DE102020116163A1 - Method for operating a motor vehicle and system for operating motor vehicles - Google Patents

Abstract

Method for operating a motor vehicle (3) when charging an electric battery (10) on an energy supply device (14) external to the vehicle, a control device (12) on the motor vehicle using the charging cable connection with a control unit (16) of the energy supply device (14) for implementation a charging protocol is communicated and a monitoring algorithm of the control device (12) monitors the correct execution of the charging process, the control device (12) - if the charging process is carried out correctly after its completion, a final information indicating this, software information and at least one identifying the energy supply device (14) Includes identification information, transmitted to a server device (2) external to the vehicle for storage in a compatibility database (4), and upon detection of an error condition that can at least possibly be traced back to the software ands while the charging process is being carried out, error information is transmitted to the server device (2), which determines software information from the stored termination information for the current energy supply device (14) from the compatibility database (4) and transmits it back to the control device (12), and upon receipt of a Correction information the software of the determined software information is installed and the loading process is restarted.

Description

The invention relates to a method for operating a motor vehicle, which has an electric battery that can be charged via a motor vehicle-side charging device, in the case of a cable-based charging process at an energy supply device external to the vehicle, in particular a charging column, with a motor vehicle-side control device, in particular comprising at least one control device, using the cable connection between of the charging device and the energy supply device communicates with a control unit of the energy supply device in order to implement a charging protocol which determines the control of the charging process. The invention also relates to a system for operating motor vehicles during charging.

Motor vehicles which can be operated electrically at least partially and / or temporarily have already been proposed in various ways in the prior art, both hybrid motor vehicles and pure electric motor vehicles being known. Both types of motor vehicles are distinguished by the fact that they have a rechargeable electric battery, in particular a high-voltage battery with a nominal voltage of at least 50 V, often at least 150 V. In purely electric motor vehicles and so-called plug-in hybrids, the electric battery of the motor vehicle is assigned a vehicle-side charging device, via which the electric battery can be connected to an external energy supply device, for example a charging station, for charging. For this purpose, for example, a connection cable carried on the motor vehicle side, which is connected to the energy supply device, can be used.

In order to start a charging process and to be able to carry it out correctly, there is often communication between the charging device on the motor vehicle and the energy supply device external to the motor vehicle, that is to say the charging infrastructure. For example, communication data for secure charging control, authentication, billing and load management can be exchanged, with a specific charging protocol being followed, for example. Since, in principle, depending on the external energy supply device, different charging modes can be used, different communication protocols have also been specified for exchanging communication data between the vehicle-side charging device and the external energy supply device. For example, communication via pulse width modulation (PWM) according to the IEC 618851-1 standard are used, while for other charging modes the so-called powerline communication according to the ISO 15118 standard can be used.

However, the communication protocols mentioned here require an extremely precise time lapse in order to function correctly and thus to correctly carry out the actual charging process when energy from the energy supply device is stored in the battery on the motor vehicle. For reasons of violation of such a time lapse and other reasons, problems arise in practice, especially when there are changes in the software of the energy supply device or in the relevant control devices in the motor vehicle, if communication is no longer possible correctly. An exemplary reason is timing that is no longer appropriate due to microcontroller loads and the like, so that the communication protocol is no longer adhered to. This can lead to the actual charging process not starting, charging processes being interrupted, aborted entirely or charging performance not being maintained correctly.

In order to avoid such situations, it is known in the prior art to carry out interoperability tests, which have to be repeated as soon as essential software scopes in the motor vehicle or on the part of the energy supply device have changed. However, the problem here is that there are a large number of manufacturers, for example for energy supply devices, in particular charging stations, who can pursue different approaches with regard to the software. Furthermore, the interoperability tests only take place during the development phase of a vehicle project. If software changes flow into the control device, in particular comprising several control devices, of the motor vehicle during the ongoing production or the motor vehicle that is already in operation, it can also happen that charging networks that have previously been positively tested, i.e. combinations of energy supply device and charging device, now no longer work. Changes in the software of the energy supply device can also lead to this undesirable behavior. However, it is not possible to always check all types of energy supply devices again for interoperability with every software change, so that the mentioned functional problems and consequently complaints can arise. This applies in particular when an owner of a motor vehicle can suddenly no longer charge an energy supply device on which he has already successfully charged several times.

DE 10 2015 204 362 A1 relates to a method for operating a charging station. A communication link is established between the charging station and an electric vehicle, the communication link being used to check whether software stored on a processing device of the electric vehicle needs to be updated. Depending on the checking, the charging station can send update data for updating the software to the electric vehicle via the communication connection, so that the software can be updated based on the update data. The checking can include whether the processing device had a malfunction and, if so, whether an update of the software is sufficient to rectify the malfunction. However, this refinement is disadvantageous in that a comparison with respect to the compatibility of the software versions with one another is carried out only once before the start of the loading process, so that problems that occur in the further course can no longer be dealt with. Furthermore, there is a security risk in that the charging station is ultimately allowed to access control devices of the motor vehicle or to make changes in this regard. Furthermore, this means that problem-solving approaches are only given for a specific charging station.

DE 10 2009 036 943 A1 relates to a charger for an energy store and a method for operating such a charger. For a lithium-ion battery in an electric vehicle, the charger can include a circuit for setting the charger in a full charge mode or a park charge mode, the park charge mode corresponding to a reduced state of charge of the energy store. The charger can have an interface for data exchange with the energy store, in particular for the transmission of a program code to the energy store for changing or updating a programming of the energy store and / or for receiving data from the energy store, in particular error messages and maintenance and / or repair requests .

DE 10 2017 122 734 A1 relates to a system and a method for monitoring and remotely controlling a charge state of at least one battery pack. The battery pack has a communication device in order to transmit charge status data of the battery pack to a server device of the system. The charge status data can be visualized on a user interface, with control data for controlling a charger also having to be transmitted from the user interface to the communication device, which forwards them to the charger. A software update for the battery pack can also be downloaded and installed via a WLAN.

WO 2011/044543 A2 relates to a method for managing charging stations for electric vehicles and for billing in this regard. An incoming and an outgoing communication channel can be opened for an electric vehicle, wherein the incoming communication channel can periodically transmit update information from an authorization server.

The invention is therefore based on the object of improving the mobility of an electrically operated motor vehicle through improved control of the charging process.

• - bei ordnungsgemäßer Durchführung des Ladevorgangs nach dessen Abschluss eine Abschlussinformation, die die ordnungsgemäße Durchführung anzeigt und eine wenigstens eine Softwareversion der bei der Durchführung des Ladevorgangs, insbesondere der Umsetzung des Ladeprotokolls, verwendeten Software der Steuereinrichtung beschreibende Softwareinformation sowie wenigstens eine die Energiebereitstellungseinrichtung identifizierende Identifikationsinformation umfasst, an eine kraftfahrzeugexterne Servereinrichtung übermittelt, wo die Abschlussinformation in einer Kompatibilitätsdatenbank gespeichert wird, und
• - bei Detektion eines zumindest möglicherweise auf die Software zurückführbaren Fehlerzustands während der Durchführung des Ladevorgangs durch den Überwachungsalgorithmus eine Fehlerinformation umfassend wenigstens die Identifikationsinformation der aktuellen Energiebereitstellungseinrichtung an die Servereinrichtung übermittelt, welche aus der Kompatibilitätsdatenbank eine, insbesondere die aktuellste, Softwareinformation der eingespeicherten Abschlussinformationen für die aktuelle Energiebereitstellungseinrichtung ermittelt und eine die Software der Softwareversion der ermittelten Softwareinformation und/oder die ermittelte Softwareinformation umfassende Behebungsinformation an die Steuereinrichtung zurückübermittelt, und
• - bei Empfang einer Behebungsinformation die der ermittelten Softwareinformation entsprechende Software in der Steuereinrichtung installiert und den Ladevorgang neu startet.

To achieve this object, it is provided according to the invention in a method of the type mentioned at the outset that a monitoring algorithm of the control device monitors the correct implementation of the entire charging process, the control device

• - if the charging process is carried out correctly, after its completion, a piece of final information that indicates that it has been carried out correctly and includes at least one software version of the software information used by the control device describing the software used to carry out the charging process, in particular the implementation of the charging protocol, as well as at least one piece of identification information that identifies the energy supply device, transmitted to a server device external to the vehicle, where the termination information is stored in a compatibility database, and
• - Upon detection of an error state that can at least possibly be traced back to the software while the charging process is being carried out by the monitoring algorithm, error information including at least the identification information of the current energy supply device is transmitted to the server device, which from the compatibility database contains, in particular, the most current, software information of the stored closing information for the current one Determines the energy supply device and sends remediation information comprising the software of the software version of the determined software information and / or the determined software information back to the control device, and
• - Upon receipt of remediation information, the software corresponding to the determined software information is installed in the control device and the loading process is restarted.

A novel concept is proposed for a method for monitoring and, if it has been established that interoperability does not exist, and if a solution exists according to the compatibility database, establishing interoperability between electric vehicles and energy supply devices, i.e. the charging infrastructure, during charging processes. Briefly summarized, the invention relates to a method for operating motor vehicles during a wired charging process of a battery of a motor vehicle at an energy supply device, wherein software of the charging device is used for communication between an energy supply device and a charging device of the motor vehicle via the connecting cable, with at least one possibly due to the software error of the loading process in the motor vehicle another software version of the software is queried and installed by a central server device, whereupon the loading process is restarted. A monitoring algorithm of the control device of the motor vehicle, which comprises at least one, usually several, control devices, detects whether the charging process is started and carried out correctly until it has been completely completed, so that error states can also be dealt with, which only occur at one later in the charging process, for example after the start of the actual charging process. If the charging process was completed without errors, relevant final information with regard to the energy supply device used and the software used in the motor vehicle is transmitted to a server device, for example a web server, where a central compatibility database that can be used in particular for a large number of motor vehicles is available. This compatibility database thus receives an entry that shows the software version with which a successful completion of the loading process was possible.

However, if a motor vehicle determines that an error condition, which is at least possibly due to the software of the control device, occurs with regard to the interoperability between the motor vehicle and the energy supply device, z. If, for example, the actual charging process is not started, if the charging power is too low or if the charging process suddenly stops, the control device, in particular the monitoring algorithm, recognizes that the error state is present and, in particular, what will be discussed in more detail, which error state it is and / or what triggered it. If the error is possibly or preferably even attributable to the control device and its software with a high or very high degree of probability, the compatibility database on the central server device can also be accessed. There it is checked whether a successful loading process has been carried out in the past, the most current software information of such a properly completed loading process being determined. If the software version described by this determined software information, i.e. the at least one software version, deviates from the current software version within the motor vehicle, the software can be downloaded and automatically installed according to the determined software information, if it was not provided directly by the server device, for example by Re-flashing of at least one control device of the control device.

The charging process can be essentially two-stage, for example. In a preparatory process as the first stage, the communication between the control device and the control unit of the energy supply device, in particular a charging station, is established. After that, information is exchanged in particular and, particularly advantageously, security checks are also carried out with regard to general and current compatibility. For example, it can be checked whether there are excessively high voltages / residual voltages in the charging assembly established by the connection to the energy supply device, whether the contacting through the charging cable is sufficient, and the like. The charging cable is also used in this context to achieve communication between the control device and the control unit. In this case, a communication protocol can be used which can be dependent on the charging mode in the control device or in the charging network, which in turn can be determined by the type of energy supply device. In particular, at least one line and / or strand of the charging cable is used as the communication connection. A dedicated charging control device, which is often also referred to as an “on-board charger” (OBC), can serve as a direct communication partner on the part of the motor vehicle, that is to say the control device. Such a charging control device as part of the control device then usually works together with at least one further control device of the motor vehicle, for example a battery control device, a power electronics control device and / or a switching control device, all of which can form part of the control device. This is particularly relevant with regard to the software used, since if there are several control devices that each use software, one can speak of a software network. Only when, in general, the communication connection between the control device and the control unit has been established and the charging parameters have been negotiated have been and / or all safety checks have been successfully completed, the actual charging process is started as the second stage, in which electrical energy from the energy supply device is transferred as electrical power to the battery of the motor vehicle, which is charged accordingly with regard to its stored energy. The charging process is also constantly monitored and controlled, in particular on the basis of the negotiated charging parameters, so that error states can still occur here, which can be detected by the monitoring algorithm.

The monitoring algorithm is implemented as part of the control device, in particular as a computer program that is used in addition to the software otherwise discussed, but can also be part of the same.

It monitors, for example on the basis of sensors, error messages and / or status messages, which will be discussed in more detail below, whether the charging process as a whole is completed properly, in particular successfully. In this case, at least one success criterion can be properly understood as fulfilling at least one success criterion. A success criterion can be that the desired state of charge of the battery is reached, preferably within a predetermined maximum time, and / or that no errors occurred during the charging process. Whenever this is the case, a corresponding final information is compiled and transmitted to the vehicle-external, in particular central server device provided for several vehicles, where the final information is stored in the compatibility database. The final information describes at least which software version of the control device software used to carry out the charging process was used, specifically on the basis of the software information, and which energy supply device was specifically used. If another motor vehicle or the same motor vehicle is now using the energy supply device after the compatibility database is preferably available to a large number of motor vehicles, the positive experience described by the final information can be used if necessary in order to establish interoperability at a later point in time .

However, if there is an error, i.e. an error state that can at least possibly, in particular with great certainty, be traced back to the software, this being true for the entire duration of the loading process, in particular also the loading process, the interoperability is disrupted and can or should be (with high probability) this is due to the software of the control device, error information is compiled, which also contains the identification information of the current energy supply device, but also, which will be discussed in more detail, can receive further information, for example also the at least one software version of the may contain descriptive software information used by the control device when carrying out the loading process. The server device now searches the compatibility database for final information on the energy supply device identified by the identification information and, if it finds one that contains software information that is different from the software information contained in the error information, remedial information to the control device, which the contains determined software information of the determined final information or even the corresponding software. The most up-to-date software information of the terminating information that can be found is preferably used for the current energy supply device, whereby the most up-to-date software information can designate the most up-to-date software according to the software version and / or the most up-to-date software according to the storage of the termination information, possibly weighted. For this purpose, a particularly advantageous development of the present invention also provides that the termination information and the error information also include a time stamp.

In this context, it should also be pointed out that, at least in some cases, the software version of the software of the control unit can also be known in the control device in the context of the exchange of information. In this case, it is also expedient if the completion information and the error information, if available, include energy supply device information describing the software version of the software of the control unit. The software version of the software of the control unit can then also be compared in the compatibility database when error information is received in order to also determine suitable final information and thus software information in this regard.

It should be noted at this point that the software must of course be compatible with the hardware of the motor vehicle according to the determined software information, so that it can be provided that the compatibility database is related to a predetermined hardware configuration of the motor vehicle. Alternatively and preferably, it can be provided that, as part of the error information and the termination information, a description of the hardware configuration, in particular with regard to the charging device, the battery and the control device Hardware information is transmitted, the server device determining software information that is compatible with the hardware information of the error information, in particular that has the same hardware information in the associated termination information.

Furthermore, it is also conceivable within the scope of the present invention to also send the software when sending the termination information with the software information so that it is available in the compatibility database. However, this is less preferred since the various software versions can preferably be provided by a manufacturer of the motor vehicle, in particular can then be downloaded and installed directly from there on the basis of software information transmitted with the remedy information. Software can of course also be kept ready on the server device itself, in particular if the server device is provided in a manufacturer-specific manner, which also makes it easier to send it with the remediation information.

As already mentioned, the error state can in particular relate to insufficient charging power and / or an abortion of the charging process and / or an error in at least one preparation process (preparation step) of the charging protocol. Of course, other error states are basically also conceivable, for example in particular repeated interruptions of the charging process as the second stage of the charging process and the like.

The control device can preferably communicate, in particular directly, with the server device via an at least partially wireless communication link that uses the Internet in particular. This means that the energy supply device is left out of communication; the communication partners are the control device and the server device. This is advantageous in that, for security reasons, the communication connection does not run via the energy supply device, which means that it is preferably not granted any access to the control device or the motor vehicle in general, in particular not in the form of newly installed software and the like.

Overall, it can be said that the procedure according to the invention allows charging problems to be rectified directly and potential breakdowns, that is to say electric motor vehicles that can no longer reach any other charging point, to be avoided. Particularly advantageous with regard to the present invention, however, is that, in particular when used for a large number of motor vehicles, the compatibility database provides an overview of energy supply devices (charging points), whereby it is recognized in each case whether and in which configuration the energy supply devices are correctly connected to the electrical Motor vehicles can interact. In addition to the procedure described here, such information can be used even more extensively, as will be explained in more detail below, namely in particular by only targeting energy supply devices with which interoperability is given or at least can be established. Furthermore, there is the possibility of informing a driver even before reaching an energy supply device that the interoperability of this energy supply device is questionable or not given. It should be noted that for this purpose, in addition to final information, the error information is also preferably stored in the compatibility database. If only error information is then available with regard to an energy supply device, there is no interoperability and the energy supply device can be reported to a driver as unsuitable or avoided in navigation systems as a charging point to be approached.

In particular, when both final information and error information are stored in the compatibility database, there is also an excellent basis for the further development of interoperability, in particular both hardware and software, since interoperability tests previously used can also be avoided if necessary, because starting up and Testing of the individual energy supply devices during the development phase is no longer required or is no longer required as often, so that significant cost savings are achieved.

The monitoring algorithm can expediently evaluate sensor data from at least one sensor monitoring a component of the battery and / or the charging device and / or at least one status information item received from a control unit of the control unit and / or at least one item of memory information from a fault memory of at least one control unit of the control unit. The present invention particularly advantageously provides a holistic approach that considers and evaluates both control-related feedback and sensor feedback together in order to determine error states and, ideally, also to classify them. Sensors that can supply sensor data to the monitoring algorithm include, for example, state of charge sensors of the battery, current and / or voltage sensors for the transmission path from the Energy supply device to the battery, contact sensors that indicate correct contact along the transmission path and the like. Status reports can, for example, be provided by the software controlling the loading process of the control device itself, since today's computer programs, which can form part of the software, are often already designed for such feedback, in particular also for the output of error messages and the like that preferably describe an error that has occurred. Finally, modern control devices, which can be part of the control device, usually also contain a so-called error memory in which errors on the control device side are logged as memory information, which can also be used for a particularly comprehensive monitoring of charging processes. In a holistic approach, a combining logic of various aspects is used in particular.

The communication between the charging device and the energy supply device can preferably take place as powerline communication and / or PWM communication. For example, the communication protocol can be selected as a function of a charging mode. For example, charging modes have already been proposed that use pulse width modulation communication (PWM communication), while other charging modes can use powerline communication, in each case, as explained, using at least one line of the charging cable that connects the motor vehicle to the energy supply device. Such communication protocols can in particular be used in accordance with a standard, as explained at the beginning.

As already mentioned, the charging protocol can comprise at least two steps or sub-processes, it being provided in particular that the charging protocol comprises at least one preparatory process forming a coordination and / or security check phase before the start of charging the battery in a charging process. In addition, authentication steps, preparations for billing and the like can also be included here.

In advantageous embodiments, the error information can also contain software information on the current software of the control device, the server device determining the software information determined differently from the software information of the error information and / or at least storing the software information of the error information in the compatibility database as incompatible, preferably the error information as a whole in saves the compatibility database. In this way, it is avoided that at an earlier point in time, for example due to a different software version of the software of the control unit at this point in time, functional software is recommended in the repair information that corresponds to the current software that is already installed in the motor vehicle . This also keeps the compatibility database up-to-date: If error information, in particular with regard to an error state that can be traced back to the software of the control device with the greatest possible certainty, is more up-to-date than final information that relates to the same software information, it can be concluded that the information described by the software information is at least a software version is unlikely to be suitable for solving software problems with interoperability.

In a particularly advantageous development of the present invention, it can be provided that the monitoring algorithm is designed to classify the error state, with an error class also being transmitted as error information. In particular, with a database for the monitoring algorithm containing as much information as possible, preferably holistic monitoring, the monitoring algorithm can already draw conclusions about the cause of the error state or the type of error, so that, for example, it can also be determined whether the error state is at least possibly or with Security is due to a software problem on the part of the control device. Faults that are not to be understood as relating to the software include, for example, a loose connection in a plug, a broken line or the like. The error information is only sent if the error state is at least possibly due to the software of the control device which is used during the loading process. The transmission of an error class, especially when also storing the error information in the compatibility database, not only offers an excellent basis for later analyzes and improvements in interoperability, but also offers other possible uses.

In a further development of the method according to the invention, it can be provided that in the compatibility database at least one update information item that contains software information assigned to an error class, the software of which corrects the error of the error class, in particular relating to the energy supply device and / or a class of the energy supply device, is stored, which is determined as software information for the remediation information if it matches the error class of the error information. For example, if a If a certain error class repeatedly occurs in at least one energy supply device, in particular a class of energy supply devices, this can be used, for example, by the manufacturer of the motor vehicle or another company that provides software for the control device in order to create an updated version of the software that addresses the errors of this error class fixes. This updated software does not necessarily have to be installed immediately in the motor vehicle, for example as part of a workshop trip, but can be made available by the server device as required. For this purpose, as a kind of further, generalized final information, update information is stored in the compatibility database, for example by the manufacturer, which includes at least the error class and software information that describes the software that corrects the error in the error class, more precisely its software version. When receiving error information with an error class, the server device uses the compatibility database to first check, using any update information that may be present, whether a suitable update is available with regard to this error class, and preferably uses the corresponding software information for the correction information. In this way, a further possibility is created, for example, to avoid rollbacks to previous software versions and instead to allow upgrades to bugfix software if the error status could be clearly assigned and a remedial measure for the error status has been implemented in the bugfix software.

In a particularly preferred embodiment of the method according to the invention, it is provided that if final information for the energy supply device is unavailable in the compatibility database and / or if a loading process that is error-free, at least with regard to the software, cannot be established for a certain period of time, in particular five to fifteen minutes, and / or for one certain number of installation processes, in particular one to four, no further charging process is started at the energy supply device and an energy supply device-related failure state is assumed. If there is no indication of a possible elimination of the error state in the compatibility database or if a change in the software of the control device itself by installing software in accordance with rectification information, in particular for a certain period and / or a certain number of attempts, does not lead to a successful, correct loading process , it can be concluded that a final elimination of the error state is not possible, since the cause of the error may then be located in the energy supply device, for example a charging station. In this case, a failure state can be entered, which can have various concrete consequences.

First, when the failure state occurs, corresponding failure information can be determined for the server device, which failure information marks the error information in the compatibility database for further analysis. Since it is ideally desired that electric motor vehicles can be connected to all energy supply devices for charging their battery, it is also desirable to establish interoperability accordingly if this has not yet succeeded due to the previous possibilities. A corresponding analysis with regard to the energy supply device can be initiated automatically, or it is conceivable to output an analysis note to a user. Such an analysis note or such an automatic analysis can serve as a basis for the development of new software and / or interoperability tests.

However, it is particularly preferred if the motor vehicle also has a navigation device, a further energy supply device closest to a route to be followed and / or a current position being determined and the motor vehicle being guided to the further energy supply device. This means, in particular depending on the state of charge in the battery, i.e. a current remaining range of the motor vehicle, the driver of the motor vehicle can be directed to a further energy supply device, in particular an already existing route can be adapted to reach an alternative energy supply device. For the further energy supply device, a compatibility (i.e. interoperability) or manufacturability of the compatibility for carrying out a charging process can be checked on the basis of the compatibility database, with another further energy supply device being determined and approached if the test fails. The compatibility refers at least to the software. This reveals a further benefit of the compatibility database, which can be useful not only in the event of a failed establishment of interoperability, i.e. when a failure condition occurs, but can also be used in other operation of the motor vehicle.

A particularly advantageous embodiment of the present invention that can be used in general provides that the motor vehicle has the or a navigation device, the at least one energy supply device to be approached when planning a route to a destination with at least one charging process along the route is selected in such a way that, on the basis of the compatibility database, there is a compatibility (interoperability) or manufacturability of the compatibility for carrying out a charging process. In other words, the compatibility database can be included in the route planning of a navigation system, be it when a driver asks directly to approach the next suitable energy supply device, or when a charging process is required along a route to another destination. For example, an alternative route can be determined if it is determined for an energy supply device actually intended to be on an original route that interoperability is neither present nor can it be expected to be established. However, if no or too little information is available about an energy supply device, it is also conceivable to plan the start-up of energy supply devices in such a way that at least one energy supply device for which interoperability exists or is likely to be able to be produced, alternatively still with the remaining state of charge of the battery can be approached. Obviously, due to the consideration not relating to an individual energy supply device, significant improvements with regard to the comfort and ensuring the mobility of electric motor vehicles are possible.

As already mentioned, the control device can include multiple control devices, for example at least partially selected from the group comprising an on-board charger (OBC), a battery control device and a power electronics control device, and / or use multiple different software programs, the Software information for the several different software programs and / or control devices each comprises a software version. In other words, within the scope of the present invention it can also be a question of a software network on the part of the control device, which is checked as a whole, but possibly only requires a partial reinstallation, for example if there is a relevant difference in only one software version of a single software program and / or control device consists.

To install the software, it can specifically be provided that at least one memory module of the control device is flashed and the control device is at least partially rebooted. The memory module can therefore be at least one flash memory which, in addition to the software for the loading process and possibly also the monitoring algorithm, can also contain basic information on the operation of the control device, in particular the respective control devices, the information on such flash memories usually being provided by what is known as "flashing “, Ie the overwriting of ROM-stored software, can be updated, whereby the new software can then be used after a restart, ie a reboot.

In a further development of the invention, it can also be provided that, in particular depending on the region, the software is only installed according to the remedy information after receipt of the driver's consent information, which can be given, for example, via an input device of the motor vehicle. Depending on the country / region and the associated regulations, in particular data protection regulations, it may be necessary to obtain prior consent from the driver, which can also be implemented within the scope of the present invention.

As already mentioned, the attempt to remedy an error state can be carried out iteratively if, even after a first attempt at the update, there is still an error state that can at least possibly be traced back to the software. In other words, the present invention can provide that, in the event of a further error state that can at least possibly be traced back to the software, error information is sent again despite the receipt and processing of remediation information. If, for example, there is a number of final information items (or update information items) in the compatibility database, rectification can first be carried out using the most current software information item, then via the second most current software information item, and so on. As already described, a failure state can be assumed after a predetermined time and / or a predetermined number of rectification attempts.

• - mittels eines Überwachungsalgorithmus die ordnungsgemäße Durchführung des gesamten Ladevorgangs zu überwachen,
• - bei ordnungsgemäßer Durchführung des Ladevorgangs nach dessen Abschluss eine Abschlussinformation, die die ordnungsgemäße Durchführung anzeigt und eine wenigstens eine Softwareversion der bei der Durchführung des Ladevorgangs, insbesondere der Umsetzung des Ladeprotokolls, verwendeten Software der Steuereinrichtung beschreibende Softwareinformation sowie wenigstens eine die Energiebereitstellungseinrichtung identifizierende Identifikationsinformation umfasst, an die Servereinrichtung übermittelt,
• - bei Detektion eines zumindest möglicherweise auf die Software zurückführbaren Fehlerzustands während der Durchführung des Ladevorgangs durch den Überwachungsalgorithmus eine Fehlerinformation umfassend wenigstens die Identifikationsinformation der aktuellen Energiebereitstellungseinrichtung an die Servereinrichtung zu übermitteln, und
• - bei Empfang einer Behebungsinformation die der ermittelten Softwareinformation entsprechende Software in der Steuereinrichtung zu installieren und den Ladevorgang neu zu starten,

und die Serveeinrichtung ausgebildet ist,

• - die Abschlussinformation in der Kompatibilitätsdatenbank zu speichern,
• - bei Empfang einer Fehlerinformation aus der Kompatibilitätsdatenbank eine, insbesondere die aktuellste, Softwareinformation der eingespeicherten Abschlussinformationen für die aktuelle Energiebereitstellungseinrichtung zu ermitteln und eine die Software der Softwareversion der ermittelten Softwareinformation und/oder die ermittelte Softwareinformation umfassende Behebungsinformation an die Steuereinrichtung zurückzuüberm itteln.

In addition to the method, the present invention also relates to a system for operating motor vehicles during wired charging processes on external energy supply devices, the system being a server device external to the vehicle with a compatibility database and several motor vehicles that have an electric battery that can be charged via a charging device on the motor vehicle side and a motor vehicle-side, in particular at least one Control device comprising control device, wherein the control device of a motor vehicle to be charged communicates with a control unit of the corresponding energy supply device during a charging process to implement a charging protocol determining the control of the charging process, the control devices being designed

• - to monitor the correct implementation of the entire charging process by means of a monitoring algorithm,
• - if the charging process is carried out correctly, after its completion, a piece of final information that indicates that it has been carried out correctly and includes at least one software version of the software information used by the control device describing the software used to carry out the charging process, in particular the implementation of the charging protocol, as well as at least one piece of identification information that identifies the energy supply device, transmitted to the server facility,
• - upon detection of an error state that can at least possibly be traced back to the software during the implementation of the charging process by the monitoring algorithm, to transmit error information including at least the identification information of the current energy supply device to the server device, and
• - upon receipt of remediation information, to install the software corresponding to the determined software information in the control device and to restart the loading process,

and the serving device is designed,

• - to save the completion information in the compatibility database,
• - upon receipt of error information from the compatibility database, to determine, in particular the most current, software information of the stored termination information for the current energy supply device and to return remediation information that includes the software version of the determined software information and / or the determined software information to the control device.

All statements relating to the method according to the invention can be transferred analogously to the system according to the invention, with which the advantages already described can therefore also be obtained. In particular, it applies to both the method according to the invention and the system according to the invention that it is preferably used on electric motor vehicles which have an electric motor that can be fed by the battery as the drive motor (traction motor).

• 1 einen Ablaufplan eines Ausführungsbeispiels des erfindungsgemäßen Verfahrens,
• 2 eine erfindungsgemäßes System, und
• 3 die Struktur einer Steuereinrichtung.

Further advantages and details of the present invention emerge from the exemplary embodiments described below and with reference to the drawing. Show:

• 1 a flow chart of an embodiment of the method according to the invention,
• 2 a system according to the invention, and
• 3 the structure of a control device.

1 shows a flow chart of an exemplary embodiment of a method according to the invention, which is used to monitor and, if necessary, establish the interoperability of motor vehicles and energy supply devices during charging processes. In the present exemplary embodiment, the motor vehicles are electric motor vehicles which consequently have an electric motor which is used to drive the motor vehicle and which is fed by a battery, in particular a high-voltage battery. By means of a charging device on the motor vehicle side, the battery can be charged in a wired manner to an energy supply device external to the vehicle, which is why such energy supply devices are also referred to as charging stations. After one of the motor vehicles has been connected to an energy supply device, for example a charging station, by means of a charging cable, a charging protocol is started in a motor vehicle-side control device of the charging device, which is carried out by step S1 is symbolized.

In the present case, the charging protocol consists of two stages or steps, namely a preparation process and the actual charging process, in which energy is fed into the battery from the energy supply device. In the preparation process, a communication connection is established between the control device of the motor vehicle and a control unit of the energy supply device, which also uses the charging cable, specifically in particular a charging line of the charging cable. In this case, PWM communication or powerline communication can be used as the communication protocol, in particular depending on the charging mode, which in turn can depend on the type of energy supply device. In addition to the establishment of this communication connection, the preparation process also involves negotiating charging parameters and checking requirements or a security check, for example by monitoring whether suitable voltages are present, whether contacts have been made correctly and the like. In the second stage, the charging process is carried out with the negotiated charging parameters. The charging process continues until the battery is charged to the desired state of charge.

During the entire execution of the loading protocol in step S1 errors can occur that lead to error states. These are often due to the fact that the communication between the control unit and the control device does not work correctly. A main reason for this is that the software or, in particular for the motor vehicle, also software networks are not correctly coordinated with one another. For example, there may be problems with timing, so that communication cannot be established or communication errors, for example incorrectly negotiated charging parameters, occur. Since communication is still required during the charging process, for example for readjustment, error states in the software of the control device can also occur at this point in time, which can lead to an abort, insufficient charging power and the like.

In order to be able to detect such error states, in the control device on the motor vehicle side according to step S2 During the entire charging process described by the charging protocol, a monitoring algorithm is executed, which evaluates the present sensor data, status information and memory information from error memories of the control devices involved in the control device or the charging process, which form the control device. It is already possible within the framework of the monitoring algorithm to analyze it more precisely when an error state occurs, and to assign it to an error class in the present case. Error classes can include, for example, communication errors, negotiation errors, loading process errors and the like. Some of the error classes can already clearly indicate that the error state is due to the software of the control device (which is not compatible with the energy supply device), while other error classes only indicate this as possible or even as not possible. The monitoring algorithm not only checks whether the charging process is started correctly, but it is monitored throughout the entire charging process until the charging process has been completed.

In one step S3 a check is carried out to determine whether the loading process has already been successfully completed, i.e. whether at least one success criterion has been met that indicates that it has been properly completed. The success criterion can, for example, check whether a desired target state of charge of the battery has been reached within a predetermined maximum period of time. If the loading process has been properly completed, it is done in one step S4 In the control device, a piece of final information is compiled and transmitted to a server device external to the vehicle, on which a compatibility database is available. In the present case, the completion information not only indicates that the charging process has been properly completed, but also contains identification information to uniquely identify the energy supply device, optionally a geodetic position of the energy supply device, a time stamp, one of the software versions in the software network of the control device Software information describing the software used for the charging process, optionally hardware information describing the hardware of the motor vehicle with regard to the charging process and, if available, energy supply device information which, for example, can describe the at least one software version of the software used in the control unit of the energy supply device. In some communication processes, this information is provided by the energy supply device, specifically the control unit.

In one step S5 the termination information is received by the server device and the compatibility data band is added, in particular assigned to the energy supply device identified by the identification information. After the system in which the method described here is used is suitable for a plurality of motor vehicles and any number of energy supply devices and is also used, the compatibility database can contain closing information of the most varied of motor vehicles for different energy supply devices.

Has been in the crotch S3 found that the loading process has not been completed or has not been completed correctly in one step S6 checks whether the monitoring algorithm has detected an error condition that prevents the charging process from being successfully completed. If this is not the case, the charging protocol (step S1 ) continue as usual and continue according to step S2 monitors until an error condition occurs or, which should be the normal case, the proper completion of the step S3 is detected.

However, an error condition of a certain error class becomes in the step S6 is established at least if the error state can at least possibly be traced back to the software of the control device, in step S7 an error information is compiled and transmitted to the server device. For example, this action can be assigned to certain error classes. For error classes to which this action is not assigned, in which the error state cannot (or possibly with too little probability) can be traced back to the software of the control device, a failure state is assumed, see step S10 , in which no more charging processes are attempted. This failure state of the The charging device of the motor vehicle will be described in more detail below.

The one in the crotch S7 Compiled error information contains the error class and possibly further information on the occurred error status as well as the identification information of the currently used energy supply device, the hardware information, the software information, the time stamp, optionally the position information and possibly further information. In one step S8 this error information is received by the server device and, in the present case, also stored in the compatibility database.

The server device then searches in step S8 Completion information that corresponds to the error information in the identification information and the hardware information, but for which there was a successful completion. If such termination information is found, it is also checked whether its software information differs from that of the error information. If this is not the case, the situation with regard to this software version, as described by the software versions of the software information, has obviously changed, so that a corresponding marking can be made. In any case, this is not suitable for eliminating the error condition, since the software would be the same.

It should be noted at this point that update information containing software information with an assigned error class eliminated by these software versions can also be stored in the compatibility database, for example directly from the manufacturer, as further final information. Such update information, which in turn can be assigned to a specific hardware or hardware group, that is to say contain corresponding hardware information, is of course also used in step S8 the comparison to be made with the compatibility database.

In step S9 a check is now made as to whether at least one piece of final information was found in the compatibility database, the software information of which differs from the software information of the error information and can therefore be referred to in the following as ascertained software information. If this is not the case, no troubleshooting can take place by means of the compatibility database, which is reported back to the motor vehicle, specifically the control device, which in turn is reported in accordance with step S10 enters the failure state.

In the event, however, that software information that differs from the software information of the error information could be determined, in one step S11 an item of remediation information is compiled by the server device, the most recent of these at least one determined software information being selected for this remedial information. The topicality can be based, if necessary weighted, either on the time stamp itself, i.e. the most recent success when charging to a power supply device, or on the software versions so that the highest software version is selected as the most current software information. If update information specifically provided for the error class has been found, the associated software information is immediately selected as being used for the correction information.

The remediation information can contain the software information, but also additionally or alternatively the software corresponding to the software information.

In step S12 the remediation information is received by the control device from the server device. If the software is already included, it can be installed immediately; if it is not included, it is downloaded by the control device using the software information contained in the remedy information, for example from another server of the manufacturer, and then installed. The installation in the control devices, in which new software programs of the software have to be installed, takes place in that the corresponding memory modules are flashed and then a reboot takes place, as is fundamentally known in the prior art.

After restarting the control devices of the control device that have received new software programs, in one step S13 still checked whether a failure criterion has been met, which is particularly relevant in the case of repeated attempts to find suitable software. For example, it can be checked whether a predetermined period of time, for example five minutes, has already passed to attempt to correct the error, and / or whether a predetermined number of attempts to install new software and restart the loading process have been used up. If this is the case, step S10 entered the state of failure. Otherwise the loading protocol will be restarted with the installed software, step S1 . It should be noted that the step S13 is shown at its corresponding position in the flowchart for reasons of ease of illustration. Of course, he can also go straight to the step S6 follow or be housed elsewhere.

Has been in the crotch S10 If the failure state is assumed, it is assumed that the error state cannot be eliminated via the software of the control device and therefore no charging process can be carried out properly on the current energy supply device. This is reported to the server device, which notes the problem, in particular the energy supply device according to the identification information, for checking. Based on this, a further analysis can take place automatically or on the part of a user in order, for example, to further develop interoperability and to eliminate the error state for the future.

However, if the motor vehicle has a navigation system, the compatibility database in step S14 can also be used to find the closest energy supply device at which the motor vehicle can probably charge its battery without errors according to the compatibility database. A route to this energy supply device is calculated and offered to the driver accordingly. In the case of motor vehicles that can be operated completely automatically, the motor vehicle can also be moved automatically to this further energy supply device.

In a navigation system, however, the compatibility database can also generally be used advantageously, in particular for routes to a destination along which loading must be carried out. An energy supply device can then be selected and approached in a targeted manner, in which interoperability is given or can at least be established according to the compatibility database.

It should also be noted that the communication between the server device and the control device of the motor vehicle preferably takes place without further, in particular intermediate communication partners, so that an intermediate role of the energy supply device as an intermediary or the like can be excluded, rather the energy supply device is ideally not involved at all.

A transmission of the hardware information can also be avoided if, for example, hardware-specific compatibility databases are used. For example, such compatibility databases can be used for certain models from a manufacturer or the like.

2 shows a schematic diagram of a system according to the invention in which the method according to the invention can be carried out. As already described, the system includes 1 the server facility 2 as well as a variety of motor vehicles 3 , here electric vehicles. In a storage means of the server device 2 is the compatibility database 4th saved. The server facility 2 can of course also have at least one processor in order to carry out the corresponding steps when different information is received. In particular, the server device 2 also, as described, from another computing device 5 , for example a further server or a server from the manufacturer, receive update information as further final information, see arrow 6th . For update information and from automobiles 3 Completion information obtained can easily be stored in the compatibility database by means of a storage unit 4th In the event of error information, a remediation unit can save and compare with the compatibility database 4th and, if necessary, compile and return the movement information.

The server facility 2 communicates over an at least partially wireless communication link using the Internet 7th can use with the motor vehicles 3 . A cellular connection is expediently also at least partially 8th used.

The motor vehicles 3 have an electric motor as an electric motor vehicle 9 on that from the battery 10 , in this case a high-voltage battery, can be fed. The motor vehicles 3 further comprise the charging device 11 with the corresponding control device 12th . Communication with the server facility 2 can be via a conventional communication device of the motor vehicle, which is basically known in the prior art 3 respectively.

In the schematic diagram shown, the motor vehicles are 3 using the appropriate charging cable 13th each with an energy supply device 14th , in this case a charging station 15th or generally a charging station, connected, which can be done via appropriate plugs. The energy supply facilities 15th comprise, as stated, control units 16 .

3 shows the functional structure of one of the control devices 12th more accurate. In the present case, this includes several control units 17th , 18th , 19th , the control unit 17th is a charging control unit (OBC) and can serve as a kind of master. The control units 18th , 19th and, if necessary, further control devices can, for example, be a battery control device, a power electronics control device (for example a Control unit of a DC-DC converter) and the like.

In the present case, each of the control devices comprises a flash memory module 20th and a fault memory 21 . As part of the charging facility 11 and possibly also the control device 12th can also use various sensors 22nd , for example current sensors, state of charge sensors, contact sensors, temperature sensors and the like can be provided.

The charging control unit 17th , which is often also referred to as an on-board charger (OBC), in the present case includes a protocol unit 23 to carry out the charging protocol to implement a charging process. A further functional unit, namely a monitoring unit, can be used to implement the monitoring algorithm 24 , be provided. This reads memory information from the error memory 21 receives status information from the various software programs of the software, here the software network, and also sensor data from the sensors 22nd . This enables a holistic view of the monitoring of occurring error states.

QUOTES INCLUDED IN THE DESCRIPTION

This list of the documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• DE 102015204362 A1 [0006]
• DE 102009036943 A1 [0007]
• DE 102017122734 A1 [0008]
• WO 2011/044543 A2 [0009]

Non-patent literature cited

• Standard IEC 618851-1 [0003]
• Standard ISO 15118 [0003]

Claims (15)

A method for operating a motor vehicle (3) which has an electric battery (10) that can be charged via a motor vehicle-side charging device (11), in the case of a cable-based charging process at an energy supply device (14) external to the vehicle, with a motor vehicle-side control device (12) using the cable connection between the charging device (11) and the energy supply device (14) communicates with a control unit (16) of the energy supply device (14) for the implementation of a charging protocol determining the control of the charging process, characterized in that a monitoring algorithm of the control device (12) ensures that the entire charging process is carried out correctly monitored, the control device (12) - if the loading process is carried out correctly, after its completion, a piece of completion information indicating that it has been carried out correctly and at least one software version of the d it comprises software information of the control device (12) describing the loading process and at least one piece of identification information identifying the energy supply device (14), transmitted to a server device (2) external to the vehicle, where the final information is stored in a compatibility database (4), and - upon detection of at least one error state possibly traceable to the software during the implementation of the charging process by the monitoring algorithm, error information comprising at least the identification information of the current energy supply device (14) is transmitted to the server device (2), which from the compatibility database (4) contains one, in particular the most current, software information of the stored Completion information for the current energy supply device (14) is determined and the software of the software version of the determined software information and / or remediation information comprising the ascertained software information is transmitted back to the control device (12), and - upon receipt of remediation information, the software corresponding to the ascertained software information is installed in the control device (12) and the loading process is restarted. Procedure according to Claim 1 , characterized in that the monitoring algorithm provides sensor data from at least one sensor (22) monitoring a component of the battery (10) and / or the charging device (11) and / or at least one from a control device (17, 18, 19) of the control device (12) evaluates received status information and / or at least one piece of memory information from a fault memory (21) of at least one control device (17, 18, 19) of the control device (12). Procedure according to Claim 1 or 2 , characterized in that the communication between the charging device (11) and the energy supply device (14) takes place as powerline communication and / or PWM communication and / or that the charging protocol before the start of charging the battery (10) in a charging process at least one comprises a preparatory process forming a coordination and / or security review phase. Method according to one of the preceding claims, characterized in that the error information also contains software information on the current software of the control device (12), the server device (2) determining the software information determined differently to the software information of the error information and / or at least the software information of the error information is stored in the compatibility database (4) as incompatible. Method according to one of the preceding claims, characterized in that the monitoring algorithm is designed to classify the error state, an error class also being transmitted as error information. Procedure according to Claim 5 , characterized in that in the compatibility database (4) at least one piece of software information assigned to an error class, the software of which corrects the error of the error class, in particular related to the energy supply device (14) and / or a class of the energy supply device (14), and the assigned Update information comprising error class is stored, with the software information of the update information for the remediation information being determined if the error class of the error information matches. The method according to any one of the preceding claims, characterized in that in the event of unavailability of final information for the energy supply device (14) in the compatibility database (4) and / or the unproducibility of a loading process free of errors, at least with regard to the software, for a predetermined period of time, in particular 5 to 15 minutes, and / or for a predetermined number of installation processes, in particular 1 to 4, no further charging process is started on the energy supply device (14) and an energy supply device-related failure state is assumed. Procedure according to Claim 7 , characterized in that when the failure condition occurs the error information in the compatibility database (4) is marked for further analysis. Procedure according to Claim 7 or 8th , characterized in that the motor vehicle (3) also has a navigation device, a further energy supply device (14) closest to a route to be followed and / or a current position being determined and the motor vehicle (3) being guided to the further energy supply device (14). Procedure according to Claim 9 , characterized in that for the further energy supply device (14) on the basis of the compatibility database (4) a compatibility or manufacturability of the compatibility for carrying out a charging process is checked, with another further energy supply device (14) being determined and approached if the test fails. Method according to one of the preceding claims, characterized in that the motor vehicle (3) has the or a navigation device, wherein when planning a route to a destination with at least one charging process along the route, the at least one energy supply device (14) to be approached is selected such that due to the compatibility database (4) there is compatibility or manufacturability of the compatibility for carrying out a charging process. Method according to one of the preceding claims, characterized in that the control device (12) comprises several control devices (17, 18, 19) and / or uses several different software programs, the software information for the several different software programs and / or control devices (17, 18 , 19) each includes a software version. Method according to one of the preceding claims, characterized in that for installing the software at least one memory module (20) of the control device (12) is flashed and the control device (12) is at least partially rebooted. Method according to one of the preceding claims, characterized in that in the event of a further error state which can at least possibly be traced back to the software, error information is sent again despite the receipt and processing of a remediation information. System (1) for operating motor vehicles (3) during wired charging processes on external energy supply devices (14), comprising a server device (2) external to the motor vehicle with a compatibility database (4) and several motor vehicles (3) that have a charging device (11) on the motor vehicle. have a chargeable electric battery (10) and a control device (12) on the motor vehicle, in particular at least one control device (17, 18, 19), the control device (12) during a charging process to implement a charging protocol with a control unit that determines the control of the charging process (16) communicates with the energy supply device (14), the control devices (12) being designed -to monitor the correct execution of the entire charging process by means of a monitoring algorithm, - if the charging process is carried out properly, after its completion, a piece of final information that indicates that it has been carried out correctly and at least one software version of the software information of the control device (12) used to carry out the charging process, in particular the implementation of the charging protocol, as well as at least one piece of software information describing the energy supply device ( 14) comprises identifying identification information, transmitted to the server device (2), - upon detection of an error state that can at least possibly be traced back to the software during the implementation of the charging process by the monitoring algorithm, to transmit error information including at least the identification information of the current energy supply device (14) to the server device (2), and - upon receipt of remediation information, to install the software corresponding to the determined software information in the control device (12) and to restart the loading process, and the server device (2) is designed, - to save the final information in the compatibility database (4), - on receipt of error information from the compatibility database (4) to determine, in particular the most current, software information from the stored termination information for the current energy supply device (14) and to send remediation information that includes the software of the software version of the determined software information and / or the determined software information to the control device (12) to be sent back.

Images