DE102021209870A1 - Method for automatically monitoring a motor vehicle for anomalies and motor vehicle - Google Patents

Abstract

The invention relates to a method (11) for automatically monitoring a motor vehicle (1) which has a battery (2), and a correspondingly equipped motor vehicle (1). In the method (11), a control unit (3, 8) of the motor vehicle (1) is woken up cyclically from a rest state at least when the motor vehicle (1) is in the idle state. The control unit (3, 8) then carries out a status check to detect a thermal anomaly. If a thermal anomaly is detected, the control unit 3, 8) initiates a specified countermeasure and checks its effectiveness. If the result of this effectiveness check is negative, a respective individual status check of one or more other control units (3, 9) of the same hierarchical level is initiated. A higher-level central control unit (6) of the motor vehicle (1) switches off a respective supply of an associated vehicle component (2) for all control units (3, 8, 9, 10) that have detected an anomaly.

Description

The present invention relates to a method for automatically monitoring a motor vehicle for anomalies, particularly thermal ones. The invention further relates to a correspondingly equipped motor vehicle.

In the past, there have always been technical faults and damage to vehicles, including vehicle fires, both while driving and when vehicles are parked. However, such events can be particularly critical in a shelter on a house or in a garage, since they can spread to these structures there. A particular problem here can be that previously corresponding events are often only recognized relatively late, which can lead to correspondingly high damage to the vehicle and possibly the respective surrounding structures. In the case of electric vehicles with batteries in particular, thermal runaway can occur in the respective battery, which can lead to extensive damage. There is therefore a need for improved handling or improved handling of this problem.

As an approach is in the DE 10 2020 124 378 A1 describes a method for monitoring and controlling an onboard system and a monitoring and control system. Monitoring of sensors with regard to the occurrence of an event in an on-board system is provided by a main controller if it is in a nominal mode and by an agent controller if the main controller is in a sleep mode. In the latter case, the agent control is signaled via the sensors that the event has occurred. The main controller can then be signaled via the agent controller to wake up from sleep mode. Then, the main controller is switched to the nominal mode, the main controller is notified of the event, and an operation to be performed is determined in response.

Another approach is in the DE 10 2019 131 116 A1 proposed distributed detection of thermal runaway. The system described there includes a primary monitoring system for determining a battery condition of a battery pack and a secondary monitoring system. The latter is designed to monitor the battery condition as communicated from the primary monitoring system over a network. At least one of the monitoring systems is intended to generate an alert when the battery condition includes a thermal event that reaches a predetermined level. This should enable efficient and reliable identification of potential battery malfunctions.

The DE 10 2019 215 812 A1 proposes a battery management device for a battery system. In a sleep mode of the battery management device, a critical state of the battery system is to be detected by a sensor arrangement based on a deviation of sensor measured values from a reference value range. A wake-up signal and stored measured values are then sent to a control arrangement, which switches from a sleep mode to an active operating mode as a result of the wake-up signal. After this change, the control arrangement is set up to carry out a plausibility check on the critical state detected by the sensor arrangement on the basis of the transmitted measured values. This is intended to enable early and reliable detection of a critical state.

The DE 10 2012 222 070 A1 discloses a warning system for detecting a battery fire in a battery of an electric or hybrid vehicle parked on or in a building. The battery management system is connected to a building network installed in the building. When a fire is detected, protective measures that are present in the building are triggered or activated by the battery management system.

The object of the present invention is to propose an efficient and effective way of monitoring a motor vehicle for anomalies, in particular thermal anomalies, and of handling them.

According to the invention, this object is achieved by the subject matter of the independent patent claims. Possible refinements and developments of the present invention are disclosed in the dependent patent claims, in the description and in the figures.

The method according to the invention is used for automatically monitoring a motor vehicle. This can in particular be a motor vehicle that has a traction battery. However, the method can also be used for or in other motor vehicles. The method can be used at least when the motor vehicle is at rest. In the idle state, the motor vehicle can in particular be turned off, ie parked, or connected to a stationary charging station for charging the battery. In the method according to the invention is at least a control unit of the motor vehicle--hereinafter also referred to as the first control unit--is woken up from an idle state cyclically, for example at a predetermined frequency or in a predetermined time pattern. In such an idle state, the control device can have a reduced energy consumption compared to an awakened or activated state, perform no or only limited functions, or the like. A corresponding cycle time or frequency, ie a corresponding temporal wake-up pattern, can be specified. Likewise, different cycle times, frequencies or wake-up patterns can be specified for different times, locations and/or situations. The at least one control unit can thus be woken up in or with a first cycle or wake-up pattern while the motor vehicle is parked and without a charging process taking place. On the other hand, while the motor vehicle is parked and being charged, the controller can be woken up in or with a different second cycle or wake-up pattern. Such a situation-dependent adaptation allows, for example, different risk profiles to be taken into account or a compromise to be reached between energy consumption and maximum monitoring security. For this purpose, the control unit can be woken up more frequently or with a higher frequency during the charging process than during parking without charging, since in the former case external energy is available and the state of charge of the battery is therefore not significantly influenced by more frequent or higher-frequency waking up. The wake-up can be carried out by the control device itself--for example a wake-up circuit which is also active in the idle state--or by a higher-level main or central control device which can be connected to the at least one control device via a communication network. Each time the at least one control unit is woken up from the idle state, it carries out a status check to detect an anomaly, in particular a thermal one. In this case, for example, internal sensors and/or external sensors connected to the control device, a temperature, a current flow, a voltage and/or the like can be checked or queried. It can also be checked, for example, whether one or more settings or functions are activated or deactivated as intended, one or more operating parameters or their parameter values are within specified permissible limits or ranges and/or the like. A thermal anomaly or abnormality may occur, for example, at or before an impending thermal runaway of a battery cell of the battery, at a temperature above a predetermined threshold in one or more monitored areas or in one or more monitored components or parts, such as in a control part or the or a control unit or the like are present or recognized. An anomaly can also be detected - at least also - on the basis of non-thermal parameters, but then, at least if nothing is done, develop into a thermal anomaly. This can optionally be avoided by the present invention.

For this purpose, when an anomaly is detected in this way by the respective control unit, that is to say by at least one control unit which has detected the anomaly, at least one predetermined countermeasure is initiated. Such a countermeasure can be or include, for example, switching off or derating one or more vehicle components, supplies and/or the like. In other words, a local thermal management is initiated or carried out by the respective control unit upon detection of the anomaly, in particular thermal anomaly already at the beginning or potentially in the later course. The aim is to isolate or eliminate the anomaly.

The effectiveness of the at least one countermeasure is then checked by the control unit. For this purpose, for example, a course or a development of the variables, properties or parameters mentioned or checked to detect the anomaly can be checked or evaluated. For example, it can be checked or determined whether a measured temperature has dropped, for example after a specified time from the initiation of the at least one countermeasure, in particular to below the specified threshold value. It can also be checked, for example, whether a current flow or a voltage is again within specified permissible limits or has at least approached them and/or the like.

In the event of a negative result of this effectiveness test, i.e. if no effect is determined or the determined effect is too low, for example if the effect is less than a specified threshold value or a certain value or parameter is still outside specified permissible limits after a specified time , a respective individual status check of one or more other control units of the same hierarchical level is initiated and carried out. This relates in particular to one or more additional control units that are located on the same hierarchical level as the first control unit and/or in a predetermined physical proximity to the first control unit. These other control units can be in a function schema or a control logic of the motor vehicle are on the same hierarchical level as that control unit that first detected the thermal anomaly. For example, these control devices can be controlled or monitored by the same higher-level main or central control device or be separated from it by the same number of control or hierarchy levels that may be in between. Likewise, the control unit that originally or first detected the thermal anomaly, ie the first control unit, and the one other control unit or several other control units of the same hierarchical level can be integrated into a common, ie the same, communication network. Additionally or alternatively, a status check can be carried out for that additional control device or for those additional control devices which are spatially closest to the first control device and/or which are arranged at most at a predetermined distance from the first control device in the motor vehicle, in particular independently of the hierarchical level or whether they are connected to the same or different communication networks. The respective status check of the additional control units can run or be carried out as described for the first control unit. The other control devices can be checked or queried, for example, for their internal function and/or, in particular but not necessarily exclusively, thermal anomalies or abnormalities of the control devices or vehicle components or sensors connected to them. For this purpose, for example, the corresponding communication network can be woken up or activated and a corresponding warning, notification or query signal can be sent to the other control devices via the communication network. The other control units can thus be queried for detected anomalies. Depending on the design or structure of the communication network or the control logic of the motor vehicle, for example, this can be carried out by the first control unit and/or by the or a higher-level main or central control unit that is located at a higher, i.e. higher-level, hierarchical level.

A respective supply of an associated vehicle component is then switched off by the central control unit for all of the control units which have recognized or detected the or an anomaly. This can be carried out in particular if at least one of the other control units has detected a thermal anomaly or abnormality, but also if at least one of the other control units has detected a different type of anomaly or abnormality, ie a non-thermal anomaly or abnormality. For example, one of the other control units can recognize as an anomaly the effect of a cable or the like that has been interrupted elsewhere due to a thermal effect as part of the detected thermal anomaly, for example in the form or on the basis of a correspondingly changed data or signal transmission, a changed resistance, a changed latency, an interrupted supply and/or the like. Such detection of an anomaly or abnormality by at least one of the other control units can be understood or evaluated as confirmation of the first detected thermal anomaly, which can prompt or justify appropriate further measures.

If no anomaly is detected by any of the other control devices, it can be assumed that there is a local anomaly in the spatial area or in the area of responsibility or control of the first control device. Accordingly, only the supply of the corresponding vehicle component or vehicle components assigned to the first control device, for which the anomaly or a thermal, functional or spatial connection with the anomaly was detected, for example, can be switched off.

If, on the other hand, an anomaly was detected by one or more of the other control units, a more extensive event can be assumed and the supply of other vehicle components can be automatically switched off accordingly, or such a switch-off can be requested, for example by a corresponding automatically transmitted control signal.

Depending on the vehicle component concerned, the respective supply in the present sense can be, for example, an energy, electricity, voltage, material or fuel supply or the like. Likewise, the supply here can mean or include a corresponding supply network, for example at least a part of an on-board electrical system, a line network and/or the like. Corresponding locks or interruptions can be activated to switch off the supply and/or parts or components essential for the supply can be switched off, for example a current or voltage source, a voltage converter, power electronics, a pump and/or the like. In each case, the supply of at least one vehicle component controlled, monitored or monitored by the respective control device can be switched off.

The switch-off of the supply proposed here can be adapted to the respective situation measure with regard to the spatial arrangement and/or a thermal or functional relationship to which at least one detected anomaly or an event on which this is based reacts. As a result, unaffected areas, functions or vehicle components of the motor vehicle can remain activated or in operation and thus enable useful functions to continue to be executed. This can, for example, contribute to safety and/or make it easier to rectify the anomaly or to handle the motor vehicle, for example in comparison to completely switching off all functions, systems and supplies of the motor vehicle. The present invention is based on the finding that today's motor vehicles have a large number of spatially distributed control units and this enables correspondingly extensive or distributed monitoring and a correspondingly localized or extensive response as required. The cyclical waking up of the control unit or control units proposed here and the corresponding cyclical execution of the status check as well as the hierarchical procedure described or the message chain described can make the improved security made possible by the method described particularly efficient and particularly particularly energy-efficient, for example in comparison to a permanent surveillance. However, since thermal events are typically announced by a gradual temperature development, this is not associated with any significantly reduced safety.

In a possible development of the present invention, the central control device stores and makes available anomaly data on all detected anomalies. This can mean, for example, that the central control device transmits or communicates the anomaly data in a specified manner or to a specified recipient. The anomaly data can specify, for example, a type of the respective anomaly, the time it was detected, relevant parameters or parameter values that lie outside of predefined limits, affected sensors, vehicle components or the like by which or on which the anomaly was detected, and/or the like. Saving the anomaly data enables the respective anomaly to be traced more easily, even if it damages local sensors, vehicle components and/or the respective first control unit, for example. The provision or transmission of the anomaly data can, for example, enable devices or persons external to the vehicle to be notified and to react.

In a further possible embodiment of the present invention, when the or an anomaly is detected by at least one of the further control units, at least one further predetermined safety measure is initiated by the central control unit. For example, one or more other vehicle devices can be controlled by the central control device, for example activated or deactivated, an alarm signal or an emergency call can be sent and/or the like. This can help contain the anomaly or mitigate damage.

In a possible development of the present invention, at least one locking device of the motor vehicle is automatically unlocked at least as part of the additional specified safety measure or safety measures, for example in the event of a confirmed, in particular thermal, fault event and/or the making of an emergency call. For example, a bonnet, a battery cover, a door, a battery cover, a charging connector lock and/or the like can be unlocked by the central control device upon detection of the anomaly. This can particularly reliably enable a particularly rapid reaction to the detected anomaly and contribute to improved security. For example, by unlocking, helping persons can be granted access to devices of the motor vehicle in a particularly simple and reliable manner, even if the respective person does not have a vehicle key at hand, for example. Corresponding delays can thereby be avoided. For example, manual safety measures can then be taken particularly quickly and easily, dangerous objects or objects of value can be removed from the vehicle and/or the like.

In a further possible embodiment of the present invention, the at least one control device, ie the first control device, and the further control devices or the at least one further control device are connected to a common first communication network. The central control unit can then in particular also be connected to this first communication network. It is provided here that, if at least one of the other control devices of the first communication network detects or has detected an anomaly, the central control device carries out a status check of at least one other control device of at least one separate second communication network, in particular all control devices of the at least one second communication network, in order to detect the anomaly or other anomalies. the cent The control unit can therefore represent a node here, in which several communication networks that are otherwise separate or independent of one another converge or are connected. In particular, control devices that are arranged at different positions in the motor vehicle can be integrated into the different communication networks. If necessary, the central control unit can therefore check a correspondingly large area of the motor vehicle for anomalies, especially if, for example, the first control unit itself does not directly check the other control units, i.e. the control units of the at least one separate second communication network, in order to carry out a respective status check can cause or indicate the detected thermal anomaly. The structure proposed here, in particular if this is simulated by a supply network for supplying the control units, allows a cascaded and area-specific localized reaction to take place. This can both reduce an energy requirement for the method according to the invention and, in a particularly simple manner, enable a graduated reaction to the initially detected thermal anomaly that is appropriate to the situation or need.

In a further possible embodiment of the present invention, a cycle time for cyclically waking up the at least one control unit is automatically extended in each case if no anomaly is detected in the current or most recently performed status check. Similarly, the cycle time is shortened if an anomaly is detected or has been detected. A frequency of the wake-up or of the status checks can therefore be reduced or increased here. In other words, the method can be used situationally for individual control units that are in the idle state, i.e. less frequently if no thermal event has been detected, and more closely if an anomaly or abnormality is detected. For example, the cycle time can be changed in steps of 0.5 s, 1 s, 2 s. Likewise, small, larger or intermediate steps or gradations are possible, for example depending on the application. The automatic adjustment of the cycle time proposed here can enable a particularly energy-saving application of the method according to the invention in the normal case or on average and at the same time, if necessary, through the more close-meshed monitoring or checking in the event of an incident, an improved safety compared to a permanently longer selected cycle time.

In a possible development of the present invention, as long as no anomaly has been detected, the cycle time is lengthened in a number of predefined steps up to a predefined maximum. For example, the cycle time, ie a duration of idle state phases between two consecutive status checks, can be extended up to a maximum of 5 s, 10 s or 15 s or the like. By limiting the maximum length of the cycle time, a minimum level of safety can be ensured even in long anomaly-free phases.

In one possible development of the present invention, the cycle time is shortened to a predetermined minimum immediately when an anomaly is detected, in particular when the thermal anomaly is initially detected, ie for the next cycle or the next idle state phase of the respective control unit. This predetermined minimum can be the shortest possible cycle time or the shortest intended or predetermined or adjustable cycle time. In other words, the cycle time can be lengthened step by step or in a stair-step fashion without an anomaly being detected and then immediately drop or jump back to the initial or minimum cycle duration when an anomaly is detected. In the event of a detected anomaly, a particularly close-meshed or closely timed monitoring or check is immediately available, ie without a corresponding adjustment phase, as a result of which it is possible to react particularly quickly and promptly to changes or other detected anomalies. This enables a particularly favorable compromise between maximum energy savings and minimum response time.

In a further possible embodiment of the present invention, after the supply of the or one of the vehicle components assigned to the at least one control unit is switched off, this supply is reactivated according to a predefined restart strategy if none of the other control units has detected an anomaly. In other words, the supply can be reactivated in a predetermined manner if the detected anomaly was obviously a locally limited anomaly. The restart strategy can, for example, provide for reactivation after a specified time has elapsed and/or based on one or more other parameter values. For example, the reactivation strategy can provide for reactivation when a temperature, current, voltage or the like has returned to a predefined permissible range or predefined permissible limits. In particular, the reactivation strategy can provide for piecemeal or staged reactivation. In this case, for example, the supply can initially be reactivated with reduced voltage, power or capacity. It can then first a renewed Status check carried out and / or wait for a predetermined period of time. If the anomaly does not occur again or is not detected, the restart strategy, i.e. the reactivation of the supply, can be continued until complete reactivation is achieved. The method according to the invention can then be continued as initially described. By reactivating the supply as proposed here, a permanent operational impairment can be avoided in the case of only temporary anomalies. This can improve convenience of use of the motor vehicle. A temporary thermal anomaly may exist or arise, for example, when a temperature sensor temporarily measures an increased temperature due to solar radiation on the temperature sensor itself or a component thermally conductively connected thereto, although all other vehicle components are nominally and correctly functioning. Likewise, a temporary anomaly can occur, for example, due to a disturbance or spike in an electrical supply network, which can then return to normal and does not represent a permanent hazard.

Another aspect of the present invention is a motor vehicle that has a battery, multiple control devices for controlling and/or monitoring at least one vehicle component of the motor vehicle that is supplied with power, and a central control device that is connected to the control devices via at least one communication network. The motor vehicle according to the invention is set up to carry out at least one variant or embodiment of the method according to the invention, in particular automatically or semi-automatically. The motor vehicle according to the invention can in particular be the motor vehicle mentioned in connection with the method according to the invention. Accordingly, the motor vehicle according to the invention can have some or all of the properties and/or features mentioned in these contexts. The multiple control devices can be arranged on or in the same hierarchical level. The control units can have internal sensors for checking the status. Additionally or alternatively, the motor vehicle can have sensors external to the control unit for the status check. Likewise, the motor vehicle can have one or more supply networks or supply devices for supplying the vehicle components. The fact that the motor vehicle is set up to carry out the method according to the invention can mean, for example, that a corresponding operating or computer program, which encodes or implements the method steps, sequences or measures of the method according to the invention, is bundled or distributed in one or more computer-readable data memories of the motor vehicle, in particular one or more of the control units or the central control unit. This operating or computer program can then be executed by a processor device, ie for example a microchip, microprocessor or microcontroller of the motor vehicle or the respective control unit or the central control unit, in order to bring about or cause the execution of the method according to the invention.

Further features of the invention can result from the following description of the figures and from the drawing. The features and feature combinations mentioned above in the description and the features and feature combinations shown below in the description of the figures and/or in the figures alone can be used not only in the combination specified in each case, but also in other combinations or on their own, without going beyond the scope of the invention to leave.

• 1 eine schematische Darstellung eines Kraftfahrzeugs mit mehreren für eine Überwachung eingerichteten Steuergeräten; und
• 2 einen beispielhaften schematischen Ablaufplan eines Verfahrens für eine entsprechende Überwachung.

The drawing shows in:

• 1 a schematic representation of a motor vehicle with a plurality of control units set up for monitoring; and
• 2 an exemplary schematic flowchart of a method for a corresponding monitoring.

1 1 shows a schematic representation of a detail of a motor vehicle 1 with a number of indicated vehicle components 2. These may be, for example, sensor devices, drive components, a battery and/or the like. The motor vehicle 1 also has a plurality of control devices 3 which, for example, can each monitor and/or control a specific area or a vehicle component 2 of the motor vehicle 1 . In the present case, some of the control units 3 are connected to one another in a first communication network 4 , while other control units 3 are connected to a second communication network 5 .

The control units 3 can be hierarchically subordinate to a central control unit 6 which is integrated here both in the first communication network 4 and in the second communication network 5 .

The motor vehicle 1 also has a number of sensors 7 . At least one or more of these sensors 7 can be sensor devices internal to the control unit, monitor one of the vehicle components 2 and/or record measured values for a specific area of the motor vehicle 1 .

The control devices 3 connected to the first communication network 4 here include, for example, a first control device 8 and further control devices 9. The control devices 3 connected to the second communication network 5 are referred to as other control devices 10.

The motor vehicle 1, in particular the control units 3 and the central control unit 6, are set up for a method for monitoring the motor vehicle 1 for anomalies and for carrying out appropriate measures in response to detection of such an anomaly. Such a method is exemplified below using a schematic in 2 illustrated flow chart 11 explained. Method steps S1 to S28 are shown in the flow chart 11 and linked to one another according to a structure of the method. It should be noted here that, in detail, other linkages of some or more of the method steps S1 to S28 can also be possible, ie the method can be carried out in different sequences. The method can, for example at least while the motor vehicle 1 is in an idle state, be repeated continuously or regularly, ie it can be executed.

The method is started in method step S1. This can be, for example, a point in time at which the motor vehicle 1 or the control units 3 and the central control unit 6 are put into operation or activated. In method step S2, the central control device 6 checks, by querying a corresponding anomaly parameter, whether an anomaly, in particular a thermal one, is currently present, ie whether it has been recognized and is active or not. If a negative result is returned, ie if there is no active recognized anomaly, the method is continued in method step S3. There it is checked whether the control units 3 are active. The procedure is explained here as an example using the first control unit 8 , but it can also be carried out for the other control units 3 . If the first control device 8 is not active, it is woken up in method step S4, that is to say it is switched from an idle state to an active state. A status check is then carried out by the first control device 8 in method step S5. In this case, the first control device 8 can, for example, check its internal operating or switching state and/or query linked sensors 7 .

Based on a result of the status check or the sensor measurement values recorded in the process, it is checked in method step S6 whether a thermal anomaly is present. This can also be carried out if the query or check in method step S3 has shown that first control unit 8 has already been woken up or was active. If no thermal anomaly is detected in method step S6, a corresponding anomaly counter is set to 0 in method step S7 and the next loop or iteration, ie the next run of the method, is started.

If, on the other hand, a thermal anomaly is detected in method step S6, the method jumps to method step S8 instead. There it is checked whether countermeasures have already been initiated or not. If this is not the case, then in method step S9 predetermined countermeasures are initiated or implemented. In any case, it is checked in method step S10 whether initiated or active countermeasures are effective or not. If this is not the case, then in a method step S13 said anomaly counter can be incremented and then in method step S15 it can be checked whether the anomaly counter has reached a predetermined maximum value. If the anomaly counter has not yet reached the maximum value or if it was determined in method step S10 that the countermeasures were or are effective, it is checked in method step S11 whether the first control unit 8, i.e. the control unit 3 in each case, on which the detection of the thermal Anomaly declined in step S6, is still in the awakened, active state. If this is the case, it is put back into the idle state in method step S12. Otherwise, if the first control device 8 was already in the idle state, the next run through of the method is started.

If the anomaly counter has reached the maximum value due to the lack of effectiveness of the countermeasures in method step S14, the method then jumps to method step S15. Therein the respective communication network, ie here the first communication network 4 , is woken up by the first control unit 8 . In method step S16, a signal or message is then sent from the first control unit 8 via the first communication network 4, which indicates that a thermal anomaly has been detected. The anomaly parameter checked in method step S2 is then set accordingly, for example to 1. The signal can be sent, for example, to the central control unit 6, which can set or manage the anomaly parameter. Likewise, the signal can be sent to the other control devices 9 in the first communication network 4 by the first control device 8 or by the central control device 6 .

Then - or if the query in step S2 has shown that the anomaly parameter indicates the presence of an active thermal anomaly - in step S17 a respective status check of the other control units 9 in the first communication network 4 is carried out - either initiated by the first control unit 8 or initiated by the central control unit 6. In the subsequent method step S18, corresponding results of the status checks are sent to the central control unit 6 and are stored and/or forwarded or forwarded by it .communicated or provided.

In method step S19, the central control unit 6 uses the results of the status checks to check whether one or more of the other control units 9 has detected an anomaly. If this is not the case, then in method step S20 a local shutdown is carried out in the area of the first control unit 8, ie in each case that control unit 3 which initially recognized the thermal anomaly. The corresponding vehicle component 2 assigned to the first control unit 8, its supply or also the first control unit 8 itself or its energy supply can be switched off. The next run of the process is then started.

If, on the other hand, the check in method step S19 reveals that at least one of the other control units 8 has detected an anomaly, corresponding predefined countermeasures are initiated in method step S21. In method step S22, the central control device 6 can then store, log and/or communicate the detected anomalies or corresponding anomaly data that characterize or describe the detected anomalies, for example to a specified recipient.

In method step S23, a shutdown then takes place in the area of those other control devices 9 that have detected an anomaly. As described for the first control unit 8, for example assigned vehicle components 2, the respective further control unit 9 and/or corresponding supply devices or supply networks or supply network parts can be switched off here.

Since it is clear at this point in the process that a number of control units 3 have detected an anomaly and that there is therefore no event strictly localized to the area of a single control unit 3, all other communication networks, in this case at least the second Communication network 5 activated or awakened. In method step S25, the central control unit 6 then queries all other control units 3, in this case in particular the other control units 10 in the second communication network 5, with regard to anomalies and/or their states. A respective status check of the other control units 10 can therefore be initiated here and carried out by them. Corresponding results can then be sent back to the central control unit 6 by this. In method step S26, it is then checked on the basis of this whether one of the other control devices 10 queried in method step S25 has detected an anomaly or not.

If no further anomaly was detected, the next run of the method is initiated.

Otherwise, ie if a further anomaly has been recognized by at least one of the other control units 10, the method jumps to method step S27. Corresponding anomaly data are stored here by the central control device 6--analogously to method step S22--and optionally made available or communicated. Analogously to method step S23, in method step S28 a shutdown is then carried out for or in the area of the other control units 10 which have detected an anomaly. This completes one run of the process and the next run of the process can be started. Since in this next run of the method in method step S2 the anomaly parameter indicates the presence of a detected anomaly, a restart strategy specified for this case for reactivating previously switched off supplies, vehicle components 2 and/or control units 3 can optionally be executed or initiated.

Overall, the examples described show how a controller response to monitor a vehicle for anomalies and when a thermal anomaly is detected can be implemented to ensure efficient and effective monitoring and response.

Reference List

1

motor vehicle

2

vehicle component

3

control unit

4

first communication network

5

second communication network

6

central control unit

7

sensor

8th

first control unit

9

other control units

10

other control devices

11

schedule

S1 - S28

process step

QUOTES INCLUDED IN DESCRIPTION

This list of documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• DE 102020124378 A1 [0003]
• DE 102019131116 A1 [0004]
• DE 102019215812 A1 [0005]
• DE 102012222070 A1 [0006]

Claims (10)

Method (11) for automatically monitoring a motor vehicle (1), at least in a state of rest of the motor vehicle (1), wherein - at least one control unit (3, 8) of the motor vehicle (1) is woken up cyclically from a rest state and then carries out a status check to detect an anomaly, in particular a thermal one, - if an anomaly is detected, a specified countermeasure is initiated by the control unit (3, 8), - the effectiveness of the countermeasure is checked by the control unit (3, 8), - if the result of the effectiveness check is negative, a respective individual status check of one or more other control units (3, 9) that are located on the same hierarchical level and/or in a specified spatial proximity to the at least one control unit is initiated and carried out by a central control unit (6th ) of the motor vehicle (1) for all control devices (3, 8, 9, 10) that have detected an anomaly, a respective supply of an associated vehicle component (2) is switched off. Method (11) according to claim 1 , characterized in that the central control unit (6) stores and provides anomaly data on all detected anomalies. Method (11) according to one of the preceding claims, characterized in that when an anomaly is detected by at least one of the further control units (3, 9) the central control unit (6) initiates a further predetermined safety measure. Method (11) according to claim 3 , characterized in that at least one locking device of the motor vehicle (1) is automatically unlocked, at least as part of the additional predetermined safety measure. Method (11) according to one of the preceding claims, characterized in that the at least one control unit (3, 8) and the further control units (3, 9) are connected to a common first communication network (4) and the central control unit (6), if at least one of the other control units (3, 9) detects an anomaly, initiates a status check of at least one other control unit (3, 10) of at least one separate second communication network (5), in particular all control units (3, 10) of the second communication network (5). . Method (11) according to one of the preceding claims, characterized in that a cycle time for cyclically waking up the at least one control unit (3, 8) is extended in each case if no anomaly is detected during the status check and shortened if an anomaly is detected becomes. Method (11) according to claim 6 , characterized in that the cycle time is extended in several predetermined steps up to a predetermined maximum as long as no anomaly has been detected. Method (11) according to claim 6 or 7 , characterized in that the cycle time is immediately reduced to a predetermined minimum when an anomaly is detected. Method (11) according to one of the preceding claims, characterized in that after the supply of the vehicle component (2) assigned to the at least one control unit (3, 8) has been switched off, this supply is reactivated according to a predefined restart strategy if none of the further control units (3 , 9, 10) has detected an anomaly. Motor vehicle (1) having a battery (2), a plurality of control units (3) for controlling and/or monitoring at least one vehicle component (2) supplied via a power supply, one connected to the control units (3) via a communication network (4, 5). Central control unit (6), wherein the motor vehicle (1) is set up to carry out a method (11) according to one of the preceding claims.

Images