DE102019117952B4 - Method for operating a processing device for controlling and/or regulating a data stream - Google Patents

Abstract

Method for operating a processing device (100) for controlling and/or regulating a data stream, comprising the steps: - providing a first sensor device (1) for data acquisition of at least one foreign object and/or an ambient temperature and/or another physical measured value, - providing a second sensor device (2), which can be operated independently of the first sensor device (1), for the data acquisition of at least one foreign object and/or an ambient temperature and/or another physical measured value, with at least the first sensor device (1) being operated in a regular operating mode, wherein at least the first sensor device (1) forwards its measured values to a coupling device (3), wherein the coupling device (3) in turn comprises a first controller unit (30) which receives data from the first sensor device (1) and combines them into individual data packets in order to these then a SWITC h-module (4),◯ comprises a second controller unit (31) operated independently of the first controller unit (30), which receives data from the second sensor device (2) and combines them into individual data packets in order to transmit them to the switch module ( 4), the first controller unit (30) and the second controller unit (31) working at least partially redundantly with respect to one another, so that in the event of a malfunction of one of the two sensor devices (1, 2) and/or one of the two controller units (30, 31) the other controller unit (30, 31) ensures error-free continued operation of the entire processing device (100), with the switch module (4) using standard operating parameters deciding whether data and/or which data from the two controller units (30, 31) are to be sent to one On-board electronics of a usage object, in particular a vehicle, are forwarded, characterized in that one of the two controller units (30, 31) respectively and ere controller unit (30, 31) controls and/or regulates if there is a malfunction in the switch module (4), so that the switch module (4) is bypassed as a result.

Description

The present application relates to a method for operating a processing device for controlling and/or regulating a data stream and a coupling device for controlling and/or regulating a data stream according to the respective preamble of patent claims 1 and 9.

the DE 10 2013 220 526 A1 relates to a processing system for surroundings sensor data in a vehicle with a surroundings sensor and at least two sensor data processing units, the surroundings sensor being connected to corresponding, preferably identically designed data transmission interfaces for the redundant transmission of sensor raw data with each of the sensor data processing units via a respectively associated data line.

In the DE 10 2005 005 995 A1 a method for monitoring signal processing units for sensors is disclosed. To improve the reliability of the sensor data of a vehicle, at least redundant processing of the sensor data takes place in two identical signal processing units, each of which independently and separately from one another has at least two processing devices in two evaluation devices, with the sensor data via separate signal lines between the respective processing device and the associated evaluation device be transmitted.

Processing devices and, in particular, also methods for operating processing devices that operate according to a fail-safe mode are also known from the prior art. When a malfunction is detected by a corresponding processing device, the corresponding defective component is usually shut down, or the entire device either starts to operate incorrectly or shuts down itself or is shut down. Such a faulty component then enters an idle state and/or a fail-safe state.

Such a fail-safe mode can have the disadvantage that continued operation of the device is either not possible at all or at least only possible to a limited extent.

If the processing device relates to one that is installed in a vehicle and controls and/or regulates onboard electronics there and/or is an element of onboard electronics of a vehicle, the onboard electronics and/or a component of the onboard electronics and/or a component of the processing device begins, for example to go into a fail-safe state. Further operation, in particular further operation in a regular operating mode, is therefore no longer possible for safety reasons. However, this means that the corresponding vehicle is simply at best only partially drivable or no longer drivable at all.

In order to avoid such a fail-safe mode of a corresponding processing device and at the same time to offer a device which, even if a malfunction is detected in one of the components of the processing device or one of the components of a sensor system connected to the processing device, a fail-operational mode to be able to continue to operate, the present invention offers the possibility of a, preferably unrestricted, continued operation of the processing device.

The aim is therefore to be able to at least partially maintain a normal operating mode even in the event of a malfunction of one of the above-mentioned components. In particular, the present application is concerned with offering a redundancy operation.

The object of the present invention is therefore to offer a fail-operational system, in particular a fail-operational processing device, in a particularly simple and cost-effective manner, in order to sensors connected to the processing device to be able to continue to operate the processing device at least partially.

This object is solved by the subject matter of claim 1 and by the subject matter of claim 9.

The method proposed here according to the invention for operating a processing device for controlling and/or regulating the data stream therefore comprises a first step, after which a first sensor device is provided for the data acquisition of at least one foreign object and/or an ambient temperature and/or another physical measuring mechanism.

Furthermore, in a second step, a second sensor device, which can be operated independently of the first sensor device, is used for the data acquisition of at least one foreign object, preferably the same foreign object and/or an ambient temperature, preferably the same ambient temperature and/or another Genetic physical measured value, preferably the same physical measured value (as also detected by the first sensor device), wherein at least the first sensor device is operated in a control operating mode, wherein at least the first sensor device forwards its measured values to a coupling device.

Within the meaning of the invention, “regulated operating mode” means a first sensor device operated within predetermined regulated operating parameters. The regular operating mode can also be a normal operating mode.

The control operating parameters can therefore be specified, for example, by instructions for use and/or by an operating recommendation provided by the manufacturer. If the operating parameters of the sensor device deviate from such a regular operating mode, the first sensor device is then in a fail mode.

The coupling device in turn includes a first controller unit, which uses data from the first sensor device and combines them into individual data packets in order to then feed them to a switch module. Furthermore, the coupling device comprises a second controller unit, which is preferably operated independently of the first controller unit and which receives data from the second sensor device and combines them into individual data packets.

It is also conceivable that the second controller unit is only operated when the first controller unit and/or the first sensor device is in a fail-operational mode and therefore leaves a regular operating mode. In this case, the second controller unit is a second controller unit that operates exclusively redundantly, preferably completely redundantly with respect to the first controller unit.

According to the invention, the first controller unit and the second controller unit therefore preferably work at least partially redundantly to one another, so that in the event of a malfunction of one of the two sensor devices and/or one of the two controller units, the other controller unit ensures error-free continued operation of the entire processing device, in particular with the switch module based on standard working parameters, decides whether data and/or which data of the two controller units are forwarded to on-board electronics of a reference object, in particular a vehicle.

The switch module mentioned above can therefore be a comparison unit which, for example, compares the data from the first controller unit, which is intended to be forwarded to on-board electronics, and the data from the second controller unit, which is intended to be forwarded to on-board electronics compares If the individual data therefore deviate from one another, the switch unit can determine which of the controller units is not working within a regular operating mode, so that only data that represents a regular operating mode and/or is viewed from a parameter page within a regular operating mode is forwarded to the on-board electronics, are located.

Alternatively or additionally, the switch module can also be set up and provided for comparing the individual data forwarded by the controller units to the switch module with normal operating parameters (= standard operating parameters) stored in the switch module and/or another processing unit.

Another input for the switch module can be diagnostic data. If, for example, a diagnostic device has detected that sensors of the sensor device are defective, then output values from the controller unit can be used even if the output values from the controller unit look better, that is, they correspond better to standard specifications.

Therefore, if the data generated by the first controller unit and/or the second controller unit deviate from the normal operating parameters, it can be decided that either the data from only the first controller unit and/or the data from only the second controller unit or no data at all is sent to the on-board electronics of a vehicle to get redirected.

In the case of a fully redundant system, it is therefore conceivable that the switch module compares the data generated by the first controller unit with the corresponding control operating parameters and, if the data deviate, in particular beyond a certain error tolerance, the switch module compares the second controller unit in operation, and in particular the first controller unit and/or the first sensor device out of operation.

From a practical point of view, the processing unit proposed here therefore consists, for example, of two redundant and different paths for calculating and/or forwarding data or a data stream to the on-board electronics. Both ways may be able to work therefore independently. Each of the two Weg can have its own sensor configuration for a so-called full 360° view.

It is conceivable that each sensor configuration of the individual sensor units is designed in such a way that individual sensor failures can also be handled by the switch module in particular.

The present invention is therefore also suitable, among other things, for exchanging the sensor data between the individual paths (first control unit and second control unit) for diagnostic reasons, for example. Both control units can therefore be in data communication with one another, in particular without the switch module mentioned above.

In order to improve the quality of the detection of the environment when special environmental conditions are present, there is also the possibility of exchanging data from the various sensor systems with one another and, in particular, of rerouting data streams among the individual control units, as already explained above.

In a regular operating mode, i.e. in normal operation, the switch module mentioned above can therefore be the last instance that decides whether the result of the first or the second path (i.e. the result of the first or second control unit) to the on-board electronics of a vehicle , for example to a vehicle communication system.

In addition, both paths have the option of sending data individually. If the switch module fails, it is conceivable that the two paths, in particular the two controller units, monitor each other and therefore mutually decide which of the controller units forwards the respective data to the on-board electronics. A so-called master-slave solution can therefore be generated in this embodiment. One of the two controller units can therefore represent a master controller unit and a second controller unit can represent the corresponding slave controller unit.

According to at least one embodiment, the method according to the invention for operating a processing device for controlling and/or regulating a data stream comprises the steps, after which a first sensor device for the data acquisition of at least one foreign object and/or an ambient temperature and/or another physical measured value is provided.

In a second step, a second sensor device that can be operated or operated independently of the first sensor device is provided for the data acquisition of at least one foreign object and/or an ambient temperature and/or another physical measured value, with at least the first sensor device being operated in a control operating mode, with the the first sensor device forwards a measured value to a coupling device, the coupling device in turn comprising a first controller unit which receives data from the first sensor device and combines them into individual data packets in order to then feed them to a switch module. The coupling device also has a second controller unit that is or can be operated independently of the first controller unit, which receives data from the second sensor device and combines them into individual data packets in order to feed them to the switch module.

According to the invention, the first controller unit and the second controller unit work at least partially redundantly to one another, so that in the event of a malfunction of one of the two sensor devices and/or one of the two controller units, the other controller unit ensures error-free continued operation of the entire processing device, in particular the switch module based on Standard operating parameters, on the basis of which the first controller unit and/or the second controller unit and/or one of the two sensor devices or both sensor devices can be operated or are operated within the control operating mode, decides whether data and/or which data from the two controller units are to be sent to on-board electronics of a Object of use, in particular vehicle are forwarded.

According to at least one embodiment, one of the two controller units at least partially assumes the role of the other controller unit, in particular with regard to processing the data arriving from the sensor devices, as soon as one of the two controller units fails or deviates from the normal operating mode. In other words, the controller unit (first controller unit or second controller unit) still working in the regular operating mode can therefore process the data of the other controller unit. This can be accomplished in that the second controller unit itself already forwards the corresponding data of the sensor device assigned to it to the other controller unit or the sensor device and/or the switch module take over this rerouting task.

According to at least one embodiment, those data, and preferably only the those data of those controller unit forwarded to the on-board electronics, which are within the control operating mode. As already mentioned above, it can therefore advantageously be ensured that the on-board electronics are not supplied with “wrong” data.

According to at least one embodiment, if both data from both controller units are within the normal operating mode (and thus both sensor devices are also operated at least simultaneously), the data from that controller unit which is closer to a target operating value and/or target operating range in terms of measurement and/or data technology is forwarded with regard to individual operating parameters.

Such a comparison can be performed by the switch module described above. As already explained above, such a comparison can be carried out by means of an absolute and/or relative comparison of the individual data sets supplied by the controller unit.

For example, the two sensor devices and/or the two controller units are operated simultaneously in such a way that the first sensor unit is operated on the basis of an optical sensor and the second sensor device is operated on the basis of a thermal sensor.

The individual data can also be combined by the individual controller units. However, a combination can also be made by the switch module. It is therefore conceivable that the data streams and/or the data generated by the sensor devices differ from one another, in particular if both sensors are operated at the same time. However, it is also conceivable that both sensor devices are operated in a completely redundant mode, that is to say that only one of the sensor devices is active at a time.

Therefore, if the first sensor device is operated without errors or within a predetermined tolerance range, i.e. if the first sensor device is therefore working in normal operating mode, the second sensor device can be operated in a standby mode, which corresponds to a corresponding reduction in performance of the second sensor unit and/or the second controller unit.

According to at least one embodiment, the two sensor devices correspond to different sensor types, in particular with at least one sensor device comprising at least one, but preferably two or more, sensor types.

For example, the individual sensor devices are different sensors. For example, as already indicated above, the first sensor device can be an optical sensor, while the second sensor device is a heat and/or a motion sensor. It is also conceivable that at least one sensor device consists of two or more sensors. It is conceivable that at least one sensor device comprises at least one optical, infrared and/or microwave sensor (for example one, two or more cameras), at least one radar and/or at least one LIDAR sensor.

According to at least one embodiment, a sensor type is selected from a group of optical sensors, sound sensors, temperature sensors, pressure sensors, radar sensors and/or other sensors. However, any other type of sensor is also possible, such as an infrared sensor and/or microwave sensor and/or LIDAR sensor. Different sensors can be combined with each other. A sensor device combines, for example, a LIDAR sensor with at least one other sensor, such as a camera

According to at least one embodiment, in the event of a failure of the switch module, one of the two controller units assumes the role of the switch module, with the corresponding switch controller unit therefore controlling its data itself. In such a case, therefore, one of the two controller units can become the switch controller unit. For example, a master-slave operation as indicated above is made possible in this respect. It is then also possible to dispense with the integration of the switch module in terms of data technology.

According to the invention, one of the two controller units controls and/or regulates the respective other controller unit if there is a malfunction in the switch module, so that the switch module is bypassed.

In particular, such an embodiment is based on the idea that the switch module has to work in normal operation and, in the event of a deviation from this normal operation, the switch module is switched off or at least switched to a standby mode.

Furthermore, the present invention includes a coupling device for controlling and/or regulating a data stream. In particular, the coupling device presented here can be used in the method described above and in particular in the processing device described above. For example, therefore, all for the method described above disclosed features also disclosed for the coupling device described here and vice versa.

The coupling device according to the invention comprises a first controller unit which is set up and provided for receiving data from a first sensor device and combining them into individual data packets in order to then feed them to a switch module. Furthermore, the coupling device comprises a second controller unit that can be operated independently of the first controller unit and that is set up and provided for receiving data from the second sensor device and combining them into individual data packets in order to then feed them to the switch module.

According to the invention, the coupling device therefore comprises two controller units, both of which work at least partially redundantly to one another, so that in the event of a malfunction of one of the two sensor devices and/or one of the two controller units, the other controller unit ensures error-free continued operation of the coupling device, in particular with the switch module is set up based on standard operating parameters and intended to check whether data and/or which data of the two controller units are forwarded to on-board electronics of a usage object, in particular a vehicle.

According to the invention, one of the two controller units of the coupling device controls and/or regulates the respective other controller unit if there is a malfunction in the switch module, so that the switch module is bypassed.

The coupling device described here includes the same advantages and advantageous configurations as the method described above, in particular the processing device described above.

• Die 1 zeigt ein Ausführungsbeispiel eines hier beschriebenen Verfahrens sowie ein Ausführungsbeispiel einer beschriebenen Vorrichtung, insbesondere eine hier beschriebene Kopplungsvorrichtung auf Basis des obig beschriebenen Erfindungskonzeptes.

The invention described is explained in more detail below with reference to a figure.

• the 1 shows an embodiment of a method described here and an embodiment of a device described, in particular a coupling device described here based on the inventive concept described above.

From the 1 a coupling device 3 is therefore shown by controlling and/or regulating a data stream within a processing device 100 . A first sensor device 1 for the data acquisition of at least one foreign object and/or an ambient temperature and/or another physical measured value and a second sensor device 2 that can be operated or operated independently of the first sensor device 1 for the data acquisition of at least one foreign object and/or an ambient temperature and /or another physical measured value, with at least the first sensor device 1 being operated or being operable in the control operating mode, with the first sensor device 1 forwarding its measured values to the coupling device 3, with the coupling device 3 in turn comprising a first controller unit 30 which transmits data from the first sensor device 1 picks up and combines them into individual data packets in order to then supply them to a switch module 4 . The coupling device 3 also includes a second controller unit 31 that is or can be operated independently of the first controller unit 30 , which receives data from the second sensor device 2 and combines them into individual data packets in order to feed them to the switch module 4 .

A core of the present invention is therefore that the first controller unit 30 and the second controller unit 31 work at least partially redundantly to one another, so that in the event of a malfunction of one of the two sensor devices 1, 2 and/or one of the two controller units 30, 31, the respective other controller unit 30, 31 ensures error-free continued operation of the entire processing device 100, in particular with the switch module 4 using standard operating parameters to decide whether data and/or which data from the two controller units 30, 31 are forwarded to on-board electronics of a vehicle.

One of the two controller units 30, 31 can assume the role of the other controller unit 30, 31, in particular with regard to the processing of the data arriving from the two sensor devices 1, 2. Both sensor devices 1, 2 have different sensor types or correspond to different sensor types. For example, the first sensor device 1 is an optical sensor, while the second sensor device 2 is an acoustic sensor, a temperature sensor or a pressure sensor.

In this respect, a fail-operational system is proposed here through the at least partially redundant cooperation between the two controller units 1, 2 in order to create a fail-safe system, in particular a fail-safe system state during the operation of the coupling device 3 and in particular also during of operating the processing apparatus 100 described above.

Reference List

1

first sensor device

2

second sensor device

3

coupling device

4

switch module

30

first controller unit

31

second controller unit

100

processing device

Claims (9)

Method for operating a processing device (100) for controlling and/or regulating a data stream, comprising the steps: - providing a first sensor device (1) for the data acquisition of at least one foreign object and/or an ambient temperature and/or another physical measured value, - providing a second sensor device (2), which can be operated independently of the first sensor device (1), for the data acquisition of at least one foreign object and/or an ambient temperature and/or another physical measured value, with at least the first sensor device (1) being operated in a regular operating mode, wherein at least the first sensor device (1) forwards its measured values to a coupling device (3), wherein the coupling device (3) in turn comprises o a first controller unit (30) which receives data from the first sensor device (1) and combines them into individual data packets, to this then an S to supply the witch module (4), ◯ includes a second controller unit (31) operated independently of the first controller unit (30), which receives data from the second sensor device (2) and combines them into individual data packets in order to transmit them to the switch module ( 4), the first controller unit (30) and the second controller unit (31) working at least partially redundantly with respect to one another, so that in the event of a malfunction of one of the two sensor devices (1, 2) and/or one of the two controller units (30, 31) the other controller unit (30, 31) ensures error-free continued operation of the entire processing device (100), with the switch module (4) using standard operating parameters deciding whether data and/or which data from the two controller units (30, 31) are to be sent to one On-board electronics of a usage object, in particular a vehicle, are forwarded, characterized in that one of the two controller units (30, 31) each because another controller unit (30, 31) controls and/or regulates if there is a malfunction in the switch module (4), so that the switch module (4) is bypassed as a result. Method for operating a processing device (100). claim 1 , characterized in that one of the two controller units (30, 31) at least partially takes over the role of the other controller unit (30, 31), in particular with regard to the processing of the data arriving from the sensor devices (1, 2), as soon as one of the two controller units (30, 31) fails or deviates from the normal operating mode. Method for operating a processing device (100). claim 1 or 2 , characterized in that those data of that controller unit (30, 31), which are forwarded to the on-board electronics, are completely within a control mode. Method for operating a processing device (100). claim 2 , characterized in that if both data from both controller units (30, 31) are within the control operating mode, those data from that controller unit (30, 31) which are closer to a setpoint operating value in terms of measurement and/or data technology are forwarded. Method for operating a processing device (100) according to at least one of the preceding claims, characterized in that the switch module (4) switches off and/or reduces the power of the second controller unit (31) if the first sensor device (1) is within of a standard working range. Method for operating a processing device (100) according to at least one of the preceding claims, characterized in that the two sensor devices (1, 2) correspond to different sensor types, in particular wherein at least one sensor device comprises at least one, but preferably two or more, sensor types. Method for operating a processing device (100). claim 5 , characterized in that a sensor type is selected from a group of optical sensors, sound sensors, temperature sensors, pressure sensors, radar sensors and/or other sensors. Method for operating a processing device (100) according to at least one of the preceding claims, characterized in that that if the switch module (4) fails, one of the two controller units (30, 31) assumes the role of the switch module (4), and the corresponding switch controller unit (30, 31) then controls its data itself. Coupling device (3) for controlling and/or regulating a data stream, comprising a first controller unit (30) which is set up and provided for receiving data from a first sensor device (1) and combining them into individual data packets, in order then to transfer them to a switch module (4), a second controller unit (31) that can be operated independently of the first controller unit (30), which is set up and provided for receiving data from the second sensor device (2) and combining them into individual data packets in order to then to the switch module (4), the first controller unit (30) and the second controller unit (31) working at least partially redundantly with respect to one another, so that in the event of a malfunction of one of the two sensor devices (1, 2) and/or one of the two controller units ( 30, 31) the respective other controller unit (30, 31) guarantees error-free continued operation of the entire coupling device (3). where the switch module (4) is set up and intended to check whether data and/or which data of the two controller units (30, 31) are forwarded to on-board electronics of a usage object, in particular a vehicle, on the basis of standard operating parameters, characterized in that one of the two controller units (30, 31) controls and/or regulates the respective other controller unit (30, 31) if there is a malfunction in the switch module (4), so that the switch module (4) is bypassed as a result will.

Images