EP4634026A1 - Method for checking the plausibility of a parameter - Google Patents

Abstract

The invention relates to a method for checking the plausibility of a parameter involved in operation of a vehicle system of a motor vehicle, wherein the plausibility of the parameter sensed by a first sensor is checked by means of a second sensor, which likewise senses the parameter, by the examination of a first sensor signal (n(S₁)) from the first sensor with a second sensor signal (n(S₂)) from the second sensor. In order to make the checking of the plausibility as reliable as possible, a differential signal (Δn) between the first sensor signal (n(S₁)) and the second sensor signal (n(S₂)) is formed and is compared with at least one threshold value (thd1, thd2). A measure is taken if the differential signal (Δn) exceeds the at least one threshold value (thd1, thd2) continuously for longer than a particular amount of time (tft1, tft2) associated with the at least one threshold value (thd1, thd2).

Description

Procedure for checking the plausibility of a parameter

The invention relates to a method for checking the plausibility of a parameter which is included in the operation of a vehicle system of a motor vehicle, wherein the parameter detected by a first sensor is checked for plausibility with a second sensor which also detects the parameter by checking a first sensor signal of the first sensor with a second sensor signal of the second sensor. The invention further relates to a control device, a computer program product and a data carrier.

Vehicle systems are usually provided for motor vehicles to support a driver when operating the respective motor vehicle. In some cases, a vehicle system also intervenes in the actual operation as a safety system in order to avoid critical operating states by executing safety functions or to ensure safe operation of the motor vehicle in the event of malfunctions. A regulation or control of such a safety function usually takes place on the basis of parameters that are recorded by corresponding sensors in the motor vehicle. However, since sensors can also fail or transmit incorrect information, which would also result in incorrect execution of the respective safety function, reliable operation of the sensors must also be monitored when operating a safety system in a motor vehicle.

DE 10 2005 048 015 A1 describes a method for checking the plausibility of a parameter, whereby the method can be used in a vehicle system of a motor vehicle, such as an ESP system, an airbag system, a driver assistance system (ACC) or similar. In this case, a parameter is determined which is necessary for carrying out a control or regulation of a respective function of the vehicle system, whereby DE 10 2005 048 015 A1 also specifies redundant monitoring as a possibility, in which a sensor signal from one sensor is checked using a different sensor signal. Based on the prior art described above, the object of the present invention is to design a plausibility check of a parameter in the simplest and at the same time most reliable manner possible.

This object is achieved from a process engineering perspective based on the generic term of claim 1 in conjunction with its characterizing features. The dependent claims that follow each give advantageous developments of the invention. A control device with which an aforementioned method can be carried out is also the subject of claims 8 and 9. Furthermore, claim 10 relates to a computer program product and claim 11 to a data carrier.

According to the invention, a method is used to check the plausibility of a parameter which is included in the operation of a vehicle system of a motor vehicle. The parameter detected by a first sensor is checked for plausibility with a second sensor which also detects the parameter by checking a first sensor signal of the first sensor with a second sensor signal of the second sensor.

Within the scope of the method according to the invention, the parameter is therefore detected by a first sensor and a second sensor, whereby the parameter is determined from a first sensor signal of the first sensor and checked for plausibility using the second sensor. For the latter, the first sensor signal of the first sensor is checked against a second sensor signal of the second sensor.

Both sensors are used to directly record the parameter, whereby these recordings are preferably carried out independently of each other for the purpose of plausibility. For this purpose, the two sensors are each provided in a corresponding area, for example both directly on a component on which the parameter can be directly recorded.

The invention now includes the technical teaching that the check is carried out by forming a difference signal between the first sensor signal and the second sensor signal and comparing it with at least one threshold value. A measure is then carried out if the difference signal exceeds the at least one threshold value continuously for longer than a period of time associated with the at least one threshold value. In other words, the first sensor signal is checked against the second sensor signal by creating a signal as the difference between the first sensor signal of the first sensor and the second sensor signal of the second sensor, with this difference signal then being compared with at least one threshold value. If the difference signal exceeds the at least one threshold value, a measure is started if the threshold value is continuously exceeded and after the elapse of a period of time associated with the threshold value.

The procedure according to the invention has the advantage that it enables the plausibility of the parameter to be checked in a simple and at the same time reliable manner. This is because by forming the difference signal and comparing this difference signal with the at least one threshold value, it is possible to check whether there is a deviation between the detection of the parameter via the first sensor and the detection of the parameter via the second sensor of a magnitude that indicates an inconsistency in the detection, for example an incorrect measurement or even a defect in one of the sensors or a defect in a cable. Even if the at least one threshold value is exceeded by the difference signal, a measure is only initiated if the at least one threshold value is continuously exceeded for longer than a predetermined period of time that is assigned to the at least one threshold value. This can prevent a possibly unavoidable difference between the sensor signals, for example due to signal tolerances, reading delays, or similar, from leading to the erroneous conclusion that the parameter was detected incorrectly and the measure being carried out as a result. The respective time period thus represents a corresponding filter time.

According to one embodiment of the invention, the difference signal is compared with a first threshold value and a second threshold value, the measure being carried out when the difference signal either exceeds the first threshold value continuously for longer than a first period of time associated with the first threshold value duration or the second threshold value is continuously exceeded for longer than a second duration associated with the second threshold value. In this way, different conditions can advantageously be defined for initiating the measure by assigning a suitable threshold value with a suitable duration to the respective condition.

In a further development of the aforementioned embodiment, the second threshold value was selected to be greater than the first threshold value and the first time period was selected to be greater than the second time period. This means that smaller deviations between the sensor signals can be defined as a reason for carrying out the measure using the first threshold value and the first time period, although these deviations must last longer. On the other hand, the measure can also be carried out using the second threshold value and the associated second time period if larger deviations between the sensor signals are detected, although these larger deviations do not have to last as long as the first threshold value and the first time period. For example, this can be used to detect a defect in a cable or something similar.

Alternatively or in addition to the above-mentioned further development, the comparisons of the difference signal with the first threshold value and the second threshold value are carried out in parallel. This has the advantage that if one of the threshold values is exceeded for a correspondingly long period of time, the measure is initiated immediately. Alternatively, the comparisons can also be carried out consecutively by first comparing the difference signal with the first threshold value or first comparing the difference signal with the second threshold value.

According to one possible embodiment of the invention, a request for emergency operation is generated as a measure in which safe operation of the motor vehicle is carried out. If it is detected that the difference signal exceeds the at least one threshold value continuously for longer than the time period assigned to the at least one threshold value, the system switches to emergency operation in which safe operation of the motor vehicle is guaranteed in any case. is guaranteed. This ensures that discrepancies or errors in the recording of the parameter cannot lead to unsafe driving conditions of the motor vehicle due to a corresponding regulation or control. The emergency mode particularly preferably corresponds to the operation of the motor vehicle into which it is also transferred when at least one safety function of the vehicle system is triggered. In particular, in the emergency mode, a drive torque of a drive motor of the motor vehicle is set to zero in order to prevent further propulsion of the motor vehicle via this drive motor from the start of the emergency mode.

In a further development of the invention, a speed, preferably a drive speed of a drive engine of the motor vehicle, is determined as a parameter. In this respect, within the scope of the method according to the invention, a plausibility check is carried out on this speed, which is detected via two sensors in parallel, whereby at least one function of the vehicle system can then be controlled or regulated on the basis of the speed. In particular, the detected speed is used to control or regulate at least one safety function of a safety system of a motor vehicle in the form of a construction machine.

The plausibility-checked parameter is included in the operation of the vehicle system in particular by using this parameter for regulating or controlling at least one function of the safety system. The vehicle system is in particular a safety system of the motor vehicle via which safety-relevant tasks can be carried out in the form of at least one safety function in order to support a driver in driving the motor vehicle and to avoid safety-critical driving conditions.

The motor vehicle is preferably a work vehicle and in particular a construction machine, such as a wheel loader. In this case, the vehicle system, which is preferably in the form of a safety system, provides safety functions in particular in the form of a function for preventing an unintentional start-up. rens, a function to prevent unintentional starting in the wrong direction and/or a function to prevent unintentional deceleration.

The invention also relates to a control device, which is in particular a transmission control device. This control device is set up to determine a parameter that can be included in the operation of a vehicle system. The control device is designed to detect the parameter via a first sensor and to check its plausibility via a second sensor that also detects the parameter, for which purpose the control device checks a first sensor signal from the first sensor with a second sensor signal from the second sensor by the control device forming a difference signal between the first sensor signal and the second sensor signal and comparing it with at least one threshold value. Furthermore, the control device is set up to carry out a measure if the difference signal continuously exceeds the at least one threshold value for longer than a period of time assigned to the at least one threshold value. Furthermore, the control device can then also be set up to implement one or more of the aforementioned variants of a method according to the invention for operating a transmission control system.

The method according to the invention can also be embodied as a computer program product which, when it runs on a processor, for example a processor of an aforementioned control device, instructs the processor by software to carry out the associated method steps according to the invention. In this context, the subject matter of the invention also includes a computer-readable medium on which a computer program product described above is stored in a retrievable manner.

An advantageous embodiment of the invention, which is explained below, is shown in the drawings. It shows:

Fig. 1 is a schematic view of a vehicle system; Fig. 2 is a schematic representation of a part of the vehicle system from Fig. 1;

Fig. 3 is a flow chart of a method according to the invention for checking the plausibility of a parameter; and

Fig. 4 is a diagram of an exemplary course of a difference signal of the method from Fig. 3.

Fig. 1 shows a schematic view of a vehicle system 1, which is preferably intended for use in a motor vehicle in the form of a work vehicle and in particular for a construction machine. The motor vehicle is preferably designed as an electric vehicle and has a drive machine - not shown in more detail here - in the form of an electric machine, which is in particular an asynchronous machine.

The vehicle system 1 comprises two control units 2 and 3 and an inverter 4 of the electric machine (not shown), whereby the control units 2 and 3 and the inverter 4 are connected to one another in a data bus system of the motor vehicle (CAN bus). The control unit 2 is a vehicle computer (VCU) via which various functions 5 of the motor vehicle can be controlled or regulated. For this purpose, the control unit 2 is supplied with information about the respective accelerator pedal positions of an accelerator pedal 6 and a brake pedal 7 as well as about a selection of a direction of travel on a direction switch 8.

The control unit 3 is present as a transmission control unit of a motor vehicle transmission (also not shown here), whereby the control unit 3 is also supplied with information about the accelerator pedal positions and the choice of direction of travel by the control unit 2 within the data bus system. The control unit 3 uses this information to regulate and control transmission functions 9, whereby the control unit 3 also accesses the inverter 4 within the data bus system in order to determine the required The control unit 3 and the inverter 4 also form a safety system 10, by means of which various safety functions of the motor vehicle can be implemented. For the control or regulation of the transmission functions 9 and the safety functions, the inverter 4 communicates a current drive speed n of the electric machine to the control unit 3 as a parameter. This drive speed n is determined independently of one another on the electric machine via two sensors (not shown here) and is transmitted to the control unit 3 in the form of two sensor signals n(Si) and n(S2) as separate messages, each of which is available as speed signals.

In Fig. 2, the safety system 10 of the vehicle system 1 formed by the control unit 3 and the inverter 4 is shown separately and schematically. Within the safety system 10, the current drive speed n is determined from the sensor signal n(Si) and used within the framework of various safety functions 11 to 14. These safety functions 11 to 14 can be a function to prevent the motor vehicle from accidentally starting off, a function to prevent the motor vehicle from accidentally starting off in the wrong direction, a function to prevent the motor vehicle from accidentally decelerating, etc. If a safety-relevant event is detected by the control unit 3 during one of the safety functions 11 to 14, the control unit 3 generates a request 15 for emergency operation of the motor vehicle. In this case, this request 15 is passed on to the inverter 4 in order to set the target torque of the electric machine to zero.

As part of a check 16, the two sensor signals n(Si) and n(S2) are also checked by the control unit 3, whereby on the one hand a check of the respective status of the respective sensor signal n(Si) or n(S2) is carried out. This check can be carried out as part of a cyclic redundancy check (CRC). If an error is detected in the status of the respective sensor signal n(Si) or n(S2), the request 15 for emergency operation is also generated and thus emergency operation is initiated by the inverter 4. On the other hand, the two sensor signals n(Si) and n(S2) are compared with each other in order to Sensor signal n(Si) to be checked for plausibility. The latter is carried out within the framework of a method according to the invention, which will now be described in more detail with the aid of Fig. 3, which shows a flow chart of the method.

At the beginning of the method, in a first step S1, a difference signal An is formed as the difference between the two sensor signals n(Si) and n(S2), with an example of the course of this difference signal An being shown in a diagram over time t in Fig. 4. This difference signal An is then compared in parallel steps S2 and S3 with a threshold value thd 1 and thd2 respectively, with the two threshold values thd1 and thd2 also being indicated in Fig. 4. It can also be seen here that the threshold value thd2 is selected to be higher than the threshold value thd 1 . If in step S2 the threshold value thd1 is detected to be exceeded by the difference signal An, the system goes to step S4, otherwise the system jumps back to step S1. Likewise, the system also goes to step S5 following step S3 if it was detected in step S3 that the threshold value thd2 was exceeded by the difference signal An. If this is not the case during the check, the system also jumps back to step S1 after step S3.

If, however, the exceeding of the threshold value thd1 was detected in step S2, the next step in step S4 is to check whether a recorded time tÜ 1 of the continuous, i.e. uninterrupted exceeding of the threshold value thd1 is longer than a time period tft1 . If this is not the case, the system jumps back to step S1, otherwise it goes to step S6.

In step S5, which is followed after step S3 when the difference signal An detects that the threshold value thd2 is exceeded, a time tÜ2 is determined which represents the duration of the continuous exceedance of the threshold value thd2 by the difference signal An. This time tÜ2 is then compared with a time period tft2 in step S5, and if the time period tft2 is exceeded by the time tÜ2, the system goes to step S6, while otherwise it jumps back to step S1. The time period tft2 is shorter here. selected as the time period tft1 , so that for a transition from step S5 to step S6 a shorter time tÜ2 is necessary compared to the time tÜ 1 .

If it has been detected in one of the parallel step pairs S2 and S4 as well as S3 and S5 that the difference signal An exceeds the respective threshold value thd 1 or thd2 continuously for longer than the respectively assigned time period tft1 or tft2, a relevant deviation between the speed signals n(Si) and n(S2) is detected in step S6 and a measure is subsequently initiated. In the course of this measure, the request 15 for emergency operation of the motor vehicle is also generated and passed on to the inverter 4, so that safe operation of the motor vehicle is brought about by step S6.

By means of the method according to the invention, a reliable plausibility check of a parameter can be realized.

Reference symbols

1 Vehicle system 2 Control unit

3 Control unit

4 Inverters 5 Functions

6 Accelerator pedal 7 Brake pedal

8 Direction switch 9 Gearbox functions

10 Safety system 11 Safety function

12 Safety function 13 Safety function

14 Safety function 15 Emergency operation requirement

16 Check n Drive speed n(Si) Sensor signal n(S ₂ ) Sensor signal On Difference signal t Time thd1 Threshold value thd2 Threshold value tÜ1 Time tÜ2 Time tft1 Duration tft2 Duration

S1 to S6 individual steps

Claims

Patent claims 1. Method for checking the plausibility of a parameter which is included in the operation of a vehicle system (1) of a motor vehicle, wherein the parameter detected by a first sensor is checked for plausibility with a second sensor which also detects the parameter by checking a first sensor signal (n(Si)) of the first sensor with a second sensor signal (n(S2)) of the second sensor, characterized in that the check (16) is carried out by forming a difference signal (An) between the first sensor signal (n(Si)) and the second sensor signal (n(S2)) and comparing it with at least one threshold value (thd1, thd2), and that a measure is carried out if the difference signal (An) exceeds the at least one threshold value (thd1, thd2) continuously for longer than a time period (tft1, tft2) assigned to the at least one threshold value (thd1, thd2). 2. Method according to claim 1, characterized in that the difference signal (An) is compared with a first threshold value (thd1) and a second threshold value (thd2), the measure being carried out when the difference signal (An) either exceeds the first threshold value (thd1) continuously for longer than a first time period (tft1) associated with the first threshold value (thd1) or exceeds the second threshold value (thd2) continuously for longer than a second time period (tft2) associated with the second threshold value (thd2). 3. Method according to claim 2, characterized in that the second threshold value (thd2) is selected to be greater than the first threshold value (thd1) and the first time period (tft1) is selected to be greater than the second time period (tft2). 4. Method according to claim 2 or claim 3, characterized in that the adjustments of the difference signal (An) with the first threshold value (thd 1 ) and the second threshold value (thd2) are carried out parallel to one another. 5. Method according to one of the preceding claims, characterized in that as a measure a request (15) for an emergency operation is generated in which a safe operation of the motor vehicle is carried out. 6. Method according to one of the preceding claims, characterized in that a rotational speed, preferably a drive speed (n) of a drive engine of the motor vehicle is determined as a parameter. 7. Method according to one of the preceding claims, characterized in that the parameter is included in a regulation or in a control of at least one function of the vehicle system (1), preferably at least one safety function (11, 12, 13, 14) of a safety system (10) of the vehicle system (1). 8. Control device (3), in particular a transmission control device, which is set up to determine a parameter which can be included in the operation of a vehicle system (1), wherein the control device (3) is designed to detect the parameter via a first sensor and to check its plausibility via a second sensor which also detects the parameter, for which purpose the control device (3) checks a first sensor signal (n(Si)) of the first sensor with a second sensor signal (n(S2)) of the second sensor, in that the control device (3) forms a difference signal (An) between the first sensor signal (n(Si)) and the second sensor signal (n(S2)) and compares it with at least one threshold value (thd1, thd2), and wherein the control device (3) is set up to carry out a measure if the difference signal (An) continuously exceeds the at least one threshold value (thd1, thd2) for longer than a time period (tft1) assigned to the at least one threshold value (thd1, thd2). , tft2). 9. Control device (3) according to claim 8, which is further configured to carry out a method according to one or more of claims 2 to 7. 10. Computer program product for a control device (3) according to claim 8 or 9, by means of which a method according to one or more of claims 1 to 7 can be carried out, wherein a routine for checking the plausibility of a parameter is implemented by corresponding control commands stored in software. 11. A data carrier with a computer program product according to claim 10.