Device and method for controlling a signal connection of a vehicle

Abstract

Device (110) for controlling a signal connection (120) of a vehicle (100), wherein the signal connection (120) represents a signal-transmitting connection between at least one control unit (130) of the vehicle (100) and at least one actuator (140) of the vehicle (100), wherein the at least one control unit (130) is configured to control the operation of the vehicle (100) within the framework of highly automated driving, characterized in that the device (110) is configured to establish and / or monitor and / or disconnect the signal connection (120) depending on an input signal (135, 165, 175, 195), wherein the device (110) is arranged on its own circuit board with a separate power supply and signal connection (120) from the at least one control unit (130), and that the device (110) is configuredto check a signal (135) transmitted via the signal connection (120) as an input signal for compliance with at least one predefined signal criterion, in order to monitor the signal connection (120).

Description

[0001] The present invention relates to a device and a method for controlling a signal connection of a vehicle.

[0002] DE 10 2015 222 530 A1 discloses a vehicle electronics control device with a monitoring control circuit unit for monitoring a control operation of a control unit.

[0003] In DE 10 2017 109 865 A1, a method for transmitting at least one control command to at least one actuator is shown, wherein a communication bus to be interrupted is monitored for a specific event, based on the detection of this event the communication bus is split into two bus segments or interrupted, and after the bus has been split, the actuator is addressed by means of a control command without components on the other bus segment becoming aware of this.

[0004] DE 10 2017 101 803 A1 relates to a device for at least partially interrupting a communication line of a vehicle, wherein the device has a disconnecting unit and an actuating unit which is designed as a human-machine interface in the vehicle or is assigned to a human-machine interface in the vehicle, wherein the disconnecting unit can be actuated by the actuating unit.

[0005] DE 10 2007 034 466 A1 discloses a control system for a motor vehicle, comprising at least one actuator, at least one control unit for controlling the actuator, an actuator signal path for transmitting signals and at least one adjustment device for changing signals.

[0006] DE 10 2016 200 385 A1 discloses a motor vehicle with a communication device comprising at least one wireless communication module which enables a wireless communication connection between at least one vehicle component connected to the wireless communication module via a communication line and a communication partner.

[0007] DE 10 2014 221 772 A1 discloses a method for operating a vehicle, wherein, in the event of external access to one or more vehicle components, the access is restricted or interrupted by means of an internal vehicle security device when a corresponding request has been received from the vehicle via a communication network.

[0008] DE 10 2015 226 214 A1 discloses a device for controlling external control commands in a vehicle, with a receiving unit which can receive external data and / or control commands and forward them to at least one internal control unit via a data connection.

[0009] Against this background, the present invention provides an improved device for controlling a signal connection of a vehicle and an improved method for controlling a connection of a vehicle according to the main claims. Advantageous embodiments are described in the dependent claims and the following description.

[0010] According to embodiments, an additional control unit, in the form of a device, control device, or safety control unit, can be provided in a vehicle to physically establish, monitor, and, if necessary, physically disconnect communication or signal transmission between vehicle control units, for example, for highly automated driving, and actuator control units. In this way, signal transmission between control units and actuators can be enabled, monitored, and prevented depending on the situation.

[0011] Advantageously, according to embodiments, reliable and safe operation of a vehicle can be achieved in particular by ensuring proper communication between control units and actuators by means of a control device or a safety control unit. For example, signal transmission can be checked for correctness, enabled when the involved devices are functioning correctly, and interrupted in the event of malfunctions.

[0012] A device for controlling a signal connection of a vehicle is presented, wherein the signal connection represents a signal-transmitting connection between at least one control unit of a vehicle and at least one actuator of the vehicle, wherein the device is configured to establish the signal connection depending on an input signal and additionally or alternatively to monitor and additionally or alternatively to disconnect it.

[0013] The device can be an electrical device that processes electrical signals, such as sensor signals, and outputs control signals accordingly. The device can have one or more suitable interfaces, which can be implemented in hardware and / or software. In the case of a hardware implementation, the interfaces can, for example, be part of an integrated circuit in which the device's functions are implemented. The interfaces can also be separate integrated circuits or consist at least partially of discrete components. In the case of a software implementation, the interfaces can be software modules that are present, for example, on a microcontroller alongside other software modules. The vehicle can be a motor vehicle, in particular a passenger car, a truck, or another commercial vehicle.The device can represent an additional control unit or control system of the vehicle. The device can also be referred to as a safety control device. The at least one control unit can be configured to control the operation of the vehicle within the framework of so-called highly automated driving. The at least one actuator can be designed as a control element for a vehicle function, such as steering, braking, a valve, or the like.

[0014] According to one embodiment, the device can be implemented separately from the at least one control unit. Additionally or alternatively, the device can be implemented on its own circuit board. In other words, the device can be arranged outside the housing of the at least one control unit. Additionally or alternatively, the device can be arranged inside the housing of a control unit on its own circuit board with a separate power supply and signal connection. This allows for a suitable implementation of the device, depending on the application or operating environment, either as a separate unit or integrated into an existing control unit as a separate subunit.

[0015] The device can also be configured to establish and, additionally or alternatively, disconnect the signal connection by controlling a coupling device. The coupling device can be integrated into the signal connection. For example, the coupling device can be designed as a gateway. The coupling device can include coupling elements for physically establishing and disconnecting the connection. These coupling elements can be relays, optocouplers, magnetic couplers, or similar devices. This embodiment offers the advantage that control of an actuator by a control unit via the signal connection is only possible if this is properly configured. Controlling the coupling device allows the signal connection to be established and, additionally or alternatively, disconnected particularly easily and reliably.

[0016] The device is designed to check a signal transmitted via the signal link as an input signal for compliance with at least one predefined signal criterion, in order to monitor the signal link. This predefined signal criterion can represent a transmitted data type, a data transmission repetition rate, range exceedances, syntactic errors, sequence errors, message counters, message checksums, and additionally or alternatively, other signal criteria. In this way, communication between the control unit and actuators can be reliably and easily checked and monitored.

[0017] Furthermore, the device can be configured to disconnect the signal connection if a signal transmitted via the signal connection violates at least one predefined signal criterion as an input signal. In this context, the signal transmitted via the signal connection represents the input signal. Such an embodiment offers the advantage that communication involving a malfunctioning device or actuator can be reliably prevented in order to maintain or increase operational reliability.

[0018] Furthermore, the device can be configured to disconnect the signal connection if it receives a shutdown signal as an input signal. In particular, this shutdown signal can represent an emergency shutdown or emergency stop signal. The shutdown signal can be provided by an interface to a vehicle function unit or a user interface. The shutdown signal can represent a requested shutdown of a highly automated operating mode or driving mode of the vehicle. This allows for a quick and reliable response to sudden events that require interrupting the signal connection.

[0019] The device can also be configured to disconnect the signal connection if an additional signal transmitted via another signal connection of the vehicle violates at least one predefined signal criterion as an input signal. This additional signal connection can affect at least one control unit and, additionally or alternatively, at least one actuator. The device can also be configured to monitor this additional signal connection. This allows for a more reliable detection of malfunctions in a control unit or actuator, enabling the interruption of its communication paths.

[0020] Furthermore, the device can be configured to disconnect the signal connection if it detects that the vehicle's driving data violates at least one predefined driving data criterion. The driving data can represent at least an acceleration value, a speed, and additionally or alternatively, other driving data. Such an embodiment offers the advantage that the signal connection can be reliably interrupted if the vehicle behaves in a non-compliant manner.

[0021] According to one embodiment, the device can be configured to output a control signal to at least one actuator. This control signal can be suitable for bringing the vehicle into a safe state when used by the at least one actuator. Thus, the vehicle can be reliably brought into a safe state even if a control unit malfunctions. In this case, the device can function as a backup control unit to increase the vehicle's operational safety.

[0022] Furthermore, a method for controlling a signal connection of a vehicle is presented, wherein the signal connection represents a signal-transmitting connection between at least one control unit of a vehicle and at least one actuator of the vehicle, wherein the method comprises the following steps: reading an input signal; and Controlling the signal connection to establish the signal connection depending on the input signal and additionally or alternatively to monitor and additionally or alternatively to disconnect.

[0023] The method can be advantageously carried out using an embodiment of the aforementioned device.

[0024] It is also advantageous to have a computer program product with program code that can be stored on a machine-readable medium such as semiconductor memory, hard disk memory or optical memory and is used to carry out the method according to one of the embodiments described above when the program is executed on a computer or device.

[0025] The invention is explained in more detail by way of example with reference to the accompanying drawings. These show: Fig. 1 a schematic representation of a vehicle with a device according to an exemplary embodiment; and Fig. 2 a flowchart of a procedure for controlling according to an exemplary embodiment.

[0026] In the following description of preferred embodiments of the present invention, the same or similar reference numerals are used for the elements shown in the various figures and having a similar effect, without repeating these elements.

[0027] Fig. Figure 1 shows a schematic representation of a vehicle 100 with a device 110 according to an exemplary embodiment. The vehicle 100 is a motor vehicle, for example a passenger car, a truck, or another commercial vehicle. The device 110 is designed to control a signal connection 120 of the vehicle 100. The device 110 can also be referred to as a control device 110 or a so-called safety ECU (safety = Sicherheit; ECU = Electronic Control Unit).

[0028] At least one control unit 130 and at least one actuator 140 are interconnected by means of the signal connection 120, enabling signal transmission. The signal connection 120 is, for example, an electrical line, an optical line, or another connection device for transmitting signals. Thus, the vehicle 100 comprises the device 110 or control device 110, the signal connection 120, the at least one control unit 130, and the at least one actuator 140. According to the embodiment shown here, the vehicle 100 comprises the control device 110, the signal connection 120, and, by way of example, only one control unit 130 and, by way of example, only one actuator 140. The control unit 130 is, for example, configured to control functions for highly automated driving. The actuator 140 can also include a control unit or actuator control unit.

[0029] To control the signal connection 120, the control device 110 is designed to establish, monitor, and / or disconnect the signal connection 120 depending on an input signal. The input signal will be discussed in more detail below.

[0030] According to the embodiment shown here, the control device 110 is separate from the control unit 130. According to another embodiment, the control device 110 can be arranged in a common housing with the control unit 130 or another control unit and implemented on its own separate circuit board. The control device 110 could, for example, be implemented as a sub-element, such as a plug-in circuit board or similar component, as part of a control unit. It is particularly important to note that the computer and the input and output elements must function and operate independently.

[0031] Furthermore, according to the embodiment shown here, a coupling device 150 is provided. The coupling device 150 is connected in the signal connection 120. The control device 110 and the coupling device 150 are connected to each other in a signal-transmitting manner. The control device 110 is configured to control the coupling device 150 in order to establish and / or disconnect the signal connection 120 by means of the coupling device 150. For this purpose, the control device 110 is configured to output a control signal 155 to the coupling device 150. The coupling device 150 is configured to enable, block, or interrupt the signal connection 120 in response to the control signal 155.

[0032] The control device 110 is thus designed to physically establish and, if necessary, disconnect the signal connection 120, particularly via the coupling device 150. To ensure that, for example, driver assistance system functions or ADAS (Advanced Driver Assistance Systems) functions of the vehicle 100 can only be activated when desired, the signal connection 120 between the control unit 130 and the actuator 140 or actuator control units is not routed via the disconnectable coupling device 150, e.g., a so-called gateway. A switch connected to the control device 110, possibly also a key switch, can be read by the control device 110 and, depending on the switch position, can activate the coupling device 150. Activating the coupling device 150 can be achieved by connecting it to a power supply.Without power, the coupling device 150 can be deactivated, with the signal connection 120 between the control unit 130 and the actuator 140 being interrupted. With power, the contact device 150 can be activated, with the signal connection 120 established. Alternatively, the signal connection 120 can also be enabled by powering the coupling elements of the coupling device 150. The coupling device 150 may already be connected to a power supply, while the coupling elements that establish the signal connection 120, e.g., relays, optocouplers, magnetic couplers, or the like, may still be de-energized. Only by powering these elements, as simulated by the control device 110, or by the control signal 155, can the signal connection 120 then be established.

[0033] To monitor the signal connection 120, the control device 110 is configured according to one embodiment to tap and analyze a signal 135 or data signal 135 transmitted via the signal connection 120 between the control unit 130 and the actuator 140. The control device 110 is configured to use the data signal 135 as an input signal. The control device 110 is configured to check the data signal 135 for compliance with at least one predefined signal criterion in order to monitor the signal connection.

[0034] The control device 110 can monitor the signal change 120 between the control unit 130 and the actuator 140. When data or data signals 135 are exchanged between the control unit 130 and the actuator 140, it is specified, for example, which data is exchanged and at what repetition rate. The control device 110 can be configured to read this data and, for example, determine whether the data is being sent at the agreed repetition rate and whether there are range violations, syntactic errors, sequence errors (e.g., a defined sequence of three valid signals should be sent during a target gear change), or similar issues in the data. If message counters, message checksums, or similar information are also exchanged, the control device 110 can check whether these signal criteria are also met.Signal characteristics correspond to agreed patterns, and thus determine whether the communication channels are functioning and whether the monitored control units and actuators are working properly.

[0035] According to one embodiment, the control device 110 is configured to disconnect the signal connection 120 if the data signal 135 or the signal 135 transmitted via the signal connection 120 violates at least one predefined signal criterion as an input signal. If, while monitoring the signal connection 120 between the control unit 130 and the actuator 140, the control device 110 detects that agreed-upon terms or signal criteria are not being met—for example, if range violations, incorrect checksum calculations, message counters jumping or stopping, etc.—occur, the control device 110 can interrupt communication via the signal connection 120. The control device 110 can also be configured to interrupt the power supply to the coupling device 150, for example, a complete gateway, or to the power supply to the coupling elements, such as relays, optical, magnetic, etc.The power supply to the coupling device 150 or the coupling elements can also be interrupted by the control device 110 if a switch or key switch that enabled the coupling is switched off. This would allow the vehicle 100, for example, to be operated conventionally in certain situations without the risk of the control unit for highly automated procedures influencing the vehicle 100.

[0036] According to one embodiment, the control device 110 is configured to read a shutdown signal 165 as an input signal. The shutdown signal 165 is, for example, an emergency shutdown signal or emergency stop signal. Such a shutdown signal 165 can be read from an interface to a functional unit 160 of the vehicle 100. Alternatively, such a shutdown signal 165 can be read from a user interface. The control device 110 is configured to disconnect the signal connection 120 in response to a read shutdown signal 165. If emergency stop switches are installed or connected wirelessly, the power supply to the coupling device 150 could be interrupted by the control device 110 if at least one emergency stop switch is actuated. Alternatively, after actuating at least one emergency stop switch, coupling elements (relays, optical, magnetic, etc.) can be activated.The coupling device 150 can be disconnected from the power supply. Emergency stop switches or shutdown signals 165 can also be read by the control device 110, and when activated, the control device 110 can interrupt the power supply to the coupling device 150 and / or the coupling elements. Shutdown signals 165 can also be read by another control unit, and the activation can be reported to the control device 110. The control device 110 can then decide whether the signal connection 120 is disconnected or maintained.

[0037] According to one embodiment, the control device 110 is configured to monitor a further signal connection 170 of the vehicle 100. According to the embodiment shown here, the further signal connection 170 is configured to connect the control unit 130 and a further vehicle component 180 in a signal-transmitting manner. A further data signal 175 can be transmitted between the control unit 130 and the further vehicle component 180 via the further signal connection 170. The control device 110 is configured to tap the further data signal 175 and read it as an input signal. Furthermore, the control device 110 is configured to disconnect the signal connection 120 if the further data signal 175 violates at least one predefined signal criterion.In other words, in addition to the interruptible signal connection 120, the control device 110 also monitors other communication channels such as the further signal connection 170 and interrupts or disconnects the signal connection 120 if the control device 110 determines that orderly function, interaction or communication between the control unit 130 and the vehicle 100 is no longer possible, meaningful or advisable.

[0038] According to one embodiment, the control device 110 is configured to read a driving data signal 195, representing driving data of the vehicle 100, from an interface to a detection device 190 of the vehicle 100. The detection device 190 is configured, for example, to detect and provide at least an acceleration value, a speed, and additionally or alternatively other driving data of the vehicle. The control device 110 is configured to disconnect the signal connection 120 if the driving data of the vehicle 100 violates at least one predefined driving data criterion. In other words, the control device 110 is configured to monitor the vehicle data for exceedances of threshold values, such as exceeding a maximum speed or the like.If, for example, the vehicle 100 exceeds the speed limit despite corresponding specifications, the control device 110 can disconnect the signal connection to terminate the communication between the control unit 130 and the actuator 140.

[0039] According to one embodiment, the control device 110 is configured to output a control signal 115 to the actuator 140. More precisely, the control device 130 is configured to output the control signal 115 to the actuator 140 when the signal connection 120 through the control device 110 is interrupted. In particular, the control signal 115 is suitable for bringing the vehicle 100 into a safe state when used by the actuator 140. If the control device 110 decides to interrupt the signal connection 120 between the control unit 130 and the actuator 140, the control device 110 can send the control signal 115 to the actuator 140 to bring the vehicle 100 into a safe state. Thus, the control signal 115 can be suitable for reducing engine torque and / or controlling a brake.

[0040] Fig. Figure 2 shows a flowchart of a method 200 for control according to an exemplary embodiment. The method 200 can be implemented to control a signal connection of a vehicle. The method 200 for control is carried out in conjunction with or using the device made of Fig. 1 or a similar device. More precisely, by carrying out method 200, a signal connection can be controlled which represents a signal-transmitting connection between at least one control unit of a vehicle and at least one actuator of the vehicle.

[0041] In step 210 of the input process, an input signal is read in the control procedure 200. Subsequently, in step 220 of the control process, the signal connection is controlled to establish, monitor, and / or disconnect the signal connection depending on the input signal. In other words, in step 220 of the control process, the signal connection is controlled depending on the input signal, whereby in step 220 of the control process, the signal connection is established, monitored, and / or disconnected.

[0042] In particular, if the signal connection was interrupted in step 220 of the control process, a control signal is output to the at least one actuator in step 230 of the output process, according to one embodiment. This control signal is suitable for bringing the vehicle into a safe state when used by the at least one actuator.

[0043] The embodiments described and shown in the figures are only examples. Different embodiments can be combined completely or with respect to individual features. An embodiment can also be supplemented by features from another embodiment.

[0044] Furthermore, the process steps according to the invention can be repeated and carried out in a different order than described.

[0045] If an embodiment includes an “and / or” connection between a first feature and a second feature, this can be interpreted as meaning that the embodiment according to one embodiment has both the first feature and the second feature, and according to another embodiment either only the first feature or only the second feature. Reference sign 100 vehicles 110 Control device or control device 115 Control signal 120 signal connection 130 control unit 135 data signal 140 actuator 150 coupling device 155 Control signal 160 Functional equipment 165 Switch-off signal 170 additional signal connections 175 additional data signal 180 more vehicle equipment 190 Recording device 195 Driving data signal 200 methods for controlling 210 Step of the reading process 220 steps of steering 230th step of spending

Claims

[1] Device (110) for controlling a signal connection (120) of a vehicle (100), wherein the signal connection (120) represents a signal-transmitting connection between at least one control unit (130) of the vehicle (100) and at least one actuator (140) of the vehicle (100), wherein the at least one control unit (130) is configured to control the operation of the vehicle (100) in the context of highly automated driving, characterized by, that the device (110) is configured to establish and / or monitor and / or disconnect the signal connection (120) depending on an input signal (135, 165, 175, 195), wherein the device (110) is arranged on its own circuit board with a separate power supply and signal connection (120) from the at least one control unit (130), and that the device (110) is configured to check a signal (135) transmitted via the signal connection (120) as an input signal for compliance with at least one predefined signal criterion in order to monitor the signal connection (120). [2] Device (110) according to claim 1, characterized by that the device (110) is designed separately from the at least one control unit (130). [3] Device (110) according to any one of the preceding claims, characterized by, that the device (110) is designed to establish and / or disconnect the signal connection (120) by controlling a coupling device (150), wherein the coupling device (150) is connected in the signal connection (120). [4] Device (110) according to any one of the preceding claims, characterized by , that the device (110) is designed to disconnect the signal connection (120) if a signal (135) transmitted via the signal connection (120) violates at least one predefined signal criterion as an input signal. [5] Device (110) according to any one of the preceding claims, characterized by that the device (110) is configured to disconnect the signal connection (120) if a shutdown signal (165) is read in as an input signal by the device (110), in particular wherein the shutdown signal (165) represents an emergency shutdown signal. [6] Device (110) according to any one of the preceding claims, characterized by , that the device (110) is designed to disconnect the signal connection (120) if a further signal (175) transmitted via a further signal connection (170) of the vehicle (100) violates at least one predefined signal criterion as an input signal, wherein the further signal connection (170) concerns the at least one control unit (130) and / or the at least one actuator (140). [7] Device (110) according to any one of the preceding claims, characterized by , that the device (110) is designed to disconnect the signal connection (120) if the device (110) detects that the vehicle's (100) driving data violates at least one predefined driving data criterion. [8] Device (110) according to any one of the preceding claims, characterized bythat the device (110) is configured to output a control signal (115) to the at least one actuator (140), wherein the control signal (115) is suitable for bringing the vehicle (100) into a safe state when used by the at least one actuator (140). [9] Method (200) for controlling a signal connection (120) of a vehicle (100), wherein the signal connection (120) represents a signal-transmitting connection between at least one control unit (130) of the vehicle (100) and at least one actuator (140) of the vehicle (100), wherein the method (200) is carried out using a device (110) according to one of the preceding claims, characterized by , that the procedure (200) comprises the following steps: Reading (210) an input signal (135, 165, 175, 195); and Control (220) the signal connection (120) to establish and / or monitor and / or disconnect the signal connection (120) depending on the input signal (135, 165, 175, 195). [10] Computer program product with program code stored on a machine-readable medium and usable for carrying out the method (200) according to claim 9, when the computer program product is executed on a computer or device (110) according to any one of claims 1 to 8.

Images