System, in particular steering system, for a vehicle, and method for operating a system, in particular a steering system, for a vehicle

Abstract

The invention relates to a system (1), in particular a steering system (1), for a vehicle, comprising a first sub-system (10) and a second sub-system (20) which are identical, the first and second sub-systems (10, 20) being configured such that they determine their own condition and disclose it to the other sub-system (20, 10), and the system (1) also being designed such that, in a normal operating mode, the first sub-system (10) is in a first condition while the second sub-system (20) is in a second condition, the second condition differing from the first condition, in particular differing by a predefined minimum condition difference. The invention also relates to a method for operating a system (1) of this type.

Description

[0001] SYSTEM, IN PARTICULAR STEERING SYSTEM, FOR A VEHICLE. AND METHOD FOR OPERATING A SYSTEM, IN PARTICULAR STEERING SYSTEM, FOR A VEHICLE

[0002] The invention relates to a system, in particular an electric steering system or a steer-by-wire system, for a vehicle, comprising a first subsystem and a second subsystem that are identically configured. Furthermore, the invention relates to a method for operating such a system.

[0003] As automotive technology advances, vehicle control and driving have become increasingly automated, for example, with the help of driver assistance systems. Current research and development is striving for increasing automation so that driving can be fully automated or autonomous in the future. However, ensuring autonomous driving requires special safety precautions and systems to prevent technically induced personal injury and property damage, or at least to mitigate the potential effects of technical malfunctions and / or failures. Furthermore, systems enabling autonomous driving must continue to exhibit their desired functionality in the event of an internal system error. Such systems are referred to as "fail-active" systems.

[0004] Fail-active systems are typically designed as redundant systems. A redundant system comprises several, in particular two, different subsystems. The two different subsystems have the same functionality, but typically different designs and components. The advantage of having two different subsystems is that a malfunction due to a systematic error or design flaw in one of the two subsystems does not also occur in the other subsystem, and in particular does not result in a simultaneous failure in both subsystems, with the result that the entire system does not fail, but rather the desired functionality is maintained - at least partially. However, having different subsystems comes with the disadvantage that the effort and thus also the associated costs for research and development, production, and after-sales increase, in particular can almost double.

[0005] Against this background, the object is to provide an alternative "fail-active" system which creates simple and more cost-effective redundancy. This object is achieved by a system, in particular a steering system or a steer-by-wire system, for a vehicle, having a first subsystem and a second subsystem which are identically designed, wherein the first and the second subsystem are configured such that they determine their own state and communicate this to the respective other subsystem, wherein the system is further set up such that - in a normal operating mode - the first subsystem is in a first state while the second subsystem is in a second state, wherein the second state differs from the first state, in particular by a predetermined minimum state distance.

[0006] The system comprises a first subsystem and a second subsystem identical to the first subsystem. The identity of the two subsystems reduces the effort and costs for the development, manufacturing, and after-sales of the system, as the system contains only one subsystem rather than two. Furthermore, the first and second subsystems are configured to determine their own status and communicate it to the other subsystem. This provides the advantage that both subsystems know the status of the other subsystem in real time and can react to it as needed.In addition, the system is configured so that - in a normal operating mode - the first subsystem is in a first state while the second subsystem is in a second state, wherein the second state differs from the first state, in particular by a predetermined minimum state distance. By maintaining a minimum state distance, it can be ensured that the two subsystems are in different states, so that an error occurring in a certain state can only affect one of the two subsystems. In other words, this has the advantage that a minimum functionality of the system can be guaranteed at all times. Due to the identity of the two subsystems - at least in normal operating mode - the system can be described as homogeneously redundant.Overall, the invention provides the advantage of providing an alternative system which, due to its homogeneity, i.e. the identity of the two subsystems, offers a simple and cost-effective solution for creating redundancy and thus also (partial) reliability.

[0007] The system within the meaning of the invention is understood in particular to be a "fail-active" system. A "fail-active" system is a fail-safe system that maintains a safe operating mode in the event of system malfunctions or errors until corrective and / or bridging measures are taken. In a "fail-active" system, the functionality of the system can always be maintained – at least partially.

[0008] According to an advantageous embodiment of the invention, the first and second subsystems are configured such that they can detect, based on the status communicated by the respective other subsystem, whether the respective other subsystem has a fault and under which operating conditions this fault occurred. If the first or second subsystem detects a fault in the respective other subsystem, the respective subsystem adjusts its own status such that it avoids the operating conditions under which the fault occurred in the other subsystem. "Status" here refers to a vector of data that describes both the freedom from faults or - in the case of a fault - the type of fault, as well as the operating conditions that - in the fault-free case - currently exist or under which the fault occurred.The adjustment or control of the receiving subsystem's own state following detection of the fault in the other subsystem can be referred to as the system's fault repetition prevention strategy. Communication between the first and second subsystems can be achieved via one or more communication buses, such as LIN, CAN, or Ethernet.

[0009] A preferred embodiment of the invention provides that the first and second subsystems have identical hardware and identical software. By using identical hardware and software, development effort and manufacturing costs can be reduced. Furthermore, communication between subsystems with identical hardware and software can be carried out with minimal effort.

[0010] In a preferred embodiment of the invention, the first and second subsystems are each configured to control a winding of an electric machine with two separate windings such that the first subsystem generates a greater torque in the electric machine than the second subsystem. The first subsystem can—particularly in normal operating mode—generate, for example, 55% or 60% of the total torque provided by the electric machine, so that an asymmetric torque distribution can be achieved.

[0011] According to an advantageous embodiment of the invention, the first and second subsystems each comprise a first and a second observer for determining their own state. Preferably, the first and second observers are identical, with an observer being understood as a software component or a model that reconstructs non-measurable or unmeasured quantities from measured quantities. Thus, determining a separate state is understood to mean, in particular, the estimation of the separate (subsystem) state or of individual state variables.

[0012] An advantageous embodiment of the invention provides that the first and second subsystems are each configured to generate an internal state vector for controlling their own state. The respective internal state vector can, for example, be an input variable for a subsystem controller of their own subsystem.

[0013] A further subject of the invention is a method for operating a system, in particular a steering system, for a vehicle, having a first subsystem and a second subsystem which are identically designed, wherein the first and the second subsystem determine their own state and communicate it to the respective other subsystem, wherein - in particular in a normal operating mode - the first subsystem is operated in a first state and the second subsystem is operated in a second state which deviates from the first state, in particular by a minimum state distance.

[0014] The method according to the invention can achieve the same technical effects and advantages that have already been described in connection with the system according to the invention.

[0015] According to a preferred embodiment of the invention, it is provided that the first or the second subsystem detects an error in the respective other subsystem on the basis of the state communicated by the respective other subsystem, and - in a fault operating mode - the first or the second subsystem sets its own state in such a way that it avoids the state in which the error occurred in the respective other subsystem.

[0016] An advantageous embodiment of the invention provides that the first and second subsystems are each operated with identical hardware and identical software.

[0017] In a preferred embodiment of the invention, the first and second subsystems each control a winding of an electrical machine with two separate three-phase windings or each control an electrical machine with one three-phase winding each, with the first subsystem generating a greater electrical and mechanical torque than the second subsystem. According to an advantageous embodiment of the invention, the first and second subsystems each determine their own state using a first and a second observer, respectively.

[0018] An advantageous embodiment of the invention provides that the first and the second subsystem each generate an internal state vector for controlling their own state.

[0019] Alternatively or in addition to the advantageous embodiments of the method described above, the advantageous features and embodiments disclosed in connection with the system according to the invention can also be used in the method - alone or in combination.

[0020] Further details and advantages of the invention will be explained below with reference to the exemplary embodiment illustrated in the drawings. Herein:

[0021] Fig. 1 schematically shows an embodiment of a system according to the invention with a first subsystem and a second subsystem; and

[0022] Fig. 2 is a detailed view of a subsystem from the embodiment according to Fig.1.

[0023] Fig. 1 schematically shows an embodiment of a system 1 according to the invention with a first subsystem 10 and a second subsystem 20, wherein the first subsystem 10 and the second subsystem 20 are identical. The system 1 shown in Fig. 1 is a steering system 1, more precisely an electro-hydraulic steering system 1, for a vehicle. The first subsystem 10 and the second subsystem 20 are configured such that they determine their own state and communicate it to the respective other subsystem 20, 10. Furthermore, the system 1 is set up such that - in a normal operating mode - the first subsystem 10 is in a first state while the second subsystem 20 is in a second state, wherein the second state differs from the first state, in particular differs by a predetermined minimum state distance.

[0024] The first and second subsystems 10, 20 are configured such that, based on the status communicated by the respective other subsystem 20, 10, they can detect whether the respective other subsystem 20, 10 has an error and under which operating conditions this error occurred. If the first or second subsystem 10, 20 detects an error in the respective other subsystem 10, 20, the respective subsystem 10, 20 adjusts its own status such that it avoids the operating conditions under which the error occurred in the other subsystem 10, 20. The first and second subsystems 10, 20 have identical hardware and identical software.

[0025] The first subsystem 10 is configured to control a first winding 101 of an electric machine 100. The second subsystem 20 is further configured to control a second winding 102 of the electric machine 100. The first subsystem 10 generates 60% of the torque provided in the electric machine 100. The second subsystem 20 therefore generates 40% of the torque of the electric machine 100. The electric machine 100 drives, in particular, a worm shaft (not shown), which in turn transmits torque to a tie rod for steering the vehicle. Alternatively, the motor torque can be transmitted via a belt drive to a ball screw drive, with the ball screw drive positioning a steering rod.

[0026] The first and second subsystems 10, 20 can communicate with each other via a communication bus, e.g., a CAN bus 30. This communication bus is preferably redundant, ie, it consists of two physical buses that transmit the same information, but preferably in different ways.

[0027] Fig. 2 shows a detailed view A from the exemplary embodiment according to Fig. 1. The first subsystem 10 has a first observer 12 for determining a respective individual state Zi. The determined individual state Zi of the first subsystem 10 is communicated to the second subsystem 20 (not shown in Fig. 2) via the CAN bus 30. Similarly, a separate state Z2 is determined by a second observer of the second subsystem 20 and communicated to the first subsystem 10 via the CAN bus 30.

[0028] If a fault is detected in the other subsystem 10, 20, the first or second subsystem 10, 20 is transferred to a fault operating mode in which the first or second subsystem 10, 20 sets its own state Zi, Z2 such that it is not the fault state detected in the other subsystem 10, 20 (avoidance strategy). For example, in the first subsystem 10, a fault occurring in the second subsystem 20 is avoided using a first controller 13. For this purpose, the first subsystem 10 generates an internal state vector V1 and feeds it to the first controller 13 as an input variable. The first controller 13 controls the first subsystem 10 such that the fault state of the second subsystem 20 is avoided.

[0029] The occurrence of an error in a subsystem 10, 20 usually leads to the shutdown of this subsystem 10, 20. The error repetition avoidance strategy according to the invention has the effect of preventing the shutdown of both subsystems 10, 20, in particular the almost simultaneous shutdown of both subsystems 10, 20.

[0030] List of reference symbols

[0031] 1 system

[0032] 10 First subsystem

[0033] 12 First Observer

[0034] 13 First regulator

[0035] 20 Second subsystem

[0036] 100 Electric Machine

[0037] 101 First winding

[0038] 102 Second winding

[0039] A Detailed view

[0040] Z2 Own state of the second subsystem

[0041] Z1 Own state of the first subsystem

[0042] V1 Internal state vector of the first subsystem

Claims

Patent claims 1. System (1), in particular a steering system (1), for a vehicle, with a first subsystem (10) and a second subsystem (20) which are identically designed, wherein the first and the second subsystem (10, 20) are configured such that they determine their own state and communicate it to the respective other subsystem (20, 10), wherein the system (1) is further set up such that - in a normal operating mode - the first subsystem (10) is in a first state while the second subsystem (20) is in a second state, wherein the second state differs from the first state, in particular differs by a predetermined minimum state distance.

2. System (1) according to claim 1, characterized in that the first and the second subsystem (10, 20) are designed in such a way that they can recognize, on the basis of the state communicated by the respective other subsystem (10, 20), whether the respective other subsystem (10, 20) has an error and under which operating conditions this error occurred, and that in the event that the first or the second subsystem (10, 20) recognizes an error in the respective other subsystem (10, 20), the respective subsystem (10, 20) sets its own state in such a way that it avoids the operating conditions under which the error occurred in the other subsystem (10, 20).

3. System (1) according to one of the preceding claims, characterized in that the first and second subsystems (10, 20) have identical hardware and identical software.

4. System (1) according to one of the preceding claims, characterized in that the first and the second subsystem (10, 20) are each designed to control a winding of an electrical machine (100) with two separate windings in such a way that the first subsystem (10) generates a greater torque in the electrical machine (100) than the second subsystem (20).

5. System (1) according to one of the preceding claims, characterized in that the first and the second subsystem (20) each comprise a first and a second observer (12, 22) for determining a respective state.

6. Method for operating a system (1), in particular a steering system (1), for a vehicle, with a first subsystem (10) and a second subsystem (20) which are identically designed, wherein the first and the second subsystem (10, 20) determine their own state and communicate it to the respective other subsystem (20, 10), wherein - in particular in a normal operating mode - the first subsystem (10) is operated in a first state and the second subsystem (20) is operated in a second state which deviates from the first state, in particular by a minimum state distance.

7. Method according to claim 6, characterized in that the first or the second subsystem (10, 20) detects an error state in the respective other subsystem (10, 20) on the basis of the state communicated by the respective other subsystem (10, 20), and - in a fault operating mode - the first or the second subsystem (10, 20) sets its own state in such a way that it is not the error state detected in the respective other subsystem (10, 20).

8. Method according to one of claims 6 or 7, characterized in that the first and second subsystems (10, 20) are each operated with identical hardware and identical software.

9. Method according to one of claims 6 to 8, characterized in that the first and the second subsystem (10, 20) each control a winding of an electrical machine with two separate windings, wherein the first subsystem (10) generates a greater torque in the electrical machine than the second subsystem (20).

10. Method according to one of claims 6 to 9, characterized in that the first and the second subsystem (20) each determine a separate state by means of a first and a second observer (12, 22).

Images