Device for switching the functional safety level (asil) depending on the operating mode
By combining decomposed and series or parallel safety devices with a microcontroller, the safety level under vehicle operating conditions is dynamically adjusted, solving the problems of high cost and complexity in existing technologies and achieving low-cost and efficient functional safety protection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- FEP FAHRZEUGELEKTRIK PIRNA GMBH
- Filing Date
- 2024-08-08
- Publication Date
- 2026-06-05
AI Technical Summary
Existing technologies are costly and complex in achieving functional safety level switching under different operating conditions in vehicles, making it difficult to achieve low-cost and efficient safety protection.
By disassembling at least two safety devices or control devices, a higher safety level can be achieved using a lower-level safety device under specific vehicle operating conditions. Through series or parallel coupling and combined with the control of a microcontroller, the functional safety device and auxiliary safety device can be decomposed, and the safety level can be dynamically adjusted.
It enables dynamic adjustment of safety levels under different vehicle operating conditions, reduces costs, improves functional safety levels, and has energy-saving effects.
Smart Images
Figure CN122161739A_ABST
Abstract
Description
[0001] manual:
[0002] The present invention relates to an apparatus and method for switching functional safety levels in a vehicle, depending on the mode of operation.
[0003] For vehicle electronics, control equipment, and electronic systems or components used in safety-critical applications in vehicles, the requirements of ISO 26262 apply. This standard is a specific specification for a series of vehicle functional safety applications. "Functional safety" is often abbreviated as "FuSi" (Functional Safety) or "FuSa" (Functional Safety). With the increasing complexity of software, embedded electronic systems, and technology development, compliance with these requirements of ISO 26262 is essential to prevent damage and avoid recalls or claims for compensation.
[0004] ISO 26262 provides a defined process model for the development and production of a range of vehicles. This ISO standard combines the process model with the required activities, their deliverables (so-called work products), and the methods to be applied to each.
[0005] If safety-related components in a vehicle are affected by such a malfunction, the worst-case scenario could result in death or injury. For example, if the ESP control unit in a motor vehicle unexpectedly triggers full braking while driving smoothly, it could lead to an accident. To minimize the risk of dangerous malfunctions from safety-related electronic systems, active safety mechanisms exist, such as eFuses, to disconnect affected components or devices from the vehicle's electrical grid.
[0006] Users of ISO 26262 include automotive manufacturers, automotive suppliers, and testing organizations. For example, if an automotive manufacturer or supplier wants to develop a safety-related system or component, the client will typically require the application of safety standards such as ISO 26262. To ensure the functional safety of the product, the client will often make requirements, such as demanding the highest safety level at ASIL D.
[0007] ASIL represents a risk assessment scheme. Besides ASIL QM, there are four other ASIL categories: ASIL A, ASIL B, ASIL C, and ASIL D. ASIL D represents the highest safety requirement and correspondingly requires a high level of safety precautions, which consequently increases costs and expenses, making the vehicle more expensive. Especially in safety schemes based on existing technology, the highest ASIL level requires correspondingly complex safety measures and electronic safety devices in the vehicle scheme. In decomposition, both elements must be designed to be redundant in terms of safety objectives. For example, both the main computer and the safety computer must be able to independently switch to a safe state in case of excessive voltage / excessive current / excessive torque / …
[0008] Therefore, the objective of this invention is to overcome the aforementioned drawbacks and provide an improved and low-cost security solution that still meets the required functional safety requirements.
[0009] This task is solved by a combination of features from claim 1 of the patent.
[0010] The core idea of this invention is to achieve specific safety levels, particularly ASIL levels, depending on the vehicle operating conditions and the required safety level.
[0011] This invention takes into account that, during a disconnection operation in the event of a fault, the highest required ASIL level must continue to be ensured in the remaining (undisconnected) power supply lines in the onboard electrical network and the vehicle electrical network. For example, an ASILC level is defined for steering, and an ASIL B level is defined for braking. However, this invention is not limited to these standardized safety levels. In principle, any feature that results in different functional safety levels in a linear or hierarchical manner is suitable for defining such safety levels (e.g., fail-safety).
[0012] The starting point is the requirement for the internal functions of a component or system, the behavior (failure) that poses a danger to the user, and the impact of external interference, which imposes functional requirements on the component or system to transfer it to a safe state.
[0013] In both cases, the severity of the anticipated failure (or the malfunction of the required function) must be assessed. Based on the ASIL classification, measures must be taken to prevent direct harm to the user.
[0014] In existing technologies, electronic fuses are typically installed in the corresponding circuit branches from the energy source (such as a DC / DC converter, battery, or generator) to the respective electrical appliances (such as steering systems, ABS pumps, and small appliances). Different ASIL levels are usually defined for safe power supply and safe disconnection, but these levels must be guaranteed by their respective safety schemes.
[0015] Based on the following requirements, a low-cost, efficient, and reliable security solution (using a microprocessor as appropriate) is desired:
[0016] -Provide safety protection for individual vehicle components up to ASIL D level.
[0017] -Energy saving (especially in standby mode or disabled / off mode)
[0018] -At least equivalent to, or better than, an improvement over known solutions.
[0019] According to the invention, at least two safety devices or two control devices are disassembled to achieve a more complex and, in particular, higher level of security through safety devices of a lower level.
[0020] The concept of decomposition, or "functional decomposition," is well-known to originate from mathematics. It describes the breakdown of complex connections and associations with functional relationships in order to recombine the original "complex" functions. Essentially, functional decomposition simplifies complex layers into less complex ones.
[0021] Therefore, according to the concept of decomposition in the sense of this invention, the required safety level, the corresponding process, and / or its function are specified to be broken down or divided into sub-functions of individual components (safety devices, control devices), and higher complexity requirements (safety requirements) are achieved through their functional interconnection. Functional interconnection specifically means, in addition to auxiliary safety devices, at least activating and deactivating the main safety device, on the one hand, to achieve a higher safety level through interconnection, but on the other hand, to deactivate a safety device (e.g., the main safety device) when not needed.
[0022] Therefore, according to the present invention, a safety device is proposed in which two components (safety device or control device) are coupled in series or in parallel in a circuit to achieve a higher level of safety under a specific vehicle operating state; however, one of the components (safety device or control device) can be deactivated or placed in standby mode by the control device under another vehicle operating state.
[0023] Therefore, according to the present invention, a cascaded safety scheme is used in a variant of the first embodiment. A cascaded arrangement in the sense of the present invention should be understood as the decomposition of at least two different electronic safety devices, in the form of parallel circuits or alternatively series circuits, each with different characteristics. This means that "different" at least implies that the safety devices have non-uniform characteristics, and thus the two safety devices are not identically constructed, but they collectively satisfy a safety requirement that cannot be guaranteed by each safety device alone.
[0024] Another aspect of the invention is that, instead of separating the two safety devices (e.g., replacing two transistors), the two control devices are separated from only one safety device (e.g., a single controllable transistor). For energy saving, one of the two control devices can be shut down. Only one transistor or one electronic safety device (which itself has sufficient fail-safety, such as ASIL C) can then be selectively controlled by the two control devices to achieve a higher level of safety. This, in particular, prevents unwanted heat generation.
[0025] In other words, in the simplest embodiment of the invention, a higher ASIL level, such as C, can be achieved by disassembling a fuse with a lower ASIL level, such as ASIL A (C) and ASIL B (C), and thus the desired higher ASIL C level can be achieved by disassembling, in particular, two different electronic fuses.
[0026] For example, the goal could be to achieve the required functionality during driving operations, which is accomplished through electronic fuses with a lower ASIL rating. Additional vehicle components can then be easily, cost-effectively, and particularly energy-efficiently shut down or placed in standby mode via another electronic fuse.
[0027] Therefore, a series or parallel combination of a functional fuse and an additional basic fuse can reliably solve the required task. The "functional fuse" represents the actual primary fuse. The basic fuse is also referred to below as an auxiliary fuse because it functions as an additional fuse besides the main intelligent fuse when the functional fuse is deactivated. Depending on the vehicle's operating state, the functional fuses can be actively activated, deactivated, or placed in standby mode by the controller when needed for operation. In standby mode, each functional fuse is only conductive in the affected power supply line between the basic fuse and the protected power supply circuit.
[0028] In one conceivable embodiment of the invention, it is specified to combine a “smart” electronic fuse (e.g., a microchip that can be controlled by an external microcontroller) with a “non-smart” electronic fuse, the latter of which does not require controller operation (a simple energy-saving switch).
[0029] In a preferred embodiment of the invention, the specified functional safety device is a “smart” electronic safety device, which in particular has or implements other features and characteristics (such as cable protection, load control, overheat protection, and other functions).
[0030] According to the present invention, a safety device for a vehicle is provided, particularly for achieving a specific safety level according to the vehicle's operating mode, specifically representing a level representing specific functional safety requirements in the vehicle's onboard electrical system. The vehicle's onboard electrical system has multiple electrical devices that operate at different, individual safety levels X-1, X, X+1, X+2, ..., where safety level X+1 is one of multiple hierarchically defined safety levels. The safety device has the following features:
[0031] Option 1: The separation of two separate control devices and a functional safety device (functional fuse) that can be operated independently by each of these control devices, having a sufficiently high ASIL rating, or
[0032] Option 2: Disassembly of two safety devices (functional fuses) and one auxiliary safety device (support fuse).
[0033] Specifically, the following features are specified in option 2:
[0034] a. At least one first electronic safety device F1, having functional safety requirements of class X-1 or X, is arranged in a branch line leading to the relevant protected equipment.
[0035] b. A second electronic safety device F2, connected in series before or in parallel with the first safety device F1 and arranged in the same branch of the line, is used to achieve the functional safety requirements of level X of the relevant equipment.
[0036] c. Wherein, through circuitry and / or a microcontroller, the first electronic safety device F1 or the second electronic safety device F2 can be selectively activated or switched to standby mode to be turned off, thereby achieving or deactivating the desired level of safety according to the operating mode in the vehicle.
[0037] In an advantageous design of the invention, the safety device is configured to achieve a safety level (relative to the highest level of a single component) that is at least one level higher (safety level) than the individual safety level X by means of the decomposition of two safety devices. This also applies to option 1, where, for example, a non-uniform control device with different ASIL levels is used. Here, the safety level is defined by very specific characteristics, such as the ASIL characteristics according to ISO standard ISO 26262, 2nd edition (2018 edition). Therefore, safety levels X-1, X, X+1, X+2 can be defined, for example, according to ISO standard ISO 26262, 2nd edition as follows: A=X-1; B=X, C=X+1, D=X+2.
[0038] Also advantageous is that if the second electronic fuse is a functional fuse (rather than a simple fuse), it may be operable via a microcontroller to provide or activate certain features and / or functions in the vehicle's electrical network. In this way, functions in the vehicle can continue to be powered, while simultaneously achieving energy savings (due to the absence of current). Therefore, cable protection and fuse functions are generally preserved.
[0039] It is particularly advantageous if the second electronic safety device is preferably a microchip with multiple, especially four, channels. Other microchips with other configurations are also conceivable.
[0040] Further preferably, the second electronic safety device provides a conductive connection between the first safety device and the protected equipment when it is in a closed or standby state. This allows for energy savings in certain operating conditions, as higher levels of additional, complex protection are not required at that time. For example, ESP can be disabled in the vehicle's parking function, which is a possible vehicle operation function, while it is required during driving. Other operating conditions require a higher level of protection, in which case the second safety device can be activated.
[0041] Furthermore, it is advantageously stipulated that the second electronic safety device can be turned off (or put into standby) or activated (active safety protection) even in a line branch without current, and in particular, it can be turned off or activated by a microcontroller.
[0042] Therefore, according to an advantageous design of the invention, multiple first and second fuses arranged in series or parallel in a decomposed manner are provided in multiple different line branches in the vehicle electrical network, each leading to a corresponding individually protected device. In this way, complex protection topologies for high ASIL levels can be implemented using fuses with lower ASIL levels.
[0043] In addition to the safety device described above, another aspect of the invention relates to a method of operating such a safety device, wherein at least one or more of the corresponding second safety devices operate in a standby mode in a specific operating state of the vehicle.
[0044] The method is preferably carried out in such a manner that, when the current vehicle operating state changes or switches to another different vehicle operating state, one or more second safety devices switch from an inactive state, particularly from a standby mode, to an active safety mode according to the changed functional safety requirements. More preferably, especially when the required safety level changes due to the switch to another vehicle operating state, the standby state of one or more second safety devices is selectively activated or deactivated, particularly depending on whether a higher or lower safety level needs to be ensured.
[0045] The features disclosed above can be combined arbitrarily, as long as it is technically feasible and they do not contradict each other.
[0046] Other advantageous embodiments of the invention are described in the dependent claims, or are described in more detail below together with the description of preferred embodiments of the invention, with reference to the accompanying drawings.
[0047] Figure 1 A schematic diagram showing the basic functions or basic components of the electronic safety device F;
[0048] Figure 2 A schematic diagram of the components of an electronic safety device F with a controller C is shown;
[0049] Figure 3 A schematic diagram illustrating the possible disassembly options for safe disconnection;
[0050] Figure 4 With Figure 3 The diagram illustrates the possible decomposition methods for safe disconnection, comparing the proposed solution with alternative solutions.
[0051] Figure 5 A schematic diagram illustrating the possible disassembly methods for secure power supply;
[0052] Figure 6 With Figure 5 The diagram illustrates the possible decomposition methods for secure power supply, comparing the proposed solutions with alternative solutions.
[0053] Figure 7 A schematic view illustrating an exemplary basic ASIL requirement for a protection topology in a vehicle.
[0054] The accompanying drawings are illustrative examples. The same reference numerals in each drawing indicate the same functional and / or structural features.
[0055] Figure 1 A schematic diagram illustrating the basic functions or components of the electronic safety device F is shown, particularly its selectable shutdown (standby) capability. State 1 indicates activation, and state 0 indicates selectable deactivation or standby. Figure 2 A schematic diagram illustrates the basic functions or components of an electronic fuse device F with a controller C, specifically for the selective shutdown (standby) of a power switch. State 1 indicates activation, and state 0 indicates optional inactivation or standby. The controller C is used to evaluate and control the power switch (e.g., a transistor). In standby mode, this control becomes inactive to save energy, and the power switch is selectively turned on or off.
[0056] exist Figure 3The left figure shows the following protection, namely the safety level ASIL C for safe disconnection, for example in the vehicle operation mode "driving", and the safety level ASIL A in the operation mode "parking".
[0057] Decomposition of the concept according to the present invention Figure 3 As shown in the right figure. The disassembly is achieved by using two different fuses, F1 and F2, arranged in series, where F2 is deactivated when in the "parked" state and activated during driving operation. Therefore, ASIL C level can be achieved in a disassembly manner using fuse F1 with ASIL A level and fuse F2 with ASIL B level (indicated in parentheses respectively).
[0058] Figure 4 An alternative design with a parallel circuit configuration is demonstrated. Two controllers, C1 and C2, with safety classes ASIL A and ASIL B are used. This decomposition is achieved by connecting two non-uniform control devices C1 and C2 via a logic unit L, provided that the power switch itself has a sufficiently low failure rate. C2 can be turned off, so only C1 can be controlled in standby mode. This also achieves the energy-saving and safety scheme according to the present invention.
[0059] exist Figure 5 and Figure 6 The image shows the implementation of a vehicle for safe power supply (instead of safe disconnection). Figure 5 An example of the first implementation is shown, illustrating how safe power supply to the equipment can be achieved through the parallel arrangement of safety devices F1 and F2. The objective is to achieve, for example, ASIL C for safe power supply in the "driving" operating mode, and ASIL A in the "stopped" operating mode. Figure 5 The diagram on the right illustrates how ASIL C security can be achieved by disassembling two safety devices, ASIL A and ASIL B. The electronic safety device F2 here can be turned off or switched to standby mode.
[0060] Figure 6 An alternative solution with two control devices, specifically non-uniform control devices C1 and C2, is demonstrated. Control is again performed through the logic unit L, provided that the power switch itself has a sufficiently low failure rate to meet safety requirements. Control device C2 is switchable, so only C1 can be controlled in standby mode.
[0061] Figure 7 The invention demonstrates a safety scheme, particularly according to the present invention, in which a safety device 1 is proposed to achieve a specific level of safety (depending on whether power is disconnected or supplied), particularly representing the level of specific requirements for the functional safety of the illustrated devices G1, G2 and G3 in the vehicle's onboard electrical system.
[0062] The vehicle electrical network comprises multiple electrical devices G1, G2, G3, etc., which operate at different, individual safety levels (ASIL A, ASIL B, ASIL C, etc.) and are located below the hierarchical / main fuse box HSB 1. HSB1 is a distribution box with wiring to devices G1, G2, and G3. Additionally, only a 12V battery and a DC / DC converter are shown as examples on the power supply side. Devices G1, G2, and G3 represent, as examples only, the steering system, ABS pump, and electrical appliances. B(C) is a functional fuse, B'(C) is a basic fuse with ASIL-B level, and A(C) is a basic fuse with ASIL-A level.
[0063] The present invention is not limited to the preferred embodiments described above. Rather, many variations are conceivable, and the solutions shown can be used even in substantially different types of embodiments.
Claims
1. A safety device (1) for a vehicle, particularly for achieving a specific safety level according to the vehicle's operating mode, particularly representing a level representing specific functional safety requirements in the vehicle's onboard electrical system, having multiple electrical devices (G1, G2, G3, ...) that operate at different, individual safety levels (X, X+1, X+2, ...) during their respective operation, wherein, The security level X is one of multiple hierarchically defined security levels (X, X+1, X+2, ...) of different security levels, wherein the security device (1) has: The system comprises two separate safety control devices (C1, C2) and a functional safety device (F1) (functional fuse) that can be individually controlled by each of these control devices (C1, C2), specifically a power switch, wherein by control, the first or second safety control device (C1, C2) is selectively activated, deactivated, or switched to standby mode, thereby achieving or deactivating a predetermined safety level according to the operating mode of the vehicle.
2. A safety device (1) for a vehicle, particularly for achieving a specific safety level according to the vehicle's operating mode, particularly representing a level representing specific functional safety requirements in the vehicle's onboard electrical system, having multiple electrical devices (G1, G2, G3, ...) that operate at different, individual safety levels (X-1, X, X+1, X+2, ...) respectively, wherein, The desired security level (X+1) is one of multiple hierarchically defined security levels, wherein the security device (1) has: a. At least one first electronic safety device (F1), having the functional safety requirements of level X-1 or X, is arranged in a line branch (L) leading to the relevant protected equipment (G1, G2, G3, ...). b. A second electronic safety device (F2) connected in series before or in parallel with the first safety device (F1) and arranged in the same line branch L, having the functional safety requirements of the level X for the protected equipment (G1, G2, G3, ...). c. Wherein, through circuitry and / or a microcontroller, the second electronic safety device (F2) can be selectively activated or switched to standby mode to be turned off, thereby achieving or disabling the desired level of safety depending on the operating mode of the vehicle.
3. The safety device (1) according to claim 2, characterized in that, By disassembling the two safety devices, a safety level X+1 is achieved that is improved relative to each of the respective safety devices (F1, F2), and in particular, at least one level higher.
4. The safety device (1) according to claim 2 or 3, wherein the second electronic safety device (F2) is a functional safety device, which is preferably operable by a microcontroller.
5. The safety device (1) according to claim 2, 3 or 4, wherein the second electronic safety device (F2) is preferably a microchip having multiple, particularly four, channels.
6. The safety device (1) according to any one of claims 2 to 5, wherein the second electronic fuse (F2) provides a conductive connection between the first fuse (F1) and the protected device (G1, G2, G3, ...) for power supply purposes in standby mode.
7. The safety device (1) according to any of the preceding claims, wherein the second electronic safety device (F2) can be turned off (standby) or activated (active safety protection) even in a line branch L without current, and in particular can be turned off or activated by a microcontroller.
8. The safety device (1) according to any of the preceding claims, wherein the safety level X corresponds to the ASIL level (ASIL A, ASIL B, ASIL C, ASIL D, ...) according to ISO standard ISO 26262, 2nd edition.
9. The safety device (1) according to any one of claims 2 to 8, wherein the plurality of first and second safety devices (F1, F2) arranged in series or in parallel in a decomposed manner are arranged in a plurality of different line branches L in the vehicle electrical network, each leading to a corresponding individual protected device.
10. The safety device (1) according to claim 1, characterized in that, A logic module L for controlling the power switch is provided between the parallel control devices (C1, C2).
11. A method for operating a safety device according to any one of the preceding claims, wherein at least one or more respective first or second safety devices (F2) are in a shut-off or standby mode in a particular vehicle operating state and are shut off in another different vehicle operating state.
12. The method of claim 10, wherein when the current vehicle operating state changes to another different vehicle operating state, one or more insurance devices, particularly a second insurance device, switch from an activated insurance mode to a deactivated insurance mode and / or switch in the opposite direction.
13. The method of claim 11, wherein, particularly when the required safety level changes due to a switch from one vehicle operating state to another, the standby state of one or more second safety devices is selectively activated or deactivated, depending on whether a higher or lower safety level needs to be ensured.