Method for verifying plausibility of parameter

Abstract

The invention relates to a method for verifying the plausibility of a parameter included in the operation of a vehicle system of a motor vehicle, in which a parameter detected by a first sensor is verified by means of a second sensor which also detects the parameter in such a way that the parameter is detected by the second sensor. A first sensor signal (n (S1)) of the first sensor is checked with a second sensor signal (n (S2)) of the second sensor. In order to design a plausibility verification as reliably as possible, a difference signal ([delta] n) is formed between the first sensor signal (n (S1)) and the second sensor signal (n (S2)) and is compared with at least one threshold value (thd1, thd2). Here, if the difference signal ([delta] n) continuously exceeds the at least one threshold value (thd1, thd2) longer than the duration (tft1, tft2) each assigned to the at least one threshold value (thd1, thd2), a measure is carried out.

Description

Field of the Invention

[0001] The present invention relates to a method for verifying the credibility of parameters incorporated into the operation of a vehicle system in a motor vehicle, wherein the parameters detected by a first sensor are verified for credibility with a second sensor that also detects the parameter in such a way that the first sensor signal of the first sensor is checked with the second sensor signal of the second sensor. Furthermore, the present invention also relates to a controller, a computer program product, and a data carrier. Background Art

[0002] In motor vehicles, vehicle systems are usually provided to support the vehicle driver during the corresponding motor vehicle operation. The vehicle systems also partially intervene in the original operation as safety systems in order to avoid critical operating conditions by implementing safety functions or to ensure the safe operation of the motor vehicle in case of a failure. The adjustment or control of such safety functions mostly occurs based on parameters detected via the corresponding sensors of the motor vehicle. However, since sensors can also fail or convey incorrect information, which may correspondingly also cause the corresponding safety functions to be incorrectly implemented, the reliable operation of the sensors must also be monitored during the operation of the safety system of the motor vehicle.

[0003] A method for verifying the credibility of parameters is known from DE 10 2005 048 015 A1, wherein this method can be used in vehicle systems of motor vehicles, such as in ESP systems, airbag systems, driver assistance systems (ACC) or similar systems. It is hereby known that parameters required for controlling or adjusting the corresponding functions of the vehicle system are obtained, and in DE 10 2005 048 015 A1, a redundant monitoring method is also described as a feasible solution, under which the sensor signal of a sensor is checked with another sensor signal. Summary of the Invention

[0004] Based on the aforementioned prior art, the present task of the invention is to verify the credibility of parameters in the simplest and at the same time reliable way and method.

[0005] This task is solved from a method-technical perspective based on the preamble of claim 1 in combination with its distinguishing features. The following dependent claims respectively reproduce advantageous improvement solutions of the present invention. Furthermore, the controller that can be used to execute the aforementioned method is the subject matter of claims 8 and 9. In addition, claim 10 relates to a computer program product and claim 11 relates to a data carrier.

[0006] According to the invention, in a method, the credibility of parameters incorporated in the operation of a vehicle system of a motor vehicle is verified. Here, the parameters detected by a first sensor are verified for credibility with a second sensor that also detects the parameter, that is, the first sensor signal of the first sensor is checked with the second sensor signal of the second sensor.

[0007] Within the scope of the method according to the invention, the parameter is detected via the first sensor and the second sensor respectively, where the parameter is determined by the first sensor signal of the first sensor and its credibility is verified using the second sensor. For credibility verification, the first sensor signal of the first sensor is checked with the second sensor signal of the second sensor.

[0008] Both of the two sensors are used to directly detect the parameter, where these detections are preferably carried out independently of each other for credibility verification. For this purpose, the two sensors are particularly arranged in respective regions, for example, both are directly arranged at a component that can directly detect the parameter.

[0009] The invention now includes the following technical teaching, that is, the check is carried out in such a way that a difference signal is formed between the first sensor signal and the second sensor signal and compared with at least one threshold. In addition, when the difference signal continuously exceeds the at least one threshold for a duration assigned to the at least one threshold, measures are taken. In other words, the check of the first sensor signal with the second sensor signal is implemented by generating a signal that is the difference between the first sensor signal of the first sensor and the second sensor signal of the second sensor, where then the difference signal is compared with at least one threshold. If the difference signal exceeds at least one threshold, then in the case of continuous exceeding and respectively after the expiration of the duration related to the threshold, measures are initiated.

[0010] The advantage of the method according to the invention here is that the plausibility verification of the parameters can be carried out in a simple and at the same time reliable manner. Since by forming a difference signal and comparing this difference signal with at least one threshold value, it can be checked whether there is a deviation in magnitude between the detection of the parameter via the first sensor and the detection of the parameter via the second sensor, and this deviation can infer an inconsistency during detection, such as a measurement error or even damage to the sensor or damage to the cable. However, even if the difference signal exceeds at least one threshold value, the measure is only activated when the at least one threshold value is continuously exceeded for a duration that is respectively predefined for the at least one threshold value. This can prevent, for example, a false inference of an error in parameter detection and thus the execution of a measure due to possibly inevitable differences in the sensor signals caused by signal tolerances, reading delays, etc. Therefore, the corresponding duration represents the filtering time that needs to elapse.

[0011] According to an embodiment of the invention, the difference signal is compared with a first threshold value and a second threshold value, wherein the measure is executed when the difference signal continuously exceeds the first threshold value for a first duration assigned to the first threshold value or continuously exceeds the second threshold value for a second duration assigned to the second threshold value. In this way, the different conditions for activating the measure can be defined in an advantageous manner by assigning respectively matched threshold values to the respective conditions, each having a matched duration.

[0012] In an improvement of the foregoing embodiment, the second threshold value is selected to be greater than the first threshold value and the first duration is selected to be greater than the second duration. In this way, the smaller deviations between the sensor signals can be defined as the reason for executing the measure with the aid of the first threshold value and the first duration, where these deviations must persist for a longer time here. With the aid of the second threshold value and the associated second duration, when a larger deviation between the sensor signals is detected, the execution of the measure can likewise be achieved, where, compared with the first threshold value and the first duration, these larger deviations do not have to persist for such a long time. In this way, for example, damage to the cable can be detected.

[0013] As an alternative or supplement to the foregoing improvement, the comparison of the difference signal with the first threshold value and the second threshold value is carried out in parallel with each other. The advantage of this is that the measure is directly activated when either of the thresholds is continuously exceeded for a corresponding long time. But as an alternative to this, the comparison can also be carried out successively, i.e., first the comparison of the difference signal with the first threshold value or first the comparison of the difference signal with the second threshold value.

[0014] According to a feasible design of the present invention, as a measure to generate requirements for emergency operation, safe operation of a motor vehicle is implemented during emergency operation. If it is detected that a difference signal continuously exceeds the at least one threshold for a duration longer than the duration assigned to each of the at least one threshold, then an emergency operation is entered. During the emergency operation, safe operation of the motor vehicle is ensured in any case. This can ensure that inconsistencies or errors in detecting parameters will not lead to unsafe driving conditions of the motor vehicle that may occur due to corresponding regulation or control in any case. The emergency operation is particularly preferably equivalent to the following operation of the motor vehicle, in which the motor vehicle also enters the emergency operation when at least one safety function of the vehicle system is triggered. In particular, during the emergency operation, the driving torque of the drive of the motor vehicle is set to zero here, so that further propulsion of the motor vehicle via this drive is interrupted since the emergency operation is started.

[0015] In an improved embodiment of the present invention, the rotational speed, preferably the driving rotational speed of the drive of the motor vehicle, is determined as a parameter. In this regard, within the scope of the method according to the present invention, the credibility verification of this rotational speed detected in parallel by two sensors is carried out, and then at least one function of the vehicle system can be controlled or regulated based on this rotational speed. In particular, the detected rotational speed is used here to control or regulate at least one safety function of the safety system of the motor vehicle in the form of a work machine.

[0016] The parameter that has passed the credibility verification is incorporated into the operation of the vehicle system in particular by the fact that this parameter is used to regulate or control at least one function of the safety system. The vehicle system particularly relates to the safety system of the motor vehicle here. Via the safety system, safety-related tasks can be implemented in the form of at least one safety function in order to support the vehicle driver when driving the motor vehicle and to avoid critical safety driving conditions.

[0017] The motor vehicle preferably relates to a work vehicle and particularly relates to construction machinery here, such as a wheel loader. Here, safety functions in the form of a function for preventing unwanted starting, a function for preventing unwanted starting in the wrong driving direction, and / or a function for preventing unwanted deceleration are particularly realized via the vehicle system that preferably exists as a safety system.

[0018] Furthermore, the subject of the invention is a controller, which in particular relates to a transmission controller. Here, the controller is set up to learn parameters that can be incorporated into the operation of a vehicle system. The controller is designed to detect a parameter via a first sensor and to verify the plausibility of the parameter via a second sensor that also detects the parameter, for which the controller checks a first sensor signal of the first sensor with a second sensor signal of the second sensor in the following manner, i.e., the controller forms a difference signal between the first sensor signal and the second sensor signal and compares it with at least one threshold value. Furthermore, the controller is also set up to execute measures when the difference signal continuously exceeds the at least one threshold value for a duration longer than that assigned to the at least one threshold value. Furthermore, the controller can also be set up to implement one or more of the aforementioned variants of the method for operating a transmission adjustment system according to the invention.

[0019] The method according to the present invention can also be embodied as a computer program product. When the computer program product is run on a processor, such as the processor of the aforementioned controller, the computer program product instructs the processor to execute the associated method steps according to the present invention in a software manner. In this context, a computer-readable medium also belongs to the subject matter of the present invention, on which the aforementioned computer program product is stored in a callable manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The advantageous embodiment of the invention to be explained below is shown in the accompanying drawings. In the drawings:

[0021] Figure 1 A schematic view of a vehicle system is shown;

[0022] Figure 2 Shows Figure 1 a schematic diagram of a portion of a vehicle system;

[0023] Figure 3 A flowchart diagram of a method for verifying the credibility of a parameter according to the present invention is shown; and

[0024] Figure 4 Shows Figure 3 Graph of an exemplary profile of a difference signal of the method. DETAILED DESCRIPTION

[0025] Depend on Figure 1 The schematic diagram of a vehicle system 1 is shown, which is preferably provided for use in a motor vehicle in the form of a work vehicle and in this case is particularly provided for a construction machine. The motor vehicle is preferably designed as an electric vehicle and has a drive machine in the form of an electric machine (not shown in detail at this moment), which is particularly provided as an asynchronous machine.

[0026] The vehicle system 1 includes two controllers 2 and 3 and an inverter 4 of an electric motor (not shown), wherein the controllers 2 and 3 and the inverter 4 are connected to each other in the bus system (CAN bus) of a motor vehicle. The controller 2 is related to a vehicle calculator (VCU) here, and different functions 5 of the motor vehicle can be controlled or adjusted via the vehicle calculator respectively. For this purpose, the controller 2 is particularly supplied with information about the respective travel pedal positions of the accelerator pedal 6 and the brake pedal 7 and information about the selection of the travel direction at the travel direction switch 8.

[0027] The controller 3 exists as a transmission controller of the motor vehicle transmission (not further shown at present) of the motor vehicle, wherein the controller 3 is also supplied with information about the travel pedal position and the selection of the travel direction by the controller 2 within the data bus system. On the one hand, the controller 3 uses this information to adjust and control the transmission function 9, wherein the controller 3 also accesses the inverter 4 within the data bus system in order to let the electric motor adjust the respectively required target torque. On the other hand, the controller 3 and the inverter 4 together form a safety system 10, and different safety functions of the motor vehicle can be realized by means of the safety system. Whether for controlling or adjusting the transmission function 9 or for the safety function, the current drive speed n of the electric motor is informed to the controller 3 as a parameter from the inverter 4 side. This drive speed n is obtained independently of each other by two sensors (not shown at present) at the electric motor here and is conveyed to the controller 3 in the form of two sensor signals n(S1) and n(S2) as separate messages, and the sensor signals exist as speed signals respectively.

[0028] In Figure 2 is now schematically shown separately the safety system 10 formed by the controller 3 and the inverter 4 of the vehicle system 1. Within the safety system 10, the current drive speed n is determined from the sensor signal n(S1) and is used within the scope of different safety functions 11 to 14. Here, these safety functions 11 to 14 are specifically related to functions such as preventing the motor vehicle from starting unexpectedly, preventing the motor vehicle from starting in an unexpected wrong travel direction, preventing the motor vehicle from decelerating unexpectedly, etc. If a safety-related event is detected by the controller 3 in one of the safety functions 11 to 14, then the controller 3 will generate a requirement 15 for the emergency operation of the motor vehicle. This requirement 15 is forwarded to the inverter 4 in this case in order to set the target torque of the electric motor to zero.

[0029] Within the scope of the check 16, the controller 3 also checks two sensor signals n(S1) and n(S2), where, on the one hand, the respective states of the respective sensor signals n(S1) or n(S2) are checked. This check can be carried out within the scope of a cyclic redundancy check (CRC). If an abnormality is recognized in terms of the state of the respective sensor signal n(S1) or n(S2), then a requirement 15 for emergency operation is also generated and thus emergency operation is initiated on the side of the inverter 4. On the other hand, the two sensor signals n(S1) and n(S2) are compared with each other in order to verify the credibility of the sensor signal n(S1). The latter is carried out within the scope of the method according to the invention, which will now be explained in more detail with the aid of the flow chart showing the method Figure 3 in more detail.

[0030] At the start of the method, first in a first step S1 a difference signal Δn is formed as the difference between the two sensor signals n(S1) and n(S2), where an exemplary curve of the difference signal Δn is shown in a graph Figure 4 versus time t. Immediately afterwards, in steps S2 and S3 in parallel with each other, the difference signal Δn is compared with a respective threshold thd1 or thd2, where the two thresholds thd1 and thd2 are also shown in Figure 4 Here it can also be seen that the threshold thd2 is chosen to be higher than the threshold thd1. If it is detected in step S2 that the difference signal Δn exceeds the threshold thd1, then the process proceeds to step S4, otherwise it jumps back before step S1. Similarly, when it is recognized in step S3 that the difference signal Δn exceeds the threshold thd2, the process also proceeds to step S5 immediately after step S3. If this is not the case during the check, then it also jumps back before step S1 after step S3.

[0031] If it is recognized in step S2 that the threshold thd1 has been exceeded, then in step S4 it is then checked whether the time tÜ1 for which the detected continuous, i.e., uninterrupted, exceeding of the threshold thd1 has lasted is longer than the duration tft1. If not, then it jumps back before step S1 again, otherwise it proceeds to step S6.

[0032] After step S3, when it is detected that the difference signal Δn exceeds the threshold thd2, the process proceeds to step S5, and the time tÜ2 is also obtained, which represents the duration for which the difference signal Δn continuously exceeds the threshold thd2. This time tÜ2 is then compared with the duration tft2 in step S5. When the time tÜ2 exceeds the duration tft2, the process proceeds to step S6; otherwise, it jumps back to before step S1. The duration tft2 is selected to be shorter than the duration tft1 here, so the time tÜ2 required to proceed from step S5 to step S6 is shorter than the time tÜ1.

[0033] If it is detected in the pairs of steps S2 and S4 and S3 and S5 that are carried out in parallel with each other that the difference signal Δn continuously exceeds the respective thresholds thd1 or thd2 for longer than the respectively assigned durations tft1 or tft2, then a relevant deviation between the rotational speed signals n(S1) and n(S2) is detected in step S6 and measures are initiated accordingly. During the course of these measures, a requirement 15 for the emergency operation of the motor vehicle is also generated here and forwarded to the inverter 4, so that the safe operation of the motor vehicle is enabled through step S6.

[0034] With the method according to the invention, a reliable plausibility verification of the parameters can be achieved.

[0035] List of reference signs

[0036] 1 Vehicle system

[0037] 2 Controller

[0038] 3 Controller

[0039] 4 Inverter

[0040] 5 Function

[0041] 6 Accelerator pedal

[0042] 7 Brake pedal

[0043] 8 Travel direction switch

[0044] 9 Transmission function

[0045] 10 Safety system

[0046] 11 Safety function

[0047] 12 Safety function

[0048] 13 Safety function

[0049] 14 Safety function

[0050] 15 Requirement for emergency operation

[0051] 16 Inspection

[0052] n Drive speed

[0053] n(S1) Sensor signal

[0054] n(S2) Sensor signal

[0055] Δn Difference signal

[0056] t Time

[0057] thd1 Threshold

[0058] thd2 Threshold

[0059] tÜ1 Time

[0060] tÜ2 Time

[0061] tft1 Duration

[0062] tft2 Duration

[0063] S1 to S6 Individual steps

Claims

1. A method for verifying the credibility of parameters incorporated in the operation of a vehicle system (1) of a motor vehicle, wherein, The parameter detected by the first sensor is plausibility-verified by means of a second sensor which also detects the parameter, i.e., the first sensor signal (n(S1)) of the first sensor is checked using the second sensor signal (n(S2)) of the second sensor, characterized in that the check (16) is carried out in such a way that a difference signal (Δn) is formed between the first sensor signal (n(S1)) and the second sensor signal (n(S2)) and the difference signal is compared with at least one threshold (thd1, thd2), and a measure is carried out when the difference signal (Δn) continuously exceeds the at least one threshold (thd1, thd2) for a duration (tft1, tft2) respectively assigned to the at least one threshold (thd1, thd2).

2. The method according to claim 1, wherein The difference signal (Δn) is compared with a first threshold (thd1) and a second threshold (thd2), wherein a measure is carried out when the difference signal (Δn) continuously exceeds the first threshold (thd1) for a first duration (tft1) assigned to the first threshold (thd1) or continuously exceeds the second threshold (thd2) for a second duration (tft2) assigned to the second threshold (thd2).

3. The method according to claim 2, wherein The second threshold (thd2) is selected to be greater than the first threshold (thd1), and the first duration (tft1) is selected to be greater than the second duration (tft2).

4. The method according to claim 2 or claim 3, characterized in that, The comparison of the difference signal (Δn) with the first threshold (thd1) and the second threshold (thd2) is carried out in parallel with each other.

5. The method according to any one of the preceding claims, characterized in that, As a measure, a requirement for emergency operation (15) is generated, and the safe operation of the motor vehicle is carried out during the emergency operation.

6. The method according to any one of the preceding claims, characterized in that, The rotational speed, preferably the drive rotational speed (n) of the drive of the motor vehicle, is determined as a parameter.

7. The method according to any one of the preceding claims, characterized in that, The parameter is incorporated into the adjustment or control of at least one function of the vehicle system (1), preferably at least one safety function (11, 12, 13, 14) of the safety system (10) of the vehicle system (1).

8. A controller (3), in particular a transmission controller, which is set up to detect parameters that can be incorporated into the operation of a vehicle system (1), wherein, The controller (3) is designed to detect the parameter via a first sensor and to verify the credibility of the parameter via a second sensor that also detects the parameter. To this end, the controller (3) checks the first sensor signal (n(S1)) of the first sensor with the second sensor signal (n(S2)) of the second sensor in such a way that the controller (3) forms a difference signal (Δn) between the first sensor signal (n(S1)) and the second sensor signal (n(S2)) and compares it with at least one threshold (thd1, thd2), and wherein the controller (3) is set up to execute measures when the difference signal (Δn) continuously exceeds the at least one threshold (thd1, thd2) for a duration (tft1, tft2) assigned to the at least one threshold (thd1, thd2).

9. The controller (3) according to claim 8, furthermore, the controller is also set up to execute the method according to any one or more of claims 2 to 7.

10. A computer program product for a controller (3) according to claim 8 or 9, which can execute the method according to any one or more of claims 1 to 7 by means of the controller, wherein, The routine for performing the credibility verification is implemented by corresponding control instructions stored in software.

11. A data carrier having the computer program product according to claim 10.

Images