DE102018212372A1 - Method for checking the plausibility of a measured variable of a sensor in a motor vehicle - Google Patents

Abstract

The invention relates to a method for plausibility checking of a measured variable of a sensor in a motor vehicle, at least one sensor (34) detecting at least one measured variable (Ubatt, Ibatt) of an energy store (32), at least one load distribution (52) being provided by the energy store (32) is supplied with energy for supplying energy to several consumers (36, 46), at least one measurement variable (Ilvo, Ulvo) of the load distribution (52) being determined, at least one plausibility check (11) being provided, which is based on the measurement variable (Ilvo, Ulvo) of the load distribution (52) determines a determined parameter (Ubatt *, Ibatt *) of the energy store (32) and compares it with the measured variable (Ubatt, Ibatt) of the energy store (32).

Description

The invention relates to a method for checking the plausibility of a measured variable of a sensor in a motor vehicle according to the independent claim.

State of the art

From the EP 1271170 B1 a method and a device for battery state detection are known. Statements are made about a battery state by means of a first battery state detection system, statements in the event of faulty operation or failure of the first battery state detection system being made about the battery state by means of a second battery state detection system, the first battery state detection system being statements about the battery state using a current measurement and with additional use a temperature measurement.

The vehicle electrical system has the task of supplying the electrical consumers with energy. If the power supply fails due to a fault or aging in the on-board electrical system or in an on-board electrical system component in today's vehicles, important functions such as power steering do not apply. Since the ability to steer the vehicle is not impaired, but only becomes stiff, the failure of the vehicle electrical system is generally accepted in today's series-produced vehicles, since the driver is available as a fallback level. In order to increase the availability, two-channel electrical system structures such as in the WO 2015/135729 A1 proposed. These are required to supply fault-tolerant systems for highly or fully automatic driving.

The invention has for its object to further increase the reliability of the overall system. This object is achieved by the features of the independent claim.

Disclosure of the invention

The plausibility check of the measured variable detected by the sensor with a further independent measured variable, which is made available by an electronic load distributor, enables the measurement signals of the sensor to be verified and thus the diagnostic coverage or the availability of the signals to be increased without causing additional costs , The electronic load distributor already contains current and voltage measuring sensors to represent its other safety and diagnostic functions, which can be used for the plausibility check. This enables a higher qualification of the signals provided according to a higher standard (e.g. ASIL decomposition according to ISO 26262 C - example: ASIL sensor: B, ASIL load distribution: A -> ASIL of the combination: C).

In an expedient development, the determined parameter of the energy store is determined from the measured variable of the load distribution using a wiring harness model. This allows conclusions to be drawn as to whether a determined parameter is obtained from the wiring harness model, which roughly corresponds to the measured variable of the energy store. A plausibility check to increase the integrity of the measured variables can thereby be achieved in a simple manner.

In an expedient development, depending on a comparison of the ascertained parameter with the measured variable of the energy store, the plausibility check forwards either the ascertained parameter or the measured variable of the energy store, in particular to a status detection of the energy store and / or to an evaluation. This means that only plausible quantities are processed further, so that the susceptibility to errors of the overall system is reduced. In addition, the functionality of the overall system is ensured even if the sensor fails.

In the case of a significant discrepancy between the ascertained parameter and the measurand of the energy store, the ascertained parameter is particularly advantageously passed on. If there is a significant deviation, an error in the sensor is likely, so that the calculated parameter is then used.

In an expedient development, the measured variable of the energy store is fed to a status detection of the energy store for determining a derived characteristic variable, the measured variable and / or the derived characteristic variable being fed to an evaluation. This makes it possible to determine further statements about the state of the energy store, such as the state of charge or the internal resistance, which are required for further functions.

In an expedient development, the output signal of the plausibility check, either the measured variable of the energy store or the determined characteristic variable, is fed to a further status detection of the energy store for determining a derived characteristic variable of the energy store. The measured variable of the energy store and / or the derived characteristic variable and / or the determined characteristic variable are particularly advantageously fed to an evaluation. A redundant determination of further parameters of the energy store can thus take place, even if the other status detection is not fed with correct measured values. A corresponding evaluation can then combine sensor signals that fall apart in the correct manner. This increases the accuracy and availability of the overall system.

In an expedient development, error information is generated if there is a significant deviation between the determined parameter and the measured variable of the energy store. When the error information is present, an automated driving function is particularly advantageously influenced, in particular a transfer of the vehicle to a safe state or an enabling of an automatic driving function. In the event of an error in the sensor, countermeasures can thus be initiated quickly, so that safety is further increased, particularly in autonomous driving.

In an expedient development, a measured value on a separating element, in particular on a DC voltage converter, is used to determine the determined parameter. In particular in on-board electrical system architectures which are distinguished for the reliable supply of safety-relevant consumers, several sub-on-board electrical system branches are provided, which in turn must be separated from one another in the event of a fault in order to prevent the error from spreading to the still intact on-board electrical system branch. Separating elements such as DC / DC converters provide suitable measured variables such as current and voltage, which can be used particularly easily to check the plausibility.

In an expedient development, a contact resistance between the energy store and the load distribution and / or mass is used to determine the determined parameter. These contact resistances are part of the wiring harness model and are suitable for precise determination of the determined parameter.

In an expedient development, the sum of the current at the isolating element, in particular at the DC-DC converter, and the current at the load distribution is used to determine the determined parameter. This makes it particularly easy to determine the expected battery current as the determined parameter.

Further expedient further developments result from further dependent claims and from the description.

list of figures

• 1 ein Blockschaltbild zur Verarbeitung und Ermittlung der gewünschten Kenngrößen,
• 2 Übersicht der verwendeten Komponenten sowie
• 3 ein Kabelbaummodell für die Plausibilisierung.

Show it

• 1 a block diagram for processing and determining the desired parameters,
• 2 Overview of the components used as well
• 3 a wiring harness model for the plausibility check.

Embodiments of the invention

The invention is illustrated schematically in the drawings using embodiments and is described in detail below with reference to the drawings.

By way of example, a battery or accumulator is described in the exemplary embodiment as a possible energy store. Alternatively, however, other energy stores suitable for this task can be used equally, for example on an inductive or capacitive basis, fuel cells, capacitors or the like.

A sensor 34 , in particular a battery sensor, detects the voltage U_batt on the energy storage 32 and / or the current Ibatt of the energy storage 32 , The measured quantities ( U_batt . Ibatt ) are sent to a status detection 13 , in particular battery status detection 13 , forwarded. Using the supplied measurands ( U_batt . Ibatt ) and a stored model of the energy storage 32 become relevant determined parameters of the energy storage 32 such as the Internal resistance Ri (in particular battery internal resistance), state of charge (SOC) and possibly other variables. The output variables of the status detection 13 (e.g. internal resistance Ri , Battery voltage Ubatt, battery current Ibatt and state of charge SOC) are an evaluation 21 , in particular a so-called fusion (which brings together several quantities supplied according to certain criteria).

It is a load balancer 52 or power distributor is provided, which is used to control and / or protect different consumers. The load distributor 52 is from the energy storage 32 provided. The load distributor 52 captures the typical load values also available, such as the respective load current ilv or tension Ulv as well from 3 more apparent. The corresponding typical load sizes on the load distributor 52 Connected consumers (especially load currents) are in the load distributor 52 by means of appropriate measuring devices anyway, since the load distributor 52 Usually, depending on the load conditions, reliable protection of the consumers is ensured, for example to protect the consumers from overcurrents. For this are in the load balancer 52 Corresponding switching means, in particular electronic semiconductor switches, are provided which open in the event of an overload. Thus there are measured variables Ilvo . Ulvo the load distribution 52 to disposal.

The measurands ( Ulvo . Ilvo ) of the load distributor 52 become a plausibility check 11 made available. In addition, a typical measured variable (e.g. the current idc , the voltage Udc ) of a separating element 26 , for example a DC voltage converter, to the plausibility check 11 , In particular for the reliable supply of an on-board network of a motor vehicle, in particular for the supply of the functions required for autonomous driving operation (in particular steering, braking, environmental sensing, trajectory planning, etc.), a plurality of on-board electrical systems can be provided, which are separated by elements 26 can be separated from each other in the event of an error. This can be done, for example, by a DC voltage converter, as shown by way of example. These on-board electrical systems supply components that are designed to be functionally redundant and that can implement the functions mentioned by way of redundancy. In the event of a failure of a partial on-board network, for example, the vehicle can be safely stopped (approaching the next parking space, immediate stop on the hard shoulder, etc.) by the components of the other on-board network, which is still working correctly.

Even from the sensor 34 determined measured variables U_batt . Ibatt be the plausibility check 11 fed. The plausibility check 11 includes a means of comparison 15 and a means of selection 17 , which is only a plausible measurement of the energy storage 32 forwards. The plausibility check 11 therefore only conducts plausible measurement variables U_batt . Ibatt further, otherwise determined parameters U_batt * . Ibatt * forwarded. The plausible measurands U_batt . Ibatt of the energy storage 32 or the determined parameters U_batt * . Ibatt * (if there is a sensor error 34 ) get another status detection 19 , in particular battery status detection. Also the further status detection 19 determines so-called derived parameters of the energy storage 32 , for example the internal resistance Ri or the state of charge SOC. This in turn takes place using a suitable model of the energy store 32 , That of the further status detection 19 derived parameters of the energy storage 32 or determined measured variables U_batt . Ibatt or determined parameters U_batt * . Ibatt * also arrive at the evaluation 21 ,

The evaluation 21 determines (and / or forwards) from the supplied quantities of both the status detection 13 as well as the further status detection 19 plausible measurements of the energy storage 33 (Battery voltage U_batt , Battery power Ibatt ) or plausible derived parameters ( Ri . SOC ). There are significant deviations from the condition determination 13 transmitted values and from the further status determination 19 determined sizes, there is probably an error. This possible fault is, for example, via the output signal S (Safe State) from the evaluation 21 passed on to a higher-level control unit. The higher-level control device could, for example, be the control device responsible for autonomous driving. This is informed of a possible fault, whereupon suitable measures are initiated, such as an emergency stop of the vehicle, etc.

According to 2 part of the underlying topology of the vehicle electrical system is shown. A DC converter connected to ground 26 as a possible coupling means (possibly with a further sub-electrical system, not shown) is with the energy store 32 connected, which in turn the load distributor 52 energized. There is also a harness diagnosis 23 provided based on a wire harness model 25 from the input variables (voltage at the DC converter Udc , Current at the DC converter idc , Voltage at the load distributor 52 Ulv , Current at the load distributor ilv ) determined parameters of the energy storage 32 , namely the battery voltage U_batt * , based on the wiring harness model 25 and the battery power Ibatt * based on the harness model 25 , provides. The determined parameters U_batt * . Ibatt * get to the means of comparison 15 , The means of comparison 15 also receives that from the sensor 34 Measured variables of the energy storage 32 , namely battery voltage U_batt , as well as battery power Ibatt ,

In 3 is an example of the wiring harness model 25 based on a typical sub-electrical system. With a redundant supply of safety-relevant, functionally redundant consumers 36 . 46 For example, two such partial electrical systems can be provided in the vehicle. A further energy storage device can be used in a further sub-electrical system 42 with another sensor 44 for recording the parameters of the further energy store 42 be provided. A partial electrical system with the relevant electrical system components is provided, consisting of a DC converter (isolating element 26 . 28 ), the energy storage 32 . 42 with sensor 34 . 44 , Wiring harness branches with the corresponding line and contact resistances 51 (plus-side resistances (index 1 ) Rx1 : R11 . R21 . R31 ) and 55 (Ground resistances (index 2 ) Rx2 : R12 . R22 . R32 ) as well as with various security-relevant consumers 36 . 46 , characterized by the associated load currents Iv1 . i v2 . Iv3 and the terminal voltages Uv1 . Uv2 . Uv3 for three consumers as an example 36 . 46 , The consumers 36 . 46 are from the load distribution 52 driven. Optionally, two or more load distributors can also be used 52 be provided. This structure forms the basis for the wiring harness model 25 , The wire harness resistors (wire and contact resistances 51 . 55 ) are determined or estimated in a suitable manner.

In a first step, the measurement variables are adopted U_batt and Ibatt from the sensor 36 , the voltage Udc and the stream idc from the DC / DC converter or isolating element 26 , as well as the measurands Ulvo and Ilvo from the load distribution 52 ,

The current Ibatt is made plausible directly via the relationship Ibatt * = Ilv - Idc. To do this, the difference between Ibatt and Ibatt * evaluated and an error flag is generated if a maximum difference or a limit value is exceeded.

The voltage Ubatt is checked for plausibility using the relationship Ubatt * = Ulv + Ibatt * (Rb1 + Rb2), where (Rb1 + Rb2) is either assumed to be constant in the simplest case or can be determined using a method that is not described in more detail.

If the Ibatt / Ubatt measurements are plausible, they are passed on directly. In the case of a plausibility problem, the values of U_batt , respectively. Ibatt through in the load sharing 52 calculated values U_batt * and Ibatt * (so-called determined parameters) replaced. An error flag is also provided, which is used in the higher-level energy management system to initiate emergency operation measures. The block described is used as a selection tool 17 in the plausibility check 11 shown.

A subsequent function calculates the redundant signals of the battery status detection from the plausibility-checked and thus qualified according to a certain standard (e.g. ASIL C) 13 . 19 , In higher-level energy management or an overarching evaluation 21 or Fusion are the redundant signals with the original signals from the sensor 34 or battery sensor linked.

By plausibility check based on independent measuring points, which act as measured variables of the load distribution 52 The measured variables can be available U_batt , Ibatt of the sensor 34 verified and thus the diagnostic coverage or the availability of the signals can be increased without incurring additional costs. This enables a higher qualification of the integrity level (ASIL according to ISO 26262) of the signals than would be possible by a measurement without plausibility checking.

In general, could be used to determine the determined parameter U_batt * . Ibatt * further voltage and / or current values of components are used, which are also associated with the energy store 32 are connected. As described, it could be separating elements 26 , further load distribution (s) 52 etc. act, but also such components that also capture suitable parameters of the sub-electrical system, in which also the energy storage 32 is arranged.

The method described is particularly suitable for increasing the reliability of the overall system, in particular for autonomous driving, to which particularly strict safety requirements are imposed. However, the use is not restricted to this.

QUOTES INCLUDE IN THE DESCRIPTION

This list of documents listed by the applicant has been generated automatically and is only included for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• EP 1271170 B1 [0002]
• WO 2015/135729 A1 [0003]

Claims (13)

Method for checking the plausibility of a measured variable of a sensor in a motor vehicle, at least one sensor (34) detecting at least one measured variable (Ubatt, Ibatt) of an energy store (32), at least one load distribution (52) being provided by the energy store (32) is supplied with energy for supplying energy to several consumers (36, 46), at least one measured variable (IIvo, Ulvo) of the load distribution (52) being determined, characterized in that at least one plausibility check (11) is provided which is derived from the measured variable (Ilvo , Ulvo) of the load distribution (52) determines a determined parameter (Ubatt *, Ibatt *) of the energy store (32) and compares it with the measured variable (Ubatt, Ibatt) of the energy store (32). Procedure according to Claim 1 , characterized in that the determined parameter (Ubatt *, Ibatt *) of the energy store (32) is determined from the measured variable (Ilvo, Ulvo) of the load distribution (52) using a wiring harness model (25). Method according to one of the preceding claims, characterized in that the plausibility check (11), depending on a comparison of the determined parameter (Ubatt *, Ibatt *) with the measured variable (Ubatt, Ibatt) of the energy store (32), either determines the determined parameter (Ubatt * , Ibatt *) or the measured variable (Ubatt, Ibatt) of the energy store (32), in particular to a status detection (19) of the energy store (32) and / or to an evaluation (21). Method according to one of the preceding claims, characterized in that in the event of a significant deviation between the determined characteristic variable (Ubatt *, Ibatt *) and the measured variable (Ubatt, Ibatt) of the energy store (32), the determined characteristic variable (Ubatt *, Ibatt *) is forwarded becomes. Method according to one of the preceding claims, characterized in that the measured variable (Ubatt, Ibatt) of the energy store (32) is fed to a status detection (13) of the energy store (32) for determining a derived characteristic variable (Ri, SOC), the measured variable ( Ubatt, Ibatt) and / or the derived parameter (Ri, SOC) is fed to an evaluation (21). Method according to one of the preceding claims, characterized in that the output signal of the plausibility check (11), either the measured variable (Ubatt, Ibatt) of the energy store (32) or the determined characteristic variable (Ubatt *, Ibatt *), a further status detection (19) of the energy store (32) is supplied to determine a derived parameter (Ri, SOC) of the energy store (32), the measured variable (Ubatt, Ibatt) of the energy store (32) and / or the derived parameter (Ri, SOC) and / or the determined parameter (Ubatt *, Ibatt *) is fed to an evaluation (21). Method according to one of the preceding claims, characterized in that in the event of a significant deviation between the determined parameter (Ubatt *, Ibatt *) and the measured variable (Ubatt, Ibatt) of the energy store (32), error information is generated. Method according to one of the preceding claims, characterized in that if there is a significant deviation between the derived parameter (Ri, SOC) from the status detection (13) and the derived parameter (Ri, SOC) from the further status detection (19) of the energy store (32) Error information is generated. Method according to one of the preceding claims, characterized in that when the error information is present, an automated driving function is influenced, in particular by transferring the vehicle to a safe state or influencing the release of the automated driving functions. Method according to one of the preceding claims, characterized in that a measured value (Udc, Idc) on a separating element (26), in particular a DC voltage converter, is used to determine the determined parameter (Ubatt *, Ibatt *). Method according to one of the preceding claims, characterized in that further voltage and / or current values of components which are additionally connected to the energy store (32) are used to determine the determined parameter (Ubatt *, Ibatt *). Method according to one of the preceding claims, characterized in that a transition resistance (Rb1, Rb2) between the energy store (32) and the load distribution (52) and / or between mass is used to determine the determined parameter (Ubatt *, Ibatt *). Method according to one of the preceding claims, characterized in that to determine the determined parameter (Ubatt *, Ibatt *) the sum of the current (Idc) at the isolating element (26), in particular DC converter, and the current (Ilo) at the load distribution ( 52) is used.

Images