Patent Application
20190143916
The invention relates to a method for operating a safety-critical controller for a motor vehicle according to the generic part of claim 1 and thereby a corresponding motor vehicle.
From EP 1062132 B1 or EP 167792 A1, by way of example, methods for controlling the activation of an occupant protection system are known, in which, by way of example, the accident sensor at regular or irregular intervals carries out an internal error check and if an error is detected sends a status signal via the status signal output connection to the controller. Then, by way of example, the activation is blocked and/or an optical or acoustic warning signal is generated. Here the connection and data exchange can take place via a vehicle bus, e.g. CAN or Flexray.
In DE 10249440 A1 methods are described for monitoring the functionality of a weight-sensing system in a vehicle, in which the weight-sensing system, when a threshold value is exceeded for the force impinging on the force sensor, issues a warning message, indicating possible damage to the weight-sensing system. Here, the warning message can be displayed visually on an instrument cluster of the vehicle, particularly as text and or/in the form of an indicator light. It is also proposed that the warning message is given on a CAN (car area network)-bus and/or stored in an error memory.
From DE 102009014624 A1 a method is also known for displaying malfunctions in the motor vehicle with self-diagnostics-capable controllers, which in the event of a malfunction issue a warning to the driver. At the same time as the warning is issued, as a function of the severity of the error, a recommended action is shown, acknowledgement of which must be given by the driver. This display is preferably only deleted once the driver has given their acknowledgement. Alternatively, or additionally, according to a further development of the invention a safety mode is activated if the acknowledgement is not given within a specified time window.
For all that, it is impossible to rule out that the driver will overlook, ignore or forget this warning and that the vehicle will be left for a long time in this state without an operational occupant protection system or other safety-critical controller.
Furthermore, by way of example from DE 29 12 547 C2 and DE 196 50 176 A1 automatic emergency call systems for vehicles are known, by means of which in the event of an accident the emergency services can be automatically informed and guided to the precise scene of the accident, in order provide a reliable guarantee of timely assistance.
The object of the present invention is to further increase this reliability. This object is achieved by the features of the independent claims. Advantageous further developments of the invention are indicated by the subclaims, wherein combinations and further developments of individual features are conceivable.
It is therefore provided that a corresponding data transmission to a vehicle manufacturer and/or service provider takes place, if within a specified time span the error has not been cleared. Apart from clearance, if necessary a corresponding error entry can be confirmed as repaired, or deleted, by an appropriate service engineer.
From the non-prior art DE 10 2015 219 402 from the applicant a method for operating an occupant protection system has previously been described, wherein the occupant protection system comprises at least one controller, at least one sensor and at least one occupant protection means, and a controller monitors the correct functioning of the controller, of at least one sensor or at least one actuator, or a plurality of these, and where specific error conditions exist a warning for the driver is generated. For at least a subgroup of error conditions an appropriate warning message is given as a warning to the driver, which must be confirmed by the driver by operating at least a specified operating means. If the warning message is not confirmed within a specified time span by operating the specified operating means, a corresponding data transmission to a vehicle manufacturer or service provider takes place. In doing so, however, no check is made on whether the error has been cleared. If, however, this should be seen as a partial anticipation, the applicant makes express reference to the scope of protection hereby sought, namely that it is not in any way intended to claim a method according to claim 1 of DE 10 2015 219 402.
The specified time span for clearing or until data transmission is preferably set at a first longer time value, if the driver, by operating the specified means of operation, confirms the warning message, wherein in addition the longer, second time span is not unlimited. Thus, in an envisaged exemplary embodiment without confirmation the data transmission takes place in a relatively short space of time of between a few minutes and a maximum of days, whereas on the other hand following confirmation for repair between from just a few days up to weeks remains, but in any event following expiry of this second time span a data transmission takes place.
Here the data transmission preferably takes place via a mobile telephone, an available mobile radio data connection or SMS and in the process preferably contains vehicle-identifying data, the type of error condition and the time of occurrence of the error conditions or expiry of the time span without operation of the operation means having taken place. Through the data transmission the vehicle manufacturer or service provider can then make contact with the driver via other channels, be this telephone, e-mail or similar and avoid continued driving without an intact safety-critical controller.
With the first data transmission, a new time window is preferably started, and the data transmission is repeated cyclically, where no clearance of the error has been detected before expiration of the time window.
It makes no difference here if the method is performed in the safety-critical controller or another controller and if only one sensor, an occupant protection means or the correct functioning of the controller itself is monitored. In addition, the warning message to be confirmed by the operation of at least one specified operating means can also be given for just a sub-group of error conditions, and thus not necessarily for all error events.
The warning message to the driver can be given visually or acoustically, as a pictogram or in various languages and apart from the reference to the malfunction of the occupant protection system preferably contains a reference to an early visit to the workshop, the need for confirmation and the consequences of non-confirmation.
For confirmation here an operating means, its operation, or a plurality or sequence of operating means is preferably selected such that an inadvertent “confirmation”, that is, operation without the intention of confirmation during normal driving operations, can be excluded to the greatest possible extent.
The operation is preferably logged by the driver by operating the specified operating means in a memory, by way of example the time of confirmation is stored in the memory, e.g. it is not for instance just that of the occurrence of the error and the warning, but similarly and separately from this also the actual operation by the driver that is stored.
If the warning message is not confirmed within a specified time span by operation of the specified operating means, apart from the data transmission a restriction is preferably placed on the vehicle. This is of course wholly dependent on the desired escalation and must be set according to the individual vehicle.
One or more of the following actions in particular is/are envisaged:
Accordingly, a safety-critical controller, be this the display controller, ESP controller or the occupant protection system, is equipped with a suitable algorithm for performing the method and a data interface with a means for issuing the warning message and for receiving a signal from the specified means of operation or for querying the means of operation and has an interface to data transmission means.
Thus, in a motor vehicle an appropriately equipped controller and means for issuing the warning message and data transmission are provided or an existing means is arranged to perform the method.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/DE2016/200336 | 7/21/2016 | WO | 00 |
