Control unit for a vehicle and method for storing data

Abstract

Control unit comprising a controller (11) and a memory unit, wherein the controller (11) and the storage unit (21) are supplied with energy independently of each other; the controller (11) is designed to provide the storage unit (21) with an output signal (S21) representing at least one parameter; the storage unit (21) is configured to store at least one parameter represented by the output signal (S21); the controller (11) is further configured to receive a readout signal (S41) representing at least one stored parameter from the storage unit (21) after a reset of the controller (11); the control unit is designed to be installed in a vehicle; and which at least one parameter represents a state of a steering wheel lock, a speed of the vehicle, a rotational speed of a drive of the vehicle or the ignition voltage of the vehicle.

Description

[0001] The invention relates to a control unit for a vehicle and a method for storing data, in particular for storing safety-relevant data in a vehicle.

[0002] For product liability reasons, compliance with various standards in the automotive sector is mandatory, such as ISO 26262 ("Functional Safety - Road Vehicles"), which concerns the functional safety of road vehicles. Implementing this standard aims to ensure the functional safety of a system with electronic control units (ECUs). "Functional Safety" refers to the aspect of a system's safety that depends on the correct functioning of safety-critical systems to mitigate risks (e.g., electrical safety, fire protection, or radiation protection are not considered functional safety).

[0003] Electronic control units (ECUs) are used in a wide variety of applications in the automotive sector. They process input data (e.g., sensor signals) using an algorithm and provide output data that is used for further control purposes. For example, the output data can be used to determine the need for intervention in various functions (e.g., the need to intervene in the braking system, etc.).

[0004] Particularly in safety-critical applications, such as steering wheel locks that prevent the steering wheel from moving using a locking mechanism, very high safety requirements are imposed due to applicable standards. For example, the last undamaged state of the control unit and the relevant input and output signals must be reliably retrievable at any time. The input signals can be processed and stored in a control unit using a microcontroller (microcontroller unit) and made available to other control units in the vehicle. However, all data stored in the microcontroller is lost when it is reset. Even after a microcontroller reset, it must be ensured that the data remains reliably retrievable. In particularly safety-critical applications, this requirement also applies during a microcontroller reset.

[0005] From the publication DE 60 2004 007 209 T2, a method for operating a security controller is known which is able to determine that security sections of the control program, such as those that can be downloaded from an external computer, are identical to an already downloaded and certified version of the program (cf. Fig. 1, Fig. 2, paragraphs 39, 40, 44, 46, 53).

[0006] The German patent application DE 10 2011 088 236 A1 describes a method for the safe operation of a field device in process automation technology. At a first point in time, a first test value is determined, which, based on at least a subset of the field device's characteristics, identifies a state of the field device. At a second point in time, after a restart of the field device, a second test value is determined based on the subset of the field device's characteristics, which identifies a state of the field device present at the second point in time after the restart (see, e.g., paragraphs 8, 15, 21, 22, 25, 31).

[0007] German patent application DE 10 2013 101 579 A1 discloses a field device for determining or monitoring a process variable in automation technology. The field device meets a safety standard required in a specified safety-critical application (see, e.g., paragraphs 31, 41, 43).

[0008] The object of the invention is to provide a control unit for a vehicle and a method in which the above-mentioned requirements for particularly safety-critical applications for a vehicle are met.

[0009] This task is solved by the subject matter of the independent claims. Advantageous embodiments are the subject matter of the dependent claims.

[0010] The control unit according to the invention for a vehicle comprises a controller (control unit) and a storage unit, wherein the controller and the storage unit are supplied with power independently of each other. The controller is configured to provide the storage unit with an output signal representing at least one parameter. The storage unit is configured to store the at least one parameter. The controller is further configured to receive a readout signal representing the at least one stored parameter from the storage unit after a reset. The at least one parameter can, for example, be a parameter measured by the control unit.

[0011] The advantage of the control unit according to the invention is that the parameters stored in an external memory are available during and after a controller reset, since the memory unit is powered independently of the controller. If the power supply to the controller is interrupted, data stored in the controller is lost. However, the data stored in the independently powered memory unit is retained and can subsequently be read back into the controller for further processing.

[0012] The controller and the storage unit can each be independently connected between a connection for a supply potential and a connection for a reference potential in order to supply them with energy independently.

[0013] The controller can be further configured to provide a release signal to the storage unit, and the storage unit can be further configured to store the output signal representing at least one parameter only when it receives a release signal from the controller. In this way, data storage security can be further increased, since the data is only stored when this is actually confirmed by the controller via a release signal.

[0014] The storage unit can further be configured to store the output signal representing at least one parameter and to calculate a checksum, with the calculated checksum being stored together with the at least one parameter. Subsequently, when the data is read out (e.g., at the request of the controller or another control unit), the checksum can be calculated again. If the two checksums match, the data is highly likely to be correct. If the checksums do not match, the data is highly likely to be erroneous.

[0015] The control unit may also include a power supply unit connected between the controller and the supply potential connection, designed to provide the controller with a constant electrical potential relative to a reference potential, such as ground. This can be advantageous because, particularly in vehicles, the supply voltage can be subject to fluctuations.

[0016] The potential provided by the power supply unit can be, for example, 3.3V or 5V relative to the reference potential. Most microcontrollers nowadays are powered by 3.3V or 5V.

[0017] The control unit can further comprise a second controller and a second memory unit, wherein the second controller and the second memory unit are each connected between the supply potential terminal and the reference potential terminal and are powered independently of each other. The second controller is configured to provide the second memory unit with a second output signal representing at least one parameter. The second memory unit is configured to store the at least one parameter. The second controller is further configured to receive a readout signal representing the at least one stored parameter from the second memory unit after a reset.

[0018] The advantage of such a control unit is that the data security can be further increased through a redundant design of the components.

[0019] The control unit is designed to be installed in a vehicle. At least one parameter represents a steering lock state, a vehicle speed, a drive speed, or an ignition voltage. These parameters are safety-critical and must be reliably available in their last state at all times.

[0020] According to a further aspect of the invention, a method is provided, in particular for operating a controller in a vehicle control unit. This method comprises: providing an output signal representing at least one parameter by a controller of the control unit, which is connected between a supply potential terminal and a reference potential terminal; storing the output signal representing the at least one parameter in a memory unit of the control unit, which is connected between the supply potential terminal and the reference potential terminal and is powered independently of the controller; and, after a reset of the controller, providing a readout signal representing the stored parameters to the controller by the memory unit.At least one parameter represents a state of a steering wheel lock, a speed of the vehicle, a rotational speed of a drive of the vehicle, or the ignition voltage of the vehicle.

[0021] Advantageous configurations of the control unit, insofar as they are transferable to the process, are to be regarded as advantageous configurations of the process, and vice versa.

[0022] Exemplary embodiments of the invention are explained in more detail below with reference to the figures. These show: Fig. 1 a block diagram of an arrangement with a controller according to an embodiment of the invention and Fig. 2 a block diagram of an arrangement with two controllers according to an embodiment of the invention.

[0023] Fig. Figure 1 shows a block diagram of an arrangement with a controller 11, for example, a microcontroller. The controller 11 is connected between a supply potential terminal Vbat and a reference potential terminal GND. In a vehicle, the supply potential is provided, for example, by a vehicle battery, and the reference potential is ground. The vehicle battery generates a voltage of, for example, 12V or 24V between the supply potential terminal Vbat and the reference potential terminal GND. However, this battery voltage can fluctuate. Therefore, a voltage supply unit 31 can optionally be connected between the controller 11 and the supply potential terminal Vbat, which is connected to Fig. The power supply unit 31 is shown as a dashed line. This power supply unit is designed to provide the controller 11 with a constant electrical potential (voltage) relative to the reference potential GND. This potential (voltage) can be, for example, 5V or 3.3V. The power supply unit 31 can, for example, include a voltage regulator.

[0024] Controller 11 is configured to receive an input signal S11. The input signal S11 represents, for example, at least one determined parameter. If the arrangement is, for instance, located in a control unit for a steering lock in a vehicle, the at least one determined parameter can represent the state of the steering lock (locked or unlocked), the vehicle's speed, the engine speed, and / or the ignition voltage. These (and possibly other) parameters are important. For safety reasons, the steering wheel must never be locked while driving, as this would pose a risk of serious accidents.

[0025] Typically, a determined parameter is saved every time it changes. This way, the latest current value of the parameter is always available. The arrangement in Fig. Device 1 has a storage device 21 for this purpose. The storage device 21 is connected to the controller 11 and is configured to receive an output signal S21 from the controller 11, which represents the parameters determined and possibly further processed by the controller 11. The storage device 21 is further configured to store the determined parameters represented by the output signal S21.

[0026] The storage device 21 is also connected between the supply potential Vbat and the reference potential GND. The storage device 21 is thus powered independently of the controller 11. Therefore, data stored in the storage device 21 is not lost when the controller 11 is reset. According to one embodiment of the invention, the storage device 21 comprises non-volatile memory that permanently stores the data, even in the event of a power failure. Thus, for example, the data stored in the storage device 21 is not lost if the vehicle's battery fails.

[0027] To increase safety, the controller 11 can also be configured to output a release signal S31. The storage unit 21 receives this release signal S31 and stores the determined parameters represented by the output signal S21, for example, only if it receives a corresponding release signal S31 from the controller 11, or if the release signal has a corresponding level.

[0028] After a reset of controller 11, a read signal S41 representing the parameters stored in memory device 21 can be read out and made available to controller 11 for further processing, for example, upon request from controller 11. Since memory device 21 is powered independently of controller 11, the stored parameters can also be made available by memory device 21 during or after a reset of controller 11. However, the parameters can also be made available to control units of other applications (e.g., via a vehicle bus). Fig. (1 not shown). These control units can, for example, send a corresponding request to the storage device 21.

[0029] To further enhance security, redundancy information can be stored in the storage device along with the parameters. Determining this redundancy information can involve calculating checksums. Various checksum methods are known. Simple methods, for example, multiply bits, bytes, or other basic components of the data to be stored by a specific factor and then sum them. More complex methods perform more sophisticated calculations instead of simply summing the data values, such as a cyclic redundancy check (CRC). The resulting value is then stored as a checksum. During further data processing or when the data is made available to other components (controllers, control units), the checksum can then be calculated again and compared with the stored checksum.If the two checksums are different, the data is most likely erroneous. If the checksums are identical, the data is highly likely to be correct.

[0030] To increase security, it may also be possible to store the determined parameters redundantly. For this purpose, as described in Fig. As shown in Figure 2, a second controller 12 is provided. This controller 12 is also connected between the supply potential Vbat terminal and the reference potential GND terminal. Optionally, a second power supply unit 32 can also be connected in series with the second controller 12 to supply the controller with a constant potential.

[0031] The second controller 12 also receives the input signal S11 representing the determined parameters and provides a second output signal S22 representing the determined parameters, which may have been further processed by the second controller 12. A second memory unit 22, also connected between the supply potential Vbat and the reference potential GND, is connected to the second controller 12. The second memory unit 22 receives the second output signal S22 representing the determined parameters, which may have been further processed by the controller 12, and is configured to store the parameters. The second memory unit 22 can provide a second readout signal S42, which represents at least one stored parameter. After a reset of the second controller 12, the last stored parameters can be read back into the second controller 12 in this way.Furthermore, the second readout signal S42 can be used by other control units in the vehicle (in . Fig. (2 not shown) are provided. If the read signal S41 of the first storage unit 21 differs from the second read signal S42 of the second storage unit 22, the data is most likely erroneous. If the read signal S41 of the first storage unit 21 matches the second read signal S42 of the second storage unit 22, the data is highly likely to be correct. To verify this, in one embodiment of the present invention, each of the controllers 11, 12 can receive both read signals S41, S42 and compare them. This is shown in Fig. 2 represented by the dashed lines of the readout signals S41, S42.

[0032] The parameters can also be stored in the second storage unit 22 together with redundancy information, as above with reference to Fig.1 described, are stored. In addition, it can be further stipulated that the parameters in the second storage unit 22 are only stored if the storage unit 22 receives a corresponding second release signal S32 from the second controller 12. Reference symbol list 11 microcontrollers 12 second microcontroller 21 storage unit 22 second storage unit 31 Power supply unit 32 second power supply unit S11 input signal S21 output signal S22 second output signal S31 Release signal S32 second release signal S41 readout signal S42 second readout signal Vbat connection for a supply potential GND connection for a reference potential

Images