Method for monitoring the operation of a computing unit, computing unit, and computer program

Abstract

The invention relates to a method for monitoring the operation of a computing unit (110, 110') in a communication network (100), comprising, by means of the computing unit (110, 110'): receiving a message (R1, R1') via a network connection (140) of the communication network (100); determining the sender (110, 110') of the message (R1, R1') on the basis of the message content; and initiating a measure if determining the sender indicates the computing unit (110, 110') even though the message (R1, R1') was not sent by the computing unit (110, 110'). The invention also relates to a corresponding computing unit.

Description

[0001] Description

[0002] title

[0003] Method for monitoring the operation of a computing unit, computing unit and computer program

[0004] The present invention relates to a method for monitoring the operation of a computing unit in a communication network as well as a computing unit and a computer program for carrying out the same.

[0005] Background of the invention

[0006] Electric vehicles are available in a variety of configurations, including those with a single driven axle (front-wheel drive or rear-wheel drive) or multiple driven axles (all-wheel drive). Accordingly, controlling the electric motors may require multiple power electronics units that must be coordinated with one another. A typical power electronics unit includes an inverter (a type of control unit) and a voltage converter. The inverter controls and monitors the electric motor and ensures the torque and speed are supplied as required. The inverter also converts the battery's DC voltage into the AC voltage required by the electric motor. The electric motors or inverters are typically controlled via a data bus, particularly CAN.

[0007] Disclosure of the invention

[0008] According to the invention, a method for monitoring the operation of a computing unit in a communications network, as well as a computing unit and a computer program for implementing the method, are proposed, having the features of the independent patent claims. Advantageous embodiments are the subject of the dependent claims and the following description.

[0009] The invention presents a solution with which a computing unit in a communication network can detect that at least one other computing unit is present that uses the same configuration by monitoring the communication network or a data connection of the communication network for messages that supposedly originate from the computing unit, although this is not the case.

[0010] Typically, participants in communication networks can be precisely addressed. In CAN communication, for example, it is precisely defined which participants send which messages and which participants receive which messages. For each message, there is usually exactly one sender and at least one receiver. The invention takes advantage of this to determine, by analyzing incoming messages, whether there is a second participant or another processing unit in the communication network that contains the same configuration. If the processing unit receives a message that it did not send, but whose content indicates that the processing unit is the sender, this suggests that there is an additional processing unit in the system that is incorrectly configured.

[0011] In one embodiment of the invention, the computing unit, together with at least one further computing unit, provides a common functionality which, for example, includes the provision of drive torque. Depending on requirements, in practice, in particular to provide high drive or torque levels, several electric motors are used in parallel, the operation of which must then be coordinated accordingly, so that the invention offers particular advantages in this regard. In one embodiment of the invention, the computing unit and the at least one further computing unit are each implemented in the power electronics of an electric motor, in particular in an inverter. In another embodiment of the invention, the computing unit and the at least one further computing unit are implemented in a control unit of an electric motor, for example in a control unit for window lifts, central locking, seat adjustment, etc.In a further embodiment of the invention, the computing unit and the at least one further computing unit are generally implemented in a control unit of a component to be controlled, such as a DC / DC converter, electric motor, and the like.

[0012] In one embodiment of the invention, the computing unit and the at least one further computing unit are controlled by a higher-level computing unit using the messages to provide the shared functionality. The higher-level computing unit can be structurally separated from the aforementioned computing units, such as a so-called vehicle computer or vehicle control unit (VCU); however, the higher-level computing unit can also be structurally integrated into one or the further computing units.

[0013] In one embodiment of the invention, the measure comprises entering a safe state and / or causing the additional processing unit to enter the safe state. A safe state is understood in particular as one according to ISO 26262, i.e., a state in which the system no longer poses a danger. This safe state depends on the type of overall system. For the engine control system of a passenger car, this could be the "engine off" state, whereas for the engine control system of a small aircraft, it could be "full throttle."

[0014] A safe state in an electric vehicle would, depending on the intended use, be, for example, preventing torque requests, informing the driver, switching off the HV system, generally preventing vehicle movement, for example by activating the parking brake or lock, etc.

[0015] As explained, an inverter of an electric motor is a suitable computing unit according to one embodiment of the invention. If several inverters are installed in a machine or system, such as a vehicle (e.g., one on the front axle and one on the rear axle), which are connected to a higher-level control unit via a data connection, the desired torque is requested or received separately from each inverter via its own message. The definition of which message each inverter "listens" to is programmed into the respective component. This means that an inverter intended for the rear axle only listens to the messages also intended for the rear axle. The same applies to the front axle.

[0016] To keep part variance low, in practice the same component (e.g., inverter) is typically used for different functions, which are ultimately implemented using different software. This software can be configured or flashed accordingly at the end of the production line by the vehicle manufacturer, for example. If, for example, a misconfiguration or programming error occurs due to negligence, ignorance, or deliberate misuse, e.g., if inverters for different axles are configured with the same information, it can happen that several inverters "listen" to the same messages. This can lead to an undesirable and potentially safety-threatening situation due to excessive drive torque. The invention now presents a possibility for detecting an unintended combination of components or the drive topology in the vehicle and ensuring safe operation of the vehicle.The invention provides an additional safety function to avoid the creation of configurations that are not desired / planned by the manufacturer.

[0017] In particular, the computing unit (for example an inverter) evaluates whether the received messages include messages that claim to be the sender, even though the computing unit did not send them itself. The presence of a message itself and its content (data, rolling counters and checksums) can be used to detect such messages. If this is determined, an appropriate measure is initiated (by the computing unit), in particular an error message is sent and / or the computing unit or expediently all computing units involved in the function are transferred to a safe state. A computing unit according to the invention, e.g. an inverter, is designed, in particular in terms of programming, to carry out a method according to the invention.

[0018] The implementation of a method according to the invention in the form of a computer program or computer program product with program code for carrying out all method steps is also advantageous, as this entails particularly low costs, in particular if an executing control unit is also used for other tasks and is therefore already present. Finally, a machine-readable storage medium is provided with a computer program stored thereon, as described above. Suitable storage media or data carriers for providing the computer program are, in particular, magnetic, optical, and electrical memories, such as hard disks, flash memories, EEPROMs, DVDs, and others. Downloading a program via computer networks (Internet, intranet, etc.) is also possible. Such a download can be wired or cable-based or wireless (e.g., via a WLAN network, a 3G, 4G, 5G, or 6G connection, etc.).

[0019] Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

[0020] The invention is illustrated schematically in the drawing using an embodiment and is described below with reference to the drawing.

[0021] Short description of the drawings

[0022] Figure 1 shows a communication network with three computing units that are correctly configured.

[0023] Figure 2 shows a communications network with three processing units, one of which is unconfigured. Figure 3 shows the communications network from Figure 2 using an embodiment of the invention.

[0024] Embodiment(s) of the invention

[0025] Figure 1 schematically illustrates a communications network 100, such as may form the basis of the invention. The communications network 100 has three computing units 110, 120, 130 as network participants, which are connected for data transmission via a network connection 140, embodied here as a CAN bus. In the example shown, the computing unit 130 acts as a higher-level computing unit to control the computing units 110 and 120 to provide a common function by exchanging various messages N1, ... on the CAN bus 140. The messages are illustrated by arrows emanating from or toward the computing units. The common function can, in particular, be the operation of electric motors to provide a desired drive moment or torque.In this case, the computing units 110 and 120 are designed, for example, as so-called inverters, and the computing unit 130 is designed, for example, as a so-called vehicle control unit (VCU). However, it should be emphasized that the invention is suitable for any type of component to be controlled that exists in multiple instances, e.g., window regulators, door lock motors, DC / DC converters, etc.

[0026] To control the inverter 110, 120, the vehicle control unit 130 sends a message N1 and a message N2, each addressed to a specific inverter 110 or 120, respectively, and containing a target drive torque to be provided for that inverter. Accordingly, the message N1 is received and processed by the inverter 110, and the message N2 is received and processed by the inverter 120. A feedback message R1 from the inverter 110 and a feedback message R2 from the inverter 120 are also output to the CAN bus 140. These messages contain, for example, the actual drive torques achieved and can in turn be received and processed by the vehicle control unit 130. Figure 2 shows a situation in which, in addition to the inverter 110, another inverter 110' is connected to the CAN bus 140 as an additional computing unit. However, due to a misconfiguration, this inverter functions as the same network participant as the inverter 110.Accordingly, message N1 is received and processed by both inverter 110 and inverter 110', so that the resulting total drive torque does not correspond to the desired torque. Critical situations can arise, so this condition must be detected and prevented. Accordingly, inverter 110 outputs a feedback message R1, and inverter 110' outputs a feedback message RT, to CAN bus 140.

[0027] According to a preferred embodiment of the invention, as illustrated in Figure 3, the inverter 110 now detects the presence of the feedback message RT on the CAN bus 140, and likewise the inverter 110' detects the presence of the feedback message R1 on the CAN bus 140. Both inverters 110, 110' are configured, according to the embodiment of the invention shown here, to analyze the feedback message R1 or RT and to determine the sender.

[0028] For example, a message content of the feedback message R1 or RT, for example a sender address and / or payload data, which, for example, indicates an actual value of the drive torque, can be analyzed. As a result, the inverter 110 or 110' can recognize that the respective feedback message originates from an inverter with its own CAN configuration, even though the respective inverter did not send this message. Thus, the misconfiguration is detected and a measure is initiated, which in particular includes assuming a safe state and / or causing other computing units to assume the safe state. In particular, corresponding messages can be output to the CAN bus 140 for this purpose (not shown), which, upon receipt by another computing unit, cause it to assume the safe state.

Claims

Claims 1. A method for monitoring the operation of a computing unit (110, 110') in a communication network (100), comprising the following steps performed by the computing unit (110, 110'): Receiving a message (R1, RT) via a network connection (140) of the communication network (100), Determining the sender (110, 110') of the message (R1, RT) based on a message content, Initiating an action if the determination of the sender results in the computing unit (110, 110') although the message (R1, RT) was not sent by the computing unit (110, 110').

2. The method according to claim 1, wherein the measure is assuming a safe state.

3. The method according to claim 1 or 2, wherein the computing unit (110, 110') together with at least one further computing unit (110, 110') provides a common functionality.

4. The method according to claim 3, wherein the computing unit (110, 110') and the at least one further computing unit (110, 110') are controlled by a higher-level computing unit (130) by means of messages (N1, N2) in order to provide the common functionality.

5. The method according to claim 4, wherein the computing unit (110, 110') and the at least one further computing unit (110, 110') are each implemented in a power electronics unit of an electric motor and wherein the common functionality is the provision of drive torque.

6. The method according to any one of claims 3 to 5, wherein the measure is causing the further computing unit (110, 110') to assume the safe state.

7. Method according to one of the preceding claims, wherein the message content contains an actual value of a quantity.

8. Method according to one of the preceding claims, wherein the network connection (140) is a CAN bus.

9. Method according to one of the preceding claims, wherein the communication network (100) is arranged in a vehicle.

10. A computing unit (110, 110') configured to carry out all method steps of a method according to one of the preceding claims.

11. A computer program which causes a computing unit (110, 110') to carry out all method steps of a method according to one of claims 1 to 9 when it is executed on the computing unit (110, 110').

12. A machine-readable storage medium having stored thereon a computer program according to claim 11.

Images