Device for switching the functional safety level (ASIL) according to the operating mode

Abstract

The invention relates to a safety device (1) for implementing a specific safety level, in particular a level which is representative of a specific requirement in terms of functional safety in an onboard electrical system of a vehicle, comprising multiple electric appliances (G1, G2, G3,... ) which are to be operated at different individual safety levels (X, X + 1, X +2,....) during operation of the relevant appliance, implemented by the decomposition of fuses or controllers.

Description

[0001] STAEGER & SPERLING

[0002] PAR NERSCHAF SGESELLSCHAF MBB

[0003] FEP Vehicle Electrics Pirna GmbH & Co. KG

[0004] P 430 PCT WE / WE

[0005] Device for operating mode-dependent switching of the functional safety level (ASIL)

[0006] Description:

[0007] The invention relates to a device and a method for operating mode-dependent switching of the functional safety level, preferably in a vehicle.

[0008] The requirements of ISO 26262, the specific standard for functional safety for series vehicles, apply to vehicle electronics, control units, electronic systems, and components for safety-critical applications in vehicles. This term is often referred to as "functional safety," or "FuS i" for short, or "Functional Safety," or "FuSa" for short. Given the ever-increasing complexity of developing software, electronic embedded systems, and technology, compliance with these requirements of ISO 26262 is essential to prevent damage and avoid recalls or claims for damages.

[0009] ISO 26262 provides an established process model for the development and production of series vehicles. The ISO standard combines the process model with required activities, their results, so-called work products, and the methods to be applied.

[0010] If a safety-relevant component in a vehicle is affected by such a malfunction, in the worst case scenario, people could be killed or injured. For example, if an ESP control unit in a vehicle were to unexpectedly trigger an emergency stop while driving at high speed, this could lead to an accident. To minimize the risk of dangerous malfunctions in safety-relevant electronic systems, there are active safety mechanisms, such as fuses (eFuse), that disconnect the affected component or device from the vehicle's electrical system.

[0011] ISO 26262 users include automobile manufacturers, automotive suppliers, and testing institutes. For example, if an automobile manufacturer or supplier wishes to develop a safety-relevant system or component, the client will typically require the application of a safety standard such as ISO 26262. To ensure the functional safety of the product, the client often sets specifications, requiring, for example, the highest safety level, ASIL D.

[0012] ASIL represents a risk assessment scheme. In addition to ASIL QM, there are four ASIL classes: ASIL A, ASIL B, ASIL C, and ASIL D. ASIL D represents the highest safety requirements and requires correspondingly stringent safety precautions, which increases costs and effort, making the vehicle more expensive. Especially with state-of-the-art safety concepts, the highest ASIL level requires correspondingly complex safety measures and configurations of electrical fuses in a given vehicle concept. During decomposition, both elements must be designed redundantly with regard to the safety objective. For example, both the main computer and the safety computer must be able to switch to the safe state independently of one another in the event of excessive voltage / current / torque / ...

[0013] The invention is therefore based on the object of overcoming the aforementioned disadvantages and of providing an improved and cost-effective protection concept in which the required functional safety is nevertheless consistently maintained.

[0014] This problem is solved by the combination of features according to patent claim 1.

[0015] The core idea of ​​the invention is to be able to specifically implement certain safety classes and in particular ASIL classes, depending on the vehicle operating state and the safety level required for that purpose.

[0016] The invention takes into account that, in the event of a disconnection in the event of a detected fault, the required highest ASIL level must still be ensured in the remaining (non-disconnected) supply lines in the on-board and vehicle electrical systems. For example, ASIL Level C is defined for the steering and ASIL Level B for the brakes. However, the invention is not limited to these standardized safety levels.

[0017] In principle, any feature that requires linearly or gradually different functional safety levels is suitable for defining such safety levels (e.g., fail-safe operation). The starting point is the requirement for the internal function of a component or system whose behavior (malfunction) poses a danger to the user, as well as external influences that place a functional requirement on the component or system in order to transfer it to a safe state.

[0018] In both cases, the severity of the expected malfunction (or failure of the required function) must be assessed. Measures must be taken according to the ASIL classification to prevent immediate harm to the user.

[0019] In the current state of the art, an electronic fuse is typically located after the power sources, such as the DC / DC converter, battery, or generator, in the respective wiring harness to the respective consumers, such as the steering system, ABS pump, small consumers, and the like. Different ASIL levels are typically defined for safe supply and safe disconnection, which, however, must be ensured by the respective fuse concept.

[0020] Based on the following requirements, a security concept is desired that is cost-effective, efficient and reliable (if necessary with a microprocessor):

[0021] - Protection up to and including ASIL Level D of individual vehicle components

[0022] - Energy saving (especially in standby mode or deactivated / switched off mode)

[0023] - At least equality, better improvement over known concepts.

[0024] According to the invention, a decomposition of at least two fuses or two controls takes place in order to realize a more complex and in particular thus higher safety level by fuses with a lower level.

[0025] The term "decomposition" or "functional decomposition" has its roots in mathematics, where it describes the decomposition of complex connections and relationships where a functional relationship exists in order to reassemble the original "complex" function. Essentially, functional decomposition simplifies a complex plane into less complex planes.

[0026] In this respect, the concept of decomposition within the meaning of the present invention proposes to decompose or divide the required safety levels, relevant processes, and / or their functions into subfunctions of separate components (fuses, controls) and to achieve the more complex requirement (safety requirement) through their functional interconnection. Functional interconnection means, in particular, the activation and deactivation of at least the main fuse in addition to the auxiliary fuse in order to achieve the higher safety level through interconnection, but also to deactivate a fuse (e.g., the main fuse) when not needed.

[0027] According to the invention, a safety device is thus proposed in which two components (fuses or controls) are coupled together in a circuit in series or parallel in order to achieve a higher level of safety in a specific vehicle operating state, whereby one of the components (fuses or controls) can, however, be deactivated or put into standby mode by a control in a different vehicle operating state.

[0028] According to the invention, a first embodiment variant uses a cascading fuse concept. A cascade arrangement within the meaning of the present invention is understood to be the decomposition in the form of parallel or, alternatively, serial connection of at least two different electronic fuses, each of which has different properties. "Different" means at least that the fuses have inhomogeneous characteristics, and the two fuses are therefore not identical, yet together fulfill a safety requirement that the fuses cannot guarantee individually.

[0029] An alternative concept in accordance with the idea of ​​the present invention is to implement a decomposition of two controls with a single fuse (e.g., a controllable transistor) instead of two fuses (e.g., instead of two transistors). To save energy, one of the two controls can then be switched off. The single transistor or the single electronic fuse (which is itself sufficiently fail-safe, e.g., ASIL C) can then be selectively controlled by the two controls to achieve a higher safety level. This prevents, in particular, undesirable heat generation.

[0030] In other words, in the simplest embodiment of the invention, a higher ASIL level, e.g. C, can be achieved by decomposing fuses with a lower ASIL level, e.g. ASIL A (C) and ASIL B (C), so that the desired higher ASIL level C can be realized by decomposing, in particular, two different electronic fuses.

[0031] For example, the goal may be to implement desired functions during ferry operation, which is achieved with electronic fuses with a lower ASIL level. Additional vehicle components can then be switched off easily, cheaply and, in particular, in an energy-saving manner, or implemented in standby mode with another electronic fuse. Thus, the serial or parallel combination of a functional fuse with an additional basic fuse (support fuse) can reliably solve the desired task. The "functional fuse" represents the actual main fuse. The basic fuse is also referred to as the auxiliary fuse below, as it acts as an additional fuse alongside the intelligent functional main fuse when this functional fuse is deactivated. Depending on the operating status of the vehicle, the functional fuse can, for example,The controller can either switch the device to active, if necessary for the operating state, off, or into standby mode, where the functional fuse is only conductive for the affected supply line between the base fuse and the protected supply circuit.

[0032] In a conceivable embodiment of the invention, it is provided that an “intelligent” electronic fuse (e.g. a microchip that can be controlled via an external microcontroller) is combined with a “non-intelligent” electronic fuse that, for example, does not require any controller control (simple power-saving switch).

[0033] In a preferred embodiment of the invention, it is provided that the functional fuse represents an “intelligent” electronic fuse, which in particular has or realizes further features and properties (such as cable protection, load control, overheating protection and other functions).

[0034] According to the invention, a safety device for a vehicle, in particular for realizing a specific safety level depending on an operating mode of the vehicle, in particular a level representative of a specific requirement of functional safety in a vehicle electrical system, comprising a plurality of electrical devices which are to be operated with different, each individual safety level X-1, X, X + 1, X +2, .... in the respective operation of the device concerned, wherein the safety level X + 1 is one of several hierarchically defined safety levels of different safety levels, wherein the safety device has the following:

[0035] Option 1 : a decomposition of two separate controls and a functional fuse that can be individually controlled by each of the controls and has a sufficiently high ASIL level or

[0036] Option 2: a decomposition of two fuses (functional fuse) and one auxiliary fuse (support fuse).

[0037] In particular, the following features are provided for in Option 2: a. at least one first electronic fuse Fi for implementing the functional safety requirement of Level X-1 or X of a device, arranged in a wiring harness that leads to the device to be protected in question, b. a second electronic fuse F2 arranged serially in front of or parallel next to the first fuse Fi in the same wiring harness for implementing the functional safety requirement of Level X of the device in question, c. wherein the first or second electronic fuse F1, F2 can be selectively activated, deactivated or switched to standby mode by a circuit and / or a microcontroller in order to implement or deactivate the desired safety levels depending on the operating mode in the vehicle.

[0038] In an advantageous embodiment of the invention, it is provided that the safety device is designed in such a way that the decomposition of the two fuses results in a safety level that is at least one level (safety level) higher than the safety level X of the respective fuses (compared to the highest level of the individual components). This also applies to option 1, where, for example, inhomogeneous controls with different ASIL levels are used. The safety levels are defined by very specific characteristics, for example by the ASIL characteristics of the ISO standard ISO 26262 2nd edition (2018 edition). For example, the safety level X-1 , X, X + 1 , X +2 can be defined according to the ISO standard ISO 26262 2nd edition as follows: A = X-1 ; B = X, C = X +1 , D = X +2.

[0039] It is also advantageous if the second electronic fuse (not a simple fuse) is a functional fuse, which can be controlled via a microcontroller if necessary, to provide or activate certain properties and / or functions in the vehicle electrical system. This allows functions in the vehicle to continue to be supplied with electricity, but saves energy (since there is no current). The cable protection and the safety function are thus retained.

[0040] It is particularly advantageous if the second electronic fuse is preferably a microchip with multiple channels, especially four. Other microchips of different designs are also conceivable.

[0041] It is further preferred if the second electronic fuse, when switched off or in standby mode, provides a conductive connection between the first fuse and the device to be protected. This can result in energy savings in certain operating states, since additional, complex protection at a higher level is then not required. For example, in the vehicle's parking function, the ESP can be deactivated as a possible vehicle operating function, while this function is required in ferry mode. Other operating situations, in turn, require a higher protection level, so that the second fuse can then be activated.

[0042] It is further advantageously provided that the second electronic fuse can also be switched off (or standby) or activated (active fuse protection) in the de-energized wiring harness, in particular switched off or activated by the microcontroller.

[0043] In this respect, according to an advantageous embodiment of the invention, several of the first and second fuses, arranged in series or parallel in decomposition, are arranged in several different cable harnesses in the vehicle electrical system, each leading to a separate device to be protected. In this way, a complex protection topology for a high ASIL level can be realized with fuses with a lower ASIL level.

[0044] A further aspect of the present invention relates, in addition to the described safety device, to a method for operating such a safety device, wherein at least one or more of the respective second fuses is or are operated in standby mode in a specific vehicle operating state of the vehicle.

[0045] The method advantageously takes place in such a way that, upon a change or transition from the current vehicle operating state to another, deviating vehicle operating state, one or more of the second fuses switch from the inactive, in particular standby, mode to the active safety mode in accordance with the then changed functional safety requirements. It is further preferred if, particularly upon a change in the currently required safety level due to a transition from one vehicle operating state to another, the standby state of one or more of the second fuses is optionally activated or deactivated, depending on whether a higher or lower safety level needs to be ensured.

[0046] The features disclosed above can be combined as desired, as long as this is technically possible and they do not contradict each other.

[0047] Other advantageous developments of the invention are characterized in the subclaims or are presented in more detail below, together with the description of the preferred embodiment of the invention, with reference to the figures. They show:

[0048] Fig. 1 Schematic representation of the basic function or basic components of an electronic fuse F;

[0049] Fig. 2 Schematic representation of the components of an electronic fuse F with a controller C;

[0050] Fig. 3 Schematic representation of the possibilities for decomposition for safe separation;

[0051] Fig. 4 Schematic representation of the possibilities for decomposition for safe separation in an alternative solution compared to the solution in Fig. 3;

[0052] Fig. 5 Schematic representation of the possibilities for decomposition for safe supply;

[0053] Fig. 6 Schematic representation of the decomposition options for safe supply in an alternative solution compared to the solution in Fig. 5; Fig. 7 a schematic view of exemplary basic ASIL requirements in a protection topology in the vehicle.

[0054] The figures are schematic examples. Identical reference numerals in the figures indicate identical functional and / or structural features.

[0055] Figure 1 shows a schematic view of the basic function and the basic components of an electronic fuse F, in particular with optional shutdown (standby). Status 1 means active and status 0 optionally inactive or standby. Figure 2 shows a schematic view of the basic function and the basic components of an electronic fuse F with a controller C, in particular for optional shutdown of the circuit breaker (standby). Status 1 means active and status 0 optionally inactive or standby. Controller C is used to evaluate and control the circuit breaker (e.g. transistor). In standby, the control is inactive and thus saves power and the circuit breaker can be either conductive or blocking.

[0056] In Figure 3, the left-hand illustration shows the protection with safety level ASIL C for safe separation in, for example, the vehicle's "drive" operating mode and ASIL A in the "parking" operating mode.

[0057] The implementation of the decomposition according to the inventive concept is shown in the right-hand illustration of Figure 3. The decomposition is achieved by using two different fuses, Fi and F2, in series, with F2 being deactivated in the "Park" state and active in ferry operation. Thus, with a fuse F1 with ASIL Level A and a fuse F2 with ASIL Level B in decomposition, ASIL Level C (indicated in parentheses) can be achieved.

[0058] Figure 4 shows an alternative design in a parallel circuit configuration. Two controllers C1 and C2 are used here, each with safety levels ASIL A and ASIL B. Decomposition is achieved by interconnecting two inhomogeneous controls C1 and C2 using a logic L, provided the circuit breaker itself has a sufficiently good fault rate (low FIT rate). C2 itself can be switched off, so that in standby mode only Ci can control. This also implements an energy-saving protection concept according to the idea of ​​the invention.

[0059] Figures 5 and 6 show the implementation for safe supply (instead of safe disconnection) in a vehicle. Figure 5 shows a first exemplary embodiment of the safe supply of a device with fuses F1 and F2 arranged in parallel. The aim is to provide protection, for example, with ASIL C for safe supply in the "drive" operating mode and ASIL A in the "parking" operating mode. The right-hand illustration in Figure 5 shows how ASIL C safety is achieved by decomposing the two fuses ASIL A and ASIL B. The electronic fuse F2 can be switched off or switched to standby mode.

[0060] Figure 6 shows an alternative solution with two control circuits, specifically inhomogeneous control circuits C1 and C2. Control is again performed using logic L if the circuit breaker itself has a sufficiently good fault rate to meet the safety requirement. Control circuit C2 can be disabled, so that only Ci can control in standby mode.

[0061] Figure 7 shows a particular protection concept according to the invention, in which a safety device 1 is proposed for realizing (depending on the case, disconnecting or supplying) a specific safety level, in particular a level representative of a specific requirement of functional safety in a vehicle electrical system for the devices G1, G2 and G3 shown.

[0062] The on-board network includes a variety of electrical devices G1, G2, G3, etc., which are to be operated with different, individual safety levels ASIL A, ASIL B, ASILC, etc. in the respective operation of the device concerned, which are located below the level / main fuse box HSB 1. The HSB 1 is a power distribution box with cables to the devices G1, G2, G3. Furthermore, a 12 V battery and a DC / DC

[0063] Converters are shown on the power supply side. Devices G1, G2, and G3 represent a steering system, an ABS pump, and a consumer merely as examples. B(C) is the functional fuse, B'(C) is the basic fuse with ASIL level B, while A(C) is a basic fuse with ASIL level A. The invention is not limited to the preferred embodiments specified above. Rather, a number of variants are conceivable, which also utilize the solution presented in fundamentally different designs.

Claims

Patent claims 1. Safety device (1) for a vehicle, in particular for realizing a specific safety level depending on an operating mode of the vehicle, in particular a level representative of a specific requirement of functional safety in a vehicle electrical system, comprising a plurality of electrical devices (G1, G2, G3, ...) which are to be operated with different, each individual safety level (X, X + 1, X + 2, ...) in the respective operation of the device concerned, wherein the safety level X is one of several hierarchically defined safety levels (X, X + 1, X + 2, ...).) of different safety levels, wherein the safety device (1 ) has the following: a decomposition of two separate safety controls (C1 , C2) and a functional fuse (F1 ) (functional fuse), in particular a circuit breaker, which can be individually controlled by these controls (C1 , C2), wherein the first or second safety control (O1 , O2) can be selectively activated, switched off or switched to a stand-by mode by a controller in order to implement or deactivate the predetermined safety levels depending on the operating mode of the vehicle.

2. Safety device (1) for a vehicle, in particular for realising a specific safety level depending on an operating mode of the vehicle, in particular a level representative of a specific requirement of functional safety in a vehicle electrical system, comprising a plurality of electrical devices (G1, G2, G3, ... ), which are to be operated with different, each individual safety levels (X-1, X, X + 1, X + 2, ... .) in the respective operation of the device concerned, wherein the safety level to be implemented (X + 1) is one of several hierarchically defined safety levels of different safety stages, wherein the safety device (1) has the following: a. at least one first electronic fuse (Fi) with the requirement of functional safety of level X -1 or X arranged in a cable harness (L) which leads to the respective device to be protected (G1, G2, G3, ... ), b. a second electronic fuse (F2) arranged serially in front of or parallel next to the first fuse (Fi) in the same cable harness L, with the requirement of functional safety of level X for the device to be protected (G1, G2, G3, ... ), c.wherein the second electronic fuse (F2) can be selectively activated or switched into a stand-by mode by a circuit and / or a microcontroller in order to implement or deactivate desired safety levels depending on the operating mode in the vehicle.

3. Safety device (1) according to claim 2, characterized in that by the decomposition of the two fuses, a safety level X +1 is realized which is increased compared to the safety level X of the respective fuses (Fi, F2), in particular increased by at least one level.

4. Safety device (1) according to claim 2 or 3, wherein the second electronic fuse (F2) is a functional fuse which is preferably controllable via a microcontroller.

5. Safety device (1) according to claim 2, 3 or 4, wherein the second electronic fuse (F2) is preferably a microchip with several, in particular 4 channels.

6. Safety device (1) according to one of the preceding claims 2 to 5, wherein the second electronic fuse (F2) in standby mode provides a conductive connection between the first fuse (Fi) and the device to be protected (G1, G2, G3, ...) for the purpose of power supply.

7. Safety device (1) according to one of the preceding claims, wherein the second electronic fuse (F2) can also be switched off (stand-by) or activated (active fuse protection) in the currentless line harness L, in particular can be switched off or activated by a microcontroller.

8. Safety device (1) according to one of the preceding claims, wherein the safety levels X correspond to the ASIL levels (ASIL A, ASIL B, ASIL C, ASIL D,...) according to the ISO standard edition ISO 26262 2nd edition.

9. Safety device (1) according to one of the preceding claims 2 to 8, wherein several of the first and second fuses (Fi, F2) arranged in series or parallel in decomposition are arranged in several different line strands L in the vehicle electrical system, each leading to a separate device to be protected.

10. Safety device (1) according to claim 1, characterized in that a logic module L for controlling the circuit breaker is provided between the parallel-connected controls (C1, C2).

11. A method for operating a safety device according to one of the preceding claims, wherein at least one or more the respective first or second fuses (F2) are operated in the switched off or standby mode in a specific vehicle operating state of the vehicle and are switched off in another vehicle operating state that differs therefrom.

12. Method according to claim 10, wherein upon a change of the current vehicle operating state to another, different vehicle operating state, one or more of the in particular second fuses change from the activated to the deactivated security mode and / or vice versa.

13. Method according to claim 11, wherein in particular upon a change of the currently required security level due to a change of one vehicle operating state to another, the standby state of one or more second fuses is optionally activated or deactivated, in particular depending on whether a higher or lower security level needs to be guaranteed.

Images