System, in particular steering system, for a vehicle; method for operating a system, in particular steering system, for a vehicle

Abstract

System (1), in particular a steering system (1), for a vehicle, comprising a first subsystem (10) and a second subsystem (20) which are identically designed, wherein the first and the second subsystem (10, 20) are configured such that they determine their own state and communicate it to the respective other subsystem (20, 10), wherein the system (1) is further configured such that - in a normal operating mode - the first subsystem (10) is in a first state while the second subsystem (20) is in a second state, wherein the second state differs from the first state, in particular by a predetermined minimum state distance, characterized in that the first and the second subsystem (10, 20) are designed in such a way that they can recognize, on the basis of the state communicated by the respective other subsystem (10, 20), whether the respective other subsystem (10, 20) has a fault and under which operating conditions this fault has occurred, and in that in the event that the first or the second subsystem (10, 20) recognizes a fault in the respective other subsystem (10, 20), the respective subsystem (10, 20) sets its own state in such a way that it avoids the operating conditions under which the fault occurred in the other subsystem (10, 20).

Description

The invention relates to a system, in particular an electric steering system or a steerby-wire system, for a vehicle, having a first subsystem and a second subsystem which are of identical design. The invention further relates to a method for operating such a system.In the course of the technical progress in the field of vehicle technology, the vehicle guidance or driving has been and is increasingly automated stepwise, for example with the aid of driver assistance systems. Current research and development is aiming at increasing automation to the effect that driving can take place fully automatically or autonomously in the future. However, in order to ensure autonomous driving, special safety measures and special safety systems are required in order to avoid technically induced damage to persons and things or at least to reduce possible effects of technical disturbances and / or failures. Further, it is required that systems that enable autonomous driving continue to have their desired functionality in the event of an internal system fault. Such systems are referred to as "fail-active" systems."Fail-Active" systems are typically constructed as redundant systems. A redundant system comprises a plurality of, in particular two, different subsystems. The two different subsystems have the same functionality, but typically different designs and components. The advantage arises from two different subsystems that a disturbance due to a systematic error or design error in one of the two subsystems does not also occur in the other subsystem, in particular does not result in a simultaneous failure in both subsystems, with the result that the entire system does not fail, but the desired functionality continues-at least partially. However, different subsystems are associated with the disadvantage that the outlay and, associated therewith, also the costs for research and development, production and after-sales increase, in particular can be approximately doubled.DE 10 2022 203 853 A1 discloses a device for braking a vehicle, which comprises a brake system of redundant design at least in sections. In particular, a second brake control device is designed redundant to a first brake control device, wherein both brake control devices each comprise at least a first and a second computer device and a brake signal generator. The invention is distinguished in that the second computer devices of the two brake control devices are each connected via a data connection both to the first computer device of the first brake control device and to the first computer device of the second brake control device.DE 101 12 514 A1 discloses an X-by-wire system for a vehicle, which comprises at least one sensor for detecting an actuation of an input device, a control device for determining a setpoint actuating effect and an energy supply. The system is designed such that the sensor, control device, actuating system and power supply are each composed redundantly of first and second modules, wherein the modules form a module and are decoupled without reaction. The first modules are interconnected and form a first subsystem, while the second modules form a second subsystem which consists exclusively of the second modules.Against this background, the object is to provide an alternative "fail-active" system which provides a simple and more cost-effective redundancy.The object is achieved by a system, in particular a steering system or a steer-by-wire system, for a vehicle, having a first subsystem and a second subsystem which are of identical design, wherein the first and the second subsystem are configured in such a way that they determine their own state and communicate them to the respective other subsystem, wherein the system is further configured such that - in a normal operating mode - the first subsystem is in a first state while the second subsystem is in a second state, wherein the second state differs from the first state, in particular differs by a predefined minimum state interval.The system comprises a first subsystem and a second subsystem identical to the first subsystem. Due to the identity of the two subsystems, the effort and costs for the development, production and after-sales of the system decrease, since only one and not two different subsystems are contained in the system. Further, the first and second subsystems are configured to determine their own state and communicate it to the respective other subsystem. This results in the advantage that both subsystems know the state of the respective other subsystem in real time and can react to it depending on the situation, if necessary. In addition, the system is configured such that-in a normal operating mode-the first subsystem is in a first state while the second subsystem is in a second state, wherein the second state differs from the first state, in particular by a predefined minimum state interval. As a result of maintaining a minimum state interval, it can be ensured that the two subsystems are in different states, with the result that an error occurring in a specific state can only adversely affect one of the two subsystems. In other words, the advantage results that a minimum functionality of the system can be ensured at any time. Due to the identity of the two subsystems, a homogeneously redundant system can be referred to-at least in the normal operating mode. Overall, the invention has the advantage that an alternative system is provided which, owing to its homogeneity, i.e. the identity of the two subsystems, offers a simple and cost-effective solution for the provision of redundancy and thus also a (partial) reliability.The system in the sense of the invention is to be understood as meaning, in particular, a "fail-active" system. A "fail-active" system is understood to mean a fail-safe system which maintains a safe operating mode in the event of faults or faults in the system until corrective and / or bridging measures are taken. In a "fail-active" system, the functionality of the system can always be maintained-at least partially.According to the invention, it is provided that the first and the second subsystem are designed such that they can identify, on the basis of the state communicated by the respective other subsystem, whether the respective other subsystem has a fault and under which operating conditions this fault has occurred, and that in the case that the first or the second subsystem identifies a fault in the respective other subsystem, the respective subsystem sets its own state such that it avoids the operating conditions under which the fault occurred in the other subsystem. The term "state" is understood here to mean a vector of data which describes both the freedom from errors or-in the case of an error-the type of error and the operating conditions which-in the case of an error-are currently present or under which the error has occurred. The setting or control of the own state of the receiving subsystem following the detection of the fault in the other subsystem may be referred to as the system fault recovery avoidance strategy. The communication between the first and the second subsystem can be effected by means of one or more communication buses such as LIN, CAN or Ethernet, for example.A preferred embodiment of the invention provides that the first and second subsystems have identical hardware and identical software. By using identical hardware and software, the development effort and the production costs can be reduced. Furthermore, the communication between subsystems can be carried out with identical hardware and software with little outlay.In a preferred embodiment of the invention, it is provided that the first and the second subsystem are configured to actuate in each case one winding of an electric machine having two separate windings in such a way that the first subsystem generates a greater torque in the electric machine than the second subsystem. The first subsystem can generate, in particular in the normal operating mode, for example 55% or 60% of the total torque provided by the electric machine, so that an asymmetric torque distribution can be referred to.According to an advantageous embodiment of the invention, it is provided that the first and the second subsystem each comprise a first and a second observer for determining their own state. The first and the second observer are preferably identical, wherein an observer is to be understood as meaning in each case a software component or a model which reconstructs quantities which cannot be measured or are not measured from measured quantities. Thus, the determination of a state of its own is to be understood in particular as the estimation of the state of its own (subsystem) or of individual state variables.An advantageous embodiment of the invention provides that the first and the second subsystem are configured to generate an internal state vector for controlling their own state. The respective internal state vector can be, for example, an input variable for a subsystem controller of its own subsystem.A further subject matter of the invention is a method for operating a system, in particular a steering system, for a vehicle, having a first subsystem and a second subsystem, which are of identical design, wherein the first and the second subsystem determine their own state and communicate it to the respective other subsystem, wherein - in particular in a normal operating mode - the first subsystem is operated in a first state and the second subsystem is operated in a second state deviating from the first state, in particular by a minimum state distance.In the method according to the invention, the same technical effects and advantages can be achieved that have already been described in connection with the system according to the invention.According to the invention, it is provided that the first or the second subsystem recognizes an error in the respective other subsystem on the basis of the state communicated by the respective other subsystem, and-in a fault operating mode-the first or the second subsystem sets its own state in such a way that it avoids the state in which the error has occurred in the respective other subsystem.An advantageous embodiment of the invention provides that the first and second subsystem are operated with identical hardware and identical software.In a preferred embodiment of the invention, it is provided that the first and the second subsystem each drive a winding of an electric machine having two separate three-phase windings or an electric machine having a respective three-phase winding, wherein the first subsystem generates a greater electrical and mechanical torque than the second subsystem.According to an advantageous embodiment of the invention, it is provided that the first and the second subsystem determine their own states by means of a first and a second observer, respectively.An advantageous embodiment of the invention provides that the first and the second subsystem each generate an internal state vector for controlling its own state.Alternatively or additionally to the advantageous embodiments of the method described above, the advantageous features and embodiments disclosed in connection with the system according to the invention can also be used in the method, alone or in combination.Further details and advantages of the invention will be explained below with reference to the exemplary embodiment shown in the drawings. Shown herein: FIG. 1 schematically shows an exemplary embodiment of a system according to the invention having a first subsystem and a second subsystem; and FIG. 2 shows a detailed view of a subsystem from the exemplary embodiment according to FIG. 1.FIG. 1 schematically shows an exemplary embodiment of a system 1 according to the invention having a first subsystem 10 and a second subsystem 20, the first subsystem 10 and the second subsystem 20 being identical. The system 1 shown in FIG. 1 is a steering system 1, more specifically an electrohydraulic steering system 1, for a vehicle. The first subsystem 10 and the second subsystem 20 are configured to determine their own state and communicate them to the respective other subsystem 20, 10. Furthermore, the system 1 is configured such that-in a normal operating mode-the first subsystem 10 is in a first state while the second subsystem 20 is in a second state, wherein the second state differs from the first state, in particular differs by a predefined minimum state interval.The first and the second subsystem 10, 20 are designed such that they can identify, on the basis of the state communicated by the respective other subsystem 20, 10, whether the respective other subsystem 20, 10 has a fault and under which operating conditions this fault has occurred, and that in the case that the first or the second subsystem 10, 20 identifies a fault in the respective other subsystem 10, 20, the respective subsystem 10, 20 sets its own state such that it avoids the operating conditions in which the fault has occurred in the other subsystem 10, 20. The first and second subsystems 10, 20 comprise identical hardware and identical software.The first subsystem 10 is configured to actuate a first winding 101 of an electric machine 100. The second subsystem 20 is furthermore configured to actuate a second winding 102 of the electric machine 100. The first subsystem 10 generates 60% of the torque provided in the electric machine 100. The second subsystem 20 thus generates 40% of the torque of the electric machine 100. Specifically, the electric machine 100 drives a worm shaft, not shown, which in turn transmits torque to a tie rod for steering the vehicle. Alternatively, the motor torque can be transmitted to a ball screw via a belt drive, wherein the ball screw positions a steering rod.By means of a communication bus, e.g. a CAN bus 30, the first and the second subsystem 10, 20 can communicate with one another. This communication bus is preferably designed redundant, i.e. consists of two physical buses which transmit the same information, but preferably in different ways.FIG. 2 shows a detailed view A of the exemplary embodiment according to FIG. 1. The first subsystem 10 has a first observer 12 for determining its own state Z 1 in each case. The ascertained own state Z 1 of the first subsystem 10 is communicated to the second subsystem 20, not shown in FIG. 2, via the CAN bus 30. Analogously, a second observer of the second subsystem 20 determines its own state Z 2 and communicates it to the first subsystem 10 by means of the CAN bus 30.If a fault is detected in the respective other subsystem 10, 20, the first or second subsystem 10, 20 is transferred into a fault operating mode in which the first or second subsystem 10, 20 sets its own state Z 1, Z 2 in such a way that it is not the fault state detected in the respective other subsystem 10, 20 (avoidance strategy). For example, in the first subsystem 10, an error occurring in the second subsystem 20 is avoided by means of a first controller 13. For this purpose, the first subsystem 10 generates an internal state vector V 1 and supplies this to the first controller 13 as an input variable. The first controller 13 controls the first subsystem 10 such that the fault condition of the second subsystem 20 is avoided.The occurrence of a fault in one subsystem 10, 20 generally leads to the shutdown of this subsystem 10, 20.List of reference characters1 System 10 First subsystem 12 First observer 13 First controller 20 Second subsystem 30 CAN bus 100 Electric machine 101 First winding 102 Second winding A Detailed View Z 2 Own state of the second subsystem Z 1 Own state of the first subsystem V 1 Internal state vector of the first subsystem

Claims

System (1), in particular steering system (1), for a vehicle, having a first subsystem (10) and a second subsystem (20) which are of identical design, wherein the first and the second subsystem (10, 20) are configured in such a way that they determine their own state and communicate them to the respective other subsystem (20, 10), wherein the system (1) is furthermore configured such that - in a normal operating mode - the first subsystem (10) is in a first state while the second subsystem (20) is in a second state, wherein the second state differs from the first state, in particular differs by a predefined minimum state interval, characterized in that the first and the second subsystem (10, 20) are configured such that they can identify, on the basis of the state communicated by the respective other subsystem (10, 20), whether the respective other subsystem (10, 10), 20) has a fault and under which operating conditions this fault has occurred, and in the event that the first or the second subsystem (10, 20) detects a fault in the respective other subsystem (10, 20), the respective subsystem (10, 20) sets its own state in such a way that it avoids the operating conditions at which the fault occurred in the other subsystem (10, 20).The system (1) according to claim 1, characterized in that the first and second subsystems (10, 20) comprise identical hardware and identical software.The system (1) according to any one of the preceding claims, characterized in that the first and the second subsystem (10, 20) are configured to control a respective winding of an electric machine (100) having two separate windings in such a way that the first subsystem (10) generates a greater torque in the electric machine (100) than the second subsystem (20).System (1) according to one of the preceding claims, characterized in that the first and the second subsystem (20) each comprise a first and a second observer (12, 22) for determining their own state.Method for operating a system (1), in particular a steering system (1), for a vehicle, having a first subsystem (10) and a second subsystem (20) which are of identical design, wherein the first and the second subsystem (10, 20) determine their own state and communicate them to the respective other subsystem (20, 10), wherein - in particular in a normal operating mode - the first subsystem (10) is operated in a first state and the second subsystem (20) is operated in a second state which differs from the first state, in particular by a minimum state interval, characterized in that the first or the second subsystem (10, 20) identifies an error state in the respective other subsystem (10, 20) on the basis of the state communicated by the respective other subsystem (10, 20), and - in an interference operating mode - the first or the second subsystem (10, 20) sets the own state in such a way, that it is not the fault state detected in the respective other subsystem (10, 20).Method according to Claim 5, characterized in that the first and second subsystem (10, 20) are operated with identical hardware and identical software in each case.Method according to either of Claims 5 and 6, characterized in that the first and the second subsystem (10, 20) each drive a winding of an electric machine having two separate windings, the first subsystem (10) generating a greater torque in the electric machine than the second subsystem (20).Method according to one of Claims 5 to 7, characterized in that the first and the second subsystem (20) determine their respective own state by means of a first and a second observer (12, 22).

Images