METHOD FOR OPERATION OF A SAFETY-CRITICAL CONTROL DEVICE FOR A MOTOR VEHICLE AND CORRESPONDING MOTOR VEHICLE

Abstract

Method for operating a safety-critical control unit, wherein the control unit monitors the correct functioning of the control unit, at least one sensor or at least one actuator or several of these, and generates a warning to a driver in the presence of predetermined fault conditions, wherein at least in the case of a subset of fault conditions, a corresponding warning message is sent to the driver, characterized in that if no rectification of the fault is detected within a predetermined time period, corresponding data is transmitted to a vehicle manufacturer and / or service provider, and that the predetermined time period for rectification or until data transmission is increased from an initial value to a longer value if the driver acknowledges the warning message by actuating a predetermined control device.

Description

[0001] The invention relates to a method for operating a safety-critical control unit for a motor vehicle according to the preamble of claim 1 and to a corresponding motor vehicle therewith.

[0002] The generic patent EP 2 848 437 A1 describes a method for detecting suspension or steering damage in a vehicle. Upon detection of such damage, specific data such as date and time, mileage, tire pressure, vehicle location, and steering wheel position are stored in a vehicle memory unit, and a warning message is issued to the driver, indicating that an inspection at a workshop is required. The driver can then contact a workshop to arrange an inspection. However, to avoid relying on the driver to take (active) action or contact, it is proposed that such an incident or damage be automatically and wirelessly transmitted to a workshop or the vehicle manufacturer via a vehicle communication unit.

[0003] Furthermore, methods for controlling the activation of an occupant protection system are known, for example, from EP 1 062 132 B1 or EP 0 167 792 A1, in which, for example, the accident sensor performs an internal fault check at regular or irregular intervals and, upon fault detection, sends a signal to the control unit via the signal output terminal. Then, for example, the activation is blocked and / or a visual and / or audible warning is generated. The connection and data exchange can also take place via a vehicle bus, e.g., CAN or FlexRay.

[0004] German patent DE 102 49 440 A1 describes a method for monitoring the functionality of a weight-sensing system in a vehicle, in which the weight-sensing system issues a warning message when a threshold value for the force acting on the force sensor is exceeded, indicating possible damage to the weight-sensing system. The warning message can also be displayed visually in a vehicle instrument cluster, in particular as text and / or in the form of a signal light. Furthermore, it is proposed that the warning message be transmitted via a CAN (car area network) bus and / or stored in a fault memory.

[0005] Furthermore, DE 10 2009 014 624 A1 discloses a method for displaying malfunctions in motor vehicles with self-diagnostic control units that issue a warning to the driver in the event of a malfunction. Simultaneously, a recommended action is displayed along with the warning, depending on the severity of the fault, and the driver must acknowledge this action. Preferably, this display is only cleared after the driver has acknowledged the action. Alternatively or additionally, according to a further development of the invention, a safety mode is activated if the acknowledgement is not received within a predetermined time window.

[0006] Despite all this, it cannot be ruled out that the driver overlooks, ignores or forgets this warning and leaves the vehicle in this state for a longer period of time without an operational occupant protection system or other safety-critical control unit.

[0007] Furthermore, automatic emergency call systems for vehicles are known, for example, from DE 29 12 547 C2 and DE 196 50 176 A1, by means of which rescue services can be automatically notified in the event of an accident and directed to the accident site in a targeted manner to ensure that timely assistance can be reliably guaranteed.

[0008] The object of the present invention is to further increase safety. This object is achieved by the features of the independent claims. Advantageous embodiments of the invention are set forth in the dependent claims, and combinations and embodiments of individual features are also conceivable.

[0009] Therefore, it is planned that data will be transmitted to a vehicle manufacturer and / or service provider if the fault is not rectified within a specified timeframe. In addition to rectification, a service technician may, if necessary, confirm the fault as repaired or delete it.

[0010] The applicant's unpublished German patent application DE 10 2015 219 402 A1 already describes a method for operating an occupant protection system, wherein the occupant protection system comprises at least one control unit, at least one sensor, and at least one occupant protection device, and a control unit monitors the correct functioning of the control unit, at least one sensor, or at least one actuator or several of these, and generates a warning to the driver in the event of predefined fault conditions. For at least one subset of fault conditions, a corresponding warning message is sent to the driver, which the driver must acknowledge by operating at least one predefined control device. If the warning message is not acknowledged by operating the predefined control device within a predefined time period, corresponding data is transmitted to a vehicle manufacturer and / or service provider.However, no check is carried out to determine whether or not the error has been corrected.

[0011] The specified time period for rectification or data transmission is extended when the driver acknowledges the warning message by activating the designated control. However, even this extended second time period is not unlimited. In one embodiment, without acknowledgment, data transmission occurs within a relatively short period of a few minutes to a maximum of a few days. Conversely, after acknowledgment, several days to weeks remain for repair, but data transmission always occurs after this second period has elapsed.

[0012] The data transmission preferably occurs via mobile phone, an existing mobile data connection, or SMS, and preferably includes vehicle-identifying data, the type of fault condition, and the time of its occurrence or the elapsed time without any control input. This data transmission allows the vehicle manufacturer or service provider to contact the driver via other channels, such as telephone, email, or similar methods, and prevent continued driving without a functioning, safety-critical control unit.

[0013] Preferably, the first data transmission starts a new time window and the data transmission is repeated cyclically if no correction of the error has been detected by the end of the time window.

[0014] It is irrelevant whether the procedure is executed in the safety-critical control unit or another control unit, and whether only a sensor, an occupant protection device, or the correct functioning of the control unit itself is monitored. Furthermore, the warning message, which must be confirmed by actuating at least one specified operating device, may only be triggered for a subset of fault conditions, i.e., not necessarily for all fault events.

[0015] The warning message to the driver can be visual or audible, can be presented as pictograms or in different languages, and preferably includes, in addition to the indication of the failure of the occupant protection system, the recommendation of an immediate visit to a workshop, the requirement for confirmation, and the consequences of non-confirmation.

[0016] For confirmation, a control device, its operating method, or a plurality of control devices or sequence is preferably chosen in such a way that an accidental "confirmation", i.e. operation without the intention of confirmation through actions in normal driving operation, can be excluded as far as possible.

[0017] Preferably, the confirmation by the driver by actuating the specified control device is logged in a memory, for example, the time of the confirmation is stored in the memory, i.e., not only the occurrence of the error and the warning, but also separately the actual confirmation by the driver is stored.

[0018] If the warning message is not acknowledged within a specified time period by activating the designated control, a restriction on the vehicle is preferably implemented in addition to data transmission. This, of course, depends significantly on the desired escalation level and must be defined individually for each vehicle.

[0019] In particular, one or more of the following measures are being considered: a) that the warning message remains permanently displayed b) that comfort features such as radio are not available or a telephone is only available for emergency calls c) that a speed limit is activated d) that restarting the vehicle after a stop is prevented

[0020] Accordingly, a safety-critical control unit, be it the display control unit, ESP control unit or the occupant protection system, will be equipped with a corresponding algorithm for carrying out the procedure, as well as a data interface to a means for reproducing the warning message and for receiving a signal from the specified operating device or for querying the operating device, and an interface to means for data transmission.

[0021] In a motor vehicle, a suitably equipped control unit is provided, as well as a means for displaying the warning message and transmitting data, or an existing means is adapted to carry out the procedure.

Claims

[1] Method for operating a safety-critical control unit, wherein the control unit monitors the correct functioning of the control unit, at least one sensor or at least one actuator or several of these, and generates a warning to a driver in the presence of predetermined fault conditions, wherein at least in the case of a subset of fault conditions a corresponding warning message is sent to the driver, characterized by , that if no rectification of the fault is detected within a specified time period, corresponding data will be transmitted to a vehicle manufacturer and / or service provider, and that the specified time period for rectification or until data transmission will be increased from an initial to a longer period if the driver acknowledges the warning message by operating a specified control device. [2] Method according to claim 1, characterized by, that with the first data transmission a new time window is started and the data transmission is repeated cyclically, unless a correction of the error has been detected by the end of the time window. [3] Method according to any of the preceding claims, characterized by , that the data transmission contains at least one of the following data: - vehicle-identifying data, - the type of fault condition, - the time of occurrence of the fault condition, - whether and when the warning message was confirmed by activating the control device. [4] Motor vehicle comprising a control unit and a means for displaying a warning message and means for transmitting data for carrying out the method according to one of the preceding claims.