CN107924169B

CN107924169B - Hands-free access and activation system for a motor vehicle

Info

Publication number: CN107924169B
Application number: CN201680045979.1A
Authority: CN
Inventors: A.维尔默尔
Original assignee: Valeo Equipements Electriques Moteur SAS
Current assignee: Valeo Equipements Electriques Moteur SAS
Priority date: 2015-08-04
Filing date: 2016-08-04
Publication date: 2020-12-22
Anticipated expiration: 2036-08-04
Also published as: FR3039903A1; WO2017021659A1; FR3039903B1; CN107924169A

Abstract

The system according to the invention comprises a microprocessor (3) which generates control signals (P1, P2, S) for controlling a control circuit (13) of a main power relay (5) of the vehicle, and a verification module (4, 9) which is separate from the microprocessor (3) and verifies the control signals (P1, P2, S). The microprocessor (3) receives average speed data (Vv) indicating an average traveling speed of the vehicle and second data (SSB1, SSB2) indicating a state of the start or stop control (2). According to the invention, the verification module (9) generates a verification signal (E) verifying the control signal (S) on the basis of wheel speed data (Vr) representing the travel speed of the vehicle wheels, second data (SSB1, SSB2) and third data (CG) representing the operation of the microprocessor (3).

Description

Hands-free access and activation system for a motor vehicle

Technical Field

The present invention relates to a hands-free access and activation system for a motor vehicle.

Background

Smartphones, known as "smartphones," have become essential in everyday life.

There are many uses in the automotive field, from displaying information of the vehicle's status in real time (locking/unlocking, opening windows, internal temperature, petrol level, etc.) to locating the vehicle in the street or parking lot, thanks to the GPS function of the phone, and to remotely starting the heating or ventilation, and of course the engine.

The implementation of these functions is based on a "gateway key" between the driver's smartphone and the vehicle system. In this way, smartphones replace and expand the possibilities that have been used for years for remote commands to remotely command the opening of doors or to replace traditional ignition keys.

In these so-called "hands-free" access and Start systems or ADML systems (known more generally to the person skilled in the art by the acronym PEPS, meaning "keyless Entry and Start system"), the information transmitted by radio frequency, read into the smart card, and even simply generated by the contacts, is generally processed by the onboard microprocessor.

In very disturbed environments, such as the environment of a vehicle (temperature, electronic parasitic elements, interference, etc.), the microprocessor is not protected from failure, or at least from errors or temporary interruptions that lead to a reset.

However, the function of some commands is critical: in particular, it goes without saying that in the case where the vehicle is not stationary, the main power supply of the vehicle must not be shut off by the microprocessor untimely when the microprocessor incorrectly interprets the vehicle speed information as being below a low threshold value indicating that the vehicle is stopped and a command to lock the door as if the driver left the vehicle.

Conversely, if the driver leaves the vehicle at rest and commands the locking of the doors without the microprocessor shutting off the main power to the vehicle, this may result in the discharge of the on-board battery, but this is not important.

In order to take into account disturbances that may lead to a malfunction of the microprocessor, the electrical control unit of the vehicle (which unit is described in us patent No. 7124005) comprises a hold and verification circuit for the signal commanding the power supply relay of the vehicle.

To this end, the microprocessor processes, in addition to the information representative of the start command, information representative of the operation of the vehicle, in particular its speed, and sends a command corresponding pulse to the retention and verification circuit.

In the event these pulses are lost, the hold and verify circuit may hold the signal for commanding the relay to prevent the motor from stopping and prevent the power supply from being shut off due to a failure of the microprocessor. In contrast, when a pulse commands a relay, the retention and verification circuit periodically tests the microprocessor to check the validity of the command signal.

In its operation, the hold and verification circuit relies entirely on the microprocessor and cannot directly take into account basic information such as the speed of the vehicle.

Furthermore, it does not seem possible to provide any guarantee as to whether the electrical control unit meets the required level in terms of safety as defined by the ISO26262 standard.

The ISO26262 standard does define four ASILs ("automotive safety integrity levels"), denoted by the letters a to D, a corresponding to the lowest risk and B corresponding to the highest safety requirement level. The level of security requirements indicated by the QM ("quality management") is assigned to non-critical functions.

However, if saving the energy of the on-vehicle battery is a non-critical usability function, the function of cutting off the main power supply is an ASIL B-level safety function.

Disclosure of Invention

It is therefore an object of the present invention to improve the operational security of a PEPS system.

The invention relates precisely to a hands-free access and activation system for a motor vehicle, of the type comprising a microprocessor which generates a command signal (S) driving a command circuit for a main power relay of the vehicle, and an authentication module which is separate from the microprocessor and authenticates the command signal, the microprocessor receiving an average speed data item representative of the running average speed of the vehicle and second data representative of the status of the activation or deactivation command.

According to the invention, the verification module generates a verification signal for the command signal, which verification signal is a function of a wheel speed data item representing the travel speed of a wheel of the vehicle, the second data and third data representing the operation or absence of the microprocessor.

According to a further feature of the present invention, the verification module includes:

-first detection means receiving the wheel speed data item and generating a first command indicating that the wheel speed is below a predetermined threshold speed;

-second detection means receiving the second data and generating a second command indicating that the switch-off command has been activated;

-third detection means receiving the third data and generating a third command indicating a failure of the microprocessor.

According to another feature, the wheel speed data item is provided by a wheel sensor.

According to another feature, the predetermined speed threshold is substantially equal to 4 km/h.

In the system according to the invention the start command is formed by at least one start button.

According to another feature, the third detection means are formed by a digital circuit linked to the microprocessor or to at least one digital input/output of the microprocessor by a serial link.

The digital circuit is preferably manufactured as an integrated circuit external to the microprocessor, such as an integrated circuit of the "single-base-chip" type, and comprises a limp-home (limp-home) mode function and/or a watchdog (watchdog).

According to another feature of the present invention, the verification module further includes a first three-input logic gate that combines the first, second and third commands and forms a verification signal, and a second two-input logic gate that combines the verification signal and the command signal and forms a verified command signal that drives the command circuit. These first and second logic gates are fabricated by using discrete components or integrated logic gates.

In the hands-free access and start system for a motor vehicle according to the invention, the microprocessor comprises computer code that generates the command signal and the third data and is developed with a first ASIL B safety requirement level according to the ISO26262 standard and the verification module is developed with a second ASIL QM safety requirement level according to the standard.

These few basic descriptions will make apparent to those skilled in the art the advantages offered by the present invention over the prior art.

In the following description, a detailed description of the present invention is given with reference to the accompanying drawings.

It should be noted that these drawings are not intended for purposes of illustration only and are not intended to limit the scope of the present disclosure in any way.

Drawings

Fig. 1 schematically illustrates a PEPS hands-free start-up system of the type known in the prior art.

Fig. 2 schematically shows a PEPS hands-free startup system according to the present invention.

Detailed Description

Fig. 1 schematically shows a PEPS system 1 designed according to the teachings of the prior art reviewed in the foregoing, which is limited to a hands-free start-up function.

The start commands SSB1, SSB2 are provided by the start button 2 and processed by the microprocessor, microcontroller 3, etc.

The microprocessor 3 sends on/off command pulses P1, P2 to a hold and verification circuit (HLD)4, which commands, through a power output R, a vehicle power relay 5 linked to the battery voltage Ubat of the vehicle and returns status information P3.

The microprocessor 3 also receives speed information including a wheel running speed data item Vr and a running average speed data item Vv of the vehicle via the wired link L and through the CAN fieldbus, respectively. The speed information Vr and Vv is constituted by measurement signals from wheel sensors 7 provided by the anti-lock brake system 6. The speed information Vr relates to the wheel speed. The speed information Vv relates to the speed of the vehicle obtained by, for example, calculating an average of various wheel speeds of the vehicle.

This speed information Vr, Vv allows the PEPS system 1 to overcome some faults of the microprocessor 3, but as long as it is processed by the microprocessor 3 itself, the holding and verification of the command pulses P1, P2 by the holding and verification circuit 4 is not completely independent of the microprocessor 3, so the level of safety is not optimal.

In the PEPS system 8 according to the invention, schematically shown in fig. 2, the average vehicle running speed data Vv and the second data SSB1, SSB2 representing the state of the start command are sent to the microprocessor 3, and the wheel running speed data items Vr and the data SSB1, SSB2 are directly transmitted and processed by the verification module 9. As in the system of fig. 1, the data Vr and Vv are transmitted via the wired link L and via the CAN field bus, respectively.

Computer code executed by the microprocessor 3 generates command signals S according to data Vv, SSB1 and SSB 2. This same computer code also produces third data CG, called "watchdog", representative of the operation or non-operation of the microprocessor 3.

The authentication module 9 comprises a digital circuit 10 in the form of an integrated circuit external to the microprocessor 3, for example of the "single basic chip" (SBC) type. The digital circuit 10 receives the third data CG via a serial link SPI linking the digital circuit 10 to the microprocessor 3. The third watchdog data CG allows the digital circuit to detect a malfunction of the microprocessor 3.

The verification module 9 also comprises first detection Means (MLI)11 which generate a first command C1 indicating a vehicle speed of less than about 4km/h when the wheel travel speed data item Vr is transmitted through the wired link L (with pulse width modulation MLI in the present embodiment). Speeds below 4km/h are defined in the european regulation ECE R116 and are considered to represent a stationary vehicle.

When the received second data SSB1, SSB2 indicates a request to switch off from the driver, the second detection device 12 generates a second command C2.

In case of a failure of the microprocessor 3, the third data CG may default to activating the limp home mode function of the SBC10, or periodically reset the watchdog service of the SBC10, which will trigger the limp home mode function in case of no service.

In the limp home mode, the SBC10 generates a third limp home command in the first three-input logic gate 14 in combination with the first and second commands C1, C2 to generate the verification signal E.

This verification signal E is combined with the command signal S generated by the microprocessor 3 in the second logic gate 15 to generate a verification signal C for driving the command circuit 13 in the form of a power transistor which commands the main power relay 5 of the vehicle through the power output R.

In a preferred embodiment of the invention, the first and

second logic gates

14, 15 are created by using discrete components such as discrete bipolar transistors or by integrating logic gates to provide a high level of reliability and reduce cost.

The PEPS system 8 according to the present invention is able to cut off the main power supply of the vehicle even in the event of loss of the microprocessor 3.

This function is an available function when the vehicle is stationary, which can save battery power, and is developed at the ASIL QM safety requirement level. However, it affects the cut-off of the main power, which is a safety function that the ASIL B class must develop.

In the PEPS system 8 according to the present invention, the switching off of the main power supply at rest in case the microprocessor 3 is lost and the start button 2 is pressed is performed by the authentication module 9 which is a component external to the microprocessor 3. The independence between the QM availability functions and the security functions performed by the microprocessor 3 at the ASIL B level is thus ensured.

The advantage of the invention is therefore that an untimely shut-down of the main power supply is prevented in the event of a failure of the microprocessor 3 of the PEPS system 8.

Of course, the invention is not limited to the preferred embodiments described above.

In particular, the activation command is advantageously formed by a command element other than the activation button 2 (for example a smart card reader, a remote control receiver or a smartphone of the smartphone type).

In an alternative of the invention, the microprocessor 3 further receives other data indicating the locking/unlocking of the door and further generates a signal for activating other power supply relays, in particular the relay of the starter, the electric lock or accessories.

The invention thus covers all possible alternative embodiments, insofar as they come within the scope of the following claims.

Claims

1. A hands-free access and starting system (8) for a motor vehicle, comprising a microprocessor (3) and a verification module (9), the microprocessor (3) generating a command signal (S) driving a command circuit (13), the command circuit (13) being intended for a main power supply relay (5) of the vehicle, the verification module (9) being separate from the microprocessor (3) and verifying the command signal (S), the microprocessor (3) receiving an average speed data item (Vv) representative of the average speed of travel of the vehicle and second data (SSB1, SSB2) representative of the status of a start or shut-off command, characterized in that the verification module (9) generates a verification signal (E) for the command signal (S), the verification signal (E) being a wheel speed data item (Vr) of the speed of travel of the wheels of the vehicle, a verification signal (E) being a verification signal (E) for the speed of travel of the wheels of the vehicle, -a function of said second data (SSB1, SSB2) and third data (CG) indicative of the operation or not of said microprocessor (3).

2. Hands-free access and activation system (8) for motor vehicles according to the preceding claim 1, characterized in that said authentication module (9) comprises:

-first detection means (11) receiving said wheel speed data item (Vr) and generating a first command (C1) indicating a wheel speed lower than a predetermined speed threshold;

-second detection means (12) receiving said second data (SSB1, SSB2) and generating a second command (C2) indicating that a switch-off command has been activated;

-third detection means (10) receiving said third data (CG) and generating a third command indicative of a failure of said microprocessor (3).

3. Hands-free access and activation system (8) for a motor vehicle according to claim 2, characterized in that said wheel speed data item (Vr) is provided by a wheel sensor (7).

4. Hands-free access and starting system (8) for motor vehicles according to the preceding claim 2, characterized in that said predetermined speed threshold is substantially equal to 4 km/h.

5. Hands-free access and activation system (8) for motor vehicles according to the preceding claim 2, characterized in that the activation command is formed by at least one activation button (2).

6. Hands-free access and activation system (8) for motor vehicles according to the preceding claim 2, characterized in that said third detection means (10) are formed by a digital circuit linked to the microprocessor (3) or to at least one digital input/output of said microprocessor (3) through a serial link (SPI).

7. Hands-free access and activation system (8) for motor vehicles according to the preceding claim 6, characterized in that said digital circuit (10) is made as an integrated circuit external to said microprocessor (3) and comprises a limp-home mode function and/or a watchdog.

8. Hands-free access and start-up system (8) for motor vehicles according to claim 7, characterized in that said integrated circuit is an integrated circuit of the "single basic chip" (SBC) type.

9. The hands-free access and activation system (8) for motor vehicles according to any of the preceding claims 2 to 8, characterized in that said authentication module (9) further comprises a first three-input logic gate (14) combining said first, second and third commands and forming said authentication signal (E), and a second two-input logic gate (15) combining said authentication signal (E) and said command signal (S) and forming an authenticated first command signal (C) driving said command circuit (13).

10. Hands-free access and activation system (8) for motor vehicles according to the preceding claim 9, characterized in that said first three-input logic gate (14) and said second two-input logic gate (15) are made by using discrete components or integrated logic gates.

11. The hands-free access and start system (8) for a motor vehicle according to any of the preceding claims 1 to 8, characterized in that the microprocessor (3) comprises computer code generating the command signal (S), the computer code being developed with a first ASIL B safety requirement level according to the ISO26262 standard, and in that the verification module (9) is developed with a second ASIL QM safety requirement level according to said standard.