Method for monitoring operation of computing unit, computing unit and computer program

Abstract

The invention relates to a method for monitoring the operation of a computing unit (110, 110 ') in a communication network (100), comprising: obtaining a message (R1, R1') via a network connection (140) of the communication network (100) by means of the computing unit (110, 110 '); determining a sender (110, 110 ') of the message (R1, R1') according to the content of the message; and if the determination of the sender indicates that the computing unit (110, 110 '), but the message (R1, R1') is not sent by the computing unit (110, 110 '), a measure is introduced. The invention also relates to a corresponding computing unit.

Description

Technical Field

[0001] The invention relates to a method for monitoring the operation of a computing unit in a communication network, as well as to a computing unit for carrying out the method and to a computer program for carrying out the method. Background Art

[0002] Electric vehicles have different variants, for example with one drive axle (as front-wheel drive or rear-wheel drive) or with multiple drive axles (all-wheel drive). Correspondingly, multiple power electronics may also be required to control the electric motor, which must be coordinated with each other. Typical power electronics have a so-called inverter (as a control device) and a voltage converter. The inverter regulates and monitors the electric motor and ensures that the torque supply and speed control meet the requirements. In addition, the inverter converts the DC voltage of the battery into the AC voltage required by the electric motor. Usually, the electric motor or the inverter is controlled via a data bus, especially CAN. Summary of the invention

[0003] According to the invention, a method for monitoring the operation of a computer unit in a communication network, a computer unit for carrying out the method and a computer program for carrying out the method are proposed, having the features of the independent patent claim. Advantageous embodiments are the subject matter of the dependent claims and the subsequent description.

[0004] The invention proposes a solution with which a computer in a communication network can detect the presence of at least one other computer using the same configuration by monitoring the communication network or its data connections for messages that are alleged to be from the computer even though this is not the case.

[0005] Usually, participants in a communication network can be addressed or located precisely. In CAN communication, for example, it is also precisely specified which participants send which messages and which participants receive which messages. For each message, there is usually exactly one sender and at least one receiver. The present invention makes use of this in order to identify, by analyzing the incoming messages, whether there is a second participant or another computing unit in the communication network that contains the same configuration. If a computing unit receives a message that it has not sent, but the content of the message indicates that the computing unit is the sender, this can be inferred that there is an additional computing unit in the system that is not correctly configured.

[0006] In one embodiment of the invention, the calculation unit provides a common function together with at least one other calculation unit, which function includes, for example, providing a drive torque. According to requirements, in practice, multiple electric motors are used in parallel, in particular for providing high drive torques or torques, and then the operation of these electric motors must be coordinated in a corresponding manner, so that the present invention exerts special advantages in this regard. In one embodiment of the invention, the calculation unit and the at least one other calculation unit are respectively implemented in the power electronics of the electric motor, in particular in the inverter. In another embodiment of the invention, the calculation unit and the at least one other calculation unit are implemented in the control device of the electric motor, for example, in the control device for the window lifter, the central locking, the seat adjustment, etc. In another embodiment of the invention, the calculation unit and the at least one other calculation unit are usually implemented in the control device of the component to be controlled (such as a DC / DC converter, an electric motor, etc.).

[0007] In one embodiment of the invention, the computing unit and the at least one further computing unit are controlled by a higher-level computing unit by means of messages in order to provide the common functionality. The higher-level computing unit can be structurally separate from the aforementioned computing units, such as a so-called vehicle control device (onboard computer (Vehicle Computer) or vehicle control unit (Vehicle Control Unit), VCU); however, the higher-level computing unit can also be structurally integrated into the computing unit or the further computing unit.

[0008] In one embodiment of the invention, the measures include: assuming a safe state and / or causing the further computing unit to assume a safe state. A safe state is understood in particular to be a state that complies with ISO 26262, i.e. a state in which the system no longer poses any danger. The safe state depends on the type of the entire system. For the engine control of a passenger vehicle (Pkw), this may be the "engine off" state, while for the engine control of a small aircraft, this may be the "full throttle" state.

[0009] Depending on the purpose of use, a safe state in an electric vehicle could be, for example: preventing torque demand, notifying the driver, shutting down the HV system, preventing the vehicle from moving at all, for example by activating a parking brake or parking lock, etc.

[0010] As explained, the inverter of the electric motor is a suitable computing unit according to the embodiment of the invention. If in a machine or system (such as a vehicle) multiple inverters are installed (for example one inverter on the front axle and one inverter on the rear axle), which are connected to a higher-level control unit via a data connection, each inverter individually requests or obtains the desired torque via its own message. The definition of which message each inverter "listens" to is programmed into the corresponding component. That is, an inverter designed for the rear axle only listens to messages that are also designed for the rear axle. The corresponding situation applies to the front axle.

[0011] In order to keep the differences in parts small, in practice the same components (e.g. inverters) are often used for different functions, which are ultimately implemented only by different software. These functions can be configured or refreshed accordingly at the end of the production line at the vehicle manufacturer, for example. If incorrect configurations or error deviations occur, for example due to negligence, inadvertent or planned misoperation, for example inverters for different axles are configured with the same information, it can happen that multiple inverters "listen" to the same message. Due to excessive drive torque, this can lead to situations that are not in line with expectations and can also endanger safety. The present invention now proposes a way of how unexpected combinations of components or drive topologies in a vehicle can be identified and safe operation of the vehicle can be ensured. The present invention provides additional safety functions to avoid the formation of configurations that are not desired / planned by the manufacturer.

[0012] In particular, an evaluation is made in a computing unit (e.g. an inverter) as to whether among the received messages there are messages whose sender is said to be this computing unit, but which this computing unit itself has not sent. The presence of the message itself and its content (data as well as rolling counters and checksums) can be used to identify such messages. If this is determined, suitable measures are initiated (by the computing unit), in particular an error message is sent and / or the computing unit or, if appropriate, all computing units participating in the function are switched to a safe state.

[0013] A computing unit according to the invention, for example an inverter, is designed, in particular programmed, to carry out the method according to the invention.

[0014] In particular, when the executed control device is also used for other tasks and thus always exists, the implementation scheme in the form of a computer program or computer program product with a program code for executing all method steps according to the method of the present invention is also advantageous, because this causes particularly low costs. Finally, a machine-readable storage medium is provided, on which a computer program as described above is stored. In particular, storage media or data carriers suitable for providing the computer program are magnetic storage, optical storage and electrical storage, such as hard disks, flash memories, EEPROMs, DVDs and others, etc. It is also feasible to download the program via a computer network (Internet, intranet, etc.). Here, this download can be implemented in a wired manner or in a cable manner or in a wireless manner (for example, via a WLAN network, 3G, 4G, 5G or 6G connection, etc.).

[0015] Further advantages and embodiments of the invention are apparent from the description and the accompanying drawings.

[0016] The invention is schematically illustrated in the drawings based on exemplary embodiments and is described below with reference to the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A communication network with three computing units is shown, all of which are correctly configured.

[0018] Figure 2 A communication network with three computing units is shown, one of which is not configured.

[0019] Figure 3 Shows Figure 2 A communication network in which an embodiment of the present invention is applied. DETAILED DESCRIPTION

[0020] exist Figure 1In FIG. 1 , a communication network 100 on which the present invention can be based is schematically shown. The communication network 100 has three computing units 110, 120, 130 as network participants, which are connected in a data transmission manner via a network connection 140 designed here as a CAN bus. In the example shown, the computing unit 130 acts as a higher-level computing unit in order to control the computing units 110 and 120 to provide a common function, in which various messages N1, ... are exchanged on the CAN bus 140. These messages are illustrated by arrows from or to these computing units. The common function can be, in particular, to operate the electric motor to provide the desired drive torque or torque. In this case, the computing units 110 and 120 are designed, for example, as so-called inverters, and the computing unit 130 is designed, for example, as a so-called vehicle control unit, VCU. However, it should be emphasized that the present invention is applicable to any type of components to be controlled in various forms, such as window lifters, door closing motors, DC / DC converters, etc.

[0021] In order to control the inverters 110 and 120, the vehicle control device 130 sends a message N1 and a message N2, which are respectively addressed to a specific inverter 110 or 120 and contain the target drive torque to be provided for the inverter. Correspondingly, the message N1 is received and processed by the inverter 110, and the message N2 is received and processed by the inverter 120, wherein the feedback message R1 is output by the inverter 110 to the CAN bus 140, and the feedback message R2 is also output by the inverter 120 to the bus, which feedback messages contain, for example, the actual drive torque achieved, and can be received and processed by the vehicle control device 130.

[0022] Now, in Figure 2 , a situation is shown in which, in addition to the inverter 110, a further inverter 110' is connected to the CAN bus 140 as a further computing unit, which, however, due to an incorrect configuration, acts as the same network participant as the inverter 110. Correspondingly, the message N1 is received and output not only by the inverter 110 but also by the inverter 110', so that the total drive torque generated does not correspond to the desired torque. In this case, a critical situation may arise, so that this state should be recognized and prevented. Correspondingly, the inverter 110 outputs a feedback message R1 to the CAN bus 140, and the inverter 110' outputs a feedback message R1' to the bus.

[0023] According to a preferred embodiment of the present invention, Figure 3As shown in , the inverter 110 now recognizes that there is a feedback message R1′ on the CAN bus 140, and the inverter 110′ also recognizes that there is a feedback message R1 on the CAN bus 140. According to the specific embodiment of the invention shown here, the two inverters 110, 110′ are configured to analyze the feedback message R1 or R1′ and determine the sender.

[0024] For example, the message content of the feedback message R1 or R1' can be analyzed, such as the sender address and / or valid data indicating the actual value of the drive torque, for example. As a result, the inverter 110 or 110' can recognize that the corresponding feedback message comes from an inverter with its own CAN configuration, but the corresponding inverter has never sent the message. Therefore, the wrong configuration is identified and measures are introduced, which measures particularly include: adopting a safe state and / or prompting other computing units to adopt a safe state. In particular, for this purpose, corresponding messages can be output to the CAN bus 140 (not shown), which, when received by another computing unit, prompt the other computing unit to adopt a safe state.

Claims

1. A method for monitoring the operation of a computing unit (110, 110') in a communication network (100), the method comprising the following steps performed by the computing unit (110, 110'): Obtaining a message (R1, R1') via a network connection (140) of the communication network (100); Determining the sender (110, 110') of the message (R1, R1') according to the message content; If the determination of the sender indicates the computer unit (110, 110'), but the message (R1, R1') was not sent by the computer unit (110, 110'), measures are initiated.

2. The method according to claim 1, wherein: The measure described is to adopt a safe state.

3. The method according to claim 1 or 2, wherein: The computing unit (110, 110') provides a common function together with at least one other computing unit (110, 110').

4. The method according to claim 3, wherein: The computing unit (110, 110') and the at least one further computing unit (110, 110') are controlled by a higher-level computing unit (130) by means of messages (N1, N2) in order to provide the common functionality.

5. The method according to claim 4, wherein: The computing unit (110, 110') and the at least one further computing unit (110, 110') are each implemented in a power electronics unit of an electric motor, and the common function is to provide a drive torque.

6. The method according to any one of claims 3 to 5, wherein: The measure is to cause the further computing unit (110, 110') to assume a safe state.

7. A method according to any one of the preceding claims, wherein: The message content contains the actual value of the parameter.

8. A method according to any one of the preceding claims, wherein: The network connection (140) is a CAN bus.

9. A method according to any one of the preceding claims, wherein: The communication network (100) is arranged in a vehicle.

10. A computing unit (110, 110') which is configured to carry out all method steps of the method according to any of the preceding claims.

11. A computer program which, when executed on a computing unit (110, 110'), causes the computing unit (110, 110') to execute all method steps of the method according to any one of claims 1 to 9.

12. A machine-readable storage medium having stored thereon the computer program according to claim 11.

Images