EP1718510A1

EP1718510A1 - Method and device for monitoring signal processing units for sensors

Info

Publication number: EP1718510A1
Application number: EP05716741A
Authority: EP
Inventors: Patrick Schäfer; Thomas Ohgke; Sebastian PÄTZOLD; Otmar Simon; Tino Sonntag
Original assignee: Continental Teves AG and Co OHG
Current assignee: Continental Teves AG and Co OHG
Priority date: 2004-02-23
Filing date: 2005-02-18
Publication date: 2006-11-08
Also published as: DE102005005995A1; WO2005080164A1; US20070282459A1

Abstract

The invention concerns a method and device for monitoring signal processing units for sensors that detect individual process control quantities or process measured quantities of a process. In order to improve the reliability of the sensor data of a vehicle, an at least redundant processing of the sensor data ensues in two identical signal processing units (43, 31, 46; 44, 32, 45) that, independent of and separate from one another, respectively comprise at least two preprocessing devices (43, 44) in two evaluating devices (31, 32). The sensor data are transferred via separate signal lines (60, 61) between the respective preprocessing device (43, 44) and the associated evaluating device (31, 32).

Description

Method and device for monitoring signal processing units for sensors

The invention relates to a method and a device for monitoring signal processing units for sensors, each of which detects individual process control or process measurement variables of a process.

Electronic stability programs are vehicle dynamics control systems that serve to support the driver in critical driving situations during braking, acceleration and steering and to intervene where the driver himself has no direct intervention. The control system supports the driver when braking, in particular on a road surface with a low or changing coefficient of friction, on which the vehicle could no longer be steerable or could skid due to locking wheels, and also during acceleration, with the risk of the drive wheels spinning. and finally when steering in a curve in which the vehicle could oversteer or understeer. Overall, not only comfort, but also active safety is significantly improved. Such a control system is based on a closed control loop, which takes over typical control tasks in normal operation of the vehicle and is intended to intercept the vehicle as quickly as possible in extreme driving situations. As actual value sensors for recording the various driving dynamics parameters are of particular importance. A plausible control assumes that the sensors correctly reflect the actual state of the controlled system. This is particularly important in the case of driving stability controls in extreme driving situations in which a control deviation has to be corrected within a very short time. For this reason, the sensors (yaw rate sensor, lateral acceleration sensor, steering angle sensor) must be constantly monitored in an electronic stability program. Corresponding online sensor monitoring has the purpose of detecting errors in the sensors at an early stage so that incorrect regulation, which could bring the vehicle into a safety-critical state, is excluded.

The ESP systems currently in series use a multiple sensor ("sensor cluster") to record the vehicle rotation rate and lateral and possibly longitudinal acceleration. This sensor is located in the passenger compartment and communicates with the ESP control unit via a CAN interface ( WO 99/47889)

Future applications (eg ESP-2 or Active Front Steering AFS) provide that the signals from the sensor cluster are also used to influence the steering. Since steering interventions generally involve higher risks than braking interventions, higher demands are also placed on the reliability of the sensors. Redundant systems are required that can automatically detect malfunctions and react accordingly. Figure 1 shows a known sensor cluster in redundant design. Rotation rates 11, 12 and acceleration sensors 1, 2 are therefore duplicated. The signal processing takes place in a shared chipset. A / D converters ADC 1, ADC 2 and processor core μCl, μC2 are designed redundantly, but the signal paths 13, 14 (eg SPI interface between the converters and processors, receive registers, etc.) are only available once. Defective sensor elements can be recognized in this way, as can errors in program execution.

It is disadvantageous, however, that errors on the transmission path between the A / D converter (ADC) and processor are not recognized, just as little as errors in the A / D converter itself (eg stuck bits) which are of the order of magnitude of the permissible signal inaccuracy lie.

The invention is therefore based on the object of providing a method and a device for monitoring the signal processing of sensors of the type mentioned at the outset, which has the reliability required in particular for driving stability control and / or comfort control with active steering interventions for vehicles.

This object is achieved according to claim 1 with a method of the type mentioned at the outset, which is distinguished by at least redundant processing of the sensor data in two identical signal processing units, each of which is evaluated and checked for plausibility independently and at least separately from one another by at least two processing devices in two evaluation devices, the Sensor data via separate signal lines between the one Processing device and one evaluation device each are transmitted.

It is advantageous that the sensor data evaluated and plausibility-checked separately in each evaluation device is exchanged via an interface between the evaluation devices. The evaluated and plausibility-checked sensor data and status information of the respective other evaluation unit are sent to a higher-level control unit of the vehicle by each evaluation device independently of the other.

The evaluated and plausible sensor data and status information of the respective other evaluation unit are transmitted via separate internal signal lines to a data bus and to the control unit of the vehicle.

This object is further achieved according to claim 5 with a device of the type mentioned, which is characterized by at least two identical signal processing units for redundant processing of the sensor data, with at least two processing devices and two evaluation devices in which the sensor data are each independently and separately evaluated and checked for plausibility , each with a processing device being connected to the respective evaluation device via separate signal lines and the sensor data being transmitted between the respective processing device and the respective evaluation device via the respective separate signal line Advantageous developments of the invention are specified in the subclaims.

The following advantages result from the invention: • Completely redundant signal path up to signal output. All errors occurring in the system can be recognized. • Avoiding loss of comfort due to premature system activation due to errors that are still within the specified range. • Suitability for highly sensitive systems with very small control thresholds.

• Cost savings by using the same components as the non-redundant standard sensor cluster. No special components (such as double core processors) are necessary.

Embodiments of the invention are shown in the drawings and are described in more detail below.

Show it:

Fig. 1 shows a simply redundant sensor cluster according to the prior art

2 shows a schematic representation of the structure of an ESP system;

Fig. 3 shows a fully redundant sensor cluster according to the invention. According to FIG. 2, the process of driving a car can be regarded as a control loop, in which a driver 1 represents the controller and a vehicle 2 the controlled system. The guide variables are the driver's personal driving wishes FW, which he creates through continuous monitoring of road traffic. The actual values IF are the instantaneous values for the direction of travel and speed, which the driver detects via his eyes or the driving feeling. Finally, the manipulated variables SF are the steering wheel angle, the position of the transmission and the positions of the accelerator and brake pedals, which the driver creates on the basis of the deviations between the target and actual values.

Such a control is often made more difficult by disturbances S such as changes in the coefficient of friction, uneven road surfaces, cross winds or other influences, since the driver cannot record them precisely, but must take them into account in the control. For this reason, the driver 1 can generally handle the tasks assigned to him, namely to regulate and monitor the process of driving a car, in normal driving conditions without difficulty on account of his training and the experience gained. In extreme situations and / or in the aforementioned exceptional driving conditions, in which the physical limits of friction between the road and the tires are exceeded, there is a risk that the driver will react too late or incorrectly and lose control of his vehicle.

In order to be able to take these driving situations into account as well, the dynamic driving control system is supplemented with a subordinate control loop (ESP), which according to FIG. 1 comprises a control algorithm 4, a system monitoring 5 and an error memory 6. Measured driving state variables are tem monitoring 5 and the control algorithm 4 supplied. The system monitoring 5 possibly generates an error message F, which is fed to the error memory 6 and the control algorithm 4. The control algorithm 4 then acts on the vehicle 2 as a function of the manipulated variables generated by the driver 1. Typical control tasks are carried out with this control loop. The vehicle is intercepted again as quickly as possible in extreme driving situations.

FIG. 3 shows the structure of such a control loop, which essentially comprises an anti-lock braking system 10, a traction control system 11 and a yaw moment control system 12. The system can be expanded to include a steering angle control, not shown, as described, for example, in WO2004 / 005093. Furthermore, yaw rate sensors 13, lateral acceleration sensors 14, a steering angle sensor 15, a pressure sensor 16 and four wheel speed sensors 17 are provided, which are used both as actual value transmitters for determining the control deviation and for forming a yaw rate setpoint and various intermediate values.

The process control variables generated by the driver 1 by actuating a gas and brake pedal and the steering wheel are added to the traction control system 11, the anti-lock braking system 10 and the pressure sensor 16 or the steering angle sensor 15. Vehicle-specific non-linearities, fluctuations in the coefficients of friction, side wind influences etc. are summarized as faults or unknown variables 18 and influence the longitudinal and transverse dynamics of the vehicle 19. This dynamic 19 is further influenced by the reference variables mentioned and the output signals of an engine management unit 20 and acts on the wheel speed sensors 17, the yaw rate sensors 13, the lateral acceleration tion sensors 14 and the pressure sensor 16. A control arbitration 21, to which the output signals of the anti-lock braking system 10, the traction control system 11, the yaw moment control system 12, the steering angle control system and a brake intervention algorithm 22 are supplied, serves to distribute the priority of these signals with regard to their action the engine management unit 20 or directly to the driving dynamics 19. The brake intervention algorithm 22 is acted upon by the yaw moment control 12 and the pressure sensor 16. Finally, a driving state detection device 23 is provided, to which the signals from the steering angle sensor 15, the yaw rate sensors 13, the lateral acceleration sensors 14 and the wheel speed sensors 17 are fed and whose output signals are the yaw moment control 12 and a tracking reference model 24, with which a desired target yaw rate is generated, or Steering angle control applied.

FIG. 4 shows the sensor cluster 40 with complete symmetrical redundancy of the signal processing units 43, 31 46 and 44, 32, 45. The sensor cluster 40 consists of two identical, separate paths for signal processing. Rotation rates 41, 42 and acceleration sensors 21, 22 are duplicated. The sensors 41, 42, 21, 22 and the signal processing units 43, 31 46 and 44, 32, 45 are preferably arranged in a common housing 62. They are assigned two signal conditioning devices 43, 44, such as analog-digital signal converters, which convert the analog output signal from the sensors into a digital input signal. Two evaluation devices 31, 32, such as identical microcontrollers, digital signal processors (DSP) or programmable logic modules, in particular ASICs, are used for signal processing. The sensor data between the one processing device (43, 44) and each of the evaluation devices (31, 32) is transmitted via a separate signal line (60, 61). The signals, which are now digital, are digitally processed in the evaluation devices 31, 32. The evaluation-related sensor signals are present on the output side of the evaluation devices 31, 32. These are fed to the serial vehicle communication bus 47 via the two CAN controllers 45, 46 formed in the evaluation devices 31, 32. The evaluation devices 31, 32 connected to the integrated CAN (Controller Area Network) via the respective separate lines 71, 72 assume the following system functions:

• Providing a driver signal / driver voltage to excite the electrical-mechanical converter of the rotation rate sensors 41, 42 • Recording the signals of the rotation rate sensors 41, 42 with specific algorithmic calculations and filtering to obtain a number for the yaw movement of a vehicle in CAN and transfer to serial bus 47.

These evaluation devices 31, 32 can correspond exactly to the components used in the known sensor cluster (e.g. EP 1 064 520 B1), i.e. then no special components are required for this system.

The outputs of the two signal processing units 43, 31, 46; 44, 32, 45 can be brought together in the sensor cluster 40 or connected to the vehicle communication bus (here CAN) in separate lines 49, 50. When merged into the sensor cluster, the interface remains compatible with the existing system. Each of the evaluation devices 31, 32 has access to all sensor data and carries out signal processing and plausibility assessment independently of the other. The result of his plausibility check and, if applicable, that of her calculations, she communicates to her partner through a suitable interface 48.

Each evaluation device 31, 32 then sends a message (here CAN message) to the (ESP) control unit independently of the other. This message contains its own data in coded form, the status of its own plausibility check and the status signaled by the partner.

Depending on the status flags contained in the messages, the control device decides whether the data are to be assessed as valid, as conditionally valid or as incorrect. Conditionally valid data can be compared by comparing other sizes, e.g. with the wheel speeds using the ^_ V, Ψ = model

evaluated and possibly still used. S is the track width of the vehicle, v _vr is the wheel speed at the front right, v _vi is the wheel speed at the front left. For example, if a yaw rate signal fails during an ESP control, the control unit can identify the intact signal on the basis of the existing model data and use it to continue the control.

This solution corresponds to two separate identical sensor clusters. However, it has the advantage that each cluster can access the other's sensors. This provides additional information. The redundancy concept explained here using the example of the sensor cluster can be transferred to any other sensor system. The following variations are therefore conceivable, which are also encompassed by the invention: Use of n> = 2 signal processing units 43, 31, 46 which access the signals from any number of sensors 41, 42, 21, 22, some of which are redundantly present but can not. • Redundant sensors 41, 42 can be present twice or more (> 2). With three or more sensors, a decision can already be made during signal processing as to which sensor is faulty. Sensors 41, 42, 21, 22 and the signal processing units 43, 31, 46; 44, 32, 45 need not be in the same housing 62. • The connection 63-70 of the sensors to the signal processing units can be done analog or digital. • The connection of the signal processing units 43, 31, 46; 44, 32, 45 to the higher-level control unit can take place analog or digital. • The signal processing units 43, 31, 46; 44, 32, 45 exchange status information, calculation results or no information at all. • The signal processing units 43, 31, 46; 44, 32, 45 can perform different tasks at certain times (e.g. in the initialization phase or with self-diagnosis). • Not every signal processing unit 43, 31, 46; 44, 32, 45 must evaluate all sensor signals, partially redundant systems are also possible. In the event that a higher-level system is not acceptable, it is advantageous to use only one signal processing unit 43, 31, 46; 44, 32, 45 to actively communicate. The other (s) initially remain passively in the background, but nevertheless carry out the plausibility check with the associated internal communication. The passive signal processing units only veto and actively report to the higher-level system if a discrepancy has been found there. In practice this could look like this:

Signal processing units 43, 31, 46 and 44, 32, 45 are identical, but have software that enables two operating modes coded via a pin. Signal processing unit 43, 31, 46 works as a master (coding 1) and sends the result of its evaluation on the CAN signal processing unit 44, 32, 45 works as slave (coding 0) and compares the result of the master received via CAN with its own calculations. It notifies the master of compliance or deviation and, if necessary, sends a CAN message to the system with the error flag set. Communication can take place, for example, via two lines MATCH, MATCH_N, which toggle in opposite directions in each software loop and both go to 1 or both to 0 in the event of an error. Signal processing unit 43, 31, 46 recognizes from the above-mentioned feedback that signal processing unit 44, 32, 45 is present and working. By receiving the CAN messages, signal processing unit 44, 32, 45 recognizes that signal processing unit 43, 31, 46 is present and working.

Claims

Claims:

1. A method for monitoring signal processing units for sensors, each of which detects individual process control or process measurement variables of a process, characterized by at least redundant processing of the sensor data in two identical signal processing units (43, 31, 46 and 44, 32, 45), each of which is independent and separate are evaluated and checked for plausibility from one another by means of at least two processing devices (43, 44) in two evaluation devices (31, 32), the sensor data being transmitted via separate signal lines (60, 61) between the respective processing device (43, 44) and the one Evaluation device (31, 32) are transmitted.

2. The method according to claim 1, characterized in that the sensor data evaluated and plausibility-checked separately in each evaluation device (31, 32) are exchanged via an interface between the evaluation devices (31, 32).

3. The method according to claim 1 or 2, characterized in that each evaluation device (31, 32) independently of the other, the evaluated and plausible sensor data and status information of the respective other evaluation unit are sent to a higher-level control unit of the vehicle.

4. The method according to any one of claims 1 to 3, characterized in that the evaluated and plausible sensor data and status information of the respective other evaluation unit (31, 32) via internal separate signal lines (49, 50) via a data bus (47) to the control unit of the vehicle are transmitted.

5. Device for monitoring signal processing units for sensors, each of which detects individual process control or process measurement variables of a process, characterized by at least two identical signal processing units (43, 31, 46; 44, 32, 45) for redundant processing of the sensor data, with at least two processing devices (43, 44) and two evaluation devices (31, 32) in which the sensor data are each evaluated and checked for plausibility independently and separately from one another, each with a processing device (43, 44) with the respective evaluation device (31, 32) are connected via separate signal lines (60, 62) and the sensor data are transmitted between the respective processing device (43, 44) and the respective evaluation device (31, 32) via the respective separate signal line (60, 61).

6. The device according to claim 5, characterized in that the sensor data evaluated and plausibility-checked separately in each evaluation device (31, 32) are exchanged via an interface between the evaluation devices (31, 32)

7. The device according to claim 5 or 6, characterized in that each evaluation device (31, 32) independently from the other sends the evaluated and plausible sensor data and status information of the respective other evaluation unit to a vehicle control unit.

Device according to one of claims 5 to 7, characterized in that each evaluation unit (31, 32) is connected via an internal separate signal line (71, 72) to a data bus (45, 46) and the evaluated and plausible sensor data and status information of the respective other evaluation unit (31, 32) are transmitted to the vehicle control unit via the respective data bus (45, 46)