The invention relates to a circuit arrangement in an electronic control unit of a motor vehicle for the detection of faults in an electronically controlled drive system.
As a result of standards prescribed by law (for example, ISO or CARB Standard Regulations), motor vehicle manufacturers have been required for many years to ensure that electronic control units or electronically controlled systems in motor vehicles, such as the digital engine control or the adaptive transmission control, are capable of self-diagnosing. So-called OBD (On-Board Diagnosis) systems, for example, were developed on that basis. One example of a design of an OBD system is contained in the applicant's German Patent Document DE 197 31 283 A1.
In this respect, the motor-vehicle-internal electronic control units have a large software capacity for self-diagnosis, in addition to the software capacity for the actual function control. One example of a self-diagnosis within the control unit is described in the applicant's German Patent Document DE 196 12 857 A1.
Up to now, the focus of the prescribed fault diagnosis has been the inherent security of each individual control unit or of each individual electronically controlled vehicle system separately. This results in high application expenditures. Particularly in the case of a motor or internal-combustion engine control (for spark-ignition engines or diesel engines), this results in a large number of stored characteristic diagrams when each programmed function has to be secured. One example, just of the expenditures of a function programming when inputting a desired drive power as a function of the accelerator pedal position is indicated in the applicant's German Patent Document DE 102 49 689 A1. If the characteristic diagrams illustrated there for the function programming were inherently securely diagnosed, approximately twice the programming expenditures or the storage space would be necessary because a fault recognition threshold would have to be stored for each characteristic curve of the characteristic diagrams.
Furthermore, from German Patent Document DE 44 38 714 A1, a so-called 3-level security concept currently widespread in practice is known—particularly in connection with electronic engine control units for the control of drive functions. The circuit arrangement according to the invention for the monitoring of drive functions is based on this 3-level security concept. The known 3-level security concept has a complex system architecture, which requires high development expenditures for control unit functionalities, which will become more and more complex and increasingly more cross-linked in the future.
Finally, in addition, reference is made to the applicant's German Patent Document DE 10 2011 002 805.6 (which is not a prior publication) which already contains a process for the detection of faults in an electronically controlled drive system of a motor vehicle, the system architecture for implementing the process not being addressed.
It is an object of the invention to simplify the system architecture of a security concept for the detection of faults in a drive system of a motor vehicle, particularly with the following objectives:
According to the invention, this task is implemented by a circuit arrangement according to the invention in an electronic control unit of a motor vehicle for detecting faults in an electronically controlled drive system, which is structured in at least two levels, specifically, a first function-controlling level and a second monitoring level. The two levels acquire at least the accelerator pedal position as an input signal. The first level has a driver intention determination block for determining a quantity proportional to a desired longitudinal acceleration and transmits this quantity as an input signal to a plausibility block of the second level. The plausibility block has at least one fault detection program by which a fault can be detected when a defined (static or dynamic) correct relationship between the accelerator pedal position and/or an accelerator pedal position change with respect to a determined quantity proportional to a desired longitudinal acceleration (particularly for a specified time period) is not present, and this relationship is therefore implausible.
By way of the invention, the main security requirement is met, specifically the avoidance of an unintended acceleration and of an unintended spinning of wheels.
The invention is based on the conventional so-called 3-level security concept, which will be explained in detail below in connection with the description of the figures.
In the circuit arrangement according to the invention, a first fault detection program can preferably be run in the plausibility block, by which fault detection program a fault is detected when a defined desired longitudinal acceleration gradient dependent on an accelerator pedal position change is exceeded longer than for a specified time period (first defined correct relation is not present). For the implementation of the process according to the invention, the plausibility block of the control unit is programmed correspondingly.
The defined acceleration gradient dependent on an accelerator pedal position change is preferably limited by the maximal slope of a characteristic curve of the actual function extent of the first level by which, depending on the accelerator pedal position, a desired vehicle acceleration is specified. This maximal slope is empirically determined, particularly in driving tests, in order to determine which acceleration gradients can still just be reasonably handled or controlled by the driver. The defined acceleration gradient(s) dependent on an accelerator pedal change is/are stored in a memory of the control unit and are integrated in the plausibility block of the control unit for the implementation of the process according to the invention.
In a further development of the invention, while the accelerator pedal is not actuated, by use of the control unit, a second fault detection program can be run in the plausibility block, by which fault detection program a fault is recognized when a defined desired longitudinal acceleration threshold value preferably depending on the vehicle speed is exceeded longer than for a specified time period (second defined correct relation is not present).
In a further development of the invention, in the case of an non-activated drive slip control system, a third fault detection program can be run by the control unit in the plausibility block, by which a fault is detected if, when the accelerator pedal is not actuated or the accelerator pedal angle is decreasing, a longitudinal acceleration gradient determined from the rotational wheel speeds is positive for longer than for a specified time period, and simultaneously the desired longitudinal acceleration gradient not determined from the rotational wheels speeds is also positive (third defined correct relation is not present).
For this purpose, the plausibility block in the second level of the control unit receives, either directly or by way of a digital bus, information such as the rotational wheel speed values or the acceleration determined from the rotational wheel speeds, as input signal(s). The rotational wheel speeds are acquired by way of corresponding sensors in a known manner anyhow, for example, for a slip control.
Furthermore, a fourth fault detection program can be run in the plausibility block, by which a fault is detected when, in the case of a specified accelerator pedal position, a disproportionately high desired longitudinal acceleration is specified (fourth defined correct relation is not present).
By way of the invention, all required ISO Regulations are complied with:
Other objects, advantages and novel features of the present invention will become apparent from the following detailed description of one or more preferred embodiments when considered in conjunction with the accompanying drawings.
According to
The circuit arrangement according to the embodiment is preferably integrated in block 2a for monitoring the driver intention acquisition in a 3-level security concept according to the state of the art, which is schematically illustrated in greater detail in
At the E1 level, the driver's intention is acquired in block 1a, and a desired drive torque, a desired longitudinal acceleration or a desired wheel torque is determined therefrom, which is forwarded into the block 1b for the desired input of the automatic control, and is finally converted in block 1c as the torque adjuster module to the actuating signals for the actuators (for example, the injection, ignition and air supply in the case of internal-combustion engine or to the driving current in the case of electric motors or in a hybrid drive). Input signals of the driver intention acquisition are particularly the accelerator pedal position or also inputs by an automatic cruise control apparatus (ACC) or a braking system (ABS, ASC, DSC).
At the level E2, according to the state of the art, the monitoring of the driver intention acquisition is carried out in block 2a, in which case, the input signals of block 2a are the same as in block 1a, and the monitoring is carried out by a duplication of the driver intention acquisition. A more detailed representation of block 2a according to the state of the art is shown in
In
The circuit arrangement according to the invention here relates to block 2a for the monitoring of the driver intention acquisition and is illustrated in detail in
By use of the circuit arrangement according to the invention, as a result of the plausibility block 100, which acquires at least the accelerator pedal position (αFP) and the desired longitudinal acceleration of the motor vehicle aFzg
By way of the first fault detection program SF_01, in particular, acceleration changes are to be prevented which are not controlled by the driver (dynamic situation).
According to
The defined acceleration gradient ΔaFzg
Accordingly, no fault is detected in
In addition, a fourth fault detection program SF_04 is illustrated in
Basically, by use of all fault detection programs SF_01 (in the form of an acceleration change monitoring), SF_02 (in the form of an acceleration coasting monitoring) SF_03 (in the form of preventing unintentionally spinning wheels) and/or SF_04 (in the form of an absolute threshold monitoring), in the event of a fault detection, the drive torque will be reduced or completely switched off.
By way of this circuit arrangement according to the invention, a system-covering, but simple, monitoring concept is created which is assigned to the engine control.
The foregoing disclosure has been set forth merely to illustrate the invention and is not intended to be limiting. Since modifications of the disclosed embodiments incorporating the spirit and substance of the invention may occur to persons skilled in the art, the invention should be construed to include everything within the scope of the appended claims and equivalents thereof.
Number | Date | Country | Kind |
---|---|---|---|
10 2012 201 653 | Feb 2012 | DE | national |
This application is a continuation of PCT International Application No. PCT/EP2013/051709, filed Jan. 29, 2013, which claims priority under 35 U.S.C. §119 from German Patent Application No. 10 2012 201 653.8, filed Feb. 3, 2012, the entire disclosures of which are herein expressly incorporated by reference.
Number | Name | Date | Kind |
---|---|---|---|
4856798 | Buma et al. | Aug 1989 | A |
5880568 | Bederna et al. | Mar 1999 | A |
5992379 | Bruedigam | Nov 1999 | A |
6038503 | Wolf et al. | Mar 2000 | A |
6052642 | Wagner et al. | Apr 2000 | A |
6407554 | Godau et al. | Jun 2002 | B1 |
6622071 | Reuter | Sep 2003 | B2 |
7437218 | Funcke et al. | Oct 2008 | B2 |
7469179 | Thissen et al. | Dec 2008 | B2 |
8725348 | John et al. | May 2014 | B2 |
20070173985 | Thissen et al. | Jul 2007 | A1 |
Number | Date | Country |
---|---|---|
44 38 714 | May 1996 | DE |
196 12 857 | Oct 1997 | DE |
196 24 825 | Jan 1998 | DE |
196 38 278 | Mar 1998 | DE |
197 31 283 | Jan 1999 | DE |
197 31 972 | Jan 1999 | DE |
199 60 782 | Jun 2001 | DE |
100 45 611 | Mar 2002 | DE |
101 63 655 | Jul 2003 | DE |
102 49 689 | May 2004 | DE |
10 2004 047 925 | Apr 2006 | DE |
10 2008 014 511 | Sep 2009 | DE |
10 2009 002 900 | Nov 2010 | DE |
10 2011 002 805 | Jul 2012 | DE |
Entry |
---|
International Search Report (PCT/ISA/210) dated Apr. 10, 2013 with English translation (seven pages). |
International Search Report (PCT/ISA/210) dated Mar. 28, 2012 with English translation (five pages). |
German Search Report dated Sep. 16, 2014 with partial English translation (Fourteen (14) pages). |
Number | Date | Country | |
---|---|---|---|
20140343817 A1 | Nov 2014 | US |
Number | Date | Country | |
---|---|---|---|
Parent | PCT/EP2013/051709 | Jan 2013 | US |
Child | 14448392 | US |