DE102015221951A1 - Procedure for checking a monitoring function - Google Patents

Abstract

The invention relates to a method for checking a monitoring with respect to at least one correlated with an acceleration of a motor vehicle size, wherein in a functional level (110) at least one default (115) for the at least one size is generated, wherein in a monitoring plane (120) the at least a default (115) is monitored by determining whether an actual value (122) of the at least one magnitude differs by more than a threshold from a setpoint (121) of the at least one magnitude, and wherein the monitoring takes into account a difference (124) between the setpoint value (121) and the actual value (122) of the at least one variable is checked.

Description

The present invention relates to a method for checking a monitoring with regard to at least one variable correlated with an acceleration of a motor vehicle and to a computing unit and a computer program for carrying it out.

State of the art

The monitoring in processing units such as engine control units in modern motor vehicles can be constructed according to a 3-level concept (see "Standardized E-Gas Monitoring Concept for Gasoline and Diesel Engine Controls", Working Group EGAS, 05.07.2013, Version 5.5) Level, the functional level, includes motor control functions, including the implementation of the requested engine torques, component monitoring, the diagnosis of input and output variables, as well as the control of the system reactions in the event of a detected error.A second level, the function monitoring level, identifies the erroneous sequence of monitoring-relevant quantities Functional software in level 1, inter alia, by monitoring the calculated moments or the vehicle acceleration For this purpose, for example, a setpoint torque with an actual torque or a setpoint acceleration with an actual acceleration are compared monitoring level controls whether the second level works correctly by means of a question and answer communication. In the event of an error, the triggering of system reactions takes place independently of the function computer.

Disclosure of the invention

According to the invention, a method for checking a monitoring function as well as a computing unit and a computer program for carrying it out with the features of the independent patent claims are proposed. Advantageous embodiments are the subject of the dependent claims and the following description.

A method according to the invention serves to check a monitoring with regard to at least one variable correlated with an acceleration of a motor vehicle, in particular in the context of a so-called control device monitoring. In this case, at least one specification for the at least one variable is generated in a function level, and the at least one specification is monitored in a monitoring level by determining whether an actual value of the at least one variable deviates by more than a threshold value from a nominal value of the at least one variable , Conveniently, the threshold value can also be linked to a time duration for which the quantity must exceed the threshold value. The at least one specification may in particular comprise a maximum and / or minimum value for the at least one variable, and the at least one variable may include in particular an acceleration of the motor vehicle and / or a torque of an internal combustion engine of the motor vehicle. The monitoring is now checked taking into account a difference between the setpoint and the actual value of at least one size.

Problems arise both during the development phase and in series, especially in the case of engine control units, which arise from inconsistencies of the functional level and the monitoring level, for example due to functional differences, if a functional further development of the functional level software was not correctly replicated in the monitoring level or for example due to incorrect or inaccurate application.

Since setpoints and actual values are compared in the monitoring level and detected for faults and an error reaction is triggered when the actual value exceeds the setpoint by more than a threshold value, there is no information about how robust the monitoring is. This means that, for example, not only large differences between the actual and setpoint values are recognized as errors, but also small differences that possibly only occur due to poor application and / or poor agreement with the functional level and actually should not necessarily be treated as errors ,

In addition, the specifications are often also defined in the context of so-called vehicle states, and then the vehicle states in the functional level are often defined differently than corresponding states in the monitoring level that some vehicle states in one of the planes are absent or timed shifted from one another become. For example, vehicle conditions may include different conditions for different sizes of the motor vehicle, such as certain limits for acceleration or torque. This can then result in a change of vehicle states greater differences in a comparison of the setpoint and actual values.

Although, for example, in order not to erroneously recognize an unwanted acceleration or deceleration, jumps in the differences can be damped by filtering before and / or during the comparison of the setpoints and actual values. However, this increases the reaction times in case of security, which is contrary to a desire for faster reaction times.

The proposed method can now be used to check the aforementioned monitoring with regard to the at least one variable correlated to an acceleration of a motor vehicle, which in particular includes an acceleration of the motor vehicle and / or a torque of an internal combustion engine of the motor vehicle, by means of the difference between the setpoint and the actual value. In this way, a statement about the robustness of the monitoring can be made and this, for example, in the course of development or even improve in series. The invention makes use of the fact that based on the difference between the setpoint and actual value, a statement about the robustness of the monitoring can be made, as erroneous error detection occurs especially at low differences and thus lead to poor robustness.

Advantageously, the monitoring is checked taking into account the difference by determining a parameter from the difference and / or a change in the difference during operation of the motor vehicle. Such a parameter may, for example, depending on the difference or the change in the difference (ie a time derivative of the difference) provide a qualitative statement about a correct or incorrect error detection, for example. By the probability of incorrect error detection with the difference determined in relation is set. For this purpose, for example, measured values of the difference or the change in the difference can be stored during operation of the motor vehicle and later evaluated offline.

Preferably, the difference and / or the change in the difference during operation of the motor vehicle as a function of an operating point of the motor vehicle and / or a change in an operating point of the motor vehicle are determined and then taken into account in the monitoring. During monitoring, an already determined difference or change in the difference can thus be taken into account for specific operating points or a change in such. This optimizes monitoring to the extent that errors are less frequently detected incorrectly. In particular, such tracking or learning of the difference leads to automatic adaptation of slow deviations occurring during a prolonged operation, while short-term deviations can still be recognized as errors. In particular, vehicle states, such as occur during operation of a vehicle, can also be used as operating points.

Expediently, the determined difference and / or the determined change in the difference are stored as a table or characteristic field, in particular as a function of the operating point of the motor vehicle and / or the change of the operating point of the motor vehicle, for example in a suitable memory of an executing arithmetic unit. This allows quick access to the data both during operation and later offline.

Alternatively, it is preferable if the determined difference and / or the determined change of the difference are taken into account in a numerical model, which is taken into account in the monitoring. Such a model can be done, for example, in the context of a data model-based or model-based application. In principle, in the model-based application, the previous physical-analytical relationship can be replaced by parameter application (or also by means of a map or parameter-based software) by a mathematical or numerical model and associated model training for learning the model parameters.

Such a model may basically consist of a mathematical or numerical algorithm (e.g., Gaussian algorithm). Universal models include, for example, new statistical learning methods that offer a universal approach to mapping high-dimensional dependencies, a replacement or simplification of complex map structures, allowing for complexity reductions and possibly performance benefits. In addition, an unprecedented accuracy in relation to the Parametrieraufwand is possible and it can be a similar model structure for a variety of problems such as. A pressure wave correction, an air system or a torque model can be used, which offers a high synergy potential for efficient functional development.

A model-based application usually includes a design of experiments, a measurement on the real system, a parameterization of the model, model variation and model optimization as well as a selection of the best compromise. Trained model data can preferably be stored in the control unit and the model run at runtime of the software.

In this case, such a numerical model can be stored, for example, in an executing arithmetic unit and continuously adapted taking into account the determined values. Such a numerical model can then be considered online during the monitoring. Furthermore, the numerical model has the advantage that vehicle states or operating ranges of the motor vehicle, which are problematic to achieve during the application on the test stand or on the motor vehicle, can be easily and better simulated.

It is advantageous if, during the monitoring, reference values for the difference and / or the change of the difference as a function of the at least one specification, a sequence of specifications and / or a duration of the at least one specification are taken into account. For this purpose, the reference values can be determined, for example, in the case of a correctly functioning reference motor vehicle and then stored accordingly and used for the monitoring. The reference values are expediently taken into account as initial values which are adapted during operation of the motor vehicle taking into account the difference and / or the change in the difference. In this way the monitoring becomes more accurate and reliable, ie its robustness is increased.

The difference is preferably used as a quality criterion and / or evaluation criterion for a calculation and / or application of a computing unit. For example. the determined or learned difference can be used to assess the completeness and / or correctness of the monitoring functions at the surveillance level. Great differences indicate, for example, in which vehicle state, combinations or sequences of vehicle states, etc., the application or assessment is not suitable and / or the monitoring functions are not sufficient. Supplied (third-party) software can thus be checked without knowledge of the exact software implementation regarding the quality of the surveillance. In addition, the difference between the initial values of the learning function and the current learning values can be monitored, for example by means of systematic field data acquisition via diagnosis / service and / or by means of the Internet, in particular so-called Web 3.0 technologies. When tracking to large differences between initial and current learning values is a problem of the components and / or, for example, insufficient, monitoring functions itself. By means of the learned differences, it can be ensured that the permissible difference between the functional level and the monitoring level always has a virtually uniform distance to the threshold value for detecting an unwanted acceleration or deceleration.

An arithmetic unit according to the invention, e.g. a control unit, in particular an engine control unit, of a motor vehicle is, in particular programmatically, configured to perform a method according to the invention.

Also, the implementation of the method in the form of a computer program is advantageous because this causes very low costs, especially if an executive controller is still used for other tasks and therefore already exists. Suitable data carriers for providing the computer program are in particular magnetic, optical and electrical memories, such as e.g. Hard drives, flash memory, EEPROMs, DVDs, etc. It is also possible to download a program via computer networks (Internet, intranet, etc.).

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

The invention is illustrated schematically with reference to an embodiment in the drawing and will be described below with reference to the drawing.

Brief description of the drawings

1 schematically shows a sequence of a method according to the invention in a preferred embodiment.

2 shows schematically various vehicle states that can be considered when performing a method according to the invention in a preferred embodiment.

Embodiment (s) of the invention

In 1 schematically a method according to the invention for checking a monitoring in a preferred embodiment is shown. A computer designed as a motor control unit 100 has three levels for a monitoring concept.

In a functional level 110 a software for a motor control is performed on a functional level. As an example, here is a vehicle condition 111 shown to be expired or respected. For this purpose, for example, a condition 130 be predetermined by a driver of an associated motor vehicle, for example by pressing an accelerator pedal, a speed selector and / or other setting.

Due to the condition 130 Then the vehicle state is determined, are made in the various specifications that define the vehicle condition. By way of example, here is a default 115 shown for acceleration. Furthermore, for example. Specifications 116 and 117 be made for a speed and a driving level. Ultimately, from the pedal request, ie the driver request for the acceleration, a desired propulsion torque (or wheel torque) is interpreted. Depending on the drive train topology, for example in a so-called P2 hybrid according to an operating strategy (energy management without and with prediction using navigation data and / or near field data), the moment requirement is divided into the engine torque and the electric motor torque.

At a surveillance level 120 is now a monitoring of the functional level 110 carried out. This is the condition 130 also to the surveillance level 120 transmitted, from which then a setpoint 121 is determined for the acceleration.

Continue to the monitoring level 120 an actual value 122 transmitted acceleration, for example by an accelerometer 140 which can be arranged at a suitable location in the motor vehicle. As part of the monitoring is now determined whether the actual value 122 the setpoint 121 exceeds more than a threshold or not. Instead of just a fixed threshold, the threshold and a duration of the test can be linked. For example. can be checked whether a torque difference of, for example, 50 Nm for 2 sec or of, for example, 100 Nm for 1 sec was exceeded. In this way, a multi-performance evaluation can be made, which can lead to an acceleration of the vehicle with respect to the example.

If the actual value 122 the setpoint 121 exceeds more than the threshold, becomes an error 123 detected and it is triggered a suitable error response. In the case of an unwanted acceleration, for example, in a first stage, an attempt to limit the power by a monitoring function (throttle or injection quantity) can be undertaken, so that engine operation is still possible. In a second stage, the internal combustion engine could then be switched off, for example, if a final stage deactivation or a reset is not converted.

In the case of an unwanted delay, which is generally relevant only in conjunction with an electric drive, for example, could be made in a first stage, a limitation of the recuperation of the electric motor (limiting retardation torque via electric motor). In a second stage, a prohibition for the recuperation moment (prohibition of deceleration torques via electric motor) could then be set so that the operation of the internal combustion engine is still possible

Because the functional level 110 and the surveillance level 120 work essentially independently, it may happen that in the functional level 110 formed vehicle states of the associated states in the monitoring level 120 differ. This may, for example, be the case if the two levels originate from different manufacturers, ie if, for example, the functional level 110 provided by a supplier.

Furthermore, it can also by the separate supply of the condition 130 to the two levels to temporal differences in the processing come, especially when switching between two vehicle states. This can lead to an error at the monitoring level 123 is recognized, although according to functional level no error was present. As already mentioned, the error detection takes place by comparing setpoint and actual value.

Furthermore, according to the present invention, a difference will now be made 124 between the setpoint 121 and the actual value 122 determined. From the difference 124 itself and / or from their temporal change, in particular taking into account the current vehicle conditions and / or other operating conditions of the motor vehicle, can now turn a parameter 125 be determined. The characteristic 125 provides a measure of the robustness of the monitoring by means of the detection of the error 123 Also, by means of the characteristic 125 If, for example, this is adjusted over the operating period, it will be decided whether the error will occur 123 is recognized. In this case, a difference can be learned or adapted over the operating period 124 and possibly a security surcharge on the error 123 getting closed.

The term robustness can here be understood to mean a tolerance to the described functional and / or application differences and / or state changes of the control software and / or the controlled system, etc. between the functional level and the monitoring level, so that the monitoring in a correct system is not falsely triggers the security case.

The robustness is shown, for example, in a sufficient distance of the difference between the acceleration or the torque of function and monitoring level to the threshold for detecting a safety-critical case.

With the proposed method, by learning the permissible differences of acceleration or torque as a function of the states or state changes in the functional and monitoring level and combinations, for example, between these increases the robustness against false detections of the security case and the sensitivity and reaction time of detection a security case can be significantly improved.

The increase in sensitivity can be achieved in that the threshold value for detecting the security case can be chosen to be smaller than previously customary, since no provision for previously unknown permissible differences is necessary.

The shortening of the reaction time can be achieved by eliminating the need for filters to attenuate short-term, higher differences in the case of unknown state changes in the planes and between the planes, and thus not unnecessarily delaying the detection time of a security case.

By considering the difference 124 and in particular also the determination of the parameter 125 It is thus possible to increase the robustness of surveillance by the surveillance level 120 in the engine control unit 100 to check.

Furthermore, now the difference 124 and / or their change, in particular via the characteristic 125 , be used for an adjustment of the subsequent or future monitoring. Because of the difference 124 or the characteristic 125 can be determined to what extent an error detection was right or wrong, so for example, a limit for the error detection, ie in particular the threshold value can be adjusted. In particular, this can be done individually for different vehicle states, transitions between vehicle states and also taking into account further operating conditions of the motor vehicle.

Furthermore, it can be provided that reference values 150 be included in the monitoring or verification of the monitoring by, for example, the reference values determined on a reference vehicle 150 be used for an initial adjustment of the monitoring with respect to the error detection. The on the reference values 150 based monitoring can then be determined by the difference determined during operation 124 or whose change is continuously adjusted. Overall, the robustness of the monitoring is thus significantly increased.

There is still a third level 130 in which a monitoring of the hardware of the engine control unit 100 regarding their correct functioning. This third level 130 is not relevant to the present invention and therefore will not be described in detail.

In 2 schematically different vehicle states, which can be considered in carrying out a method according to the invention in a preferred embodiment shown. In particular, in a preferred embodiment of the method according to the invention, it is possible to determine the difference or the change in the difference during operation, in particular to determine it over a relatively long period of time and to use it for monitoring.

Thus, learning a permissible difference between a value of the vehicle state or state of the functional level 110 (In the figure, the states A, B, C, D are shown as examples), and a value that depends on the state of the monitoring level 120 (In the figure, the states a, b, c are shown) depends, possible.

The term "states" includes in particular the differentiation of acceleration-relevant variables such as, for example, environmental variables, vehicle states, powertrain states, engine operating states, and the like. The state determination takes place separately and independently in the functional level and the monitoring level. That the way of state determination is similar but not necessarily identical and can be done with, albeit small, time offsets. In addition, it may also be that certain states exist in one level and not in the other. Also differences in accuracy and detailing are possible. The aspect of time offset, albeit small, is becoming increasingly important with the parallelization of software within the framework of MultiCore concepts.

Possible state definitions are dependent upon the presence of environmental information, the type of vehicle, a powertrain topology, etc. The state detection may be based on sensor values, e.g. Clutch open, manipulated values, e.g. Internal combustion engine on and off, and other calculated or transmitted quantities, e.g. Road gradient, done independently in the plains. As environmental conditions are e.g. an uphill, a level trip, a downhill, an effective wind on the vehicle or road characteristics such as coefficients of friction, poor path detection, aquaplaning, etc. into consideration. Vehicle states are e.g. Driving, in particular with a further distinction between deceleration, braking, constant driving, accelerating, and standing, in particular with a further distinction between parking, living, stop, engine on or off, starting, into consideration. As powertrain conditions are e.g. Types of driving such as electromotive driving, internal combustion engine driving and sailing (clutch to the engine open), engine on and off and hybrid driving into consideration. As types of deceleration, for example, conventional braking, recuperative braking or internal combustion engine thrust operation come into consideration.

Now, the difference between the torque or acceleration values between the monitoring level 120 and functional level 110 depending on the states and state changes in the levels and between the levels (different combinations, eg aA, aB, bA, bB etc. possible) on a correct and gedateten vehicle learned and stored. On these learned differences, a small safety margin can be added. The learned differences are for example the maximum permissible differences occurring in a state combination or state change combination.

In normal operation, the difference can now be permanently stored in the (same) vehicles, e.g. the torque or acceleration values between the monitoring level and the functional level and the states and state changes in and between the levels determined and compared with the learned state-dependent and state change dependent differences plus the safety margin. If the current difference is greater than the learned difference plus the safety distance, it is thus possible to detect a safety case.

Optionally, even times since the last state change in the respective level (function or monitoring level) can be included in the learning and test procedure.

Claims (12)

Method for checking a monitoring with regard to at least one quantity correlated with an acceleration of a motor vehicle, wherein in a functional level ( 110 ) at least one default ( 115 ) is generated for the at least one size, wherein in a monitoring level ( 120 ) the at least one default ( 115 ) is monitored by determining whether an actual value ( 122 ) of the at least one size by more than a threshold of a setpoint ( 121 ) of at least one size, and wherein the monitoring takes into account a difference ( 124 ) between the setpoint ( 121 ) and the actual value ( 122 ) of at least one size is checked. Method according to claim 1, wherein the monitoring takes into account the difference ( 124 ) is checked by a characteristic ( 125 ) from the difference ( 124 ) and / or a change in the difference ( 124 ) is determined during operation of the motor vehicle. Method according to claim 1 or 2, wherein the difference ( 124 ) and / or the change of the difference ( 124 ) are determined during operation of the motor vehicle as a function of an operating point of the motor vehicle and / or a change in an operating point of the motor vehicle and subsequently taken into account in the monitoring. Method according to claim 3, wherein the determined difference ( 124 ) and / or the change in the difference ( 124 ) are stored as a table or map. Method according to claim 3, wherein the determined difference ( 124 ) and / or the change in the difference ( 124 ) are taken into account in a numerical model, which is taken into account in the monitoring. Method according to one of the preceding claims, wherein reference values ( 150 ) for the difference ( 124 ) and / or the change of the difference ( 124 ) depending on the at least one default ( 115 ), a sequence of specifications and / or a duration of the at least one specification ( 115 ). Method according to claim 6, wherein the reference values ( 150 ) are taken into account as initial values which, during operation of the motor vehicle, take account of the difference ( 124 ) and / or the change of the difference ( 124 ) be adjusted. Method according to one of the preceding claims, wherein the at least one size comprises an acceleration of the motor vehicle and / or a torque of an internal combustion engine of the motor vehicle. Method according to one of the preceding claims, wherein the difference ( 124 ) as a quality criterion and / or evaluation criterion for a calculation and / or application of a computing unit ( 100 ) is used. Arithmetic unit ( 100 ), which is adapted to perform a method according to any one of the preceding claims. Computer program comprising a computing unit ( 100 ) to perform a method according to any one of claims 1 to 9 when it is executed on the arithmetic unit. Machine-readable storage medium with a computer program stored thereon according to claim 11.

Images