DE102008004208A1 - Controllers for motor vehicle, have outlets for sending signal to later controller, where inlets are provided for receiving another signal from later controller - Google Patents

Abstract

The controllers (312,315) have outlets (313,316) for sending a signal to the later controller. Inlets (314,317) are provided for receiving another signal from the later controller. The controllers are arranged to carry an apparatus (302) of the motor vehicle in a safe condition when the later signal indicates a malfunctioning of the later controller. Independent claims are included for the following: (1) a device for carrying an apparatus of a motor vehicle in a safe condition; (2) a method for carrying an apparatus of a motor vehicle in a safe condition; and (3) a computer program with program code unit for the execution of the procedure.

Description

The The invention relates to a control device for a motor vehicle and means for transferring a Apparatus in a safe state, a method for transferring a Apparatus in a safe state, a computer program and a computer program product.

State of the art

In a control unit for one Internal combustion engine, for example a gasoline or diesel engine, can monitoring mechanisms be realized. Such a monitoring mechanism can Error in the controller recognize and by appropriate measures bring about a safe state of the motor. For example, a safe condition can be achieved by stopping the engine.

To the Shutting down the engine in the event of a fault usually the power amplifiers the relevant actuators switched off. For the relevant actuators For example, it may be a throttle and injectors act.

Around provide a secured shutdown of the engine in case of failure to be able to are known control devices with a monitoring CPU independent of the main CPU, for example a so-called watchdog. The monitoring module is provided to the functionality of the ECU to monitor and in the event of a defect in the control unit, the said output stages are self-contained off. There will be constant monitoring the CPU of the controller through the monitoring module provided.

It is therefore desirable Provide ECUs, the no additional monitoring module need and still meet the same safety criteria.

In front In this background, with the present invention, a control device for a motor vehicle, a device for transferring a Apparatus of a motor vehicle in a safe state, continue Method for transferring a Apparatus of a motor vehicle in a safe state and finally a corresponding computer program and a computer program product presented according to the independent claims. advantageous Embodiments emerge from the respective subclaims and the following description.

Advantages of the invention

Of the The present invention is based on the finding that monitoring functions are advantageous through a distributed system. In doing so, the monitoring functions distributed to two or more separate and separate ECUs become. For example, you can the monitoring functions be used in conjunction with a motor control.

According to the invention independent shutdown paths as a safety mechanism, for example for a control unit monitoring in a distributed engine control, create. It is possible at least the same level of security as an architecture with a control unit to reach. In addition allows the inventive approach a possible Simplification and cost savings in the hardware structure of the individual ECUs. It is omitted the need to have each control device with a second independent monitoring component equip. Rather, the monitoring of a controller is done by another controller, in particular by means of secure bus communication.

The The present invention provides a control device for a motor vehicle having a Output for sending a first signal to a second controller and a Input for receiving a second signal from the second or another control unit, being the control unit is adapted to an apparatus of the motor vehicle, preferably the engine to transfer to a safe state when the second signal indicates a malfunction of the second or further control device. This can in particular by the absence of the second signal or by a invalid second signal. It should be noted that the transmitted first signal received by a second or further control device as a second signal becomes.

One preferred controller has a testing device to provide at least one error signal if the controller malfunctions to provide at the exit. In this case, a defined Error signal generated as the first signal, which evaluates a Error state for the other control devices simplified.

Conveniently, For transmitting the first signal, a secured bus communication provided. Thus lets a malfunction of a controller reliably to each other Transmit control devices.

According to a particularly preferred embodiment, the control unit is designed to independently of the second signal, the apparatus of To control motor vehicle. This should in particular be clarified that it is fully functional control devices for motor vehicles that meet all other known control functions in addition to the monitoring functionality.

A inventive device to transfer a Apparatus of a motor vehicle in a safe state or a monitoring device for a Motor vehicle comprises at least two control devices according to the invention. The at least two controllers are for mutual monitoring formed, wherein in case of malfunction of a control device this Malfunction is detected by the other controller and the other controller the apparatus of the motor vehicle, in particular the engine, transferred to the safe state. Of the Apparatus has at least one required for operation of the apparatus Component on. However, the invention can be particularly advantageous be applied when the apparatus at least two for operation the apparatus required components and the control units different Control components. In case of error, the at least one component of the device so controlled that the device the safe state occupies.

The The present invention provides such a device, wherein the first controller is trained to be dependent from a first fault condition, the at least one component of the To operate the apparatus in such a way that the apparatus assumes the safe state, and the second controller is trained to be dependent from a second fault condition the at least one component of the To control the apparatus so that the apparatus assumes the safe state.

advantageously, is the first control unit designed to receive at least a first error signal that is the first one Indicates fault condition, and the second controller is configured to be at least to receive a second error signal representing the second error condition displays. Error states can be reliably transmitted to the monitoring devices by means of the error signals become.

According to one preferred embodiment the testing device designed to be in case of malfunction of the first control device, the at least one provide second error signal, and in case of malfunction of the second controller to provide the at least one first error signal. Thus let itself the control devices monitor better.

It is advantageous if the apparatus as an internal combustion engine and the at least one component as injection valve, ignition device, Throttle, fuel pump, fuel quantity control and / or are designed as high-pressure control valve. Thus, the suitable inventive approach for use in monitoring mechanisms for internal combustion engines.

The The present invention further provides a method for transferring a Apparatus in a safe condition.

The inventive computer program with Program code means is designed for all steps of the method according to the invention perform, if this computer program is on a computer or equivalent Arithmetic unit, in particular a control device according to the invention or a device according to the invention, carried out becomes.

The Computer program product according to the invention with program code means stored on a computer-readable medium, is to carry the method according to the invention provided when this computer program on a computer or a corresponding arithmetic unit, in particular a control device according to the invention or a device according to the invention, carried out becomes.

Further Advantages and embodiments of the invention will become apparent from the Description and the accompanying drawings.

It understands that the mentioned above and the features to be explained below not only in the specified combination, but also in other combinations or alone, without to leave the scope of the present invention.

The Invention is based on embodiments schematically shown in the drawing and is below under Referring to the drawings described in detail.

figure description

1 shows a schematic structure of monitoring functions of an engine control unit;

2 shows a further schematic structure of monitoring functions of an engine control unit;

3 shows a block diagram of a preferred embodiment of the device according to the invention; and

4 shows a more detailed block diagram of the device according to 3 ,

1 shows an exemplary structure of monitoring functions in a typical engine control unit. The engine control unit may be suitable for an internal combustion engine, such as a gasoline or diesel engine. The construction shown has facilities 102 for providing an input signal, a processor in the form of a CPU 104 , an amplifier 106 and a watchdog device 108 on.

The CPU 104 indicates a first level 112 , a second level 114 and a third level 116 on. The first level 112 has a block "driving functions" 121 and a block "diagnosis" 122 on. The second level 114 is designed to carry out a function monitoring and has a block "program sequence" 123 on. The third level 116 has a block "memory test" 124 , a block "question-answer communication" 125 and a block "command test" 126 on.

The facilities 102 are designed to provide at least one input signal to the first level 112 and the second level 114 provide. The first level 112 is designed to send a signal to the power amplifier 106 and the second level 114 provide. The second level 114 is designed to "enable" a signal to an input of the power amplifier 106 provide.

The watchdog device 108 is designed to send another signal to the "enable" input of the power amplifier 106 provide. The signals provided to the "enable" input are two shutdown paths that allow mutual monitoring.

The block 123 the second level 114 is designed to receive a signal from the block 125 the third level 116 to receive and another signal to the block 125 provide. The block 125 is designed to send another signal to the block 126 the third level 116 provide and another signal from the block 126 to recieve.

Between the third level 116 and the watchdog device 108 there is a bidirectional connection for the exchange of question-answer watchdog signals. The final stage 106 is designed to send a signal to actuators 130 provide. By means of the signal, the actuators can 130 be switched off. At the actuators 130 it may be, for example, a throttle and injectors.

To safeguard the switch-off option, two independent switch-off signals can be sent to the output stages in the control unit 106 be guided. A shutdown signal may be from the CPU 104 be controlled by software and another shutdown signal can be controlled by a built-in separate hardware monitoring mechanism. This additional monitoring module can be used, for example, as a watchdog 108 working and stopping the CPU 104 detect. The monitoring module 108 can then independently via its own switch-off the safe shutdown of the power amplifiers 106 cause. The monitoring module 108 and the software-controlled CPU 104 can constantly monitor each other. At the actuators 130 that of the power amplifier 106 can be switched off, it may be, for example, a throttle and injectors.

2 shows an exemplary shutdown of the power amplifier 106 through the separate watchdog module 108 or by the CPU 104 , A motronic control unit 203 assigns the CPU 104 , the power amplifier 106 and a monitoring module in the form of the watchdog 108 on. The Motronic control unit 203 is designed to receive input signals from a device 102 which may be an accelerator pedal. The CPU 104 indicates the first level 112 , the second level 114 and the third level 116 on. The third level 116 has a software watchdog. The second level 114 and the watchdog 108 are each designed to provide an enable signal to the power amplifier 106 provide. The final stage 106 has three output stage devices, each configured to receive a signal from the first level 112 to receive and in each case a signal to the actuators 130 provide.

3 shows a block diagram of an embodiment of a device 300 for transferring an apparatus 302 in a safe condition. The device 300 shows two preferred embodiments of a control device 312 . 315 on. Accordingly, the apparatus 302 as an internal combustion engine and the at least two components 322 . 324 be designed as an injection valve, ignition device, throttle valve, fuel pump, fuel quantity control and / or as a high-pressure control valve.

The device 300 has a first controller 312 and a second controller 315 on. The apparatus 302 has a first component 322 and a second component 324 on. The components 322 . 324 are required for the operation of the apparatus. The first controller 312 is configured to be the first component depending on a first fault condition 322 of the apparatus 302 to drive so that the apparatus 302 assumes the safe state. The second control unit 315 is designed to be dependent on a second error state, the second component 324 of the apparatus 302 to drive so that the apparatus 302 assumes the safe state. An exit 313 of the first controller 312 is with an entrance 317 of the second controller 315 connected. Likewise is an exit 316 of the second ECU 315 with an entrance 314 of the first controller 312 connected. It is understood that said inputs and outputs do not have to be present as separate physical interfaces, but are preferably realized via a bus connection between the control units. By transmitting monitoring signals between the control units 312 and 315 a mutual monitoring of the control devices is provided.

The device 300 may be configured to the method for transferring the apparatus 302 to execute in a safe condition.

4 shows a detailed block diagram of the embodiment of the device 300 according to the present invention. Shown are separate shutdown paths and mutual monitoring in a distributed engine control.

The device has the controllers 312 . 315 on. The first controller 312 may be formed to a first component in the form of a throttle valve 322 to drive and the second control unit 315 may be formed to a second component in the form of injection valves 324 head for. The first controller 312 can block a "shutdown path 1" 431 , a block "level-2" 432 and a block "level-3" 433 having a testing device. The second control unit 315 can make a block "shutdown path 2" 436 , a block "level-2" 437 and a block "level-3" 438 having a testing device.

The first controller 312 and the block 432 of the first controller 312 may be configured to receive a signal from an accelerator pedal 441 to recieve. The block 432 may be configured to send a signal to the block 431 provide and a signal from the throttle 322 to recieve. The second control unit 315 and the block 437 of the second controller 315 can be designed to receive in each case a signal from a sensor n_Mot (KWG) 442 as well as a rail pressure sensor 443 to recieve. The block 437 may be configured to send a signal to the block 436 provide and a signal from the injectors 324 to recieve. The blocks 432 . 437 may be configured to transmit control or communication signals between each other. The blocks 433 . 438 can be configured to transmit between each other, the first and the second signal, for example, question-answer signals or monitoring signals.

To deal with in 4 to get the same security level as shown in one of the 1 and 2 shown individual control unit, the components or actuators 322 . 324 the two separate control units 312 . 315 be assigned in the way that over both control devices 312 . 315 in case of failure, a safe shutdown, for example, the engine is possible.

This eliminates every single one of the ECUs 312 . 315 the need to arrange a second independent monitoring component, for example in the form of a monitoring computer, a monitoring module or a watchdog. Rather, the monitoring of each controller 312 . 315 through the other control unit 312 . 315 via a secured bus communication. This can be done with similar mechanisms as between the in 1 shown CPU and the monitoring module is common. For example, a question-answer communication between the controllers 312 . 315 be used.

For a gasoline engine control, this can be realized by, for example, the control unit 315 the control of the injection valves 324 and the ignition is assigned. At the other control unit 312 are then, for example, the throttle 322 and the fuel pump connected. Thus, there are two spatially, logically and electrically disconnected Abschaltpfade the safe shutdown of the engine in case of failure by one of the two control units 312 . 315 allow.

For a diesel engine control the division can be made so that on a control unit, the injectors are connected and on the other control unit, the control valves for the generation the fuel pressure and the fuel delivery pump. Both by parking the injectors on the one hand and by Abregeln or shutdown the fuel pressure or the fuel delivery on the other hand, the Engine safely parked.

One Another advantage of separate control units is given by the fact that in the event of an error not necessarily a shutdown of the respective component the shutdown of the power amplifier for the achievement of the safe state must be performed. This is included a conventional one control unit necessary, because the monitoring module no active intervention, but only a shutdown can perform.

Since a second functional control unit is still available in the event of a single fault in the distributed system, it is now possible to ensure the safe state even if active activation of a specific state of a component must be carried out on the shutdown path. An example of this could be the active activation of a pressure reduction valve in the event of a fault be.

possible alternatives the approach of the invention are given by the fact that at usual Motor concepts several components to shut down the engine to disposal stand. these can then distributed in several combinations on two control units be sure that at least one yourself on every controller located.

For one Otto engine may be the components typically injectors, ignition coils or spark plugs, the throttle, the fuel pump, the fuel quantity control of the high pressure pump act on direct injection or the high pressure control valve.

For one Diesel engine may typically be around at the components Injectors, possibly the throttle, the fuel pump, the fuel quantity control of the high pressure pump or the high pressure control valve act.

The described embodiments are chosen only as an example and can be combined with each other. In particular, a physical Assignment of components to a motor control system that out more than one controller exists, adapted to the respective circumstances. There can be more as two separate controllers be used, in turn, any number of components can be assigned.

102

facilities for providing an input signal

104

CPU

106

final stage

108

Watchdog unit

112 114, 116

levels

121

Block "Driving functions"

122

Block "Diagnosis"

123

Block "Program flow"

124

Block "memory test"

125

Block "Question-answer communication"

126

Block "Command Test"

130

actuators

203

Motronik controller

300

Facility

302

apparatus

312 315

control unit

313 316

output

314 317

entrance

322 324

components

431, 432, 433

Blocks of the first control unit

436 437, 438

Blocks of the second control device

441, 442, 443

sensors

Claims (11)

Control unit ( 312 ; 315 ) for a motor vehicle having an output ( 313 ; 316 ) for sending a first signal to a second control device ( 315 ; 312 ), an entrance ( 314 ; 317 ) for receiving a second signal from the second ( 315 ; 312 ) or another control unit, wherein the control unit ( 312 ; 315 ) is set up to use an apparatus ( 302 ) of the motor vehicle in a safe state, when the second signal is a malfunction of the second ( 315 ; 312 ) or the further control device displays. Control unit ( 312 . 315 ) according to claim 1 with a test device ( 433 . 438 ), which is designed to be in the event of a malfunction of the control unit ( 312 . 315 ) at least one error signal at the output ( 313 . 316 ). Control unit ( 312 . 315 ) according to claim 1 or 2, arranged to provide secure bus communication for transmission of the first signal. Control unit ( 312 . 315 ) according to one of the preceding claims, which is designed to separate the apparatus (independent of the second signal). 302 ) of the motor vehicle. Device for transferring an apparatus ( 302 ) of a motor vehicle in a safe state comprising at least two control devices ( 312 . 315 ) according to one of the preceding claims, wherein at least one for the operation of the apparatus ( 302 ) required component ( 322 . 324 ) is provided, wherein the first control unit ( 312 ) is formed, in order, depending on a first error state, the at least one component ( 322 ) of the apparatus so that the apparatus assumes the safe state; and the second controller ( 315 ) is formed, in order, depending on a second error state, the at least one component ( 324 ) of the apparatus so that the apparatus assumes the safe state. Facility ( 300 ) according to claim 5, wherein the first control device ( 312 ) is adapted to receive at least a first error signal, the indicates the first fault condition, and wherein the second control unit ( 315 ) is configured to receive at least a second error signal indicative of the second error condition. Facility ( 300 ) according to claims 2 and 6, wherein the test device ( 433 . 438 ) is designed to be in case of malfunction of the first control device ( 312 ) provide the at least one second error signal, and in the event of a malfunction of the second control device ( 315 ) to provide the at least one first error signal. Facility ( 300 ) according to one of claims 5 to 7, wherein the apparatus ( 302 ) as an internal combustion engine and the at least one component ( 322 . 324 ) are designed as injection valve, ignition device, throttle valve, fuel pump, fuel quantity control and / or as a high-pressure control valve. Method for transferring an apparatus ( 302 ) of a motor vehicle in a safe state, wherein at least one for the operation of the apparatus ( 302 ) required component ( 322 . 324 ), wherein at least two control devices ( 312 . 315 ) are provided according to one of claims 1 to 4, with the following steps: driving the at least one component ( 322 . 324 ) of the apparatus ( 302 ) depending on a first fault condition, so that the apparatus assumes the safe state; and driving the at least one component ( 322 . 324 ) of the apparatus ( 302 ) depending on a second fault condition, such that the apparatus ( 302 ) assumes the safe state. Computer program with program code means to all Steps of a method according to claim 9 to perform if the computer program is on a computer or equivalent Computer unit executed becomes. Computer program product with program code means, which are stored on a computer-readable medium to all To perform steps of a method according to claim 9, when the computer program product on a computer or on a corresponding one Computer unit executed becomes.