DE102018009560A1 - Method for operating control devices of a motor vehicle, in particular of a motor vehicle - Google Patents

Abstract

The invention relates to a method for operating control devices (12, 14, 16) of a motor vehicle, in which the initially deactivated control devices (12, 14, 16) are activated in a targeted manner according to a first sequence, whereupon the activated control devices (12, 14, 16 ) are selectively deactivated according to a different from the first sequence second sequence.

Description

The invention relates to a method for operating control devices of a motor vehicle, in particular of a motor vehicle.

The DE 10 2008 050 272 A1 discloses a power supply management apparatus for a vehicle having a first function for detecting a start of one of electric loads attached to a vehicle and subjected to power supply management.

Object of the present invention is to provide a method by which a particularly high reliability of control devices can be realized.

This object is achieved by a method having the features of patent claim 1. Advantageous embodiments with expedient developments of the invention are specified in the remaining claims.

In the method according to the invention for operating control units of a motor vehicle, in particular of a motor vehicle, it is provided that the initially deactivated control units are activated in a targeted manner according to a first sequence. After an operation of the control units following the activation, the control units activated by the activation are deactivated in a targeted manner according to a second sequence different from the first sequence, wherein preferably between activating and deactivating, a further activation and a further deactivation are omitted.

The sequences differ, for example, in their sequences in which the controllers are activated and deactivated. Alternatively or additionally, the sequences may differ in their respective time periods between the activation and deactivation of respective two of the controllers. The different sequences lead to different operating times of the control units. As a result, the probability that it comes to a simultaneous failure of all ECUs are kept particularly low. In other words, it can be ensured with a high probability that at least one or more of the control units at least one of the control units is still active, so that the still active control unit detects or can determine that at least one or more control units have failed. As a result, safe states of functions or components can be set, for example, by the still active, not failed control device, whereby safe operation can be realized.

The invention is based in particular on the following findings: In automated driving, whose functions provide safety-relevant availability requirements for a combination of control units, since, for example, no human or no driver can intervene, it should be ensured that the relevant control units do not fail at the same time and thus the failure of one or more control devices of at least one remaining, still active control unit still recognized in good time before the own failure and in the consequence the motor vehicle can be transferred to a safe state. One cause of the simultaneous failure of ECUs may be aging processes in electronic components of the ECUs.

To keep the likelihood of a simultaneous failure of all control units particularly low, which also called startup as well as the deactivation of the control devices, also referred to as shutdown occurs, for example, at the beginning or end of a driving or battery cycle in a particular order, for example, on a longer period of, for example, three years leads to significantly different operating times of the control units in the network. As a result, significantly different operating times of the control devices can be realized, in particular towards the end of the service life of the control devices, in particular when the so-called bathtub curve increases. The inventive method, a simultaneous failure of all control devices that monitor each other and can transfer the failure of one of the control units, the motor vehicle in a safe state, can be avoided with a high probability, since aging processes of the control units no longer run the same. This is particularly advantageous for components such as memory and / or processor components of the same manufacturer. The method avoids a common cause error.

In other words, the different operating times lead to different probabilities with which the control units fail in each case. This can minimize the likelihood of all ECUs failing simultaneously. As a result, a particularly advantageous mutual monitoring of the control devices with each other can be ensured, so that when one or more of the control units fail, the still active control unit can convert the motor vehicle into a safe state. The activation, which is also referred to as turn-on, and deactivation, which is also referred to as turn-off, is purposefully controlled or regulated, for example, so that different total operating times of the control units occur.

Further advantages, features and details of the invention will become apparent from the following description of a preferred embodiment and from the drawing. The features and feature combinations mentioned above in the description as well as the features and feature combinations mentioned below in the description of the figures and / or in the figures alone can be used not only in the respectively specified combination but also in other combinations or in isolation, without the scope of To leave invention.

• 1 eine schematische Darstellung zur Veranschaulichung eines erfindungsgemäßen Verfahrens zum Betreiben von Steuergeräten eines Kraftfahrzeugs;
• 2 ein Diagramm zum weiteren Veranschaulichen des Verfahrens; und
• 3 ein Diagramm zum weiteren Veranschaulichen des Verfahrens.

The drawing shows in:

• 1 a schematic representation for illustrating a method according to the invention for operating control units of a motor vehicle;
• 2 a diagram for further illustrating the method; and
• 3 a diagram for further illustrating the method.

1 shows a schematic representation of a composite 10 from control units 12 . 14 and 16 a preferably as a motor vehicle, especially as a passenger car, trained motor vehicle. The controllers 12 . 14 and 16 are arranged, for example, in a network or in a data bus and connected via the network or the data bus at least signal technology, so that the control units 12 . 14 and 16 can communicate with each other via the network or the data bus, in particular, can exchange data with each other. The respective control unit 12 . 14 . 16 is an electronic computing device, by means of which, for example, at least one component of the motor vehicle operated, in particular controlled or regulated, can be. In particular, the control devices 12 . 14 and 16 in the association, also referred to as the control unit network 10 used to perform an autonomous drive or an autonomous driving the motor vehicle.

In 1 illustrate arrows 18 that are the controllers 12 . 14 and 16 monitor each other. This monitoring is also called monitoring. By a in 1 schematically illustrated lightning 20 is illustrated that, for example, the control unit 12 fails. This failure of the controller 12 can at least one of the still active ECUs 14 and 16 be recognized. As a result, for example, the control unit 14 and or 16 the component, which by means of the control unit 12 is operated or was in a safe state, so that the vehicle can be transferred to a safe state in total. It can be seen from this example that it is advantageous if one or more of the control devices fails 12 . 14 and 16 at least one of the control units 12 . 14 and 16 is still active. In this case, the at least one, still active control unit 12 . 14 respectively 16 to ensure a safe condition of the motor vehicle.

The following is a method of operating the control devices 12 . 14 and 16 described. By means of the method, the probability that the control units 12 . 14 and 16 be in the control unit network due to the same aging processes simultaneously or simultaneously fail, be kept particularly low. This is particularly advantageous for a combination of control units with safety-relevant availability requirements, as is the case with automated or piloted driving of the motor vehicle. A failure of one or more of the control units 12 . 14 and 16 should not lead to an unsafe condition. For example, braking and steering along trajectories and / or environmental monitoring should not be unexpected and fail to transition to a safe state. This is particularly relevant if no person is present who could notice the failure of the respective control unit and could take over control or guidance of the motor vehicle.

To the likelihood that it will lead to a simultaneous failure of all control devices 12 . 14 and 16 the control unit network comes to keep particularly low, it is advantageous if the respective operating times, also referred to as total operating times of the control units involved 12 . 14 and 16 With increasing operating time are so far different that each aging processes of the control units 12 . 14 and 16 located in different stages. As a result, for example, if necessary, a failure order of the control units 12 . 14 and 16 be influenced to a limited extent, in particular controlled.

In order to realize a particularly high level of operational reliability, it is provided in the method that the initially deactivated control units 12 . 14 and 16 are selectively activated according to a first sequence, whereupon the activated control units 12 . 14 and 16 are selectively deactivated according to a different from the first sequence second sequence. For this purpose, it is provided, for example, that the first sequence has a first order in which the control devices 12 . 14 and 16 be activated, wherein the second sequence comprises a second order different from the first order, according to which the control units 12 . 14 and 16 be deactivated.

Alternatively or additionally, it may be provided that the activation, which is also referred to as start-up, and / or the deactivation of the control devices, which is also referred to as switching off or switching-off 12 . 14 and 16 with time delays. This is based on 2 illustrated. In 2 designated t _S1 a first time, t _S2 a second time, ts3 a third time, t _E1 a fourth time, t _E2 a fifth time and t _E3 a sixth time. The control unit 12 will be at the first time t _S1 activated, the controller 14 becomes the second time t _S2 activated, and the controller 16 becomes the third time t _S3 activated. Thus, the first sequence includes the times t _S1 . t _S2 and t _S3 , Between the times t _S1 and t _S2 is a first period of time Δt ₁ , which is also called the first delay. Between the times t _S2 and t _S3 is a second time span Δt ₂ , which is also referred to as the second delay. Thus, the activation of the controller takes place 14 delayed by the first delay after activating the controller 12 , activating the controller 16 occurs at the second delay delayed to activate the controller 14 ,

At the time t _E1 becomes the controller 12 disabled at the time t _E2 becomes the controller 14 disabled, and at the time t _E3 becomes the controller 16 disabled. Between the times t _E1 and t _E2 is a third period of time Δt ₃ , which is also called the third delay, and between times t _E2 and t _E3 is a fourth time span Δt ₄ , which is also referred to as the fourth delay. Thus, the second sequence includes the times t _E1 . t _E2 and t _E3 as well as the third delay and the fourth delay. Disabling the controller 14 is thus delayed by the third delay to disable the controller 12 , and disabling the controller 16 is delayed by the fourth delay to disable the controller 14 , The first delay and the second delay may be equal or different. The third delay and the fourth delay may be equal or different. The third delay is greater than the first delay and greater than the second delay, and the fourth delay is greater than the first delay and greater than the second delay. For this it comes to different, in 2 illustrated by arrows operating times of the control units 12 . 14 and 16 , where the operating time of the controller 12 With 22 , the operating time of the controller 14 With 24 and the operating time of the controller 16 With 26 are designated. The delays are such that the operating times 22 . 24 and 26 differ in pairs. This may increase the likelihood of the controllers 12 . 14 and 16 at the same time, are kept particularly low, especially with regard to the respective, in 3 shown bathtub curves 28 . 30 and 32 of the respective control device 12 . 14 and 16 ,

3 shows a diagram on the abscissa 34 the time is up. On the ordinate of the chart is the failure rate 36 applied. The respective bathtub curve 28 . 30 and 32 illustrates the observed error rate of the respective ECU 12 . 14 respectively 16 , This illustrates the bathtub curve 28 the observed failure rate of the controller 12 , the bathtub curve 30 the observed failure rate of the controller 14 and the bathtub curve 32 the observed failure rate of the controller 16 , Especially good 3 can be seen that due to the different sequences aging processes of the control units 12 . 14 and 16 can be influenced, so the likelihood of causing a simultaneous failure of all control devices 12 . 14 and 16 comes, can be kept very low. Under a failure of the respective control unit 12 . 14 and 16 It should be understood, for example, that there is an unexpected and sudden deactivation of the initially activated control device 12 . 14 respectively 16 comes. Furthermore, a failure can be understood as resulting in a malfunction of the respective control device 12 . 14 respectively 16 comes.

Overall, it can be seen that the control units 12 . 14 and 16 have different operating times by the method in the same operating cycle. About the respective lifetime of the respective control unit 12 . 14 respectively 16 The different operating times add up and lead to different probabilities for the failure of the ECUs 12 . 14 and 16 at the same time, with increasing difference in increasing life or lifetime.

LIST OF REFERENCE NUMBERS

10

composite

12

control unit

14

control unit

16

control unit

18

arrow

20

lightning

22

uptime

24

uptime

26

uptime

28

bathtub curve

30

bathtub curve

32

bathtub curve

34

abscissa

36

Failure rate

t _E1

time

t _E2

time

t _E3

time

t _S1

time

t _S2

time

t _S3

time

Δt ₁

Period of time

Δt ₂

Period of time

Δt ₃

Period of time

Δt ₄

Period of time

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102008050272 A1 [0002]

Claims (3)

Method for operating control devices (12, 14, 16) of a motor vehicle, in which the initially deactivated control devices (12, 14, 16) are activated in a targeted manner according to a first sequence, whereupon the activated control devices (12, 14, 16) are targeted according to a be deactivated by the first sequence of different second sequence. Method according to Claim 1 characterized in that the first sequence comprises a first order in which the controllers (12, 14, 16) are activated, and the second sequence comprises a second order different from the first order, according to which the controllers (12, 14, 16 ) are disabled. Method according to Claim 1 or 2 , characterized in that between the activation of each two of the control devices (12, 14, 16) a first time period and between the deactivation of the respective two of the control devices (12, 14, 16) is a different from the first time period second period.

Images