercial vehicle (200b), has a fuel cell (150), the control device (151) being set up to evaluate and/or further process the output signal (131) in order to control the fuel cell (150). to switch off and/or to control and/or regulate components of the fuel cell (150) and/or the gas supply system (160).

Images