DE102021112420A1 - Method for protecting an electric-electronic system and electric-electronic system for a motor vehicle - Google Patents

Abstract

The invention relates to a method for protecting an electrical-electronic system (10) of a variant of a motor vehicle model comprising a number of variants, the system (10) having at least two electrical and/or electronic components (14, 14', 14") and the at least two components (14, 14', 14") are connected to one another by means of a transmission network (16), with the following steps: - providing an evaluation function for each component (14, 14', 14") of the group; (S1) - determining a superset which comprises at least one of the components (14, 14', 14"); (S2) - determining at least one subset with at least one of the components (14, 14', 14"); (S3) - determining a network capacity of the transmission network (16) that can be provided for the components (14, 14', 14") on the basis of the superset and/or subset; (S4) and determining at least one network component (18) forming the connection based on the ascertained network capacity. (S5) The invention also relates to an electrical-electronic system (10).

Description

The invention relates to a method for protecting an electrical-electronic system of a variant of a motor vehicle model comprising a plurality of variants according to patent claim 1. The invention also relates to an electrical-electronic system for a motor vehicle according to the preamble of patent claim 10.

Nowadays, a model series of a motor vehicle type, in particular a passenger car, usually includes a large number of possible model variants. A respective variant includes, for example, different types of special equipment or other extras. Since these can often be combined with each other, the range of variants, i.e. the number of possible variants of the motor vehicle, is growing almost exponentially. Special equipment can include a component such as a control device and/or line electronics. Such a component is usually connected to other components of the motor vehicle by means of a transmission network for the purpose of supplying energy and/or exchanging data. Thus, several components and the transmission network form an electric-electronic system or what is known as an E/E architecture in the motor vehicle.

The electrical-electronic (E/E) architecture of a motor vehicle includes the vehicle electronics and the vehicle electrics, the networking, the interfaces and an optimal power supply, signal processing and data distribution between several of the components and is also necessary for car-to-car, for example - or car-to-infrastructure communication.

Such an E/E architecture includes, for example, energy management, energy storage, energy supply and energy recovery. E/E systems are used in petrol or fuel-powered vehicles as well as in electric vehicles. For example, they supply and/or control driver assistance systems with their electrical control devices and so on. Protecting such E/E systems, for example against failure, is important in motor vehicles.

In principle, each variant would have to be secured, which costs a lot of time and resources. As a rule, there are currently two ways of dealing with the problem: firstly, over-protection through unrealistic protection scenarios with all components, or the opposite, under-protection through randomly or poorly selected variants.

The EP 1 691 310 A2 a process for the production of a complex technical system with components for a means of transport.

The object of the present invention is to provide a method for protecting an electrical-electronic system and the system for a motor vehicle, which can be protected in a particularly resource-saving manner even with a large range of variants.

According to the invention, this object is achieved by the subject matter of the independent patent claims. Advantageous refinements and developments of the invention are specified in the dependent patent claims as well as in the description and the drawing.

A first aspect of the invention relates to a method for protecting an electric-electronic system of a variant of a motor vehicle model comprising a plurality of variants, the system depending on the variant having at least two, in particular more than two, electrical and/or electronic components from a plurality of components comprehensive group.

In other words, the method serves to protect the system, it being possible for the protection to take place for any variant of a motor vehicle from a motor vehicle model series. A motor vehicle is, for example, in particular a passenger car. The motor vehicle model can include a large number of variants, for example due to different combinations of special equipment, for each of which a safeguarding has to take place. In this case, the respective variant comprises at least two components, with the respective component being able to comprise, for example, a control unit and/or power electronics or being designed as such. The respective component can be selected from a group of components. For example, a group can include a number of control devices, in particular, for example, motor devices, which can each be designed differently depending on the type of motor. For example, only one of the engine control units from this group is used for one variant of the vehicle.

The electrical-electronic system, or E/E system for short, is designed in such a way that the at least two components are connected to one another by or by means of a transmission network. The Transmission Network enables an exchange between the at least two components and is used in particular for an energy exchange and/or data exchange between the two components. The transmission network can be, for example, an electricity network or an energy network and/or a communication network such as a bus system or the like. In other words, the at least two components are connected to one another via the transmission network for an energy exchange and/or data exchange.

• In einem ersten Schritt erfolgt das Bereitstellen einer Bewertungsfunktion für jede Komponente der Gruppe, wobei die Bewertungsfunktion eine durch die jeweilige Komponente verursachbare Last auf das Übertragungsnetz beschreibt. Dabei ist das Übertragungsnetz eine von den wenigstens zwei Komponenten gemeinsam genutzte Ressource. Das Übertragungsnetz dient ganz allgemein dem Austausch der Komponenten miteinander.
• In einem zweiten Schritt erfolgt ein Ermitteln einer Obermenge, welche wenigstens eine der Komponenten umfasst, für welche die Bewertungsfunktion eine vorgegebene Last beschreibt. Die vorgegebene Last ist beispielsweise die durch eine der Bewertungsfunktionen größte beschriebene Last einer der Komponenten.
• In einem dritten Schritt des Verfahrens erfolgt ein Bestimmen wenigstens einer Untermenge, welche wenigstens einer der Komponenten umfasst, deren Bewertungsfunktion eine Last ergibt beziehungsweise beschreibt, welche unterhalb der Last der wenigstens einen Komponente der Obermenge liegt.
• In einem vierten Schritt erfolgt ein Ermitteln einer für die wenigstens zwei Komponenten des E/E-Systems bereitstellbaren Netzkapazität des Übertragungsnetzes anhand der Obermenge und/oder Untermenge. Dabei ist die Netzkapazität eine Übertragungskapazität des Übertragungsnetzes.
• In einem fünften Schritt erfolgt ein Bestimmen wenigstens einer die Verbindung ausbildenden Netzwerkkomponente anhand der ermittelten Netzkapazität zur Absicherung des Übertragungsnetzes und somit des E/E-Systems.

According to the invention, the method comprises several steps:

• In a first step, an evaluation function is provided for each component of the group, the evaluation function describing a load on the transmission network that can be caused by the respective component. In this case, the transmission network is a resource that is used jointly by the at least two components. The transmission network is generally used to exchange components with one another.
• In a second step, a superset is determined, which includes at least one of the components for which the evaluation function describes a specified load. The specified load is, for example, the largest load of one of the components described by one of the evaluation functions.
• In a third step of the method, at least one subset is determined, which includes at least one of the components whose evaluation function results in or describes a load that is below the load of the at least one component of the superset.
• In a fourth step, a network capacity of the transmission network that can be provided for the at least two components of the E/E system is determined on the basis of the superset and/or subset. The network capacity is a transmission capacity of the transmission network.
• In a fifth step, at least one network component forming the connection is determined based on the ascertained network capacity to secure the transmission network and thus the E/E system.

The core idea of the invention is the systematic reduction of the variants to be evaluated in order to also be able to provide protection for all variants. In other words, the method provides for a reduction based on finding supersets. For this purpose, the possible variants are compared. It is checked whether a variant A or component A = {a1, a2, a3, a4 ...} is a subset of variant B or component B = {b1, b2, b3, b4, ...}. Thus, for each a of component A or variant A, there is a variant B or component B with b = a.

From the point of view of evaluation, variant B shows at least as good or bad behavior as variant A, and therefore variant A does not have to be evaluated. The following should always apply to the method: F(a+b)≧F(a), where F is the respective evaluation function in which, for example, a maximum is sought. If the minimum is to be sought, then F (a+b) ≤ F (a) should apply.

The invention is based on the finding that the variety of variants poses a problem when securing E/E systems. Due to the numerous combinations of special equipment, for example, which are provided by the components, there is a particularly large range of variants and therefore also a particularly great effort in securing the possible variants. If, for example, a gateway load or a bus load of the E/E system is protected, it is important to consider the variants that cause the greatest load. According to previous practice, it was not possible to identify them in advance. In order to get the most accurate picture possible of the utilization, you would have to evaluate or test all possible variants, for example by carrying out a respective load test. This would consume a particularly large amount of time and/or resources.

These disadvantages result, for example, from the fact that special vehicle equipment is mutually exclusive, for example a control unit for a sunroof and a control unit for a convertible roof. Furthermore, for example, different engine control units can exclude each other as components, so the engine control unit for a 6-cylinder plug-in hybrid and an engine control unit for a 12-cylinder are not simultaneously installed in one variant of the motor vehicle. A camera and radar sensor, for example, are also often mutually exclusive in a control device for a spacer. In addition, the user can, for example, install virtually any app for infotainment systems and their control units, the utilization of which in communication, for example in exchange with other devices and/or sensors, which can represent other components of the motor vehicle, is often unknown.

The underlying technical problem here is the high number of possible variants, wel che can, for example, grow exponentially with the number of components considered. As a result, the hedging effort is very high and in many cases cannot be presented in a reasonable time. This problem is solved by the method, and protection for any variants of the system or the motor vehicle model is possible.

For example, the method can be carried out in such a way that a component, a control device, which is to be designed with a gateway functionality, is secured. The gateway load depends on the communication relationships of the components of the E/E architecture. It is important to find and evaluate the variant with the maximum resource consumption. So that not all possible variants need to be evaluated, which would be possible with a load test, for example, the method finds the upper variants and discards the sub-variants for the tests. The determination of the network component, which is for example a cable and/or a gateway or the like, can thus be determined, which thus has sufficient capacity for all variants, as a result of which the system can be secured.

If the at least two components are power electronics, for example, and the transmission network is therefore an energy network, a simple evaluation function can be a maximum individual current, for example, and the evaluation function F(a+b) can map the sum of the maximum individual currents. In the case of electricity, for example, it should be ensured that the method cannot be used simultaneously for electricity consumers and electricity sources as components, but should be carried out individually for electricity consumption and electricity sources.

The method can advantageously be carried out on an electronic computing device. Simulations can be used for this, for example. However, measurements for determining or to support the determination of evaluation functions are more advantageous.

The method according to the invention has the advantage that no variant can be overlooked for jointly or municipally used resources, such as the transmission network, by the components regardless of a variant of the motor vehicle due to the grouping of the components into supersets and subsets. Thus, no component or variant should appear for which it can later turn out that only a sub-protection was obtained due to poorly selected variants during the protection or tests for protection. The method can also be used in other types of vehicles than motor vehicles, for example in aircraft.

In an advantageous embodiment of the invention, at least one of the at least one of the at least two components is a control unit and/or a power component. Additionally or alternatively, the network component includes a line, for example in the form of at least one cable, and/or a bus and/or a gateway. In other words, the component is designed as the control device, for example as an engine control device or for a comfort function and/or a driver assistance system. In addition or in addition, the component includes a power component, which is designed, for example, to convey electricity into an energy storage device or from an energy storage device. This means that the electrical-electronic system is secured on a line and/or a bus and/or a gateway. In addition, protection takes place on a control unit and/or a power component.

In automotive engineering, gateways are often found between the various data buses such as CAN in different speed versions, e.g. B. MOST bus. A typical configuration in an automobile consists of a "fast" CAN bus for engine control and similar real-time control units and a "slow" CAN bus for control units with little and rarely occurring data ("comfort bus", for tire pressure monitoring or fuel gauges) . For certain purposes (diagnostics), some data must also be made available on the other bus. For this purpose the gateway copies the data from one bus to the other. This gateway can appear as a separate control unit or be part of an existing, larger control unit (e.g. the instrument cluster), which must serve connections to all bus variants. The transmission network can include at least one of the buses, for example.

This results in the advantage that the method can be carried out particularly advantageously on most important components of the motor vehicle.

In a further advantageous embodiment of the invention, the transmission network is a communication network, and a bus width or bandwidth is therefore determined as the load and/or the network capacity. In other words, the communication network is, for example, the CAN bus or, for example, the MOST bus, and the Load, depending on which the protection is to take place, is a bus width or bandwidth that is available as data on the bus or at least is to be transmitted. This results in the advantage that the method can be used to ensure in a particularly advantageous manner that any component-specific communication can be guaranteed via the transmission network.

In a further advantageous embodiment of the invention, the transmission network is an energy network and an amount of electricity is determined as the load and/or the network capacity. In other words, the system includes a recuperation device, a charging system, a battery or the like as components, so that electricity is to be transmitted between the motor vehicle components by means of the transmission network. The method thus has the advantage that the energy network can be secured in a particularly advantageous manner in such a way that, for example, overloads and thus short circuits or similar damage in the motor vehicle can be avoided.

In a further advantageous embodiment of the invention, the load of the component is determined with a measuring device for the provision of at least one of the evaluation functions of at least one of the components. In other words, the load is measured on a test stand, for example. The measuring device includes suitable sensors, for example, which can detect the size of the load depending on the type of load. This results in the advantage that the method can be carried out particularly precisely, with the quality of the safeguard being able to be improved.

In a further advantageous embodiment of the invention, at least one further evaluation function is provided, which characterizes several, ie more than one, component of one of the supersets and/or the subsets in their loads. In other words, a load function is formed which, for example, combines the load of a number of components. For example, a load can be combined for all components of a subset. This results in the advantage that the method can be carried out particularly efficiently, for example.

In a further advantageous embodiment of the invention, functional safety of the system is provided by the protection. In other words, the system is safeguarded in such a way that safety can also be achieved by, if necessary, setting the intended function and assuming a safe state, as a result of which the system has safety integrity. This results in the advantage that the system can be secured particularly advantageously.

In a further advantageous embodiment of the invention, the network capacity is measured in a further step, with the network capacity being compared with the network capacity determined, for example by calculation. In other words, a comparison of target and actual values is carried out, for example, on a motor vehicle test stand. As a result, the method can be carried out particularly precisely in a particularly advantageous manner and the protection can thus be increased.

In a further advantageous embodiment of the invention, the network component is adapted in a further step of the method as a function of the comparison. In other words, in particular if there is a difference between the measured and the determined network capacity, the network component may be adjusted in such a way that protection can be ensured in a particularly advantageous manner. This results in the advantage that possible variants of the motor vehicle can be secured particularly advantageously by the method.

A second aspect of the invention relates to an electric-electronic system for a motor vehicle with at least two components connected by a transmission network for an energy exchange and/or data exchange, the system being protected by a method used according to the first aspect of the invention.

In this case, advantages and advantageous configurations of the first aspect of the invention apply as advantages and advantageous configurations of the second aspect of the invention and vice versa.

Further features of the invention result from the claims, the figures and the description of the figures. The features and combinations of features mentioned above in the description and the features and combinations of features mentioned below in the description of the figures and/or shown alone in the figures can be used not only in the combination specified in each case, but also in other combinations or on their own.

The invention will now be explained in more detail using a preferred exemplary embodiment and with reference to the drawings.

• 1 ein schematisches Ablaufdiagramm eines Verfahrens zur Absicherung einer Eigenschaft beziehungsweise Komponente eines elektrisch-elektronischen (E/E) Systems für ein Kraftfahrzeug;
• 2 in einer schematischen Übersicht ein Kraftfahrzeug mit einem elektrisch-elektronischen System; und
• 3 eine Tabelle über Varianten eines Kraftfahrzeugmodells, mit dem E/E-System, welches verschiedene Komponenten aufweist.

It shows:

• 1 a schematic flowchart of a method for securing a property or component of an electric-electronic (E/E) system for a motor vehicle;
• 2 in a schematic overview, a motor vehicle with an electric-electronic system; and
• 3 a table of variants of a motor vehicle model, with the E/E system, which has different components.

1 shows in a schematic flowchart the steps S1 to S5 of a method for securing an in 2 shown electric-electronic (E / E) system 10. The system 10 is a system for a variant of a vehicle model comprising a plurality of variants. In other words, the system 10 is arranged in a special variant, i.e. design, of a motor vehicle 12, which is designed in particular as a passenger car, with the actual design of the system 10 and thus its variant depending on the variant of the motor vehicle.

The system 10 has at least two, in particular more than two, electronic and/or electrical components 14, 14', 14'' depending on the variant, which describes, for example, the extent of the special equipment of the motor vehicle model. The at least two components 14, 14' , 14" come from a group comprising several components. This means that the at least one group includes, for example, a number of differently designed control units. For example, component 14, 14', 14" can be a control unit. A group can include engine control units, for example, which provide different control units for different numbers of cylinders depending on the engine electric drive also looks different than an engine control unit for an internal combustion engine.

Since the components 14, 14', 14" can also be designed, for example, as control devices for driver assistance systems and/or as line electronics and/or as further control devices, such as for convertible roofs, for example, they are for an energy exchange and/or data exchange by means of a transmission network 16 connected to each other.

• Schritt S1 stellt eine Bewertungsfunktion für jede Komponente 14 der Gruppe bereit, wobei die Bewertungsfunktion eine durch die jeweilige Komponente 14 verursachbare Last auf das Übertragungsnetz 16 beschreibt.
• Im Schritt S2 erfolgt ein Ermitteln einer Obermenge, welche wenigstens eine der Komponenten umfasst, für welche die Bewertungsfunktion eine vorgegebene Last beschreibt.
• Im Schritt S3 erfolgt das Bestimmen wenigstens einer Untermenge mit wenigstens einer der Komponenten 14, deren Bewertungsfunktion eine Last ergibt, welche unterhalb der Last der wenigstens einen Komponente 14 der Obermenge liegt.
• In einem Schritt S4 erfolgt ein Ermitteln einer für eine Komponente bereitstellbare Netzkapazität des Übertragungsnetzes 16 anhand der Obermenge und/oder der Untermenge.

The steps of the procedure are:

• Step S1 provides an evaluation function for each component 14 of the group, the evaluation function describing a load on the transmission network 16 that can be caused by the respective component 14 .
• In step S2, a superset is determined, which includes at least one of the components for which the evaluation function describes a specified load.
• In step S3, at least one subset is determined with at least one of the components 14 whose evaluation function results in a load that is below the load of the at least one component 14 of the superset.
• In a step S4, a network capacity of the transmission network 16 that can be provided for a component is determined on the basis of the superset and/or the subset.

Finally, in a step S5, at least one network component 18 forming the connection is determined on the basis of the ascertained network capacity to secure the transmission network and thus the system.

2 shows the motor vehicle 12, comprising the system 10 with three components 14 in the exemplary embodiment, which, for example, can all be different components 14, 14', 14", but also the same components 14, 14', 14", represented by the dashes of the reference number 14 This includes in the 2 the transmission network 16 several network components 18, which can be designed, for example, in the simplest case as lines for power transmission and / or as data buses.

Advantageously, at least one of the at least two components 14, 14', 14" is a control unit and/or a power component and/or the network component 18 is a line and/or a bus and/or a gateway. In addition, the transmission network 16 can be a communication network , and thus the load and/or network capacity that is determined is, for example, a bus width or bandwidth.

Additionally or alternatively, the transmission network can be an energy network, whereby the load determined by the method and/or the transmission capacity or network capacity determined is an amperage.

The protection provided by the method can advantageously provide functional safety of the system.

In a further alternative embodiment, the method can include an additional step in which a network capacity is measured, with the measured network capacity being compared with the ascertained network capacity. In addition, in a further step in Depending on the comparison, an adjustment of the network component 18 takes place.

The table of 3 shows the advantages of the method, which consist in the fact that a separate validation does not have to be carried out for every possible variant of the motor vehicle 12 due to the method shown. The rows of the table indicate four possible variants V1 to V4, variant 1, recognizable by the tick in the table, having component (K)A and components B, C, D not. The load that causes component A is described by the evaluation function F(A).

In addition to component A, variant 2 of the motor vehicle also has component B, with a common evaluation function being provided which characterizes more than one component of one of the supersets and/or the subsets with a plurality of loads. A suitable evaluation function for this would be F(A, B), which is larger and therefore also has the greater load than F(A). Therefore, in order to obtain reliable protection for model variants 1 and 2 of the motor vehicle 12, variant 1 does not need to be protected separately, but it is sufficient if protection is provided using variant 2. This is symbolized by the arrow 20, which describes a reduction in the number of safeguards that can be carried out from two to one.

The situation is analogous with variants 3 and 4, with variant 3 comprising components B and D and variant 4 having only component D.

Thus, in order to obtain protection for both Variant 3 and Variant 4, there can also only be a safeguard according to Variant 3, which means that there is a reduction, also shown by arrow 20, from one safeguard to be carried out from two to one variant can be done.

A further reduction in the number of safeguards that can be carried out is not possible here, since, for example, there is no variant which contains components A, B and D at the same time. This variant could be excluded by at least one boundary condition. A corresponding evaluation function can thus be formed, which would therefore have just as good or bad behavior as variant 2 or variant 3. Nevertheless, it can be shown here that, in the exemplary embodiment, the method can be used to halve a reduction in the safeguards to be carried out. The load can be calculated using an electronic computing device, for example, in order to obtain the respective evaluation function. Additionally or alternatively, the load of the component can also be recorded, for example, by a measuring device on a test bench.

The advantage resulting from the invention is that a method for reducing the protection variants for the E/E architecture of a motor vehicle 12 can be provided in a particularly advantageous manner. In addition, a corresponding system 10 can be provided, which can be manufactured particularly cheaply, for example.

Reference List

10

E/E system

12

motor vehicle

14, 14', 14"

component

16

transmission network

18

network component

20

Arrow

S1

first step

S2

second step

S3

Third step

S4

fourth step

S5

fifth step

QUOTES INCLUDED IN DESCRIPTION

This list of the documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• EP 1691310 A2 [0006]

Claims (10)

Method for protecting an electrical-electronic system (10) of a variant of a motor vehicle model comprising a plurality of variants, the system (10) having at least two electrical and/or electronic components (14, 14', 14") depending on the variant a group comprising several components (14, 14', 14") and the at least two components (14, 14', 14") are connected to one another by means of a transmission network (16), with the following steps: - Providing an evaluation function for each component (14, 14', 14") of the group, the evaluation function describing a load on the transmission network (16) that can be caused by the respective component (14, 14', 14"); (S1) - determining a superset, which includes at least one of the components (14, 14', 14"), for which the evaluation function describes a predetermined load; (S2) - determining at least one subset with at least one of the components (14, 14', 14") whose evaluation function results in a load which is below the load of the at least one component (14, 14', 14") of the superset; (S3) - determining a network capacity of the transmission network (16) that can be made available for the components (14, 14', 14") on the basis of the superset and/or subset; (S4) and - Determining at least one network component (18) forming the connection based on the determined network capacity to secure the transmission network (16) and thus the system (10). (S5) procedure after claim 1 , characterized in that at least one of the at least two components (14, 14', 14") is a control unit and/or a power component and/or the network components (18) comprise a line and/or a bus and/or a gateway. procedure after claim 1 or 2 , characterized in that the transmission network (16) is a communication network and a bus width is determined as the load and/or the network capacity. Method according to one of the preceding claims, characterized in that the transmission network (16) is an energy network and an amount of electricity is determined as the load and/or the network capacity. Method according to one of the preceding claims, characterized in that the load of the component (14, 14', 14") is determined with a measuring device to provide at least one of the evaluation functions of at least one of the components (14, 14', 14"). Method according to one of the preceding claims, characterized in that a further evaluation function is provided which characterizes a number of components (14, 14', 14") of one of the supersets and/or the subsets in their loads. Method according to one of the preceding claims, characterized in that functional safety is provided by the protection. Method according to one of the preceding claims, characterized in that in a further step the network capacity is measured and this is compared with the ascertained network capacity. procedure after claim 8 , characterized in that in a further step, the network component (18) is adapted as a function of the comparison. Electro-electronic system (10) for a motor vehicle (12) with at least two components (14, 14', 14") connected by means of a transmission network (16) for an energy exchange and/or data exchange, characterized in that the system (10) is protected by a method according to one of the preceding claims.

Images