Operating device with function monitoring of the switching state detection of at least one associated, operable switching element, associated use and procedure

Description

[0001] The invention relates to an operating device comprising a switching element operable by an operator, such as a switch or push-button, and a first microcontroller for determining the respective switching state of the switching element. These microcontrollers typically have an analog-to-digital converting input to determine the switching state of the switching element based on the potential applied to the input. ISO 26262 specifies the technical effort required to ensure the functional reliability of the operating device ("functional safety"), depending on the safety-relevant nature of the failure of the vehicle function controlled by the operating device. This applies, for example, to the microcontroller to be used.This microcontroller is comparatively expensive and complex to construct, especially if it has multiple inputs, for example, for determining the switching states of multiple switching elements, and may be difficult to obtain in the event of a shortage due to a crisis. Being stuck in the detection range is a common failure mode for microcontrollers in motor vehicles. Other failures include problems such as values ​​outside the detection range, low values ​​outside the detection range, and an offset between the actual (nominal) value and the measured value. A microcontroller stuck in the detection range has failed in such a way that it generates a constant signal that lies within the normal detection range; this is particularly problematic and difficult to detect.A conventional plausibility diagnosis involves comparing the measured values ​​of a first microcontroller based on a first signal with the measured values ​​of a second microcontroller based on a second signal, where the first and second signals are correlated signals, to determine whether one of the first and second microcontrollers is stuck in the detection range by comparing the absolute difference between the signals with an error limit. If the absolute difference is too large, at least one of the measured values ​​is interpreted as meaning that the associated microcontroller is stuck in the detection range and faulty. In practice, the error limit for this type of plausibility diagnosis is set quite high to minimize false indications of a fault by the diagnosis.Consequently, this type of plausibility diagnostic is limited to diagnosing microcontrollers that have a significant amount of offset or those that are stuck in the sensing range at a value far from the nominal value, so this type of plausibility diagnostic has a detection range similar to an out-of-range diagnostic and is limited in sensitivity to that of that diagnostic.

[0002] DE 10 2017 127047 A1 describes an R2R resistor network for monitoring the state of a large number of switches.

[0003] Against this background, there was a need for an operating device in which function monitoring is reliably ensured, in particular the microcontroller can be reliably detected if it becomes stuck in the detection area, and in which function monitoring compliant with ISO 26262 can be implemented comparatively simply and thus cost-effectively. This object is achieved by an operating device according to claim 1. An equally advantageous use and a method for function monitoring are each the subject of the independent claims. Advantageous embodiments are the subject of the respective dependent claims. It should be noted that the features individually listed in the patent claims can be combined with one another in any technologically expedient manner and demonstrate further embodiments of the invention.The description, particularly in connection with the figures, further characterizes and specifies the invention.

[0004] The invention relates to an operating device comprising a first microcontroller with at least one first measuring input, which is designed to convert a respective measuring potential present at the first measuring input into a respective associated detection result dependent on the respective measuring potential. According to the invention, a voltage source with a supply voltage predetermined by two supply potentials is also provided.

[0005] The device according to the invention further comprises a resistor network to which the supply voltage is applied, wherein the first measuring input of the first microcontroller is electrically connected to a first tap on the resistor network.

[0006] According to the invention, at least one switching element is integrated into the resistor network, the switching state of which can be changed from one switching state to the other by operation, touch, and / or actuation by an operator. For example, the switching element is an electromechanical switch or pushbutton, or a capacitive or resistive sensor switching element.

[0007] According to the invention, the resistance network is designed such that a different switching potential applied to the first measuring input is assigned to the respective switching state, and at least one switching potential differs from the supply potentials, preferably all switching potentials differ from the supply potentials,

[0008] According to the invention, a second microcontroller is further provided, which is higher-level to the first microcontroller and is designed to receive the respective detection result from the first microcontroller and output it to a higher-level control unit. "Higher-level" means that the second microcontroller is not only interposed during the data transmission of the detection result from the first microcontroller to the control unit, but also decides on its forwarding to the control unit based on a functional test triggered by it.

[0009] For this purpose, the invention provides an active component that is integrated into the resistor network and can be controlled by the second microcontroller. This component is used to set the measurement potential present at the first measurement input to a disturbance potential that differs from all switching potentials by influencing the resistor network. For example, the active component is an electromechanical switch or a semiconductor-based switching element, such as a transistor. For example, the active component switches an additional branch in the resistor network. The disturbance potential is preferably located between the supply potentials.

[0010] According to the invention, the second microcontroller is designed to at least temporarily suppress subsequent output of the detection result to the higher-level control unit if the first microcontroller fails to detect the interference potential during control of the active component. The inventive design allows for reliable detection of a malfunction of the first microcontroller, but in particular, its jamming in the detection range. In particular, microcontroller-based detection can be easily converted into an ISO 26262-compliant design by simply expanding it with a higher-level check by another microcontroller.

[0011] The resistance network is preferably designed as a Wheatstone bridge. For example, the resistance network comprises two current branches connected in parallel between the supply potentials, each consisting of a plurality of series-connected resistors, of which at least one resistance can be changed by the active component, preferably by selectively connecting further resistors in parallel or by selective bridging.

[0012] The resistor network is preferably designed as an R2R resistor network. This makes it possible to evaluate more than two switching states per switching element, or the switching state of more than one switching element, with a single microcontroller input.

[0013] To increase sensitivity to electromagnetic interference, the first microcontroller has a second measurement input that is electrically connected to a second tap in the resistor network that is different from the first tap and is designed to determine the detection result from a potential difference between the measurement potential applied to the first measurement input and the second measurement input. For example, the first and second taps are each located on a different branch and are each located between two resistors of the resistor network designed as a Wheatstone bridge.

[0014] Preferably, two switching elements are provided, the switching states of which are changed from at least two switching states by actuation of an operator, wherein the switching elements are integrated in different branches of the resistance network.

[0015] Preferably, the active component is periodically controlled by the second microcontroller. For example, the second microcontroller verifies the reliability of the first microcontroller based on the repeated detection of the interference potential.

[0016] Preferably, the second microcontroller is designed to report a fault to the higher-level control unit.

[0017] The invention further relates to the use of the operating device in one of the previously described embodiments in a motor vehicle for functional monitoring of a safety-relevant switching state detection,

[0018] The invention further relates to a method for functional monitoring of a switching state detection system, comprising the following steps. In a provision step, an operating device in one of the previously described embodiments is provided. In a control step of the method according to the invention, the active component is controlled such that the measurement potential applied to the first measurement input is at an interference potential that differs from all switching potentials by influencing the resistor network. In a simultaneous or subsequent step, the otherwise provided output and transmission of the detection result from the second microcontroller to a higher-level control unit are suspended according to the invention in the event that the interference potential was not previously detected by the first microcontroller during the control of the active component by the second microcontroller.This allows a malfunction of the microcontroller, but especially its jamming in the detection area, to be reliably detected.

[0019] Other advantageous objects, benefits and implementations of this invention will become more apparent from the detailed description of a specific embodiment in conjunction with the accompanying drawings, in which: Fig. 1 represents an embodiment of an electronic circuit diagram of the device according to this invention.

[0020] The invention relates to an operating device 1 comprising a first microcontroller C1 with a first measurement input ADC1 and a second measurement input ADC2, each of which is designed to convert a measurement potential applied to the first measurement input ADC1 or second measurement input ADC2 into a respective associated detection result dependent on the respective measurement potential. Furthermore, a voltage source with a supply voltage predetermined by two supply potentials U and GND is provided. The supply voltage formed from the supply potentials U and GND is applied to a resistor network W.

[0021] The first measuring input ADC1 of the first microcontroller C1 is electrically connected to a first tap A1 of the resistor network W, while a second tap A1 of the resistor network W is electrically connected to the second measuring input ADC2 of the first microcontroller C1. The resistor network W is designed as a Wheatstone bridge, so the resistor network W comprises two current branches I1, I2 connected in parallel between the supply potentials U, GND, each with several series-connected resistors per current branch I1, I2, namely R1, R4 in current branch I2 and R3, R6 and R8 in current branch I1. Here, the first tap A1 is in the first branch I1 and the second tap A2 is in the second branch I2, each between two resistors of the resistor network W designed as a Wheatstone bridge.

[0022] Furthermore, two switching elements S1 and S2 are provided which are integrated in the resistor network W, the switching state of which can be changed from one switching state to the other from at least two switching states by operation, touching and / or actuation by an operator. For example, the first switching element S1 and the second switching element S2 are each an electromechanical switch or button. Depending on the switching state of the switching element S1, the resistor R7 is connected in parallel with the resistor R6, while depending on the switching state of the switching element S2, the resistor R2 is connected in parallel with the resistor R1, so that the switching potential which depends on the switching state of the switching elements S1, S2 is present at the first measuring input ADC1 and the second measuring input ADC2.

[0023] The resistance network W is designed such that a different switching potential is assigned to the respective switching state of the first and second switching elements S1 S2, at least per measuring input, and all switching potentials differ from the supply potentials U and GND.

[0024] The first microcontroller C1 is designed to detect the switching potentials present at the first measuring input ADC1 or second measuring input ADC2 as operating input of the first switching element S1 or the second switching element S2 by differential evaluation and to transmit them to a higher-level microcontroller C2 via a first data bus BUS1.

[0025] The second microcontroller C2, which is higher-level than the first microcontroller C1, is provided and configured to receive the respective detection result of the first microcontroller C1 and to output it to a higher-level control unit U via a second data bus BUS 2. "Higher-level" means that the second microcontroller C2 is not only interposed on the path of data transmission of the detection result from the first microcontroller C1 to the control unit U, but also decides on the forwarding to the control unit U depending on a functional test triggered by it.

[0026] For this purpose, the invention provides an active component ES, which is integrated into the resistor network W and can be controlled by the second microcontroller C2 via a control line SS. This component ES is designed to set the measurement potential applied to the first measurement input ADC1 and the second measurement input ADC2 to a noise potential that differs from all switching potentials by influencing the resistor network W. Here, the active component ES is a semiconductor-based switching element, such as a transistor. The noise potential can be different for the first measurement input ADC1 and the second measurement input ADC2.

[0027] The second microcontroller C2 is configured to at least temporarily suppress subsequent output of the detection result to the higher-level control unit U in the event of a non-reaction of the first microcontroller C1 to the presence of the interference potential during the activation of the active component ES. The inventive design allows for reliable detection of a malfunction of the first microcontroller C1, but in particular, its jamming in the detection range.

Claims

1. Operating device (1), comprising: a first microcontroller (C1) having at least a first measurement input (ADC1), which is designed for converting a measurement potential present in each case at the first measurement input (ADC1) into a respectively associated detection result dependent on the respective measurement potential; a voltage source having a supply voltage predefined by two supply potentials (U, GND); a resistor network (W) to which the supply voltage is applied, wherein the first measurement input (ADC1) is electrically conductively connected to a first tap (A1) at the resistor network (W); at least one switching element (S1, S2) which is integrated in the resistor network (W) and whose switching state out of at least two switching states is changed by operation on the part of an operator; wherein the resistor network (W) is designed such that the respective switching state is assigned a different switching potential present at the first measurement input (ADC1), and at least one switching potential differs from the supply potentials (U, GND); a second microcontroller (C2), which is superordinate to the first microcontroller (C1) and is designed to receive the respective detection result of the first microcontroller (C1) and to output it to a superordinate control unit (U); an active component (ES) integrated in the resistor network (W) and controllable by the second microcontroller (C2), in order that the measurement potential present at the first measurement input (ADC1) is put at an interference potential differing from all the switching potentials as a result of influencing of the resistor network (W); wherein the second microcontroller (C2) is designed, in the case where the detection result of the first microcontroller (C1) does not correspond to that of the interference potential during the control of the active component (ES), to suppress a subsequent output of the detection result to the superordinate control unit (U) at least temporarily.

2. Operating device (1) according to Claim 1, wherein the resistor network (W) is designed as a Wheatstone bridge.

3. Operating device (1) according to either of the preceding claims, wherein the resistor network (W) is designed as an R2R resistor network.

4. Operating device (1) according to any of the preceding claims, wherein the first microcontroller (C1) comprises a second measurement input (ADC2), which is electrically conductively connected to a second tap (A2) differing from the first tap (A1) in the resistor network (W) and is designed to determine the detection result from a potential difference between the measurement potentials respectively present at the first measurement input (ADC1) and the second measurement input (ADC2).

5. Operating device (1) according to any of the preceding claims, comprising two switching elements (S1, S2) whose switching states out of at least two switching states are changed by actuation on the part of an operator and the switching elements (S1, S2) are integrated in different branches of the resistor network (W).

6. Operating device (1) according to any of the preceding claims, wherein the active component (ES) is a semiconductor-based switching element.

7. Operating device (1) according to any of the preceding claims, wherein the active component (ES) is periodically controlled by the second microcontroller (C2).

8. Operating device (1) according to any of the preceding claims, wherein the second microcontroller (C2) is designed to report an interference situation to the superordinate control unit (U).

9. Use of the operating device (1) according to any of the preceding claims in a motor vehicle for the functional monitoring of a safety-relevant switching state detection.

10. Method for the functional monitoring of a switching state detection comprising the following steps: providing an operating device (1) according to any of the preceding Claims 1 to 8; controlling the active component (ES) in such a way that the measurement potential present at the first measurement input (ADC1) is at an interference potential differing from all the switching potentials as a result of influencing of the resistor network (W); suppressing an output of the detection result from the second microcontroller (C2) to the superordinate control unit (U) for the case where the detection result of the first microcontroller (C1) does not correspond to that of the interference potential during the control of the active component (ES) by the first microcontroller (C1), said control being brought about by the second microcontroller (C2).