Cascaded shutdown system in the event of fluid entering the steering system of a vehicle

Description

Technical area

[0001] The invention relates to a vehicle with a control unit designed for electrically controlling an integrated vehicle device, in particular a steering system, a brake, or an electric drive train. The vehicle can be a motor vehicle or another type of land, air, or water vehicle. Technical background

[0002] Water ingress into steering systems cannot be ruled out and can be caused, for example, by defective boots. Typically, after a certain period of time, a hard shutdown occurs via a non-directional error detection in the associated control electronics. However, this may no longer be acceptable, especially with heavy vehicles and the resulting high steering forces.

[0003] Various liquid and water sensors are known in the prior art for detecting the ingress of moisture into a system. For example, German patent DE 1018649 B discloses a method for electrically indicated moisture measurement and an electrode for implementing the method. Furthermore, DE 10 2016 007 297 A1, for example, describes a measured value change detection device designed such that, in the presence of water at the device, a change in an electrical resistance detected by the device is measured or can be measured. Furthermore, for electromechanical steering systems with an axle-parallel drive, the skipping of a drive belt after sufficiently prolonged contact with water and corresponding detection algorithms is known as a shutdown measure.

[0004] The document EP 3 672 859 discloses a drive component, in particular a steering system for a motor vehicle, comprising an electric motor and at least one control unit, wherein the electric motor has at least one winding, wherein the winding has connection points for power electronics of the at least one control unit, wherein the drive component has at least one sensor for detecting liquid, wherein the sensor has an evaluation and control unit which is connected to the connection points of the at least one winding, wherein the evaluation and control unit is designed to generate a test signal and to detect an impedance change.

[0005] The document DE 10 2015 115 118 A1 discloses a device for operating a steering system having at least one electrically operable actuator, with at least one carrier substrate on which a first electronic system and a second electronic system, at least partially redundant thereto, for operating the actuator are arranged, wherein the at least one carrier substrate is sealed in a liquid-tight manner at least in regions with a protective layer, characterized in that the first electronic system is at least substantially sealed by the protective layer, and in that the second electronic system is at least partially free of a protective layer.

[0006] Existing shutdown systems based on water ingress detection using water sensors are characterized by a high rate of false detections and considerable additional costs. The solution using a skipping drive belt also has comparatively poor reliability.

[0007] The object of the present invention is to provide an alternative or improved shutdown mechanism for steering systems and other devices in a vehicle that are sensitive to water ingress. The invention is particularly directed at preventing a hard shutdown in the event of water ingress and / or at improving the detection of water ingress. Disclosure of the invention

[0008] This object is achieved by a vehicle with a control unit according to claim 1.

[0009] Further embodiments are specified in the dependent claims.

[0010] According to a first aspect, a vehicle, in particular a motor vehicle, is provided. It comprises an integrated vehicle device; and a control unit that is designed and configured to electrically control the integrated vehicle device, in particular a steering system, a brake, or an electric drive train, and for this purpose can comprise, for example, one or more printed circuit boards with control electronics formed thereon, which are generally referred to hereinafter as "hardware." The vehicle can be, in particular, a motor vehicle, but also any other land, air, or water vehicle. The said vehicle device can, in particular, be a steering system, a braking system, or, for example, an electric drive train.

[0011] The control unit is designed as a so-called dual-channel control unit, comprising a first control channel (hereinafter referred to as the "first channel") and a redundant second control channel (hereinafter referred to as the "second channel"), which is designed to independently control the vehicle device in the event of a failure of the first channel. At least some of the hardware components of the first channel are designed and arranged to be fluid-sensitive, such that fluid entering the control unit leads to a direct and / or automatic shutdown of the first channel. This can be achieved, for example, by connecting certain electrical conductors (tracks) of the first channel to one another by the incoming fluid (e.g., water), thereby causing a direct shutdown of the electrical circuit of the first channel.Alternatively or additionally, the first channel can be automatically switched off by a suitable algorithm, for example using appropriately programmed software, based on a relevant signal from one or more water sensors installed in the first channel.

[0012] In contrast to the first channel, hardware components of the second channel that could otherwise be damaged or affected by fluid ingress are designed and / or arranged in such a way that, if fluid (e.g., water) penetrates the control unit, the second channel remains fully functional for at least a predetermined period of time after the first channel has failed due to fluid ingress. This period of time, for example, several minutes or more, is selected to be sufficient to transfer the vehicle to a predetermined safe state—for example, for the vehicle to approach the right side of the road until it comes to a stop on the hard shoulder or on the right side of the road.

[0013] The invention is therefore based on so-called dual-channel control units, such as those used to achieve the required availability in steering systems or other safety-relevant systems in vehicles. One idea of ​​the invention is that a first channel should fail quickly if water or another harmful liquid enters the control unit, while the redundant second channel remains operational for a somewhat longer period. Some possible ways of achieving this are outlined below. With the second channel still functioning, the vehicle can be brought into a suitable safe state. The failure / deactivation of the first channel can be reliably detected, for example, using suitable software, and an appropriate error response can be triggered.

[0014] In other words, the control unit presented here is equipped with a cascaded shutdown system in the event of fluid ingress. This is ensured by targeted protection of only one of the two channels, for example, through a suitable / targeted arrangement of the associated hardware elements on one or more circuit boards in the control unit.

[0015] The invention can be used in particular in all steering systems with a two-channel, low-mounted control unit. It is also generally applicable to all other control units of this type (i.e., not only in steering systems) with high safety requirements and a certain probability of moisture ingress.

[0016] The control unit described herein is characterized by particularly high and reliable availability in the event of fluid ingress, even in safety-relevant applications (such as electrically assisted steering of a heavy vehicle or autonomous driving). It can be manufactured cost-effectively and with relatively little qualification effort. In principle, no additional components are required to implement the invention.

[0017] In particular, the control unit can be configured to control the vehicle device via the second channel to automatically transfer the vehicle to the predetermined safe state in the event of a fluid-related failure or shutdown of the first channel as described herein. Alternatively or additionally, a warning signal can be generated for vehicle occupants and / or bystanders, indicating fluid ingress into the control unit and prompting immediate, safe parking of the vehicle. A suitable warning signal can be, for example, visual, such as in the form of flashing or brightly lit symbols in signal colors such as red or orange, etc.; and / or acoustic, such as in the form of a loudspeaker announcement, and / or much more.In addition, the control unit can activate at least one predetermined preventive measure in the vehicle once the vehicle has been transferred to the predetermined safe state. This reliably prevents the vehicle from continuing to drive by on-board autonomous systems or uninformed drivers until the fluid ingress has been completely remedied with appropriate specialist measures. Such preventive measures can include, for example, a brake and / or steering wheel lock, or many other features.

[0018] According to the invention, the hardware of the second channel is designed to be liquid-protected, in contrast to the hardware of the first channel, exclusively or inter alia, by positioning the second channel higher than the first channel when the control unit is installed in a vehicle. In other words, this embodiment is based on the first channel of the control unit being geodetically arranged at the bottom and the second channel at the top. This is based on the general knowledge that water or other liquids generally flow downwards under the influence of gravity when they enter the control unit from the outside. This ensures that the first channel fails quickly when water enters, while the second remains operational for longer.

[0019] Alternatively or additionally, according to a further embodiment, the hardware of the second channel can be designed to be liquid-protected, in contrast to the hardware of the first channel, by protecting only the electronic components of the second channel against moisture with suitable additional protective measures (e.g., by painting). For this purpose, at least those hardware components of the second channel whose function would be impaired by liquid without such protective measures can be coated with a waterproof cover, such as a coating or a film or layer of rubber or plastic, etc.

[0020] In particular, the control unit can be divided into two separate, spatially and electrically completely separated sub-control units, with the first channel located in one sub-control unit and the second channel located in the other sub-control unit. This allows the differences in the design of both channels described herein to be implemented in a particularly simple and effective manner.

[0021] In particular, the hardware of the first channel can be specifically designed to reliably detect the ingress of liquid, which, for example, far exceeds the quantity of mere condensation of moisture from the air. This can prevent incorrect detection, which would lead to a direct or automatic shutdown of the first channel without any actual need. This can be achieved, for example, by ensuring that conductors (tracks) that are to be short-circuited to detect liquid ingress have a predetermined minimum distance from one another. Alternatively or additionally, several independent electrical and / or sensor components can be incorporated into the aforementioned detection system to prevent false detection. At comparatively low cost, this can ensure that an error reaction is only triggered when there is actually water in the system.

[0022] In this context, the first channel can, in particular, comprise one or more sensors designed to detect the ingress of liquid into the first channel and to output a corresponding signal to the control unit for automatically shutting off the first channel. Suitable liquid or moisture sensors, which may be based on electrical or other physical processes, are widely known in the prior art, as mentioned above. Brief description of the drawings

[0023] The above-described embodiments and design variants are explained in more detail below with reference to the examples shown in the accompanying drawings. The drawings are to be understood as schematic, i.e., they primarily serve to illustrate the general operating principle of the invention. Identical or corresponding elements bear the same reference numerals in the drawings. They show: Figure 1 shows an embodiment of a control unit of the type described herein for an electromechanical vehicle steering system, which is designed and configured to detect the ingress of moisture and the resulting cascaded shutdown; Figure 2 shows, for comparison, a circuit board of a conventional two-channel control unit with a geodetically random positioning of the circuit board in the vehicle; and Figure 3 shows a circuit board of the control unit of the Fig. 1 with hardware components of a first and a redundant second control channel formed thereon, wherein the second channel, in contrast to the first channel, is designed and arranged to be liquid-protected. Description of embodiments

[0024] Fig. 1 schematically shows an embodiment of a control unit 1 of the type presented herein for an integrated vehicle device, in a perspective side view. Purely by way of example, this is a control unit of an electromechanical steering system with an axle-parallel drive for a motor vehicle (not shown). The control unit 1 has a printed circuit board 2 with control electronics ("hardware") formed thereon. Below this, its other electrical and mechanical components, such as electromechanical actuators, can be housed in a housing 3 of the control unit 1.

[0025] The control unit 1 is designed and configured to detect moisture ingress and initiate a resulting cascaded shutdown. As a prerequisite for this, it has two independent control channels—a first and a second channel—whose hardware components are configured separately from one another on the circuit board 2.

[0026] Fig. 2 shows for comparison with an embodiment of the invention (which is shown in Fig. 3 shown) a circuit board 200 of a conventional two-channel control unit with a geodetically random positioning of the circuit board 200, which is illustrated with respect to the usual vehicle-specific coordinate system with mutually perpendicular longitudinal, transverse and vertical axes X, Y and Z. In the top view of the Fig. 2 Hardware components of a first channel 400 on the left and a redundant second channel 500 on the right are arranged at approximately the same height with respect to the vehicle height axis Z.

[0027] Fig. 3 shows, again in a top view, the circuit board 2 of the control unit 1 of the Fig. 1 with hardware components of a first channel 4 and a redundant second channel 5 formed thereon. In contrast to the conventional design according to Fig. 2 , is in Fig. 3 The second channel 5 is specially designed and arranged to be fluid-protected, in contrast to the first channel 4, whose design and arrangement are designed so that in the event of unwanted fluid entering the control unit 1, the first channel 4 is the first to be exposed to the fluid and fails before the second channel 5 is also affected. Due to the fluid-related failure of the first channel 4, the fluid ingress into the control unit 1 is detected, whereupon the still-functional second channel 5 is used to bring the vehicle into a safe state via the shortest possible route before the second channel 5 is also shut down.

[0028] For this purpose, the circuit board 2 is in Fig. 3 geodetically aligned (as shown with respect to the vehicle's own coordinate system with mutually perpendicular longitudinal, transverse, and vertical axes X, Y, and Z) such that hardware components of the first channel 4 are located lower in the vehicle than hardware components of the second channel 5 (as additionally indicated by arrows). Additionally, in this example, only hardware components of the second channel 5 are partially painted to protect against water or other liquids. It makes sense to only coat those elements of the second channel 5 with protective paint 6 that would otherwise react to moisture according to the circuit diagram and, in particular, are paintable.

[0029] The Fig. 3 The principle shown can be extended / applied analogously to any additional circuit boards (not shown) of the control unit 1 that may be present.

Claims

1. Vehicle, in particular a motor vehicle, comprising: - an integrated vehicle device; and - a control unit (1) which is designed and configured to electrically control the integrated vehicle device, in particular a steering system, a brake or an electric drive train, wherein - the control unit (1) comprises a first control channel (4) and a redundant second control channel (5) which is designed to independently control the vehicle device in the event of a failure of the first channel (4); - at least some of the hardware of the first channel (4) is designed and arranged to be sensitive to liquids such that liquid ingress into the control unit (1) leads to a directly or automatically induced shutdown of the first channel (4); and - hardware of the second channel (5) is designed and / or arranged to be protected against liquids such that the second channel (5) remains functional in the event of liquid ingress into the control unit (1), for at least a predetermined period of time which is sufficient to transfer the vehicle into a predetermined safe state, wherein, in contrast to the hardware of the first channel (4), hardware of the second channel (5) is designed to be protected against liquids, in that hardware of the second channel (5) is arranged higher than hardware of the first channel (4) with respect to a height direction (Z) of a vehicle's individual Cartesian coordinate system.

2. Vehicle according to claim 1, wherein the control unit (1) is configured, in the event of a shutdown of the first channel (4) induced by liquid ingress, - to control the vehicle device via the second channel (5) in order to transfer the vehicle into the predetermined safe state; and / or - to generate a warning signal for vehicle occupants and / or external persons indicating liquid ingress into the control unit (1), and to prompt the immediate parking of the vehicle in the predetermined safe state; and / or - to activate at least one predetermined measure to block further travel in the vehicle as soon as the vehicle has been transferred to the predetermined safe state.

3. Vehicle according to either of the preceding claims, wherein, - in contrast to the hardware of the first channel (4), hardware of the second channel (5) is designed to be protected against liquids, in that only hardware of the second channel (5) is at least partially covered with a waterproof cover, in particular a protective coating (6).

4. Vehicle according to any of the preceding claims, - which is divided into two separate sub-control units which are spatially and electrically separate from one another, - wherein the first channel (4) is accommodated in one of these sub-control units and the second channel (5) is accommodated in the other sub-control unit.

5. Vehicle according to any of the preceding claims, wherein - hardware of the first channel (4) is designed for reliable detection of liquid ingress, the quantity of which is multiple times greater than mere condensation of moisture from the air; and - the direct or automatic shutdown of the first channel (4) is based on this detection.

6. Vehicle according to any of the preceding claims, wherein - the first channel (4) comprises a sensor which is designed to detect liquid ingress into the region of the first channel (4) and to output a corresponding signal to the control unit (1) to automatically shut down the first channel (4).