Method and device for unlocking locking function of control device

Abstract

According to the invention, the technology disclosed herein relates to a device (101) for unlocking at least one function of a control device (111) of a vehicle (100), the function being designed according to a specific ASIL level. The device (101) is designed to determine that a component is damaged during operation of the vehicle (100) and to determine that a function of the control device (111) has been locked as a safety response thereto. The device (101) is further designed to determine that a check of the locked function of the control device (111) is to be carried out and to cause a check program stored on a memory unit (102) of the vehicle (100) to be carried out in order to check the function of the control device (111), the check program and the memory unit (102) being designed at least according to a specific ASIL level. The device (101) is further designed to unlock a function of the control device (111) as a function of a result of the checking procedure.

Description

Technical Field

[0001] The technology disclosed herein relates to a method and a corresponding device, which are designed to enable and / or unlock in an efficient and secure manner a function of a vehicle's control device that has been locked due to a functional failure of a vehicle component. Background Art

[0002] Vehicles generally include a large number of different safety-related components. Safety-related components (such as valves of a vehicle's pressure vessel) can be operated by the vehicle's control device. A malfunction of a component or a malfunction of a component associated therewith (such as a sensor) can cause the control device of the component or at least one or more functions of the control device to be locked in order to reliably prevent further use of the safety-related component.

[0003] Safety-related components and control devices for safety-related components are generally designed according to the Automotive Safety Integrity Level (ASIL), ISO 26262, for example, designed according to ASIL B or ASIL D. Therefore, it is generally required to check the locked control device or the locked function of the control device according to the corresponding ASIL level after replacing or repairing the damaged component, and then the control device or the function of the control device can be re-enabled for further use. Summary of the Invention

[0004] A preferred task of the technology disclosed herein is to reduce or eliminate at least one disadvantage of previously known solutions or to propose an alternative solution. A preferred task of the technology disclosed herein is to be able to achieve an efficient and functionally safe enabling of a locked control device of a vehicle or a locked function of a control device.

[0005] The above task is solved by the subject matter of the independent patent claims. The dependent claims constitute preferred embodiments.

[0006] According to one aspect, a device for unlocking at least one function of a control device of a (motor) vehicle is described, wherein the function is designed according to a specific ASIL level (such as ASIL A, B, C or D). The function of the control device can be associated with a (possibly safety-related) component of the vehicle (such as the operation of the component, in particular the control), wherein the component is also designed according to a specific ASIL level. The component can be part of a pressure vessel system for storing fuel (such as hydrogen, in particular H2) for operating the vehicle. The component can be, for example, a valve of a pressure vessel of the pressure vessel system.

[0007] During the operation of a vehicle, components or components associated therewith (e.g., sensors, actuators, cables, etc.) can become damaged. The damage can cause the functions of the control device to be locked (as a safety response), e.g., in order to prevent further operation of the component.

[0008] The device can be, for example, part of the central control device of the vehicle. Alternatively or additionally, the device can be designed at least according to a specific ASIL level.

[0009] The device is configured to determine that an inspection of the (locked) function of the control device is to be performed. An inspection of the function of the control device can be initiated, for example, after a repair or after replacing a damaged component and / or damaged component of the vehicle to eliminate the locking of the function of the control device.

[0010] The device can be set to receive a control signal via a data interface (e.g., via the vehicle's OBD (On-Board Diagnostic) interface). The vehicle's data interface is generally not designed according to a specific ASIL level (but only according to a lower ASIL level or without an ASIL level). The vehicle's data interface can be designed in particular according to a QM (Quality Management) level.

[0011] Based on the control signal received via the data interface, it can be reliably determined that an inspection of the function of the control device is to be performed. Thus, it is possible to initiate an inspection of the locked function via the vehicle's data interface (e.g., after repairing or replacing a damaged component that has caused function locking).

[0012] The device can be configured to check whether a component or component (which has caused the function locking of the control device and / or which has been damaged) has been repaired or replaced. If necessary, an inspection of the function of the control device can be determined in response to a (positive) inspection. Thus, a particularly reliable unlocking of the function of the control device can be caused.

[0013] The device is also set to cause an inspection program stored on the vehicle's storage unit to be executed to inspect the function of the control device and / or to inspect one or more components (in particular sensors and / or actuators) that interact with the control device and / or the component and that may have caused the control device to lock. Here, preferably, the inspection program and / or the storage unit are designed at least according to a specific ASIL level.

[0014] The inspection program can be configured to:

[0015] · Perform at least one current and / or voltage measurement at at least one connection of the control device, in particular at at least one connection to a vehicle component and / or to a component that has caused the function locking of the control device;

[0016] · Check at least one measured value of at least one sensor of the control device, in particular of at least one sensor on a component and / or on a structural member;

[0017] · Check the availability of at least one sensor of the control device, in particular of sensors on a component and / or on a structural member; and / or

[0018] · Check the availability of the interface to the actuator of the control device, in particular to the actuator of a component.

[0019] One or more checks can thus be carried out within the scope of the checking program. If the one or more checks are successful, a positive result for unlocking the locked function of the control device can be provided by the checking program.

[0020] The device is also set to unlock the function of the control device according to the result of the checking program. Here, if the checking program provides a positive result, the function can be unlocked. On the other hand, unlocking of the function can be blocked. In addition, a fault message can be issued (for example via a user interface) in this case.

[0021] A device (and a corresponding method) is thus described which enables at least one locked function of a control device for controlling safety-relevant components of a vehicle to be unlocked efficiently and with functional safety.

[0022] The checking program can be configured to check a plurality of different locked functions of the control device in order to enable efficient unlocking of a plurality (possibly all locked) functions of the control device.

[0023] Alternatively or additionally, the device can be set to respectively identify a function-specific checking program for a plurality of different locked functions of the control device, where the function-specific checking programs are preferably designed respectively at least according to specific ASIL levels, and / or where the function-specific checking programs are preferably stored respectively on a storage unit of the vehicle.

[0024] To unlock a function, execution of a function-specific checking program can be initiated. In addition, the individual functions of the control device can be unlocked according to the result of the corresponding function-specific checking program. By providing function-specific checking programs, particularly reliable and safe unlocking of the individual functions can be achieved.

[0025] The device can be set to check one or more conditions for executing a checking program for unlocking the function of the control device. In addition, execution of the checking program can be initiated (only if necessary) when one or more conditions are met. The one or more conditions can include:

[0026] · Conditions relating to the maximum allowable frequency for executing the checking program; and / or

[0027] · Conditions related to the required restart of the vehicle and / or the control device before executing the inspection program; and / or

[0028] · Conditions related to the minimum duration required between successive consecutive executions of the inspection program.

[0029] By considering one or more conditions for executing the inspection program, the reliability of enabling the functions of the control device can be further improved.

[0030] According to another aspect, a (road) motor vehicle (in particular a passenger car or a truck or a bus or a motorcycle) is described, which includes the device described herein.

[0031] According to another aspect, a method for unlocking at least one function of a control device of a (motor) vehicle is described, wherein the function is designed according to a specific ASIL level. The method includes: determining to perform an inspection of the function of the control device, and causing an inspection program stored on a storage unit of the vehicle to be executed to inspect the function of the control device. The method further includes unlocking the function of the control device according to the result of the inspection program. After unlocking, the function of the control device can be used, for example, to operate (safety-related) components of the vehicle.

[0032] According to another aspect, a software (SW) program is described. The SW program can be set to be executed on a processor and thereby execute the method described herein.

[0033] According to another aspect, a storage medium is described. The storage medium can include a software program, which is set to be executed on a processor and thereby execute the method described herein.

[0034] It should be noted that the methods, devices and systems described herein can be used alone or in combination with other methods, devices and systems described herein. In addition, any aspects of the methods, devices and systems described herein can be combined with each other in various ways. In particular, the features of the claims can be combined with each other in various ways. In addition, the features listed in parentheses should be understood as optional features. Description of the Drawings

[0035] The present invention is described in more detail with the aid of embodiments. Here

[0036] Figure 1 Exemplary components of the vehicle are shown; and

[0037] Figure 2 A flowchart showing an exemplary method for enabling a locked control device and / or a locked function of a control device of a vehicle is shown. Detailed implementation manners

[0038] As explained at the beginning, the present disclosure relates to the safe and efficient unlocking of a control device for a vehicle. In this regard, Figure 1 An exemplary vehicle 100 is shown, which includes a pressure vessel system having a pressure vessel 110 and a valve 113. The pressure vessel 110 may be configured to store fuel (such as hydrogen). The valve 113 may be opened to direct fuel from the pressure vessel 110 to an energy converter 112, particularly to a fuel cell stack. The energy converter 112 may be arranged to generate electrical energy for operating a drive motor (not shown) of the vehicle 100 based on the fuel.

[0039] The valve 113 may be controlled by a control device 111 of the vehicle 100, particularly by a function of the control device 111 of the vehicle 100, for example to open or close the valve 113 as needed, adjust the opening degree of the valve 113, and / or determine the state of the valve 113.

[0040] The valve 113 is an example of a safety-related component of the vehicle 100, which is typically designed according to a specific ASIL level (such as ASIL B or ASIL D). The control device 111 for controlling the valve 113 typically has the same ASIL level. The aspects described herein in connection with the valve 113 may be generally applicable to (safety-related) vehicle components.

[0041] During operation of the vehicle 100, a defect in the line between the pressure vessel 110 and the energy converter 112 may be identified if necessary. The line leading away from the pressure vessel 110 may be considered a component associated with the valve 113 (as a safety-related component). In response thereto, the valve 113 may be caused to be permanently closed (as a safety response). In addition, the control device 111 of the valve 113, particularly the function of the control device 111 for controlling the valve 113, may be caused to be permanently locked to prevent further manipulation of the valve 113.

[0042] The faulty line (i.e., the damaged component) may be replaced or repaired in a workshop. In addition, the locked control device 111 needs to be re-enabled. To ensure the safe operation of the repaired pressure vessel system and the control device 111, an inspection of the pressure vessel system and the control device 111 may be performed (e.g., by workshop personnel) before enabling the control device 111. For this purpose, an inspection device (such as a PC and / or test equipment) may be connected to a (control) device 101 of the vehicle 100, such as a central control device, via a (data) interface 103 of the vehicle 100 (e.g., via an OBD (on-board diagnostic) interface). Then, an inspection program may be executed on the inspection device to inspect the locked control device 111 and the repaired pressure vessel system.

[0043] The (data) interface 103 of the vehicle 100 usually has a functional safety level that is lower than that of the safety-related component 113 and the locked control device 111. For example, the (data) interface 103 can be designed only according to QM (quality management) if necessary. Therefore, it is generally not possible to perform checks that meet the functional safety requirements, especially the ASIL level requirements, of the safety-related component 113 and the locked control device 111 via the (data) interface 103.

[0044] The vehicle 100 can have a storage unit 102 designed according to the ASIL level of the safety-related component 113 and the locked control device 111. The inspection (software) program developed according to the same ASIL level can be stored on the storage unit 102. In order to enable the locked control device 111 to cause the inspection program stored on the storage unit 102 to be executed to check the component 113, one or more other components (such as sensors and / or actuators) around the component 113 (which are necessary for the safe operation of the component 113) and / or the control device 111. After a successful inspection, the locked control device 111 can be enabled so that the operation of the component 113 can be realized. The execution of the inspection program can be initiated via the (data) interface 103 (for example, by a control signal).

[0045] As explained at the beginning, due to the triggering of irreversible safety functions on the control device 111, one or more associated functions can be irreversibly locked by the control device 111 (such as the manipulation of the safety-related component 113). This means that, for safety reasons, the one or more functions are locked until one or more countermeasures are executed (for example, the repair of the component 113 or other damaged components by the workshop) and cannot be restored, for example, by restarting the vehicle, etc.

[0046] After the execution of the one or more countermeasures (such as the repair performed by the workshop), the locking of the one or more functions must be reset, which can be performed, for example, via the diagnostic interface 103 of the vehicle 100. However, the diagnostic interface 103 is generally not developed according to ISO 26262 and therefore generally only meets the QM standard, so that the diagnostic interface 103 cannot affect the safety functions within the meaning of ISO 26262.

[0047] The use of a "re-verification function" is described herein, which is developed at least using the triggering according to ISO 26262 and the integrity of the function to be unlocked. The re-verification and / or inspection function (already stored in the vehicle 100) can be activated via the QM diagnostic interface 103. If the results of all tests are positive, the system, especially the control device 111 with the one or more locked functions, can be re-unlocked.

[0048] All locks related to functional safety aspects of the control device 111 can be re-verified. Alternatively or additionally, specific re-verifications can be performed for each individual lock. If necessary, a time-limited frequency for invoking the re-verification and / or checking function can be set (e.g., only once within 2 hours, and / or only once until the control device 111 is restarted, etc.).

[0049] Possible test criteria for the re-verification and / or checking procedure are:

[0050] · The availability of one or more sensor signals;

[0051] · The availability of one or more interfaces to one or more actuators;

[0052] · Internal functional testing of the control device 111;

[0053] · One or more current and / or voltage measurements at one or more connections of the control device 111; and / or

[0054] · Testing of one or more sensor measurements (e.g., pressure, temperature, H2 concentration, etc.).

[0055] Figure 2 A flowchart of a method 200 (optionally computer-implemented) for unlocking and / or enabling at least one function of the control device 111 of the vehicle 100 is shown, wherein the function and / or the control device 111 are designed according to a specific ASIL level (e.g., ASIL A, ASIL B, ASIL C, or ASIL D). The method 200 can be executed on the device 101 of the vehicle 100, wherein the device 101 is preferably designed at least according to a specific ASIL level.

[0056] The locked functions of the control device 111 can be set to operate and / or control safety-related components 113 of the vehicle 100 (which are designed according to a specific ASIL level). The functions of the control device 111 can be locked due to damage to the safety-related components 113 or due to damage to components associated with the components 113 (such as sensors, actuators, or lines).

[0057] The method 200 includes determining 201 that a check of the functions of the control device 111 is to be performed. In particular, it can be determined that a control signal is received via the data interface 103 of the vehicle 100, which indicates that the locked functions of the control device 111 should be checked in order to unlock the functions.

[0058] Furthermore, method 200 includes causing 202 an inspection program stored on storage unit 102 of vehicle 100 to be executed to check the functionality of control device 111. Here, the inspection program and / or storage unit 102 are preferably designed at least according to a specific ASIL level (or according to a higher ASIL level).

[0059] Method 200 further includes enabling and / or unlocking 203 the functionality of control device 111 based on the results of the inspection program. The inspection program can perform one or more tests and / or inspections, which are designed to check the correct functionality of the locked functionality of control device 111 and / or safety-related component 113. If the one or more tests and / or inspections are successful, the inspection program can indicate that the functionality of control device 111 can be enabled and / or unlocked as a positive result. Then, the enabling and / or unlocking of the functionality of control device 111 can be caused.

[0060] The measures described herein can cause an efficient and functionally safe unlocking of control device 111 of vehicle 100.

[0061] The present invention is not limited to the illustrated embodiments. In particular, it should be noted that the description and the drawings are only intended to exemplarily illustrate the principles of the proposed methods, devices, and systems.

[0062] List of reference numerals

[0063] 100 Vehicle

[0064] 101 (Control) device

[0065] 102 Storage unit

[0066] 103 Interface

[0067] 110 Pressure vessel

[0068] 111 Control device

[0069] 112 Energy converter (fuel cell stack)

[0070] 113 Valve

[0071] 200 Method for enabling a locked control device

[0072] 201 - 203 Method steps

Claims

1. A device (101) for unlocking at least one function of a control device (111) of a vehicle (100); wherein, The described function is designed according to a specific ASIL level; wherein, the function of the control device (111) is associated with the safety-related component (113) of the vehicle (100), and the safety-related component is designed according to the specific ASIL level; wherein, the device (101) is configured to - determine that a component associated with the component (113) is damaged during operation of the vehicle (100), and determine that the function of the control device (111) has been locked as a safety response thereto; - determine to perform an inspection of the locked function of the control device (111); - cause an inspection program stored in the storage unit (102) of the vehicle (100) to be executed to inspect the function of the control device (111); wherein, the inspection program and the storage unit (102) are designed at least according to the specific ASIL level; and - unlock the function of the control device (111) according to the result of the inspection program.

2. The device (101) according to claim 1, wherein, The device (101) is arranged to - receive a control signal via the data interface (103) of the vehicle (100); and - determine to perform an inspection of the function of the control device (111) based on the control signal.

3. The device (101) according to claim 2, wherein, - the data interface (103) of the vehicle (100) is not designed according to the specific ASIL level; and / or - the data interface (103) of the vehicle (100) is designed according to the QM level.

4. The device (101) according to one of the preceding claims, wherein, The device (101) is configured to - check whether the damaged component has been repaired or replaced; and - determine to perform an inspection of the function of the control device (111) in response thereto.

5. The device (101) according to one of the preceding claims, wherein, The inspection program is configured to - perform current and / or voltage measurements at the connection part of the control device (111), especially at the connection part with the safety-related component (113) of the vehicle (100); - check the measured values of the sensors of the control device (111), especially the sensors on the safety-related component (113); - check the availability of the sensors of the control device (111), especially the sensors on the safety-related component (113); and / or - check the availability of the interface with the actuator of the control device (111), especially with the actuator of the safety-related component (113).

6. The device (101) according to one of the preceding claims, wherein, The inspection program is configured to inspect a plurality of different locked functions of the control device (111).

7. The device (101) according to one of the preceding claims, wherein, The device (101) is arranged to - respectively identify function-specific inspection programs for a plurality of different locked functions of the control device (111); wherein, the function-specific inspection programs are respectively designed at least according to the specific ASIL level; - cause the function-specific inspection programs to be executed; and - unlock each function of the control device (111) according to the result of the corresponding function-specific inspection program.

8. The device (101) according to one of the preceding claims, wherein, - The device (101) is arranged to - check one or more conditions for performing the checking procedure; and - cause the checking procedure to be executed when the one or more conditions are met; and - the one or more conditions particularly include - a condition related to the maximum allowable frequency for performing the checking procedure; and / or - a condition related to the required restart of the vehicle (100) and / or the control device (111) before performing the checking procedure; and / or - a condition related to the required minimum duration between successive consecutive executions of the checking procedure.

9. The device (101) according to one of the preceding claims, wherein, The safety - related component (113) is part of a pressure - vessel system for storing the fuel for operating the vehicle (100).

10. The device (101) according to one of the preceding claims, wherein, The device (101) is designed at least according to the specific ASIL level.

11. A method (200) for unlocking at least one function of a control device (111) of a vehicle (100); wherein, The function is designed according to a specific ASIL level; wherein, the function of the control device (111) is associated with the safety - related component (113) of the vehicle (100), and the safety - related component is designed according to the specific ASIL level; wherein, the method (200) includes: - determining that a component associated with the component (113) is damaged during operation of the vehicle (100), and determining that the function of the control device (111) has been locked as a safety response thereto; - determining (201) that an inspection of the locked function of the control device (111) is to be performed; - causing (202) a checking procedure stored on the storage unit (102) of the vehicle (100) to be executed to check the function of the control device (111); wherein, the checking procedure and the storage unit (102) are designed at least according to the specific ASIL level; and - unlocking (203) the function of the control device (111) according to the result of the checking procedure.

Images