Method for checking the plausibility of a parameter

Abstract

The invention relates to a method for checking the plausibility of a parameter involved in operation of a vehicle system of a motor vehicle, wherein the plausibility of the parameter sensed by a first sensor is checked by means of a second sensor, which likewise senses the parameter, by the examination of a first sensor signal (n(S1)) from the first sensor with a second sensor signal (n(S2)) from the second sensor. In order to make the checking of the plausibility as reliable as possible, a differential signal (Δn) between the first sensor signal (n(S1)) and the second sensor signal (n(S2)) is formed and is compared with at least one threshold value (thd1, thd2). A measure is taken if the differential signal (Δn) exceeds the at least one threshold value (thd1, thd2) continuously for longer than a particular amount of time (tft1, tft2) associated with the at least one threshold value (thd1, thd2).

Description

[0001] Procedure for checking the plausibility of a parameter

[0002] The invention relates to a method for checking the plausibility of a parameter that is included in the operation of a vehicle system of a motor vehicle. The parameter detected by a first sensor is checked for plausibility with a second sensor that also detects the parameter by comparing a first sensor signal from the first sensor with a second sensor signal from the second sensor. Furthermore, the invention relates to a control unit, a computer program product, and a data storage medium.

[0003] Motor vehicles are usually equipped with vehicle systems to assist the driver during operation of the vehicle. In some cases, a vehicle system also intervenes in the actual operation as a safety system in order to avoid critical operating conditions by executing safety functions or to ensure safe operation of the vehicle in the event of malfunctions. The regulation or control of such a safety function is usually based on parameters that are recorded by the vehicle's sensors. However, since sensors can also fail or transmit incorrect information, which would accordingly result in the respective safety function being executed incorrectly, the reliable operation of the sensors must also be monitored during the operation of a motor vehicle's safety system.

[0004] DE 10 2005 048 015 A1 discloses a method for checking the plausibility of a parameter, which method is applicable to a vehicle system of a motor vehicle, such as an ESP system, an airbag system, a driver assistance system (ACC), or the like. A parameter is determined which is necessary for controlling or regulating a respective function of the vehicle system. DE 10 2005 048 015 A1 also specifies redundant monitoring as a possibility, in which a sensor signal from one sensor is checked using a different sensor signal. Based on the prior art described above, the object of the present invention is to design a plausibility check for a parameter in the simplest and most reliable manner possible.

[0005] This problem is solved from a process engineering perspective based on the preamble of claim 1 in conjunction with its characterizing features. The dependent claims that follow each of these claim 10 describe advantageous developments of the invention. A control device with which the aforementioned method can be carried out is further the subject of claims 8 and 9. Furthermore, claim 10 relates to a computer program product, and claim 11 relates to a data carrier.

[0006] According to the invention, a method is used to check the plausibility of a parameter that is included in the operation of a vehicle system of a motor vehicle. The parameter detected by a first sensor is checked for plausibility with a second sensor that also detects the parameter by comparing a first sensor signal from the first sensor with a second sensor signal from the second sensor.

[0007] Within the scope of the method according to the invention, the parameter is thus detected by a first sensor and a second sensor, respectively. The parameter is determined from a first sensor signal of the first sensor and verified for plausibility using the second sensor. For the latter, the first sensor signal of the first sensor is checked against a second sensor signal of the second sensor.

[0008] Both sensors are used to directly detect the parameter, with these detections preferably being carried out independently of each other for plausibility purposes. For this purpose, the two sensors are each located in a corresponding area, for example, both directly on a component where the parameter can be directly detected.

[0009] The invention now comprises the technical teaching that the check is carried out by forming a difference signal between the first sensor signal and the second sensor signal and comparing it with at least one threshold value. In addition, a measure is carried out if the difference signal continuously exceeds the at least one threshold value for longer than a time period associated with the at least one threshold value. In other words, the check of the first sensor signal with the second sensor signal is carried out by creating a signal as the difference between the first sensor signal of the first sensor and the second sensor signal of the second sensor, wherein this difference signal is then compared with at least one threshold value. If the difference signal exceeds the at least one threshold value, a measure is started while the threshold value is continuously exceeded and after the elapse of a time period associated with the threshold value.

[0010] The procedure according to the invention has the advantage that it enables the plausibility of the parameter to be checked in a simple and, at the same time, reliable manner. This is because by forming the difference signal and comparing this difference signal with the at least one threshold value, it can be checked whether there is a deviation between the detection of the parameter via the first sensor and the detection of the parameter via the second sensor on a scale that would indicate an inconsistency in the detection, for example an incorrect measurement or even a defect in one of the sensors or a defect in a cable. Even if the at least one threshold value is exceeded by the difference signal, a measure is only initiated if the at least one threshold value is continuously exceeded for longer than a predetermined period of time that is assigned to the at least one threshold value. This can prevent a possibleAn unavoidable difference between the sensor signals, for example due to signal tolerances, read-in delays, or similar, leads to the erroneous conclusion that the parameter has been detected incorrectly, and the action is therefore taken. The respective time period thus represents a corresponding filter time.

[0011] According to one embodiment of the invention, the difference signal is compared with a first threshold and a second threshold, wherein the measure is implemented when the difference signal either continuously exceeds the first threshold for a period longer than a first time period associated with the first threshold or continuously exceeds the second threshold for a period longer than a second time period associated with the second threshold. Advantageously, different conditions can be defined for initiating the measure by assigning a suitable threshold with a suitable time period to each condition.

[0012] In a further development of the aforementioned embodiment, the second threshold value was selected to be greater than the first threshold value and the first time period greater than the second time period. This allows the first threshold value and the first time period to define smaller deviations between the sensor signals as a reason for implementing the measure, although these deviations must last longer. However, the second threshold value and the associated second time period can also be used to implement the measure if larger deviations between the sensor signals are detected, although these larger deviations do not have to last as long as the first threshold value and the first time period. For example, this can be used to detect a defect in a cable or something similar.

[0013] Alternatively or in addition to the aforementioned refinement, the comparisons of the difference signal with the first threshold and the second threshold are performed in parallel. This has the advantage that if one of the thresholds is exceeded continuously for a sufficiently long period, the appropriate action is initiated immediately. Alternatively, the comparisons can also be performed sequentially by first comparing the difference signal with the first threshold or first comparing the difference signal with the second threshold.

[0014] According to one possible embodiment of the invention, a request for emergency operation is generated as a measure, in which safe operation of the motor vehicle is undertaken. If it is therefore detected that the difference signal continuously exceeds the at least one threshold value for longer than the time period assigned to each of the at least one threshold value, the system switches to emergency operation, in which safe operation of the motor vehicle is guaranteed in all cases. This ensures that inconsistencies or errors in the detection of the parameter cannot under any circumstances lead to unsafe driving conditions of the motor vehicle arising due to corresponding regulation or control. Particularly preferably, emergency operation corresponds to the operation of the motor vehicle into which it is also transferred when at least one safety function of the vehicle system is triggered.In particular, in emergency operation, a drive torque of a drive engine of the motor vehicle is set to zero in order to prevent further propulsion of the motor vehicle via this drive engine once emergency operation is initiated.

[0015] In a further development of the invention, a rotational speed, preferably a drive speed of a drive engine of the motor vehicle, is determined as a parameter. Within the scope of the method according to the invention, a plausibility check is carried out on this rotational speed, which is detected via two sensors in parallel, whereby at least one function of the vehicle system can then be controlled or regulated based on the rotational speed. In particular, the detected rotational speed is used to control or regulate at least one safety function of a safety system of a motor vehicle in the form of a construction machine.

[0016] The plausibility-checked parameter is incorporated into the operation of the vehicle system, in particular by using this parameter for regulating or controlling at least one function of the safety system. The vehicle system is, in particular, a safety system of the motor vehicle, via which safety-relevant tasks can be performed in the form of at least one safety function in order to support the driver in driving the motor vehicle and avoid safety-critical driving conditions.

[0017] The motor vehicle is preferably a work vehicle, in particular a construction machine, such as a wheel loader. The vehicle system, which is preferably in the form of a safety system, implements safety functions in the form of a function for preventing unintentional starting, a function for preventing unintentional starting in the wrong direction, and / or a function for preventing unintentional deceleration.

[0018] The invention also relates to a control unit, which is in particular a transmission control unit. This control unit is set up to determine a parameter which can be taken into account during operation of a vehicle system. The control unit is designed to detect the parameter via a first sensor and to check its plausibility via a second sensor which also detects the parameter, for which purpose the control unit checks a first sensor signal from the first sensor with a second sensor signal from the second sensor by the control unit forming a difference signal between the first sensor signal and the second sensor signal and comparing it with at least one threshold value. Furthermore, the control unit is set up to carry out a measure if the difference signal continuously exceeds the at least one threshold value for longer than a time period assigned to the at least one threshold value.Furthermore, the control unit can then be configured to implement one or more of the aforementioned variants of a method according to the invention for operating a transmission control system.

[0019] The method according to the invention can also be embodied as a computer program product which, when running on a processor, for example a processor of an aforementioned control unit, instructs the processor via software to perform the associated method steps according to the invention. In this context, the subject matter of the invention also includes a computer-readable medium on which a computer program product described above is stored in a retrievable manner.

[0020] An advantageous embodiment of the invention, which is explained below, is illustrated in the drawings. It shows:

[0021] Fig. 1 is a schematic view of a vehicle system; Fig. 2 is a schematic representation of a part of the vehicle system from Fig. 1;

[0022] Fig. 3 is a flowchart of a method according to the invention for checking the plausibility of a parameter; and

[0023] Fig. 4 is a diagram of an exemplary curve of a difference signal of the method from Fig. 3.

[0024] Fig. 1 shows a schematic view of a vehicle system 1, which is preferably intended for use in a motor vehicle in the form of a work vehicle, and in this case, in particular, for a construction machine. The motor vehicle is preferably designed as an electric vehicle and has a drive motor—not further illustrated here—in the form of an electric machine, which is in particular an asynchronous machine.

[0025] The vehicle system 1 comprises two control units 2 and 3 and an inverter 4 of the electric motor (not shown). The control units 2 and 3 and the inverter 4 are interconnected in a data bus system of the motor vehicle (CAN bus). The control unit 2 is a vehicle control unit (VCU) via which various functions 5 of the motor vehicle can be controlled or regulated. For this purpose, the control unit 2 is supplied, among other things, with information about the respective accelerator pedal positions of an accelerator pedal 6 and a brake pedal 7, as well as about the selection of a travel direction via a travel direction switch 8.

[0026] The control unit 3 is a transmission control unit of a motor vehicle transmission (also not shown in detail here), wherein the control unit 3 is also supplied with information about the accelerator pedal positions and the selection of the direction of travel by the control unit 2 within the data bus system. The control unit 3 uses this information, on the one hand, to regulate and control transmission functions 9, wherein the control unit 3 also accesses the inverter 4 within the data bus system in order to set a required target torque from the electric machine. On the other hand, the control unit 3, together with the inverter 4, forms a safety system 10, by means of which various safety functions of the motor vehicle can be implemented. Both for the control andTo control the transmission functions 9 and the safety functions, the inverter 4 communicates a current drive speed n of the electric motor as a parameter to the control unit 3. This drive speed n is determined independently of each other at the electric motor via two sensors (not shown here) and transmitted to the control unit 3 in the form of two sensor signals n(Si) and n(S2) as separate messages, each of which is in the form of speed signals.

[0027] Fig. 2 shows a separate schematic representation of the safety system 10 of the vehicle system 1, formed by the control unit 3 and the inverter 4. Within the safety system 10, the current drive speed n is determined from the sensor signal n(Si) and used within the framework of various safety functions 11 to 14. These safety functions 11 to 14 can specifically be a function to prevent the motor vehicle from accidentally starting up, a function to prevent the motor vehicle from accidentally starting up in the wrong direction, a function to prevent the motor vehicle from accidentally decelerating, etc. If a safety-relevant event is detected by the control unit 3 during one of the safety functions 11 to 14, the control unit 3 generates a request 15 for emergency operation of the motor vehicle.In this case, this request 15 is passed on to the inverter 4 in order to set the target torque of the electric machine to zero.

[0028] As part of a check 16, the two sensor signals n(Si) and n(S2) are further checked by the control unit 3, whereby, on the one hand, a check of the respective status of the respective sensor signal n(Si) or n(S2) is carried out. This check can be carried out as part of a cyclic redundancy check (CRC). If an error in the status of the respective sensor signal n(Si) or n(S2) is detected, the request 15 for emergency operation is also generated and emergency operation is thus initiated by the inverter 4. On the other hand, the two sensor signals n(Si) and n(S2) are compared with one another in order to check the plausibility of the sensor signal n(Si). The latter is carried out as part of a method according to the invention, which will now be described in more detail with the aid of Fig. 3, which shows a flow diagram of the method.

[0029] At the beginning of the method, a difference signal An is formed as the difference between the two sensor signals n(Si) and n(S2) in a first step S1, an exemplary curve of this difference signal An being shown in a diagram over time t in Fig. 4. This difference signal An is then compared in parallel steps S2 and S3 with a threshold value thd1 and thd2 respectively, the two threshold values ​​thd1 and thd2 also being indicated in Fig. 4. It can also be seen that the threshold value thd2 is selected to be higher than the threshold value thd1. If an exceedance of the threshold value thd1 by the difference signal An is detected in step S2, the system goes to step S4, while otherwise the system jumps back to step S1.Likewise, the system proceeds to step S5 following step S3 if the difference signal An was detected in step S3 to exceed the threshold value thd2. If this is not the case during the check, the system also returns to step S1 after step S3.

[0030] If, however, the exceedance of the threshold value thd1 was detected in step S2, the next step in step S4 is to check whether a detected time tÜ 1 of the continuous, i.e., uninterrupted exceedance of the threshold value thd1 is longer than a time period tft1 . If this is not the case, the program returns to step S1; otherwise, the program proceeds to step S6.

[0031] Also in step S5, to which the system transitions after step S3 upon detection of the threshold value thd2 being exceeded by the difference signal An, a time tÜ2 is determined which represents the duration of the continuous exceedance of the threshold value thd2 by the difference signal An. This time tÜ2 is then compared with a time period tft2 in step S5. If the time period tft2 is exceeded by the time tÜ2, the system transitions to step S6, while otherwise the system jumps back to step S1. The time period tft2 is selected to be shorter than the time period tft1, so that a shorter time tÜ2 is required to transition from step S5 to step S6 compared to the time tÜ1.

[0032] If, in one of the parallel step pairs S2 and S4, as well as S3 and S5, it is detected that the difference signal An continuously exceeds the respective threshold value thd1 or thd2 for longer than the respectively assigned time period tft1 or tft2, a relevant deviation between the speed signals n(Si) and n(S2) is detected in step S6, and a subsequent measure is initiated. During this measure, request 15 for emergency operation of the motor vehicle is also generated and passed on to inverter 4, so that safe operation of the motor vehicle is initiated by step S6.

[0033] By means of the method according to the invention, a reliable plausibility check of a parameter can be realized.

[0034] Reference symbol

[0035] 1 Vehicle system 2 Control unit

[0036] 3 Control unit

[0037] 4 inverters 5 functions

[0038] 6 Accelerator pedal 7 Brake pedal

[0039] 8 Direction switch 9 Gearbox functions

[0040] 10 Security system 11 Security function

[0041] 12 Safety function 13 Safety function

[0042] 14 Safety function 15 Emergency operation requirement

[0043] 16 Check n Input speed n(Si) Sensor signal n(S2) Sensor signal On Difference signal t Time thd1 Threshold value thd2 Threshold value tÜ1 Time tÜ2 Time tft1 Duration tft2 Duration

[0044] S1 to S6 single steps

Claims

Patent claims 1 . Method for checking the plausibility of a parameter which is included in the operation of a vehicle system (1) of a motor vehicle, wherein the parameter detected by a first sensor is checked for plausibility with a second sensor which also detects the parameter, by checking a first sensor signal (n(Si)) of the first sensor with a second sensor signal (n(S2)) of the second sensor, characterized in that the check (16) is carried out by forming a difference signal (An) between the first sensor signal (n(Si)) and the second sensor signal (n(S2)) and comparing it with at least one threshold value (thd1, thd2), and in that a measure is carried out if the difference signal (An) continuously exceeds the at least one threshold value (thd1, thd2) for longer than a time period (tft1, tft2) assigned to the at least one threshold value (thd1, thd2).

2. Method according to claim 1, characterized in that the difference signal (An) is compared with a first threshold value (thd1) and a second threshold value (thd2), the measure being carried out when the difference signal (An) either continuously exceeds the first threshold value (thd1) for longer than a first time period (tft1) assigned to the first threshold value (thd1) or continuously exceeds the second threshold value (thd2) for longer than a second time period (tft2) assigned to the second threshold value (thd2).

3. Method according to claim 2, characterized in that the second threshold value (thd2) is selected to be greater than the first threshold value (thd1) and the first time period (tft1) is selected to be greater than the second time period (tft2).

4. Method according to claim 2 or claim 3, characterized in that the adjustments of the difference signal (An) with the first threshold value (thd 1 ) and the second threshold value (thd2) are carried out in parallel to one another.

5. Method according to one of the preceding claims, characterized in that as a measure a request (15) for emergency operation is generated in which a safe operation of the motor vehicle is carried out.

6. Method according to one of the preceding claims, characterized in that a rotational speed, preferably a drive speed (n) of a drive engine of the motor vehicle is determined as a parameter.

7. Method according to one of the preceding claims, characterized in that the parameter is included in a regulation or in a control of at least one function of the vehicle system (1), preferably at least one safety function (11, 12, 13, 14) of a safety system (10) of the vehicle system (1).

8. Control unit (3), in particular a transmission control unit, which is configured to determine a parameter which can be included in the operation of a vehicle system (1), wherein the control unit (3) is designed to detect the parameter via a first sensor and to check its plausibility via a second sensor which also detects the parameter, for which purpose the control unit (3) checks a first sensor signal (n(Si)) of the first sensor with a second sensor signal (n(S2)) of the second sensor, in that the control unit (3) forms a difference signal (An) between the first sensor signal (n(Si)) and the second sensor signal (n(S2)) and compares it with at least one threshold value (thd1, thd2), and wherein the control unit (3) is configured to carry out a measure if the difference signal (An) continuously exceeds the at least one threshold value (thd1, thd2) for a period longer than a period assigned to the at least one threshold value (thd1, thd2). Duration (tft1 ,tft2) exceeds., 9. Control device (3) according to claim 8, which is further configured to carry out a method according to one or more of claims 2 to 7.

10. Computer program product for a control device (3) according to claim 8 or 9, by means of which a method according to one or more of claims 1 to 7 can be carried out, wherein a routine for checking the plausibility of a parameter is implemented by corresponding control commands stored in software. 11 . A data carrier with a computer program product according to claim 10.

Images