FR3039903B1 - HANDS-FREE ACCESS AND START SYSTEM OF A MOTOR VEHICLE - Google Patents

Abstract

The system according to the invention is of the type comprising a microprocessor (3), generating a control signal (P1, P2, S) intended to drive a control circuit (13) of a main power supply relay ( 5) of the vehicle and a validation module (4, 9) separate from the microprocessor (3) and validating the control signal (P1, P2, S). The microprocessor (3) receives an average speed data (Vv) representative of a mean vehicle running speed and second data (SSB1, SSB2) representative of a state of a start or cut command (2) . According to the invention, the validation module (9) generates an enable signal (E) of the control signal (S) as a function of a wheel speed data (Vr) representative of a running speed of a vehicle wheel, second data (SSB1, SSB2), and third data (CG) representative of an operation of the microprocessor (3).

Description

HANDS-FREE ACCESS AND START SYSTEM OF A VEHICLE

AUTOMOBILE TECHNICAL FIELD OF THE INVENTION.

The present invention relates to a system for accessing and starting hands-free of a motor vehicle. BACKGROUND ART OF THE INVENTION.

Smart mobile phones known as "smartphones" have become indispensable in everyday life.

Their uses in the automobile sector are numerous and range from the real-time display of information on the state of the vehicle (locked / unlocked, open windows, cabin temperature, fuel level, etc.). ) the location of the vehicle in the street or the car park thanks to the phone's GPS, via the remote start of the heating or ventilation, and, of course, by starting the engine. The implementation of these features is based on a "gateway key" between the driver's smartphone and the vehicle systems. In this way, the smartphone replaces, and extends the possibilities, remotes already used for many years to remotely control the opening of the doors or replace the traditional ignition key.

In these so-called "hands-free" access and boot systems, or ADML systems (more known to those skilled in the art under the acronym PEPS, for "Passive Entry Passive Start" in English terminology), the information transmitted by radio frequencies, read in a smart card, or even simply generated by a contactor are usually processed by an embedded microprocessor.

In a very disturbed environment such as that of a vehicle (temperature, electrical noise, interference, etc.), this microprocessor is not immune from failures, or at least errors or transient unavailability leading to a re-initialization.

However, certain controlled functions are critical: it goes without saying in particular that the main power supply of the vehicle must not be cut off unexpectedly by the microprocessor, which falsely interprets a vehicle speed information as being below a low threshold representative of a stopping the vehicle and a door lock command as if the driver were leaving the vehicle while the vehicle was not stationary.

Conversely, if the driver leaves the vehicle at a standstill, and controls the door lock without the microprocessor shutting off the vehicle's main power supply, this may result in the battery being discharged, but this circumstance not critical.

In order to take into account the disturbances that can cause a malfunction of the microprocessor, an electric control unit of a vehicle described in US Pat. No. 7124005 comprises a circuit for holding and validating the control signals of the vehicle power supply relay.

To do this, the microprocessor processes, in addition to information representative of a start command, information representative of the operation of the vehicle, in particular its speed, and sends corresponding control pulses to the holding circuit and validation.

In the event of the disappearance of these pulses, due to a malfunction of the microprocessor, the holding and validation circuit can maintain the control signals of the relay to avoid stopping the motor and a power failure. Conversely, when pulses have controlled the relay, the holding and validation circuit periodically tests the microprocessor to check the validity of the control signals.

In operation, this holding and validation circuit is completely dependent on that of the microprocessor without being able to directly take into account essential information, such as the speed of the vehicle.

In addition, no assurance can be given as to any compliance of this electrical control unit with the safety requirement levels as defined by ISO 26262.

The ISO 26262 standard defines four AS ILs ("Automotive Security Integrity Level"), indicated by letters from A to D, A corresponding to the lowest risk and B to the security requirement level. higher. A level of security requirement indicated by QM ("Quality Management" ie "Quality Management") is assigned to non-critical functions.

However, if saving the energy of the on-board battery is a non-critical availability function, the main power cut-off function is an ASIL level safety function B. GENERAL DESCRIPTION OF THE INVENTION.

The present invention therefore aims to improve the operational safety of an ADML system.

It relates specifically to a hands-free access and start-up system for a motor vehicle of the type comprising a microprocessor generating a control signal (S) intended to drive a control circuit of a main power supply relay. of the vehicle, and a validation module separate from the microprocessor validating the control signal, the microprocessor receiving an average speed data representative of an average vehicle running speed and second data representative of a state of a start command or break.

According to the invention, the validation module generates a control signal enable signal as a function of a wheel speed data representative of a rolling speed of a vehicle wheel, second data and third data. representative of a functioning or not of the microprocessor.

According to other characteristics of the invention, the validation module comprises: first detection means receiving the wheel speed data, and generating a first command indicating that the wheel speed is lower than a predetermined speed threshold; second detection means receiving the second data and generating a second command indicating that the cut-off command has been activated; and third detection means receiving the third data, and generating a third command indicating a failure of the microprocessor.

According to another characteristic, the wheel speed data is provided by a wheel sensor.

According to yet another characteristic, the predetermined speed threshold is substantially equal to 4 km / h.

In the system according to the invention, the start command is formed of at least one start button.

According to yet another characteristic, the third detection means are formed by a digital circuit connected by a serial link to the microprocessor or connected to at least one digital input / output of the microprocessor.

This digital circuit is preferably made in the form of an integrated circuit external to the microprocessor, such as a "Single Basic Chip" type integrated circuit, and includes a degraded mode function and / or a watchdog.

According to yet another characteristic of the invention, the validation module further comprises a first three-input logic gate combining the first, second and third commands and forming the validation signal, and a second two-input logic gate combining the signal. and control signal, and forming a validated control signal driving the control circuit. These first and second logic gates are realized by means of discrete components or integrated logic gates.

In the hands-free access and start-up system of a motor vehicle according to the invention, the microprocessor comprises a computer code generating the control signal and the third data developed with a first level of requirement in terms of AS safety. IL B according to an ISO 26262 standard, and the validation module is developed with a second level of ASIL QM security requirement according to this standard.

These few essential specifications will have made obvious to the skilled person the advantages provided by the invention compared to the state of the prior art.

The detailed specifications of the invention are given in the following description in conjunction with the accompanying drawings.

It should be noted that these drawings have no other purpose than to illustrate the text of the description and do not constitute in any way a limitation of the scope of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 shows schematically an ADML hands-free startup system of a type known from the state of the art.

Figure 2 schematically shows an ADML hands-free start system according to the invention. DESCRIPTION OF THE PREFERRED EMBODIMENTS OF THE INVENTION

Figure 1 shows schematically an ADML type system 1 designed according to the teaching of the state of the art recalled above in preamble, limited to a hands-free start function.

A start command SSB1, SSB2 is provided by a start button 2 and processed by a microprocessor, a microcontroller or the like, 3.

This microprocessor 3 sends control pulses P1, P2 on / off to a holding and validation circuit (HLD) 4 which controls by a power output R a vehicle power supply relay 5 connected to a battery voltage Ubat of the vehicle and returns a status information P3.

The microprocessor 3 also receives velocity information comprising a wheel speed data Vr and a vehicle average speed data Vv respectively by a wire link L and via a CAN bus type field . The speed information Vr and Vv are constructed from measurement signals provided by an anti-lock brake system 6 from wheel sensors 7. The speed information Vr relates to a wheel speed. The speed information Vv relates to the speed of the vehicle which is obtained for example by calculating the average of the different wheel speeds of the vehicle.

This speed information Vr, Vv, allow the ADML system 1 to overcome certain malfunctions of the microprocessor 3, but insofar as they are processed by the microprocessor 3 itself, the maintenance and validation of the control pulses P1, P2 by the holding and validation circuit 4 are not completely independent of the microprocessor 3, and the security level is not optimum.

In the ADML system 8 according to the invention shown diagrammatically in FIG. 2, the average vehicle running speed data Vv and the second data SSB1, SSB2 representative of a state of the start command are sent to the microprocessor 3, and the wheel speed data Vr and the data SSB1, SSB2 are transmitted and processed directly by a validation module 9. As in the system of FIG. 1, the data Vr and Vv are conveyed respectively by a wired connection. L and via a CAN bus.

Computer code executed by the microprocessor 3 generates a control signal S as a function of the data Vv, SSB1 and SSB2. This same computer code also generates third data CG, called "watchdog", representative of a functioning or not of the microprocessor 3.

The validation module 9 comprises a digital circuit 10 in the form of an integrated circuit external to the microprocessor 3, for example a "Single Basic Chip" (SBC) type integrated circuit. The digital circuit 10 receives the third data CG through a serial link SPI connecting this digital circuit 10 to the microprocessor 3. The third watchdog data CG allow the digital circuit to detect a failure of the microprocessor 3.

The validation module 9 also comprises first detection means (MLI) 11 generating a first command C1 when the wheel rolling speed data Vr, transmitted on the wire link L, in pulse width modulation PWM in this embodiment, indicates that the vehicle speed is less than about 4 km / h. The speed below 4 km / h is defined in the European regulation ECE R116 and is considered representative of a stationary vehicle.

Second detection means 12 generate a second command C2 when the second data SSB1, SSB2, received indicates a request of cutoff emanating conductor.

The third CG data can activate by default a degraded mode function of the SBC 10 (so-called "limp home" function in English terminology) in case of failure of the microprocessor 3, or periodically reset a service of an SBC watchdog 10, which will trigger this degraded mode function if the service is missing.

In degraded mode, the SBC 10 generates a third HOME LIMP command which is combined with the first and second C1, C2 commands in a first three input logic gate 14 to produce a validation signal E.

This validation signal E is combined with the control signal S generated by the microprocessor 3 in a second logic gate 15 to produce a validation signal C intended to drive a control circuit 13 in the form of a power transistor controlling by the power output R the main power supply relay 5 of the vehicle.

In the preferred embodiments of the invention, the first and second logic gates 14, 15 are produced by means of discrete components such as discrete bipolar transistors or by means of integrated logic gates, both to ensure high reliability and reliability. lower the costs.

The ADML system 8 according to the invention makes it possible to cut off the main power supply of the vehicle, even in the event of loss of the microprocessor 3.

When the vehicle is stationary, this function is an availability function that saves battery power, and is developed with ASIL QM safety requirements. Nevertheless, it acts on the main power cut, and cutting off the main power supply is a safety function that needs to be developed at the ASIL B level.

In the ADML system 8 according to the invention, the shutdown of the main power supply at standstill in the event of loss of the microprocessor 3 and of pressing on the start button 2 is performed by the validation module 9, which is a component external to the microprocessor 3. The independence between the availability function QM and the security function performed by the microprocessor 3 at level ASIL B is therefore guaranteed.

An advantage of the invention is therefore to improve a prevention of inadvertent power failure in case of failure of the microprocessor 3 of the ADML 8 system.

It goes without saying that the invention is not limited to the only preferred embodiments described above.

In particular, the start command 2 is advantageously formed by control elements other than a start button 2, for example a smart card reader, a remote control receiver or a smartphone-type smart mobile phone.

In variants of the invention, the microprocessor 3 further receives other data representative of the locking / unlocking of the doors, and further generates activation signals of other power supply relays, including starter relays, electric locks or accessories.

Claims (10)

1) Hands-free access and start system (8) for a motor vehicle of the type comprising a microprocessor (3), generating a control signal (S) for driving a control circuit (13) a main power supply relay (5) of said vehicle, and a validation module (9) separate from said microprocessor (3) validating said control signal (S), said microprocessor (3) receiving a medium speed data ( Vv) representative of a mean running speed of said vehicle and second data (SSB1, SSB2) representative of a state of a start or cut command (2), characterized in that said validation module (9) generates a validation signal (E) of said control signal (S) as a function of a wheel speed data (Vr) representative of a rolling speed of a wheel of said vehicle, second data (SSB1, SSB2) and third data (CG) representative of a function ionisation or not of said microprocessor (3). 2) system for access and start hands-free (8) of a motor vehicle according to claim 1, characterized in that said validation module (9) comprises: - first detection means (11) receiving said wheel speed data (Vr), and generating a first command (C1) indicating that the wheel speed is below a predetermined speed threshold; second detection means (12) receiving said second data (SSB1, SSB2), and generating a second command (C2) indicating that said cutoff command (2) has been activated; - third detection means (10) receiving said third data (CG), and generating a third command (LIMP HOME) indicating a failure of said microprocessor (3). 3) A hands-free access and start system (8) of a motor vehicle according to the preceding claim 2, characterized in that said wheel speed data (Vr) is provided by a wheel sensor (7). 4) access system and hands-free start (8) of a motor vehicle according to claim 2, characterized in that said predetermined speed threshold is substantially equal to 4 km / h. 5) A hands-free access and start system (8) of a motor vehicle according to claim 2, characterized in that said start command (2) is formed of at least one start button. 6) A hands-free access and start system (8) for a motor vehicle according to claim 2, characterized in that said third detection means (10) are formed by a digital circuit connected by a serial link ( SPI) to said microprocessor (3) or connected to at least one digital input / output of said microprocessor (3). 7) Access system and hands-free start (8) of a motor vehicle according to claim 6, characterized in that said digital circuit (10) is embodied in the form of an integrated circuit external to said microprocessor ( 3), such as a "Single Basic Chip" (SBC) type integrated circuit, and includes a degraded mode function and / or a watchdog. 8) Access system and hands-free start (8) of a motor vehicle according to any one of claims 2 to 7 above, characterized in that said validation module (9) further comprises a first logic gate with three inputs (14) combining said first, second and third commands (C1, C2, HOME LIMP) and forming said enable signal (E), and a second two-input logic gate (15) combining said enable signal (E ) and said control signal (S), and forming a validated control signal (C) driving said control circuit (13). 9) system for access and start hands-free (8) of a motor vehicle according to claim 8, characterized in that said first logic gate with three inputs (14) and said second logic gate with two inputs (15). ) are realized by means of discrete components or integrated logic gates. 10) Hands-free access and start system (8) of a motor vehicle according to any one of claims 1 to 9 above, characterized in that said microprocessor (3) comprises a computer code generating said control signal (S) developed with a first level of requirement, and in that the validation module (9) is developed with a second level of requirement.