Control device for an automated vehicle

Abstract

Control device (1) for an automated vehicle (2), comprising at least one computing module (3) which is designed to control at least two at least partially redundant components (5, 6) of the vehicle (2) depending on a malfunction of at least one cooling device (4) of the vehicle (2) in such a way that they are operated alternately.

Description

[0001] The invention relates to a control device for an automated vehicle. Furthermore, the invention relates to a control system for an automated vehicle and to a corresponding automated vehicle. The invention also relates to a computer-implemented method and to a computer program product.

[0002] It is known from the prior art that, in the event of a malfunction in the cooling system of components of an automated vehicle, the vehicle's functionality can be significantly reduced, or the affected components can be switched off after reaching a thermal limit, usually within a short time. Both can lead to an abrupt stop of the vehicle in moving traffic and thus to an immediate danger to the vehicle occupants and other road users.

[0003] DE 10 2021 003 218 A1 discloses a device and a method for operating an automated means of transport. DE 10 2011 104 259 A1 discloses a motor vehicle with at least two control units.

[0004] A control device for an automated vehicle is proposed. The control device comprises at least one computing module designed to control at least two at least partially redundant vehicle components, depending on a malfunction of at least one of the vehicle's cooling devices, in such a way that these components are operated alternately.

[0005] The control device is preferably intended for use in the vehicle. In particular, the vehicle may include the control device. Preferably, the control device may at least partially constitute or be comprised of a control unit, in particular an electronic control unit (ECU), of the vehicle. The control device may, in particular, be intended to control functions, especially automated driving functions, of the vehicle. "Intended" is understood to mean, in particular, specifically programmed, specially equipped, and / or specially designed. The fact that an object is intended for a function is understood to mean, in particular, that the object performs the function in at least one operating state.

[0006] The term "automated vehicle" shall be understood to mean, in particular, a vehicle with one of the automation levels 1 to 5 of the SAE J3016 standard. Specifically, the automated vehicle shall have the technical equipment required for these automation levels. This technical equipment shall include, in particular, environmental perception sensors, such as radar sensors, lidar sensors, cameras and / or acoustic sensors, control units, in particular the control device, or the like. Preferably, the automated vehicle shall be a land vehicle, in particular a road vehicle. The automated vehicle may be, in particular, a passenger car, preferably a passenger transport vehicle, a truck, a construction vehicle, an agricultural vehicle, or any other vehicle that would appear appropriate to a person skilled in the art.The automated vehicle can alternatively be designed as an aircraft, for example as a drone, an airplane, a helicopter, a vertical take-off and landing aircraft or the like, as a rail vehicle, for example as a locomotive, a wagon or the like, or as a watercraft, in particular as a ship, a boat or the like.

[0007] The computing module can be designed, at least partially, as a microprocessor, a microcontroller, an integrated circuit, in particular an FPGA (Field Programmable Gate Array), or an application-specific integrated circuit (ASIC), or the like. The control unit can preferably include further components, such as interfaces, memory modules, or the like, which can interact with the computing module.

[0008] The at least partially redundant components are preferably necessary for the operation of the vehicle, particularly for at least semi-automated operation. These components require cooling. In particular, the components generate waste heat during operation, which must be dissipated, especially by the cooling device, to enable continuous operation of the components. The components are preferably electronic components, such as chips, processors, memory modules, interface modules, printed circuit boards, or the like. Two components are considered redundant if they can perform the same functions in the same manner, for example, with the same precision and speed. In particular, two identical components can be redundant.A component is partially redundant with respect to another component if it can perform some of the functions of the other component in the same way and / or the functions of the other component in a different way, for example, more slowly. In particular, the vehicle can comprise multiple sets, for example, pairs, of at least partially redundant components. Specifically, more than two components can be at least partially redundant with respect to each other.

[0009] The cooling device is preferably designed to cool at least two at least partially redundant components. In particular, the cooling device can be designed to cool a plurality of components, preferably all components of the vehicle requiring cooling. The cooling device can be designed as an air cooling system and / or as a liquid cooling system. The vehicle can also include a plurality of cooling devices. The cooling device is designed, in particular, to maintain the components at an optimal operating temperature. In particular, if the cooling device malfunctions, it may no longer be able to provide the required cooling capacity. A malfunction of the cooling device could be, for example, a total failure of the cooling device, a leak in the cooling device, a defect in a coolant pump, or any other malfunction that would be considered plausible by a person skilled in the art.

[0010] The control device, in particular the computing module, is preferably designed to detect malfunctions of the cooling device. In particular, the control device can be connected to the cooling device, especially to a control module of the cooling device, via data transmission. In particular, the cooling device can be designed to transmit an error signal to the control device depending on a malfunction. Alternatively or additionally, it is conceivable that the control device, in particular the computing module, can detect the malfunction of the cooling device depending on a communication interruption with the cooling device, depending on a lack of response or a missing heartbeat signal from the cooling device, or in another manner that would appear sensible to a person skilled in the art.In particular, it is conceivable that the control device, especially the computing module, can detect the malfunction of the cooling device depending on a signal from at least one sensor intended for monitoring the cooling device. The sensor can, for example, be a temperature sensor, a fluid flow sensor, or the like.

[0011] Alternatively or additionally, it is conceivable that the control device, in particular the computing module, is designed to detect the malfunction of the cooling device depending on the behavior of at least one of the at least partially redundant components. In particular, the control device can be connected to at least some of the components via data transmission. Specifically, a component can be designed to transmit an error signal to the control device depending on overheating. Alternatively or additionally, it is conceivable that the control device, in particular the computing module, can detect the malfunction of the cooling device depending on a communication interruption with at least one of the components, depending on a lack of response or a missing heartbeat signal from the component, or in another manner that would appear sensible to a person skilled in the art.In particular, it is conceivable that the control device, especially the computing module, can detect the malfunction of the cooling device depending on a signal from at least one sensor, which is intended to monitor at least one of the components. The sensor can, for example, be a temperature sensor, a voltage sensor, or the like.

[0012] In particular, a component heats up increasingly during operation without cooling. Preferably, a component cools down while not in operation, so that it can subsequently be operated again without cooling for a certain period of time.

[0013] Preferably, the computing module is designed to transmit control commands to the components to enable alternating operation. For example, the computing module can alternately transmit switch-on and switch-off commands to the components. In particular, the computing module itself can be one of the at least partially redundant components. For example, depending on the malfunction of the cooling device, the computing module can alternately switch itself on and off or put itself into a standby state. For example, shortly before reaching an overheating state, the computing module can transmit a switch-on or wake-up command to another at least partially redundant computing module and then put itself into a standby state. For example, shortly before reaching an overheating state, the other computing module can transmit a switch-on or wake-up command to the computing module and then put itself into a standby state.

[0014] The design of the control device according to the invention advantageously enables a response to a malfunction of a cooling system in an automated vehicle. Advantageously, it allows for the longest possible operating time of the vehicle after the malfunction. Advantageously, it provides sufficient time to bring the vehicle to a safe state. Advantageously, it ensures a high level of occupant and traffic safety.

[0015] Furthermore, it is proposed that the computing module be designed to switch between operating the components depending on whether a temperature threshold, in particular a maximum temperature value, of the currently operating component is reached. Specifically, the computing module is designed to switch to operating the currently inactive component depending on whether the temperature threshold of the currently operating component is reached, in particular to deactivate the currently operating component and activate the currently inactive component. The temperature threshold of the currently operating component could, for example, be a temperature at which the components can no longer deliver their full performance, at which their performance is no longer sufficient for the functions for which the components are intended, at which damage to the components due to overheating may occur, or similar.The temperature threshold of the currently operated component can be stored, in particular, in a memory unit of the control device. Preferably, the control device is designed to monitor the temperature of at least the currently operated component, for example, by communicating with the component or with a temperature sensor that monitors the currently operated component. Advantageously, temperature-dependent switching operation can be enabled.

[0016] Furthermore, it is proposed that the computing module be designed to switch between operating the components depending on whether a temperature threshold, in particular a minimum temperature value, of the currently inactive component is reached. Specifically, the computing module is designed to switch between operating the components depending on whether a temperature threshold, in particular a minimum temperature value, of the currently inactive component is reached, or alternatively or additionally, whether a temperature threshold, in particular a maximum temperature value, of the currently active component is reached.In particular, the computing module is designed to switch to operating a currently inactive component when its temperature threshold is reached, specifically to deactivate the currently active component and activate the currently inactive component. The temperature threshold of the currently inactive component could, for example, be the temperature at which the components can operate at full capacity, at which their performance is sufficient for their intended functions, at which cooling-free operation of the components is possible for a certain period of time, or similar. The temperature threshold of the currently inactive component could, in particular, be stored in the control device's memory unit.Preferably, the control device is designed to monitor the temperature of at least the currently inactive component, for example by communicating with the component or with a temperature sensor that monitors the currently inactive component. Advantageously, a further variant of temperature-dependent alternating operation can be enabled.

[0017] Furthermore, it is proposed that the computing module be designed to switch between operating components depending on whether an operating duration threshold of the currently operating component is reached. Specifically, the computing module is designed to switch between operating components depending on whether an operating duration threshold of the currently operating component is reached, either as an alternative or in addition to reaching a temperature threshold of the currently operating component and / or the currently inactive component. Specifically, the computing module is designed to switch to operating the currently inactive component depending on whether the operating duration threshold of the currently operating component is reached, in particular to deactivate the currently operating component and activate the currently inactive component.The operating time threshold of the currently operating component can, for example, be an operating time beyond which the components can no longer deliver their full performance without adequate cooling, beyond which their performance without adequate cooling is no longer sufficient for the functions for which the components are intended, beyond which damage to the components due to overheating can occur without adequate cooling, or similar. The operating time threshold of the currently operating component can be stored, in particular, in the memory unit of the control device. Specifically, different operating time thresholds can be stored for different malfunctions of the cooling device.Preferably, the control device is designed to monitor the operating time of at least the currently operated component, for example by communicating with the component or with a counter unit that measures the operating time of the currently operated component. Advantageously, alternating operation dependent on operating time can be enabled.

[0018] Furthermore, it is proposed that the computing module be designed to bring the vehicle into a safe state during component switching. A safe state of the vehicle is, in particular, a state in which the risk to the vehicle's occupants and other road users is minimized. Preferably, the vehicle is in this safe state while stationary and off the roadway, for example, on a hard shoulder, in a parking lot, in a workshop, or the like. Specifically, the computing module is designed to control other vehicle components, such as a control unit, a drive motor, a steering system, or the like, in order to enable the vehicle to be brought into this safe state during component switching.Transitioning to a safe state can involve, in particular, driving to a safe stopping point, such as a hard shoulder, a parking area, a workshop, or similar, and then stopping and switching off the vehicle. Alternating between these steps can advantageously facilitate reaching a safe state.

[0019] Furthermore, a control system for an automated vehicle is proposed. The control system comprises at least one control device according to the invention. The control system comprises at least two at least partially redundant components. In particular, the control system can comprise a plurality of control devices and / or at least partially redundant components. Advantageously, a control system can be provided that enables a particularly high level of occupant and traffic safety.

[0020] Furthermore, it is proposed that the control system include at least one cooling device for cooling the components. The control system may, in particular, include multiple cooling devices. Advantageously, a particularly safe control system with a cooling device can be provided.

[0021] Furthermore, an automatically operated vehicle is proposed. The vehicle comprises at least one control device or at least one control system according to the invention. Advantageously, a particularly safe vehicle for occupants and traffic can be provided.

[0022] Furthermore, a computer-implemented method is proposed. Depending on a malfunction of at least one cooling device of an automated vehicle, at least two at least partially redundant components of the vehicle are controlled such that they are operated alternately. Preferably, the operation of the components is switched depending on whether a temperature threshold, in particular a maximum temperature, of the currently operated component is reached; depending on whether a temperature threshold, in particular a minimum temperature, of the currently inactive component is reached; and / or depending on whether an operating duration threshold of the currently operated component is reached. Preferably, the vehicle is brought into a safe state during the alternating operation of the components.Advantageously, a particularly safe computer-implemented procedure for occupants and traffic can be provided.

[0023] Furthermore, a computer program product is proposed. This computer program product comprises execution commands which, when executed by a control device according to the invention, cause the device to execute a method according to the invention. Advantageously, a particularly safe computer program product for occupants and traffic can be provided.

[0024] The invention is illustrated by an exemplary embodiment in the following figures. They show: Fig. 1 a schematic representation of an automatically operated vehicle according to the invention and Fig. 2 a flowchart of a computer-implemented method according to the invention in a schematic representation.

[0025] Fig. Figure 1 shows a schematic representation of an automated vehicle 2. In the present embodiment, the automated vehicle 2 is exemplary as a land vehicle, in particular as a passenger car. The vehicle 2 comprises at least one control system 7. The control system 7 comprises at least one control device 1. The control system 7 comprises at least two at least partially redundant components 5, 6. The control system 7 comprises at least one cooling device 4 for cooling the components 5, 6.

[0026] The control device 1 comprises at least one computing module 3, which is designed to control the at least two at least partially redundant components 5, 6 of the vehicle 2, depending on a malfunction of the cooling device 4 of the vehicle 2, such that these components are operated alternately. In the present embodiment, the components 5, 6 are designed separately from the control device 1, in particular the computing module 3. In alternative embodiments, it is conceivable that the control device 1 comprises at least one of the components 5, 6, in particular that the computing module 3 forms one of the components 5, 6.

[0027] The control device 1, in particular the computing module 3, is designed to detect malfunctions in the cooling device 4. The computing module 3 is designed to transmit control commands to components 5 and 6 to enable alternating operation. For example, the computing module 3 can alternately transmit on and off commands to the components.

[0028] The computing module 3 can be configured to switch between operating components 5 and 6 depending on whether a temperature threshold, in particular a maximum temperature value, of the currently operating component 5 is reached. For the sake of clarity, it is assumed that the first component 5 is the currently operating component 5 and the second component 6 is the currently inactive component 6. This assignment naturally changes regularly during alternating operation. In one embodiment, the computing module 3 is configured to switch to operating the currently inactive component 6 depending on whether the temperature threshold of the currently operating component 5 is reached, specifically to deactivate the currently operating component 5 and activate the currently inactive component 6.

[0029] The computing module 3 can be configured to switch between operating components 5 and 6 depending on whether a temperature threshold, in particular a minimum temperature value, is reached by component 6, which is currently not in operation. Alternatively, or in addition to reaching a temperature threshold, in particular a maximum temperature value, by component 6, which is currently not in operation, the computing module 3 can also switch between operating components 5 and 6.In one embodiment, the computing module 3 is designed to switch to operating the currently non-operated component 6 depending on whether the temperature threshold of the currently non-operated component 6 is reached, in particular to deactivate the currently operated component 5 and to activate the currently non-operated component 6.

[0030] The computing module 3 can be configured to switch between operating components 5 and 6 depending on whether the currently operating component 5 reaches an operating duration threshold. Alternatively, or additionally, depending on whether the currently operating component 5 reaches an operating duration threshold, the computing module 3 can switch between operating components 5 and 6 depending on whether the currently operating component 5 and / or the currently inactive component 6 reach a temperature threshold. In one embodiment, the computing module 3 is configured to switch to operating the currently inactive component 6 depending on whether the operating duration threshold of the currently operating component 5 is reached, in particular to deactivate the currently operating component 5 and activate the currently inactive component 6.

[0031] The computing module 3 is designed to bring the vehicle 2 into a safe state during the alternating operation of components 5 and 6. The computing module 3 is also designed to control other devices of the vehicle 2, such as a control unit, a drive motor, a steering system, or similar components (not shown here), in order to enable the vehicle 2 to be brought into a safe state during the alternating operation of components 5 and 6. This transition to a safe state can involve driving to a safe stopping point, such as a hard shoulder, a parking lot, a workshop, or similar, and subsequently stopping and switching off the vehicle 2.

[0032] Fig.Figure 2 shows a schematic flowchart of a computer-implemented process. In a first process step 8, depending on a malfunction of at least one cooling device 4 of the automated vehicle 2, the at least two at least partially redundant components 5, 6 of the vehicle 2 are controlled such that they are operated alternately. The operation of components 5, 6 is switched depending on whether a temperature threshold, in particular a maximum temperature value, of the currently operated component 5 is reached, depending on whether a temperature threshold, in particular a minimum temperature value, of the currently inactive component 6 is reached, and / or depending on whether an operating duration threshold of the currently operated component 5 is reached.In a second process step 9, the vehicle 2 is brought into a safe state during the alternating operation of components 5, 6.

[0033] A computer program product includes execution instructions which, when the program is executed by the control device 1, cause it to carry out the procedure. Reference sign 1 Control device 2 vehicles 3. Computing module 4 Cooling device 5 components 6 components 7 Tax system 8. Procedure step 9. Procedure step

Claims

Control device (1) for an automated vehicle (2), comprising at least one computing module (3) which is designed to control at least two at least partially redundant components (5, 6) of the vehicle (2) depending on a malfunction of at least one cooling device (4) of the vehicle (2) in such a way that they are operated alternately. Control device (1) according to claim 1, wherein the computing module (3) is provided to switch between operating the components (5, 6) depending on reaching a temperature threshold, in particular a maximum temperature, of the currently operated component (5, 6). Control device (1) according to claim 1 or 2, wherein the computing module (3) is provided to switch between operating the components (5, 6) depending on reaching a temperature threshold, in particular a minimum temperature, of the currently not operated component (5, 6). Control device (1) according to one of the preceding claims, wherein the computing module (3) is provided to switch between operating the components (5, 6) depending on reaching an operating duration threshold of the currently operated component (5, 6). Control device (1) according to one of the preceding claims, wherein the computing module (3) is provided to bring the vehicle (2) into a safe state during alternating operation of the components (5, 6). Control system (7) for an automated vehicle (2), comprising at least one control device (1) according to one of the preceding claims and at least two at least partially redundant components (5, 6). Control system (7) according to claim 6, comprising at least one cooling device (4) for cooling the components (5, 6). Automated vehicle (2) comprising at least one control device (1) according to one of claims 1 to 5 or at least one control system (7) according to claim 6 or 7 . Computer-implemented method, wherein, depending on a malfunction of at least one cooling device (4) of an automated vehicle (2), at least two at least partially redundant components (5, 6) of the vehicle (2) are controlled in such a way that they are operated alternately. Computer program product comprising execution instructions which, when the program is executed by a control device (1) according to any one of claims 1 to 5, cause the control device to execute a method according to claim 9.

Images