Method and control system for checking the plausibility of a first driver request sensor in relation to a second driver request sensor of a motor vehicle that is different from the first

Abstract

Method for checking the plausibility of a first driver request sensor in relation to a second driver request sensor of a motor vehicle which is different from the first, wherein the first and the second driver request sensor each monitor interventions of a driver on a brake pedal or an accelerator pedal or a steering wheel or a gear selector lever of the motor vehicle, wherein measurement signals (111, 112) of the first and the second driver request sensor are recorded and redundantly evaluated independently of one another in a first functional module (110) and a second functional module (210) which is independent of the first, and the two evaluations (116, 216) are compared with one another, characterized in that in the event of an unrecognized implausibility on the part of the first functional module (110), the second functional module (210) after a temporal debouncing with a repeated check of the two evaluations (116,216) a corresponding response request to the implausibility is directed to the first functional module (110).

Description

[0001] The present invention relates to a method and a corresponding control system for verifying the plausibility of a first driver request sensor in relation to a second driver request sensor that differs from the first in a motor vehicle. State of the art

[0002] A plausibility check, also called plausibility verification or plausibility assessment, is generally a method in which a value or, more generally, a result is examined to determine whether it is plausible, i.e., acceptable, logical, and comprehensible. The primary goal is to identify any obvious inaccuracies in order to initiate appropriate corrective action.

[0003] Plausibility checks in motor vehicles typically involve monitoring specific signals from various functional units within the vehicle. Such plausibility checks or plausibility assessments are particularly necessary for specific driver input sensors, such as the plausibility of the accelerator and brake pedals. For example, simultaneous activation of both pedals can lead to implausibility, as accelerator and brake pedal activation generally have opposing effects and therefore cannot simultaneously correspond to the driver's input and / or the respective driving situation. During plausibility assessment, other boundary conditions are also typically considered to determine the necessary characteristics of the current driver input, thus enabling, for example, the reduction of an accelerator pedal input in favor of a braking request.to hide.

[0004] A safety function known from the prior art is "accelerator pedal-brake plausibility check" (FBP), which performs a plausibility check of the two driver input sensors, "driver input" and "brake," within an engine control unit. The FBP safety function is executed only at a so-called "user software" level (Level 1) in the software architecture and is therefore not subject to any further internal control unit safety measures, such as those typically found in control unit monitoring functions. In the corresponding software architecture of a motor vehicle, there is usually another level, referred to below as Level 2, in which functional monitoring software is stored. This software is designed to check the control unit itself with regard to its calculations, thereby effectively implementing a double check.

[0005] In light of the prior art, it was now an object of the present invention to perform a plausibility check of a first driver request sensor with respect to a second driver request sensor not only in a previously known calculation in an application software (level 1) but also in a function monitoring software (level 2), in order to thus be able to exclude a possible control unit-internal miscalculation of the plausibility check.

[0006] From DE 40 17 045 A1, a system for controlling a motor vehicle is known, which is equipped with two elements operable by the driver that influence the speed of the motor vehicle and two measuring devices that detect the position of these elements. The system is deemed to be functioning correctly when a position signal of an element influencing the speed reaches, exceeds, or falls below a predetermined value through a change in position.

[0007] From DE 43 14 118 B4, a method and a device for controlling the drive power of a vehicle are known. A redundant readout of driver request signals is known in this process.

[0008] From DE 10 2011 075 131 A1 a system and a method for controlling a vehicle powertrain in response to a brake pedal input are known. Disclosure of the invention

[0009] To solve this problem, the present invention proposes a method with the features of claim 1 and a control system with the features of claim 9. Further embodiments can be found in the corresponding dependent claims.

[0010] According to the invention, a method for verifying the plausibility of a first driver request sensor with respect to a second, distinct driver request sensor of a motor vehicle is provided, in which the first and the second driver request sensors each monitor the driver's actions on a brake pedal, accelerator pedal, steering wheel, or gear selector lever of the motor vehicle. According to the method according to the invention, measurement signals from the first and the second driver request sensors are acquired and redundantly evaluated independently of each other in a first functional module and a second, independent functional module. The two evaluations are then compared.

[0011] By additionally performing redundant evaluation or calculation of the plausibility check from two different driver request sensors, such as the "accelerator pedal" and the "brake" sensors, in a second, independent functional unit, a truly reliable execution of the plausibility check between the first driver request sensor, such as the "accelerator pedal", and the second driver request sensor, such as the "brake", in an engine control unit can be guaranteed.

[0012] According to one possible embodiment of the method according to the invention, the first functional module is provided in an application software (level 1) of a control software architecture of a corresponding motor vehicle, while the second functional module is provided in a function monitoring software (level 2) of the control software architecture of the corresponding motor vehicle.

[0013] According to a further embodiment of the method according to the invention, when evaluating the measurement signals of the first and the second driver request sensor, further boundary conditions relevant for plausibility are taken into account.

[0014] Further boundary conditions for plausibility checks include, for example, status values ​​of the driver request sensors, in particular those indicating whether the driver request sensor has already been classified as defective or with limited availability. System parameters such as vehicle speed and engine speed are also used for plausibility checks.

[0015] According to one possible embodiment of the method according to the invention, the first driver input sensor monitors the driver's actions on the brake pedal, and the second driver input sensor monitors the driver's actions on the accelerator pedal. The further process will now be explained in more detail using this specific embodiment, particularly with regard to the figures that follow. The first driver input sensor will be referred to as the "brake pedal," and the second driver input sensor as the "accelerator pedal."

[0016] According to one possible embodiment of the method according to the invention, a detected implausibility between the accelerator pedal and the brake pedal leads to a reduction of the corresponding accelerator pedal value in both evaluations. According to the invention, such a reduction of the accelerator pedal value in the event of a detected implausibility with the brake is now taken into account not only in a driver request calculation of the application software (level 1), as before, but also in the function monitoring software. As a result, in the event of implausibility, there is no longer any inaccuracy or expansion of the function monitoring software. The safety concept of the two aforementioned software levels is based on the fact that the accelerator pedal values ​​of the two levels, level 1 and level 2, are compared elsewhere. The function monitoring software (level 2) represents a limitation of the application software (level 1).Level 2 has not yet reduced the accelerator pedal value in any way and has therefore used a higher accelerator pedal value than Level 1 in the event of an implausibility. As a result, Level 2 could no longer reach the limitations of Level 1, even in the case of other types of errors, and was therefore too high or "expanded" in its comparison or limitation value.

[0017] In a further embodiment of the method according to the invention, the comparison of the evaluation is realized by a logical OR operation of the first functional module with the second functional module.

[0018] According to the invention, if the first functional module fails to detect an implausibility, the second functional module, after a time-based debouncing and a further review of both evaluations, sends a corresponding response request to the first functional module. Debouncing generally refers to the following procedure: After an error occurs, a so-called debouncing counter is started, and if the error does not disappear before the debouncing time expires, an entry is made in an error memory. If necessary, as provided for in the invention, the second functional module intervenes in the responsiveness of the first functional module.

[0019] According to a further embodiment of the method according to the invention, a removal of a detected implausibility and thus a reset of the evaluation in the first functional module is only carried out after confirmation of the removal of the detected plausibility and a removal of the detected implausibility by the second functional module and a corresponding reset of the evaluation in the second functional module.

[0020] The removal of the detected implausibility in the first function module occurs instantaneously after the removal of the detected implausibility in the second function module.

[0021] The present invention further relates to a control system for verifying the plausibility of a first driver request sensor in relation to a second driver request sensor of a motor vehicle that differs from the first.

[0022] The first and second driver input sensors each monitor a driver's inputs to a brake pedal, accelerator pedal, steering wheel, or gear selector lever of the motor vehicle. The control system according to the invention comprises a recording and storage unit configured to acquire measurement signals from the first and second driver input sensors. Furthermore, the control system comprises a first and a second functional module communicating with the recording unit. The first functional module and the second, independent of the first, are configured to redundantly and independently evaluate the measurement signals and compare the two evaluations.

[0023] The control system according to the invention is in particular configured to carry out a method according to the invention described above.

[0024] Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawing.

[0025] It is understood that the features mentioned above and those to be explained below can be used not only in the combinations specified, but also in other combinations or on their own, without leaving the scope of the present invention. Brief description of the drawing Fig. Figure 1 shows a schematic representation of the architecture of a possible embodiment of a control system according to the invention. Embodiments of the invention

[0026] The invention is schematically illustrated with reference to embodiments in the drawing and is described in detail below with reference to the drawing.

[0027] Fig.Figure 1 shows a schematic representation of an embodiment of a control system 100 according to the invention. The control system 100 comprises a first functional module 110 and a second functional module 210 that is independent of the first. Functional modules 110 and 210 have access to, and receive from, a recording and storage unit (not shown) measurement signals from a first and a second driver input sensor. In the case shown here, the first driver input sensor is a "brake" or "brake pedal," and the second driver input sensor is an "accelerator pedal." Furthermore, the first functional module 110 and the second functional module 210 have access to additional data or boundary conditions relevant for a plausibility check. A measurement signal "accelerator pedal position" from the second driver input sensor is included with the value 111 in both calculations or evaluations by functional module 110 and functional module 210, respectively.Furthermore, the measurement signal "brake status" 112 is taken into account in the respective evaluation of function module 110 and function module 210. Additional conditions 113 are also included in the respective evaluation of the first function module 110 and the second function module 210.

[0028] In the first function module 110, an accelerator pedal-brake plausibility check (APC) 114 is then performed based on this information 111, 112, 113. Independently of this, an accelerator pedal-brake plausibility check (APC) 214 is also performed in the second function module 210. A detected implausibility between the accelerator pedal and brake leads to a reduction of the accelerator pedal value in both the first function module 110 and the second function module 210, as indicated in evaluations 120 and 220, respectively. To ensure that the evaluation of the second function module 210 is always set immediately after the evaluation of the first function module 110 is detected, a logical OR operation 215 is provided in the second function module 210. Here, the plausibility check 214 of the second function module and the evaluation 116 of the first function module are taken into account, leading to a comparison 216 in the second function module followed by a corresponding reduction of the accelerator pedal value 220.Thus, the evaluation of the FBP can be kept synchronized in both function modules 110 and 210.

[0029] If an implausibility between the accelerator pedal and brake inputs, e.g., due to internal control unit errors, is not detected in the first function module 110, this implausibility is detected in the second function module 210. There, a request to reduce the accelerator pedal input is sent to function module 110 by checking the two evaluations 214 and 116, or by comparing 216 and evaluation 116 after a time-based debouncing 219. This forces function module 110 to react accordingly. To enable this, the evaluation or...The accelerator pedal-brake plausibility check 116 from the first function module 110 is initially fed to a logical "no" calculation 217 in the second function module 210 and then combined with a logical "AND" operation 218 with the evaluation FBP 216 of the second function module 210 and subjected to a time debouncing 219, so that the resulting request to reduce the accelerator pedal value 221 is forwarded to the first function module 110.

[0030] The FBP request 221 of the second function module 210 is then fed to a logical OR operation 117 and ultimately also leads to a reduction of the accelerator pedal value 120 in the first function module 110.

[0031] A correction of an implausibility, and thus a reset of the FBP evaluation, can only occur if the first function module 110 and the second function module 210 recognize that the accelerator pedal and brake are behaving plausibly again. For this purpose, a hold condition is created in the first function module 110 using an auxiliary status 118. This hold condition is set by the FBP evaluation 116 of the first function module and can only be removed if the FBP evaluation 216 of the second function module 210 is no longer set, i.e., the implausibility has been resolved. To achieve this, evaluation 216 and auxiliary status 118 are combined using a logical AND operation 117 and then compared with evaluation FBP 116 using a logical OR operation 115. If evaluation 216 and evaluation 116 match, auxiliary status 118 is ultimately reset.This means that the first function module 110 waits to clear a detected implausibility until the second function module 210 has confirmed it. Therefore, a reduction in accelerator pedal position is first cleared in the second function module 210 and then immediately cleared in the first function module 110. Thus, even when resetting evaluation FBP 116, the accelerator pedal value of the first function module 110 cannot exceed the value of evaluation FBP 216 of the second function module 210.

Claims

[1] Method for verifying the plausibility of a first driver request sensor with respect to a second driver request sensor of a motor vehicle that is different from the first, wherein the first and the second driver request sensor each monitor actions of a driver on a brake pedal or an accelerator pedal or a steering wheel or a gear selector lever of the motor vehicle, wherein measurement signals (111, 112) of the first and the second driver request sensor are acquired and redundantly evaluated independently of each other in a first functional module (110) and a second functional module (210) independent of the first, and the two evaluations (116, 216) are compared with each other, characterized by, that in the event of an undetected implausibility on the part of the first functional module (110), the second functional module (210) will, after a time debouncing with a further check of the two evaluations (116, 216), send a corresponding request for a reaction to the implausibility to the first functional module (110). [2] Method according to claim 1, wherein further boundary conditions (113) relevant for plausibility are taken into account when evaluating the measurement signals. [3] Method according to claim 1 or 2, wherein the first driver request sensor monitors the driver's inputs to the brake pedal and the second driver request sensor monitors the driver's inputs to the accelerator pedal. [4] Method according to claim 3, wherein a detected implausibility between accelerator pedal and brake pedal in both evaluations (116, 216) leads to a reduction of a corresponding accelerator pedal value. [5] Method according to one of the preceding claims, wherein the comparison of the two evaluations (116, 216) is realized by a logical OR operation of the first function module (110) with the second function module (210). [6] Method according to one of the preceding claims, wherein a removal of a detected implausibility and thus a resetting of the evaluation (116) in the first functional module (110) is carried out only after a confirmation and a removal of the detected implausibility and a resetting of the evaluation (216) in the second functional module (210). [7] Method according to claim 6, wherein the removal of the detected implausibility in the first functional module (110) occurs instantaneously after the removal of the detected implausibility in the second functional module (210). [8] Control system (100) for verifying the plausibility of a first driver request sensor with respect to a second driver request sensor of a motor vehicle that is different from the first, wherein the first and the second driver request sensor each monitor actions of a driver on a brake pedal or an accelerator pedal or a steering wheel or a gear selector lever of the motor vehicle, wherein the control system (100) comprises a recording and storage unit configured to acquire measurement signals (111, 112) from the first and the second driver request sensor, and a first and a second function module (110, 210) each communicating with the recording unit, wherein the first function module (110) and the second function module (210), which is independent of the first, are configured to redundantly and independently evaluate the measurement signals (111, 112) and to compare the two evaluations (116, 216) with each other, characterized by, that the control system (100) is configured to perform a method according to any one of claims 1 to 7.

Images