Method for controlling the operation of a vehicle and control unit and external computer for carrying out the method

Abstract

A method for controlling the operation of a vehicle (1) is proposed, wherein an engine (2) of the vehicle takes an energy source from a storage device (3) of the vehicle to operate the engine (2). A quantity of a permissible energy source introduced into the storage device (3) is determined. During operation of the engine, a consumption of the energy source by the engine (2) is determined from operating data of the vehicle (1). The plausibility of the consumption is checked by comparing the quantity of permissible energy source introduced into the storage device (3) with the quantity of energy source consumed. If a deviation is detected between the quantity of permissible energy source introduced and the quantity of energy source consumed, the operation of the vehicle (1) is restricted.

Description

State of the art

[0001] The invention is based on a method and a control device and an external computer according to the class of the independent patent claims.

[0002] DE 10 2021 206 395 A1 already discloses a method for operating a vehicle in which a fuel consumption calculated in the vehicle is compared with the amount of fuel refueled. Comparing these two values can improve the determination of fuel consumption in the vehicle. Advantages of the invention

[0003] The inventive method for controlling the operation of a vehicle or the corresponding control unit or the corresponding external computer according to the class of the independent claims makes it possible to check whether the vehicle is being operated only with a permissible energy source. This makes it possible to ensure that specifications regarding the operation of the vehicle only with a permissible energy source are met. The specifications can be defined, for example, by legal or contractual framework conditions for the operation of the vehicle. This makes it possible to ensure that the vehicle is operated only with a specified permissible energy source.

[0004] Further advantages and improvements arise from the features of the dependent patent claims. By using a signature that is assigned to the vehicle, a defined quantity of permissible energy source is clearly assigned to a vehicle. This ensures that a dispensed quantity of permissible energy source can only be used by one vehicle. This method is particularly secure if an external computer is used to transmit the signature. Alternatively, this can also be achieved through direct communication between a dispensing device and the vehicle. To increase the accuracy of determining the vehicle's consumption, the fill level of the energy source storage can also be used. If the use of an impermissible energy source is detected, the operation of the vehicle is restricted.This is particularly advantageously achieved through measures that still allow the vehicle to operate but reduce its value. This procedure can be implemented particularly easily using a control unit for controlling the vehicle's engine. The procedure is particularly secure when an external computer is used that communicates with a vehicle's control unit. Description

[0005] In the Fig. 1 schematically shows a vehicle 1 and a dispensing device 5 for an energy source. The vehicle 1 has an engine 2 and a storage device for the energy source 3. Furthermore, the vehicle also has a computer or control unit 4 for controlling the processes in the vehicle 1. The dispensing device for the energy source also has a computer 6 for controlling the processes of the dispensing device 5. The vehicle 1 can, for example, be a conventional vehicle with an internal combustion engine. Accordingly, a liquid fuel, for example gasoline or diesel, is used as the energy source. In this case, the engine 2 is an internal combustion engine and the storage device 3 is a tank. Alternatively, the vehicle can also be designed as an electric vehicle, in which the engine 2 is designed as an electric motor and the storage device 3 is designed as a battery.Accordingly, the dispensing device 5 for the energy source is designed as a fuel pump or filling station for a liquid fuel or as a charging station for electrical energy.

[0006] The aim is to ensure that the vehicle is only powered by a permitted energy source. In the case of liquid fuel, this could, for example, be a synthetic fuel produced in a CO2-neutral manner or a biofuel with a high ethanol content. Such synthetic fuels are also referred to as e-fuels. In the case of electrical energy, the permitted energy source could, for example, be electrical energy generated from non-fossil sources, such as wind power or solar energy.

[0007] For simplification, the further description assumes a fuel pump or filling station for liquid fuel as the dispensing device 5 and an internal combustion engine 2 and a tank 3 as the engine 2 and storage device 3.

[0008] To ensure that a vehicle 1 is only operated with a permissible energy source, each refueling of the tank 3 by the filling station 5 with the permissible fuel is logged and compared with the actual consumption of the vehicle 1. If the consumption of the vehicle 1 is determined to be too low, it is assumed that the fuel was refueled with an impermissible fuel and the operation of the vehicle 1 is restricted. This reliably prevents the operation of the vehicle 1 with an impermissible fuel. To ensure that the tank of the vehicle 3 has been refueled with an permissible fuel, a signature is generated by the filling station 5 during each refueling process. This signature contains cryptographically encrypted information about the admissibility and the quantity of fuel dispensed. The encryption ensures that this information cannot be falsified.The signature is transmitted to the control unit 4 so that the vehicle has information about the amount of permissible fuel filled.

[0009] Furthermore, the control unit 4 determines the amount of fuel consumed by evaluating data from the vehicle 1. For this purpose, vehicle operating data are taken into account, for example signals from sensors (for example, for engine speed, intake air mass flow, boost pressure, fuel pressure, temperatures, oxygen concentration in the exhaust gas, vehicle speed, vehicle weight, vehicle position, ambient conditions, tank level), control signals to actuators (for example, fuel injectors or ignition coils), or the calculated engine power or the calculated engine torque. Furthermore, environmental data of the vehicle 1, for example, route information (gradient or gradient, altitude above sea level) or weather data, can be taken into account. This information, in particular the weather data, can also be transmitted to the vehicle 1 via a communication connection.

[0010] The signature of each refueling process can be transmitted from the gas station 5 to the vehicle 1 in various ways. One possibility is a direct communication connection, for example, via Wi-Fi or other radio connections. Alternatively, an intermediate station can be used, such as a mobile phone of a vehicle user, which receives the information from the gas station 5 and then transmits it to the vehicle 1. Another possibility is for the user of the vehicle 1 to receive the signature via a corresponding code number, which they then manually enter into an input device in the vehicle.

[0011] Furthermore, it must be ensured that the signature, ie the information indicating the admissibility of the fuel and the fuel quantity, is not used more than once on multiple vehicles. For this purpose, the signature, which is generated by the filling station 5, must be assigned to the vehicle 1 into whose tank 3 the fuel was filled. A method for such an assignment of the signature to a vehicle is described in the Fig. 2 shown.

[0012] In the Fig. 2 will again be a vehicle 1 and a petrol station 5 with the same elements and functions as in the Fig.1. In addition, however, an external computer 7 is also shown, which can also be designed as a computer network, as a computer server, or as a cloud. The computer 7 is in communication with the gas station 5 and the vehicle 1 and ensures that the signature is assigned to only one vehicle, namely the vehicle into whose tank 3 the permitted fuel was filled. The communication connection between the computer 7 and the vehicle 1 is usually ensured by a radio connection, for example via a mobile network. The communication connection between the computer 7 and the gas station 5 can also be established via a radio connection or via a cable connection, for example an internet connection.

[0013] The signature can be assigned to the vehicle in various ways. In the first option, gas station 5 sends a signature to vehicle 1, and vehicle 1 forwards this signature, along with the identity of vehicle 1, to external computer 7. The comparison between the amount of permissible fuel refueled and the vehicle's consumption is then performed in external computer 7, which can thus prevent multiple use of the same signature. Alternatively, it is also possible for gas station 5 to send the signature only to external computer 7, and vehicle 1 to only receive information from gas station 5 about retrieving the signature from external computer 7. The comparison between the amount refueled and the vehicle's consumption is then performed in engine control unit 4 of vehicle 1.Depending on where the comparison between the amount of fuel refueled and the vehicle's consumption takes place, more or less regular or continuous communication between the vehicle 1 and the external computer 7 is required.

[0014] Furthermore, a signature can also be assigned to a vehicle 1 if a unique identity of vehicle 1 is communicated to gas station 5 during refueling. Gas station 5 can then generate a signature that, in addition to the admissibility of the fuel and the quantity, also indicates the identity of the vehicle. This signature can then only be used by the vehicle whose identity was used to generate the signature.

[0015] To compare the amount refueled and the amount consumed, a sliding view of a predefined number N of refueling operations is expediently used. The algorithm stores or calculates values related to the last N refueling operations, where N is a fixed, sufficiently large number, for example, N = 20. The control unit 4 detects a refueling operation when the signature containing the information about the permissible amount of fuel is transmitted.

[0016] The stored variables are stored in ring buffers of length N: During the first N refueling operations after commissioning of the control unit, the variables are stored with ascending indices; index 1 corresponds to the first refueling operation, 2 to the second, etc. From the Nth refueling operation onwards, index N corresponds to the last refueling operation, N-1 to the second to last, etc.

[0017] The algorithm is described below as it works starting with the Nth refueling. The algorithm adjustments during the phase before the Nth refueling are immediately apparent.

[0018] The following notation is used below: T denotes the fill level T of the tank as determined by a tank level sensor.

[0019] The following sizes are saved: A(1), A(2), ..., A(N) is the quantity of permissible fuel taken up during refueling in the unit litres. B(1), B(2), ..., B(N) denotes the quantities of calculated fuel consumption in the unit litres, where B(N) is the fuel consumption since the last refuelling, i.e. a number increasing during engine operation; B(N-1) is the fuel consumption between refuelling operations N-1 and N, B(N-2) is the fuel consumption between refuelling operations N-2 and N-1, etc. T_VOR(1), T_VOR(2), ..., T_VOR(N) - the fuel levels immediately before refueling in liters, measured while the vehicle is stationary using the fuel level sensor. It is assumed that at the time of determining the fuel level before refueling, the vehicle has been stationary with the engine off for some time (e.g., 30 seconds). This can be ensured, for example, by a time-controlled locking of the fuel cap. This ensures that the fuel in the tank is no longer moving, as fuel movement could affect the measurement data from the fuel level sensor.

[0020] The variables A(K), B(K), and T_VOR(K) (for K = 1, ..., N) remain stored even when the control unit is turned off. When the control unit detects a refueling process, the variables are updated, or B(N) is initialized to 0.

[0021] The sums SA(K) of the fuel quantities consumed during the last K refuelings and the sums SB(K) of the last K calculated fuel consumption quantities are calculated. The values are calculated according to the following rules: SA(1)=A(N) SA(K)=A(N−K+1)+...+A(N) for K=2,...,N SB(1)=B(N) SB(K)=B(N−K+1)+...+B(N) for K=2,...,N

[0022] If the calculated fuel consumption quantities B(K) and the tank levels T(K) were exact, the following would have to apply at any time for all K = 1, ..., N: SB(K)=T_VOR(N−K+1)+SA(K)−T

[0023] If the sum of the calculated consumption SB(K) were greater than the right-hand side of equation (1), this would be an indication of the intake of non-permitted fuel.

[0024] If K=N, T_VOR(1) indicates the tank level before the first of the N refueling operations. This prevents a K number of refueling operations with a very small amount from canceling the tank's refill with an inadmissible fuel. Under normal user behavior, where refilling typically occurs when the tank level is low, the amount T_VOR(1) is relatively small and negligible compared to the sum of SB(N) and SA(N).

[0025] However, it should be noted that both the determination of the fuel level and the calculation of fuel consumption by the vehicle are subject to tolerances. Furthermore, the fuel level determination in a moving vehicle is less accurate than in a vehicle that has been stationary for some time and whose engine has been switched off for some time. Strictly speaking, the quantities A(K) measured by the supply units are also subject to tolerances, but in the following, it is assumed that these tolerances are negligible, as they are significantly smaller than those in the determination of consumption by control unit 4.

[0026] For the true fuel level T_REAL in a vehicle that has been standing for some time with the engine switched off, a relationship typically applies T−DTU(T)≤T_REAL≤T+DTO(T)

[0027] The safety margins DTU(T) (Difference Tank Bottom) and DTO(T) (Difference Tank Top) are functions of the measured tank level T. The values for DTU(T) and DTO(T) are determined during vehicle development and stored accordingly.

[0028] For the true fuel consumption B_REAL for the interval over which SB(K) is determined, a relationship typically applies FU×SB(K)≤B_REAL≤FO×SB(K) if SB(K)≥SB_MIN

[0029] FU, FO, and SB_MIN are values determined and stored during vehicle development. This applies to safety factors FU < 1 and FO > 1, for example, FU = 0.95 and FO = 1.05. For SB_MIN, for example, the tank volume is a plausible value. SB_MIN ensures that the calculated quantity is sufficient.

[0030] For a vehicle that has been stationary for some time with the engine switched off, a fairly accurate measurement of the current tank level T is possible. If SB(K) ≥ SB_MIN, the following must apply: FU×SB(K)≤T_VOR(N−K+1)+DTO(T_VOR(N−K+1))+SA(K)−T+DTU(T)

[0031] When the vehicle is moving, a reliable measurement of the fuel level T is not possible, as the fuel quantity can only be measured inaccurately due to the vehicle's movements. Therefore, the current fuel level T should not be taken into account. However, the following must always apply:

[0032] If SB(K) ≥ SB_MIN: FU×SB(K)≤T_VOR(N−K+1)+DTO(T_VOR(N−K+1))+SA(K)

[0033] For K=N these formulas simplify to: FU×SB(N)≤T_VOR(1)+DTO(T_VOR(1))+SA(N)−T+DTU(T) and FU×SB(N)≤T_VOR(1)+DTO(T_VOR(1))+SA(N)

[0034] If the tank quantity T_VOR(1) is small compared to the quantities that were filled by the K tank operations, then T_VOR(1) can be neglected and the formulas simplify further to: FU×SB(N)≤SA(N)−T+DTU(T) and FU×SB(N)≤SA(N)

[0035] Formula 4 simply means that the sum of the calculated fuel quantities multiplied by a safety margin must be less than the sum of the fuel quantities filled plus the quantity still in the tank plus a safety margin.

[0036] Formula 5 simply means that the sum of the calculated fuel quantities multiplied by a safety factor must be less than the sum of the fuel quantities filled.

[0037] If, through the evaluation of formulas 4 or 5, 4' or 5', 4" or 5", implausible vehicle operation is detected, which suggests the use of non-permitted fuel, the use of the vehicle is restricted. Before such a restriction is imposed, a warning or notice may initially be issued in stages, and the vehicle user is requested to restore normal operation. Depending on the extent of the detected use of non-permitted fuel, further measures may then be taken in an escalating manner, such as limiting engine power or driving speed or preventing the engine from restarting.

[0038] If the plausibility check for fuel consumption is performed in control unit 4, the vehicle's usage restrictions are triggered by control unit 4. If the plausibility check for fuel consumption is performed in the external computer 7, these measures are triggered by the external computer 7, which then instructs the control unit 4 to implement the restrictions. To lift the usage restrictions for vehicle 1, the vehicle user must generally contact a competent authority or the operator of the external computer 7. Typically, a usage restriction is triggered by refueling with an unauthorized fuel. This can then be remedied by paying a fine, after which the vehicle user receives a signature lifting the usage restrictions. This signature can then also be transmitted via the external computer 7.Another possible scenario is a monitoring malfunction, which is then detected by an authorized workshop. In this case, the workshop could then issue a corresponding signature to vehicle 1 to lift the restriction. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] DE 10 2021 206 395 A1

[0002]

Claims

[1] Method for controlling the operation of a vehicle (1), wherein an engine (2) of the vehicle takes an energy source from a storage device (3) of the vehicle for operating the engine (2), wherein a quantity of a permissible energy source introduced into the storage device (3) is determined, wherein during operation of the engine, a consumption of the energy source by the engine (2) is determined from operating data of the vehicle (1), wherein the plausibility of the consumption is checked by comparing the quantity of permissible energy source introduced into the storage device (3) with the consumed quantity of the energy source, characterized by that if a discrepancy is detected between the quantity of permissible energy source introduced and the quantity of energy source consumed, the operation of the vehicle (1) is restricted. [2] Method according to claim 1, characterized bythat when the storage device (3) of the vehicle is filled, a signature is assigned to the vehicle (1), the signature indicating the quantity of the energy source and the admissibility of the energy source, and that only the quantity of admissible energy source is used for the comparison. [3] Method according to claim 2, characterized by that the signature is generated by a delivery device (5) for the energy carrier, that the signature is transmitted to an external computer (7) and is assigned to the vehicle by the external computer (7). [4] Method according to claim 2, characterized by that the signature is generated by a delivery device (5) for the energy carrier, and that the signature is transmitted to the vehicle by direct communication between the delivery device (5) and the vehicle (1) or by input into an input device of the vehicle and is thus assigned to the vehicle. [5] Method according to claim 1, characterized bythat the filling level of the storage (3) for the energy source is also used to determine the deviation. [6] Method according to one of the preceding claims, characterized by that signals from vehicle sensors such as engine speed, intake air mass flow, boost pressure, fuel pressure, temperatures, oxygen concentration in the exhaust gas, vehicle speed, vehicle weight, vehicle position, ambient conditions, fill level or other sensor signals are used as operating data of the vehicle (1) for determining the consumption of the energy source by the engine (2). [7] Method according to one of the preceding claims, characterized by that a limitation of the output torque of the engine (2), the start of the engine (2), the vehicle speed, the power output of the engine (2) and / or the speed of the engine (2) are used as a limitation of the operation of the vehicle (1). [8] Method according to one of the preceding claims, characterized by that the method is carried out by a control unit (4) for controlling the engine. [9] Method according to one of the preceding claims, characterized by that the method is carried out by an external computer (7) which has a communication relationship with the control unit (4) of the engine. [10] Control device (4) for controlling a vehicle, with means for carrying out the method according to one of the preceding claims. [11] External computer (7) arranged for communication with a vehicle, with means for carrying out the method according to one of the preceding claims.

Images