Drive system for a vehicle

Abstract

The invention relates to a drive system for a vehicle, having an accelerator pedal (1) with an associated accelerator pedal control unit (3) which carries out a driving task when the accelerator pedal is actuated by the driver, the accelerator pedal control unit (3) being connected as a transmitter control unit to an assistance control unit (5) as a receiver control unit, which performs a driver-independent, automated driving task, wherein in particular the assistance control unit (5) deactivates the driver-independent, automated driving task in the presence of a valid driver-side kickdown actuation.

Description

[0001] Drive system for a vehicle

[0002] DESCRIPTION:

[0003] The invention relates to a drive system for a vehicle according to the preamble of claim 1 and to a method for operating such a drive system.

[0004] A generic vehicle has an assistance function or a piloted function that, when activated, takes over driving from the driver. If the driver deactivates the assistance function, the driver takes over. The vehicle's drive system has an accelerator pedal with an associated accelerator pedal control unit, which performs a driving task when the driver presses the accelerator pedal. The accelerator pedal control unit is connected to an assistance control unit that performs the assistance function. If the driver presses the kickdown button, the assistance function or the piloted function is deactivated, so the driver is again responsible for taking over the driving task.

[0005] In the above-mentioned assistance system, a fully depressed accelerator pedal (kickdown) must be identified to detect driver takeover. However, even a slight application of the accelerator pedal must not deactivate the assistance function. Therefore, the detection and evaluation of accelerator pedal information in the assistance control unit are highly safety-relevant. If driver takeover is incorrectly detected, the assistance function would deactivate even though the driver may not be ready to take over. Therefore, in the state of the art, all components, from the acquisition of the raw accelerator pedal values ​​and their processing to the output, are developed with the highest safety integrity (ASIL = automotive safety integrity level) to ensure that the required information reaches the assistance control unit with the required safety integrity (ASIL).The required safety integrity of each component leads to very high procedural and technical requirements.

[0006] DE 101 50 422 A1 discloses a method and a device for determining a driver's input. DE 10 2016 011 175 A1 discloses a device for detecting the actuation of an accelerator pedal of a motor vehicle. WO 2020 / 180140 A1 discloses a brake pedal system for an electronically controlled vehicle brake.

[0007] The object of the invention is to provide an assistance system for a vehicle and a method for operating such an assistance system, which can be manufactured with reduced effort compared to the prior art without any loss of safety integrity.

[0008] The object is solved by the features of claim 1. Preferred further developments of the invention are disclosed in the subclaims.

[0009] It should be emphasized that the invention primarily relates to a drive system in which a kickdown actuation can be detected with high safety integrity, by means of which a driver-independent, automated driving task can be deactivated. However, the invention is not limited to this specific application. Rather, the invention is also generally applicable to the detection of accelerator pedal actuation. However, for the sake of clarity, the detection of a kickdown actuation will be referred to below as an example:

[0010] The invention is based on a drive system that has an accelerator pedal control unit with an associated accelerator pedal. When the driver presses the accelerator pedal, the driver performs a driving task. The accelerator pedal control unit is connected as a transmitter control unit to an assistance control unit as a receiver control unit. The assistance control unit can perform a driver-independent, automated driving task. If the driver presses the kickdown button, the assistance function or the piloted function is deactivated, so that the driver is again responsible for taking over the driving task. To reliably detect such a kickdown operation with the accelerator pedal, the following measures are taken according to the characterizing part of claim 1: Two accelerator pedal sensors are assigned to the accelerator pedal.The first accelerator pedal sensor detects a first raw accelerator pedal value, while the second accelerator pedal sensor independently detects a second raw accelerator pedal value in parallel operation. The first accelerator pedal sensor is connected to the accelerator pedal control unit via a first signal path and, in the further signal path, to the assistance control unit. In the same way, the second accelerator pedal sensor is connected to the accelerator pedal control unit via a second signal path and, in the further signal path, to the assistance control unit. If the signals are processed correctly, both accelerator pedal sensors detect a kickdown actuation by the driver. Accordingly, a kickdown signal is generated in each signal path. The assistance control unit checks the plausibility of the two kickdown signals to ensure that the signals are processed correctly in the signal paths.

[0011] With the signal processing according to the invention, the safety integrity of the accelerator pedal control unit can be reduced. Through clever signal processing and plausibility checks in the assistance control unit (i.e., the receiver control unit), parts of the functional chain (i.e., the accelerator pedal control unit) can be developed with lower safety integrity requirements (e.g., ASIL B) than the accelerator pedal and the assistance control unit. The accelerator pedal and the assistance control unit, on the other hand, are developed with higher safety integrity requirements (e.g., ASIL D).

[0012] The signal paths from the accelerator pedal to the assistance control unit are described below: For example, the raw accelerator pedal value, available with ASIL B(D) quality, for example, can be sent unadulterated from one of the accelerator pedal sensors to the assistance control unit (receiver control unit). Together with the accelerator pedal information processed in the accelerator pedal control unit, these two pieces of information can be meaningfully combined in the assistance control unit, ultimately achieving the required high level of safety integrity (ASIL D) (see decomposition rules of ISO 26262).

[0013] The accelerator pedal control unit routes one of the two ASIL B(D) information of the accelerator pedal (accelerator pedal raw values) to the assistance control unit (i.e. receiver control unit), together with the test information checksum and message counter.

[0014] For example, the following error scenario can occur in signal processing: Because the accelerator pedal control unit is less trustworthy (i.e., has a lower safety integrity), the message is corrupted during routing. According to the invention, the error determination is carried out as follows: The assistance control unit (receiver control unit) receives the processed accelerator pedal information from the accelerator pedal control unit (transmitter control unit) with ASIL B(D integrity) via the first signal path. In addition, the receiver control unit receives the raw information from the other accelerator pedal sensor via a second signal path with ASIL B(D) and can generate the same information with ASIL B(D). To obtain kickdown information with ASIL D, the results from the first signal path and the second signal path must be linked.In order for the assistance control unit to detect falsification of the accelerator pedal raw value in the second signal path, the assistance control unit must check the integrity of the accelerator pedal information with the additionally received test information (message counter, checksum).

[0015] As already mentioned above, it should be emphasized that in addition to the information “kickdown”, the information “accelerator pedal pressed” or “accelerator pedal not pressed” can also be displayed using the same procedure.

[0016] In a technical implementation, signal processing in the first signal path can be carried out as follows: The accelerator pedal control unit can have a comparator module that compares the first accelerator pedal raw value with a kickdown limit. The comparator module sets the kickdown signal to "kickdown performed" (i.e., K1 = yes) if the first accelerator pedal raw value is greater than the kickdown limit. In addition, latent error diagnostics can be performed in the accelerator pedal control unit. During latent error diagnostics, a diagnostic module compares the first and second accelerator pedal raw values. If there is a significant deviation between the two accelerator pedal raw values, the diagnostic module detects a latent error. In this case, the diagnostic module sets diagnostic information to an error value.Alternatively, if both accelerator pedal raw values ​​match, the diagnostic module does not detect a latent error, so the diagnostic module sets the diagnostic information to a "no error" value. The diagnostic information generated in the diagnostic module is added to the first kickdown signal. It should be emphasized that, according to ISO 26262, latent error diagnoses may be performed with lower integrity. Against this background, the latent error diagnosis according to the invention can easily be performed in the accelerator pedal control unit, which is preferably developed with a lower safety integrity requirement (e.g., ASIL B) than the accelerator pedal and the assistance control unit.

[0017] In a further technical implementation, signal processing in the second signal path can be performed as follows: Routing can occur in the second signal path in the accelerator pedal control unit, transmitting the second accelerator pedal raw value to the assistance control unit without signal processing. In this case, the second accelerator pedal raw value is only processed in the assistance control unit. This is done using a comparator module that compares the second accelerator pedal raw value with the kickdown threshold. The comparator module sets the kickdown signal to "Kickdown performed" (i.e., K2=yes) if the second accelerator pedal raw value is greater than the kickdown threshold.

[0018] Preferably, the second signal path can have end-to-end protection. With the help of the end-to-end protection, a signal transmission error in the second signal path resulting from faulty routing in the accelerator pedal control unit can be identified. The end-to-end protection can generally be constructed as described in EP 2 454 864 B1, to which reference is hereby made. For example, the end-to-end protection in the assistance control unit can have a test module that performs protection by checking a checksum and a message count value.

[0019] The end-to-end protection for the second signal path is described below using an example: For the checksum test, a sender calculation module (assigned to the accelerator pedal control unit) calculates a sender checksum from the second accelerator pedal raw value using a calculation formula (before the routing path in the accelerator pedal control unit). The sender checksum is added to the second accelerator pedal raw value. A receiver calculation module (assigned to the assistance control unit) is provided in the signal path after the routing path. This calculates a receiver checksum using the same checksum calculation formula, specifically from the received second accelerator pedal raw value. The test module also compares the sender checksum with the receiver checksum. If the sender checksum differs from the receiver checksum, the test module detects a transmission error.

[0020] The end-to-end protection message counter (also assigned to the accelerator pedal) increases a message counter value for each sampling cycle of the second accelerator pedal raw value by one increment, for example, by the value one. For each sampling cycle, the current message counter value is added to the second accelerator pedal raw value. The assistance control unit's test module checks the message counter value for plausibility. In particular, it checks whether the current message counter value has increased compared to the message counter value of the last received second accelerator pedal raw value. If this is not plausible, a transmission error is detected.

[0021] The test module located in the assistance control unit generates test information after the test has been completed. The test module sets the test information to an error value if the message count value checked in the test module is not plausible and / or if the receiver checksum and sender checksum do not match. Alternatively, the test module sets the test information to an error-free value if the message count value checked in the test module is plausible and the two checksums match. The test information generated by the test module is added to the second kickdown signal.

[0022] Similarly, the first signal path can also have end-to-end protection, which can be used to identify a signal transmission error in the first signal path. Unlike the second signal path, the calculation module and the message counter are not assigned to the accelerator pedal, but rather to the accelerator pedal control unit. Therefore, in the first signal path, the security data (i.e., the sender checksum and the message counter value) are not added to the first accelerator pedal raw value upstream of the accelerator pedal control unit in the signal flow direction, but rather directly in the accelerator pedal control unit.

[0023] A core element of the invention is that both the path from the accelerator pedal to the accelerator pedal control unit and the path from the accelerator pedal control unit to the assistance control unit are protected with end-to-end protection. In order for the accelerator pedal raw values ​​to be processed in the accelerator pedal control unit (e.g., for a latent error check), the accelerator pedal control unit must extract the data from both accelerator pedal raw values ​​and check them for validity before they are submitted to the latent error check. The validity check of this data takes place in the accelerator pedal control unit as part of the end-to-end protection. In addition, the second accelerator pedal raw value is forwarded to the assistance control unit with the security data SD (i.e., sender checksum CS and message counter value BZ).

[0024] In a preferred embodiment, the two signal paths can be routed to an evaluation module of the assistance control unit. The evaluation module is in signal communication with the program module of the first signal path and with the program module of the second signal path. Therefore, the evaluation module firstly records the first kickdown signal with associated diagnostic information and with associated test information. Secondly, the evaluation module records the second kickdown signal with associated test information. On this basis, the evaluation module detects a valid driver-side kickdown actuation, provided the following conditions are met in combination:

[0025] - the first kickdown signal K1 is set to K1 = yes;

[0026] - the diagnostic information added to the first kickdown signal is set to a no-error value;

[0027] - the test information added to the first kickdown signal is set to a no-error value.

[0028] - the second kickdown signal K2 is set to K2=yes;

[0029] - the test information added to the second kickdown signal is set to a no-error value.

[0030] An embodiment of the invention is described below with reference to the attached figures.

[0031] They show:

[0032] Fig. 1 shows a drive system for a vehicle in a schematic block diagram;

[0033] Fig. 2 to 6 in views corresponding to Figure 1 different operating states of the drive system.

[0034] Figure 1 shows a drive system for a vehicle in a block diagram to the extent necessary for understanding the invention. The program components of the block diagram have been selected for ease of understanding of the invention and do not represent the actual software architecture in the drive system. The drive system has an accelerator pedal 1 with an associated accelerator pedal control unit 3, which performs a driving task when the driver actuates the accelerator pedal. The accelerator pedal control unit 3, acting as a transmitter control unit, is connected to an assistance control unit 5, acting as a receiver control unit. With the aid of the assistance control unit 5, a driver-independent, automated driving task can be performed without driver intervention.If the driver initiates a kickdown, the assistance control unit 5 deactivates the assistance function or the piloted function, so that the driver is again responsible for taking over the driving task. In the figures, the accelerator pedal 1 and the assistance control unit 5 each have a high safety integrity level (ASIL D), while the accelerator pedal control unit 3 has a reduced safety integrity level (ASIL B).

[0035] As shown in Figure 1, two accelerator pedal sensors 7, 9 are assigned to the accelerator pedal 1. These sensors each independently detect a first accelerator pedal raw value F1 and a second accelerator pedal raw value F2. The first accelerator pedal sensor 7 is connected to the accelerator pedal control unit 3 via a first signal path I and, in the further signal path, to the assistance control unit 5. Similarly, the second accelerator pedal sensor 9 is connected to the accelerator pedal control unit 3 via a second signal path II and, in the further signal path, to the assistance control unit 5.

[0036] In the accelerator pedal control unit 3, the first accelerator pedal raw value F1 is processed using a comparator module 11, which compares the first accelerator pedal raw value F1 with a kickdown limit value y (for example, y = 95%). The comparator module 11 generates a kickdown signal K1. The kickdown signal K1 is set to "kickdown performed," i.e., K1 = yes, if the first accelerator pedal raw value F1 is greater than the kickdown limit value y. If the first accelerator pedal raw value F1 is less than the kickdown limit value y, the kickdown signal K1 is set to "kickdown not performed," i.e., K1 = no.

[0037] The accelerator pedal control unit 3 also checks for latent errors between the accelerator pedal raw values ​​F1, F2 (e.g., drift errors) and reveals these errors. This test is sufficient with ASIL B (ISO 26262-4:2018, 6.4.2.5). Latent error diagnosis is performed using a diagnostic module 13, which compares the first accelerator pedal raw value F1 and the second accelerator pedal raw value F2. If there is a significant deviation between the two accelerator pedal raw values ​​F1, F2, the diagnostic module 13 detects a latent error, e.g., a drift error. In this case, the diagnostic module 13 sets a diagnostic information DI to an error value of "not OK." Alternatively, if both accelerator pedal raw values ​​F1, F2 match, the diagnostic module 13 does not detect a latent error. In this case, the diagnostic module 13 sets the diagnostic information DI to an error-free value of "OK."According to Figure 1, the diagnostic information DI generated in the diagnostic block 13 is added to the first kickdown signal K1 at a program block 15.

[0038] The accelerator pedal control unit 3 not only generates the accelerator pedal information based on the sensor information F1:

[0039] - Accelerator pedal value, ASIL B(D)

[0040] - Kickdown activated, ASIL B(D)

[0041] - Kickdown not activated, ASIL B(D), but also the following accelerator pedal information:

[0042] - Accelerator pedal pressed, ASIL B(D)

[0043] - Accelerator pedal not pressed, ASIL B(D)

[0044] In summary, the accelerator pedal control unit 3 can only provide information with ASIL B(D), since the basic softwareZ-hardware of the accelerator pedal control unit 3 only provides measures against E / E errors with max. ASIL B(D).

[0045] In contrast to the first signal path I, in the second signal path II the accelerator pedal raw value F2 is routed in the accelerator pedal control unit 3 via a routing path 20, along which the second accelerator pedal raw value F2 is transmitted to the assistance control unit 5 without signal processing.

[0046] Accelerator pedal control unit 3 therefore routes the raw accelerator pedal value F2 of accelerator pedal 1, along with the backup data SD described later, to assistance control unit 5. If a different bus protocol is used, repackaging into other bus messages may be necessary. Errors can also occur during repackaging and routing. These errors are detected in assistance control unit 5 based on the backup data SD.

[0047] According to the invention, the signal processing of the second accelerator pedal raw value F2 is not performed in the accelerator pedal control unit 3, but rather in the assistance control unit 5. The signal processing is performed using a comparator module 17, which compares the second accelerator pedal raw value F2 with the kickdown limit value y. The comparator module 17 sets the kickdown signal K2 to "kickdown performed," i.e., K2 = yes, if the second accelerator pedal raw value F2 is greater than the kickdown limit value y. If the second accelerator pedal raw value F2 is less than the kickdown limit value y, the kickdown signal K2 is set to "kickdown not performed," i.e., K2 = no.

[0048] Faulty routing in the accelerator pedal control unit 3 can lead to a signal transmission error in the second signal path II. To identify such a signal transmission error, an end-to-end protection 19 is provided, as is already known in principle from EP 2 454 865 B1. The end-to-end protection 19 has a receiver test module 21 in the assistance control unit 5, which performs a checksum check and with the help of a message counter 23.

[0049] For checksum verification, the end-to-end protection 19 has – in addition to the message counter 23 – a sender calculation module 25. Both the message counter 23 and the sender calculation module 25 are assigned to the accelerator pedal 1. The sender calculation module 25 calculates a sender checksum Cs using a checksum calculation formula Cs=f(x). In practice, the calculation formula is a polynomial, for example, CRC8 or 16-bit. To simplify understanding of the invention, the calculation formula in the sender calculation module 25 and the receiver test module 27 is indicated in a roughly simplified manner as follows: Cs = F2 / 2. In Figure 1, the sender checksum Cs and the message count value BZ form the security data SD, which is added to the second accelerator pedal raw value F2 before the routing path 20. The backup data SD is already generated in accelerator pedal 1, since this information must be available with the highest safety integrity.

[0050] After the routing path 20, the end-to-end protection 19 has a receiver calculation module 27. This module calculates a receiver checksum CE from the received second accelerator pedal raw value F2 using the same checksum calculation formula. In the receiver checksum module 27, the sender checksum Cs is compared with the receiver checksum CE. The receiver checksum module 27 detects a transmission error if the sender checksum Cs differs from the receiver checksum CE.

[0051] As already mentioned above, in Figure 1, the message counter 23 and the sender calculation module 25 of the end-to-end protection 19 are assigned to the accelerator pedal 1. The accelerator pedal control unit 3 routes the second accelerator pedal raw value F2 together with the protection data SD (i.e., the message count BZ and the sender checksum Cs) – without signal processing – simply through. The message counter 23 increases a message count BZ for each sampling cycle of the second accelerator pedal raw value F2 by an increment, for example, by one. For each sampling cycle, the current message count BZ is added to the second accelerator pedal raw value F2. In the receiver test module 21, the message count BZ is checked for plausibility. In particular, it is checked whether the current message count BZ has increased compared to the message count BZ of the last received second accelerator pedal raw value F2. If the data is not plausible, a transmission error is detected.

[0052] The receiver test block 21 sets the test information PI2 to an error value of "not OK" if the message count value BZ checked in the receiver test block 21 is not plausible and / or if the receiver checksum CE does not match the sender checksum Cs. Alternatively, the receiver test block 21 sets the test information PI2 to an error-free value of "OK" if the message count value BZ checked in the receiver test block 21 is plausible and the two checksums CE and CS match. The test information PI2 generated by the receiver test block 21 is added to the second kickdown signal K2 at a program block 29.

[0053] The first signal path I is also assigned an end-to-end protection 19, which is essentially identical in structure to the end-to-end protection 19 of the second signal path II described above, but is only indicated in the figures for reasons of clarity. Unlike the second signal path II, in the first signal path I, the protection data SD of the end-to-end protection 19 (i.e., the transmitter checksum Cs and the message counter value BZ) are added to the kickdown signal K1 in the accelerator pedal control unit 3 in order to satisfy ASIL B(D) integrity.

[0054] A core of the invention is that both the path from accelerator pedal 1 to accelerator pedal control unit 3 and the path from accelerator pedal control unit 3 to assistance control unit 5 are protected with end-to-end protection 19. This means that in order to process the data (for example, latent error testing in diagnostic module 13), accelerator pedal control unit 3 must extract the data from both the accelerator pedal raw value F1 and the accelerator pedal raw value F2 and check them for validity before they can be used, for example, for latent error testing.

[0055] The validity check of this data is performed in the accelerator pedal control unit 3 as part of the end-to-end validation 19, which is not illustrated by program blocks in the figures. The validity check is performed in the same way as described using the receiver test blocks 21 and the receiver calculation blocks 27 in the assistance control unit 5.

[0056] In addition, the accelerator pedal raw value F2 is forwarded to the assistance system with the backup data SD (i.e., the sender checksum CS and the message count value BZ). The receiver test module 21 sets the test information PI1 to an error value of "not OK" if the message count value BZ checked in the receiver test module 21 is not plausible and / or if the receiver checksum CE does not match the sender checksum Cs. Alternatively, the receiver test module 21 sets the test information PI1 to an error-free value of "OK" if the message count value BZ checked in the receiver test module 21 is plausible and the two checksums CE and CS match. The test information PI1 generated by the receiver test module 21 is added to the first kickdown signal K1.

[0057] In the further signal course, both the first kickdown signal K1 (with added diagnostic information DI and test information PI1) and the second kickdown signal K2 with added test information PI2 are fed to an evaluation module 31 which is located in the assistance control unit 5.

[0058] The evaluation module 31 detects a valid driver-side kickdown actuation if the following conditions are met in combination:

[0059] - first kickdown signal K1 set to K1 = yes;

[0060] - the diagnostic information DI added to the first kickdown signal K1 is set to an error-free value “iO”;

[0061] - the test information PI1 added to the first kickdown signal K1 is set to an error-free value “iO”;

[0062] - second kickdown signal K2 set to K2=yes;

[0063] - the test information PI2 added to the second kickdown signal K2 is set to an error-free value “iO”.

[0064] Figure 2 describes error-free signal processing in the drive system in which the driver has not performed a kickdown operation of the accelerator pedal 1. Accordingly, the two accelerator pedal raw values ​​F1, F2 are at 0%. In both the accelerator pedal control unit 3 and the assistance control unit 5, the kickdown signals K1, K2 are therefore set to K1 = no and K2 = no, respectively. On this basis, the evaluation module 31 recognizes that no valid kickdown operation has been performed by the driver. Figure 3 also shows error-free signal processing in which the driver has performed a kickdown operation. Accordingly, the two accelerator pedal raw values ​​F1, F2 are at 100%. In the accelerator pedal control unit 3, the first kickdown signal K1 is set to K1 = yes, and in the assistance control unit 5, the second kickdown signal K2 is set to K2 = yes. The diagnostic information DI determined in the accelerator pedal control unit 3 is set to an error-free value iO.Likewise, the test information PH, PI2 determined in the assistance control unit 5 is set to an error-free value of OK. The evaluation module 31 of the assistance control unit 5 therefore recognizes that a valid driver-side kickdown actuation has been performed.

[0065] Figure 4 shows faulty signal processing in which the driver has not performed a kickdown operation, so that the two accelerator pedal raw values ​​F1, F2 are at 0%. However, in Figure 4, an error 32 has occurred in the signal processing of the accelerator pedal control unit 3, in which the comparator module 11 incorrectly sets the first kickdown signal K1 to K1 = yes. The evaluation module 31 therefore determines that the first kickdown signal K1 is set to K1 = yes, but the second kickdown signal K2 is correctly set to K2 = no. On this basis, the evaluation module 31 recognizes that no valid driver-side kickdown operation has been performed.

[0066] Figure 5 indicates faulty signal processing in which the driver has not activated the kickdown pedal, but a latent error (e.g., a drift error) has been detected during the latent error diagnosis in the accelerator pedal control unit 3. Accordingly, the accelerator pedal sensor 7 generates a faulty accelerator pedal raw value F1 of 100%, while the second accelerator pedal sensor 9 generates a faulty accelerator pedal raw value F2 of 96%. In the accelerator pedal control unit 3, the kickdown signal K1 is therefore set to K1 = yes. In addition, the diagnostic information DI in the accelerator pedal control unit 3 is set to an error value niO because the two accelerator pedal raw values ​​F1, F2 do not match. The first kickdown signal K1 is also assigned the test information PI1, which is set to an error-free value iO. In the latent error case according to Figure 5, the second kickdown signal K2 is set to K2 = yes in the assistance control unit 5.The second kickdown signal K2 is added to the test information PI2, which is set to an error-free value of OK. Based on this, the evaluation module 31 determines that although both kickdown signals K1 and K2 are set to K1 = yes and K2 = yes, the diagnostic information DI is set to an error value of NOK. This allows the evaluation module 31 to detect that no valid driver-side kickdown actuation has been performed.

[0067] Figure 6 indicates faulty signal processing in which the driver has not activated the kickdown function, but an error case 32 has occurred in the routing path 20 of the accelerator pedal control unit 3, in which the second accelerator pedal raw value F2 is set from 0% to 100%. In this case, the sender calculation module 25 of the end-to-end protection 19 calculates a sender checksum Cs of 0%, while the receiver calculation module 27 of the end-to-end protection 19 calculates a receiver checksum CE of 50%. By comparing the two CE and Cs, the test module 21 located in the assistance control unit 5 determines a non-plausibility, whereby the transmission error on the routing path 20 is detected in the accelerator pedal control unit 3. Therefore, a piece of test information PI2 is added to the second kickdown signal K2, which is set to an error value not OK.On this basis, the evaluation module 31 detects that no valid driver-side kickdown actuation has been performed.

[0068] LIST OF REFERENCE SYMBOLS:

[0069] I Accelerator pedal control unit

[0070] 5 Assistance control unit

[0071] 7, 9 Accelerator pedal sensors

[0072] II Comparator module

[0073] 13 Diagnostic module

[0074] 15 program module

[0075] 17 Comparator module

[0076] 19 End-to-end security

[0077] 20 routing route

[0078] 21 Receiver test module

[0079] 23 message counters

[0080] 25 Sender calculation module

[0081] 27 Recipient calculation module

[0082] 29 Program module

[0083] 31 Evaluation module

[0084] 32 Error case y Kickdown limit

[0085] I, II signal pathways

[0086] ASIL automotive safety integrity level

[0087] DI diagnostic information

[0088] PH , PI2 test information

[0089] CE recipient checksum

[0090] Cs Sender checksum

[0091] F1 accelerator pedal raw value

[0092] F2 accelerator pedal raw value

[0093] SD backup data

[0094] K1, K2 kickdown signals

Claims

PATENT CLAIMS:

1. Drive system for a vehicle, comprising an accelerator pedal (1) with an associated accelerator pedal control unit (3) which performs a driving task when the accelerator pedal is actuated by the driver, wherein the accelerator pedal control unit (3) is connected as a transmitter control unit to an assistance control unit (5) as a receiver control unit which performs a driver-independent, automated driving task, wherein in particular the assistance control unit (5) deactivates the driver-independent, automated driving task when a valid kick-down actuation by the driver is present, characterized in that, for the reliable detection of a pedal actuation, in particular a valid kick-down actuation as a driver takeover request, two accelerator pedal sensors (7, 9) are assigned to the accelerator pedal (1), which independently each detect a first accelerator pedal raw value (F1) and a second accelerator pedal raw value (F2),that the first accelerator pedal sensor (7) is connected via a first signal path (I) to the accelerator pedal control unit (3) and to the assistance control unit (5), and the second accelerator pedal sensor (9) is connected via a second signal path (II) to the accelerator pedal control unit (3) and to the assistance control unit (5), that when the pedal is actuated, an actuation signal, in particular a kickdown signal (K1, K2), is generated in each signal path (I, II), and that the assistance control unit (5) checks for error-free signal processing in the control units (3, 5).

2. Drive system according to claim 1, characterized in that the first raw accelerator pedal value (F1) is processed in the accelerator pedal control unit (3) using a comparator module (11) which compares the first raw accelerator pedal value (F1) with a limit value, in particular a kickdown limit value (y), and that the comparator module (11) sets the first actuation signal (K1) to (K1 = yes) when the first raw accelerator pedal value (F1) is greater than the limit value (y). Drive system according to claim 1 or 2, characterized in that a latent fault diagnosis is performed in the accelerator pedal control unit (3), in which a diagnostic module (13) compares the first and second accelerator pedal raw values ​​(F1, F2) with each other, and that the diagnostic module (13) detects a latent fault in the event of a significant deviation of the two accelerator pedal raw values ​​(F1, F2), so that the diagnostic module (13) sets a diagnostic information (DI) to a fault value (niO), or that the diagnostic module (13) does not detect a latent fault in the event of a match of both accelerator pedal raw values ​​(F1, F2), so that the diagnostic module (13) sets a diagnostic information (DI) to a fault-free value (iO), and that the diagnostic information (DI) generated in the diagnostic module (13) is added to the first actuation signal (K1).A drive system according to one of the preceding claims, characterized in that in the second signal path (II) in the accelerator pedal control unit (3) routing takes place, in which the second accelerator pedal raw value (F2) is transmitted to the assistance control unit (5) via a routing path (20) without signal processing. A drive system according to one of the preceding claims, characterized in that signal processing of the second accelerator pedal raw value (F2) takes place in the assistance control unit (5), namely with a comparator module (17) which compares the second accelerator pedal raw value (F2) with the limit value (y), and that the comparator module (17) sets the second actuation signal (K2) to (K2=yes) if the second accelerator pedal raw value (F2) is greater than the limit value (y).Drive system according to claim 4 or 5, characterized in that an end-to-end protection (19) is provided by means of which a signal transmission error in the first signal path (I) and / or in the second signal path (II) can be identified, which results from faulty signal processing in the accelerator pedal control unit (3), and that the end-to-end protection (19) in the assistance control unit (5) has a receiver. The test module (21) includes a checksum check and a message counter (23). Drive system according to claim 6, characterized in that, for checksum verification, a transmitter calculation module (25) calculates a transmitter checksum (Cs) from the raw accelerator pedal value (F1, F2) using a calculation formula (Cs=f(x)), which is added to the raw accelerator pedal value (F1, F2), in particular before the routing path (20), that a receiver calculation module (27) calculates a receiver checksum (CE) from the received raw accelerator pedal value (F1, F2) using the same calculation formula (CE=f(x)), and that the receiver check module (21) compares the transmitter checksum (Cs) with the receiver checksum (CE), and that the receiver check module (21) detects a transmission error if the transmitter checksum (Cs) deviates from the receiver checksum (CE).and that, in particular, in the first signal path (I), the transmitter calculation module (25) and the message counter (23) are assigned to the accelerator pedal control unit (3), so that the transmitter checksum (Cs) and a message counter value (BZ) of the message counter (23) are added to the first accelerator pedal raw value (F1) in the accelerator pedal control unit (3), and that, in particular, in the second signal path (II), the transmitter calculation module (25) and the message counter (23) are assigned to the accelerator pedal (1), so that the transmitter checksum (Cs) and a message counter value (BZ) of the message counter (23) are already added to the second accelerator pedal raw value (F2) in the accelerator pedal (1). Drive system according to claim 6 or 7, characterized in that the message counter (23) increases a message count value (BZ) by one increment for each sampling cycle of the second accelerator pedal raw value (F2), and that for each sampling cycle the current message count value (BZ) is added to the second accelerator pedal raw value (F2),and that the receiver check module (21) checks the message count (FC) for plausibility, in particular checking whether the current message count differs from the message count of the last, has increased the received second accelerator pedal raw value (F2), and that the test module (21) detects a transmission error in case of implausibility. Drive system according to claim 8, characterized in that the receiver test module (21) sets a test information (PH , PI2) to an error value (niO) if the message count value (BZ) checked in the receiver test module (21) is not plausible and / or if there is a mismatch between the receiver checksum (CE) and the sender checksum (Cs), or that the receiver test module (21) sets the test information (PH , PI2) to an error-free value (iO) if the message count value (BZ) checked in the receiver test module (21) is plausible and the two checksums (Cs, CE) match, and / or that, in particular, the test information (PH , PI2) generated by the receiver test module (21) is assigned to the respective first or second actuation signal (K1 , K2).Drive system according to one of claims 3 to 9, characterized in that the two signal paths (I, II) are led to an evaluation module (31) of the assistance control unit (5), and that the evaluation module (31) detects a driver-side pedal actuation, provided that the following conditions are met in combination in the evaluation unit (31):. - first activation signal (K1 ) set to (K1 = yes); - the diagnostic information (DI) added to the first actuation signal (K1 a) is set to the error-free value (iO); - the test information (PI1) added to the first actuation signal (K1) is set to the error-free value (iO); - second activation signal (K2) set to (K2=yes); - the test information (PI2) added to the second actuation signal (K2) is set to the error-free value (iO).

Images