Method and circuit arrangement in an electronic control unit of a motor vehicle for detecting faults

This application is a continuation of PCT International Application No. PCT/EP2013/051709, filed Jan. 29, 2013, which claims priority under 35 U.S.C. §119 from German Patent Application No. 10 2012 201 653.8, filed Feb. 3, 2012, the entire disclosures of which are herein expressly incorporated by reference.

The invention relates to a circuit arrangement in an electronic control unit of a motor vehicle for the detection of faults in an electronically controlled drive system.

As a result of standards prescribed by law (for example, ISO or CARB Standard Regulations), motor vehicle manufacturers have been required for many years to ensure that electronic control units or electronically controlled systems in motor vehicles, such as the digital engine control or the adaptive transmission control, are capable of self-diagnosing. So-called OBD (On-Board Diagnosis) systems, for example, were developed on that basis. One example of a design of an OBD system is contained in the applicant's German Patent Document DE 197 31 283 A1.

In this respect, the motor-vehicle-internal electronic control units have a large software capacity for self-diagnosis, in addition to the software capacity for the actual function control. One example of a self-diagnosis within the control unit is described in the applicant's German Patent Document DE 196 12 857 A1.

Up to now, the focus of the prescribed fault diagnosis has been the inherent security of each individual control unit or of each individual electronically controlled vehicle system separately. This results in high application expenditures. Particularly in the case of a motor or internal-combustion engine control (for spark-ignition engines or diesel engines), this results in a large number of stored characteristic diagrams when each programmed function has to be secured. One example, just of the expenditures of a function programming when inputting a desired drive power as a function of the accelerator pedal position is indicated in the applicant's German Patent Document DE 102 49 689 A1. If the characteristic diagrams illustrated there for the function programming were inherently securely diagnosed, approximately twice the programming expenditures or the storage space would be necessary because a fault recognition threshold would have to be stored for each characteristic curve of the characteristic diagrams.

Furthermore, from German Patent Document DE 44 38 714 A1, a so-called 3-level security concept currently widespread in practice is known—particularly in connection with electronic engine control units for the control of drive functions. The circuit arrangement according to the invention for the monitoring of drive functions is based on this 3-level security concept. The known 3-level security concept has a complex system architecture, which requires high development expenditures for control unit functionalities, which will become more and more complex and increasingly more cross-linked in the future.

Finally, in addition, reference is made to the applicant's German Patent Document DE 10 2011 002 805.6 (which is not a prior publication) which already contains a process for the detection of faults in an electronically controlled drive system of a motor vehicle, the system architecture for implementing the process not being addressed.

It is an object of the invention to simplify the system architecture of a security concept for the detection of faults in a drive system of a motor vehicle, particularly with the following objectives:

reducing development expenditures caused by additional functions and components, avoiding multiple expenditures at various components, restricting security-relevant communication between the control units, demand addition from various components (functional and quantitative), while ISO security evidence for cross-linked systems is to continue to be guaranteed.

According to the invention, this task is implemented by a circuit arrangement according to the invention in an electronic control unit of a motor vehicle for detecting faults in an electronically controlled drive system, which is structured in at least two levels, specifically, a first function-controlling level and a second monitoring level. The two levels acquire at least the accelerator pedal position as an input signal. The first level has a driver intention determination block for determining a quantity proportional to a desired longitudinal acceleration and transmits this quantity as an input signal to a plausibility block of the second level. The plausibility block has at least one fault detection program by which a fault can be detected when a defined (static or dynamic) correct relationship between the accelerator pedal position and/or an accelerator pedal position change with respect to a determined quantity proportional to a desired longitudinal acceleration (particularly for a specified time period) is not present, and this relationship is therefore implausible.

By way of the invention, the main security requirement is met, specifically the avoidance of an unintended acceleration and of an unintended spinning of wheels.

The invention is based on the conventional so-called 3-level security concept, which will be explained in detail below in connection with the description of the figures.

In the circuit arrangement according to the invention, a first fault detection program can preferably be run in the plausibility block, by which fault detection program a fault is detected when a defined desired longitudinal acceleration gradient dependent on an accelerator pedal position change is exceeded longer than for a specified time period (first defined correct relation is not present). For the implementation of the process according to the invention, the plausibility block of the control unit is programmed correspondingly.

The defined acceleration gradient dependent on an accelerator pedal position change is preferably limited by the maximal slope of a characteristic curve of the actual function extent of the first level by which, depending on the accelerator pedal position, a desired vehicle acceleration is specified. This maximal slope is empirically determined, particularly in driving tests, in order to determine which acceleration gradients can still just be reasonably handled or controlled by the driver. The defined acceleration gradient(s) dependent on an accelerator pedal change is/are stored in a memory of the control unit and are integrated in the plausibility block of the control unit for the implementation of the process according to the invention.

In a further development of the invention, while the accelerator pedal is not actuated, by use of the control unit, a second fault detection program can be run in the plausibility block, by which fault detection program a fault is recognized when a defined desired longitudinal acceleration threshold value preferably depending on the vehicle speed is exceeded longer than for a specified time period (second defined correct relation is not present).

In a further development of the invention, in the case of an non-activated drive slip control system, a third fault detection program can be run by the control unit in the plausibility block, by which a fault is detected if, when the accelerator pedal is not actuated or the accelerator pedal angle is decreasing, a longitudinal acceleration gradient determined from the rotational wheel speeds is positive for longer than for a specified time period, and simultaneously the desired longitudinal acceleration gradient not determined from the rotational wheels speeds is also positive (third defined correct relation is not present).

For this purpose, the plausibility block in the second level of the control unit receives, either directly or by way of a digital bus, information such as the rotational wheel speed values or the acceleration determined from the rotational wheel speeds, as input signal(s). The rotational wheel speeds are acquired by way of corresponding sensors in a known manner anyhow, for example, for a slip control.

Furthermore, a fourth fault detection program can be run in the plausibility block, by which a fault is detected when, in the case of a specified accelerator pedal position, a disproportionately high desired longitudinal acceleration is specified (fourth defined correct relation is not present).

By way of the invention, all required ISO Regulations are complied with:

the new concept permits manageable analyses and documentations; the small number of input variables can be provided with the acquired ASIL level; the monitoring precision is at least comparable with the actual-engine torque monitoring of the previous security concept; the concept covers all fault mechanisms (such as spinning wheels, actuator system, etc).

Other objects, advantages and novel features of the present invention will become apparent from the following detailed description of one or more preferred embodiments when considered in conjunction with the accompanying drawings.

FIG. 1 is a schematic overview of components of a motor vehicle with a network of electronically controlled systems;

FIG. 2 is a schematic overview of a cross-linking of electronic control units to electrically controlled systems in a motor vehicle;

FIG. 3 is a schematic representation of the 3-level security concept according to the state of the art;

FIG. 4 is an overview of directly and indirectly acceleration-effective (or not) torques;

FIG. 5 is an overview of the monitoring structure of the driver intention acquisition according to the state of the art;

FIG. 6 is an overview of the monitoring structure of the driver intention acquisition according to an embodiment of the invention;

FIG. 7 is an overview of the possible fault detection programs within the monitoring structure of the driver intention acquisition;

FIG. 8 is a graphical view of an example concerning the first fault detection program;

FIG. 9 is a graphical view of an example concerning the determination of a defined acceleration gradient that depends on an accelerator pedal position change;

FIG. 10 is a graphical view of an example concerning the second fault detection program;

FIG. 11 is a graphical view of an example concerning the third fault detection program where no fault is detected; and

FIG. 12 is a graphical view of an example concerning the third fault detection program, where a fault is detected.

FIG. 1 is a schematic overview of components of a motor vehicle having a conceivable network of electronically controlled systems consisting an internal-combustion engine VM with an electronic engine control unit DMS, an automatic transmission G having an electronic transmission control unit EGS and of a brake system having an electronic brake control unit DSC. In addition, the wheels R of the vehicle are schematically illustrated, which have sensors for the acquisition of the rotational wheel speeds n_R. The signals for the acquisition of the rotational wheel speeds n_R are acquired, for example, in the brake control unit DSG. An acceleration a n — R determined from the rotational wheel speeds is, for example, computed therefrom. The engine control unit DMS receives the acceleration a n — R determined from the rotational wheel speeds, for example, by way of a digital bus connection which exists between all of the control units. For this purpose, FIG. 2 again is a schematic overview of a conceivable cross-linking of the electronic control units DMS, DSC, EGS and, optionally, also of a driver assistance control unit FAS by way of digital bus connections.

According to FIG. 2 , the electronic engine control unit DMS receives at least the position of the accelerator pedal, for example, directly by way of the signal of a sensor for measuring the accelerator pedal angle α FP as well as the rotational wheels speeds n_R as input signals.

The circuit arrangement according to the embodiment is preferably integrated in block 2 a for monitoring the driver intention acquisition in a 3-level security concept according to the state of the art, which is schematically illustrated in greater detail in FIG. 3 . In the case of a 3-level security concept according to the state of the art, at least a first level E 1 , as a function-controlling level with the actual function software, and a second level E 2 , as the monitoring level with a monitoring software, are provided preferably in a single control unit, here particularly, in the electronic engine control unit DMS. A third level E 3 is provided for the hardware monitoring. This level checks, for example, whether the computer for implementing the software at levels E 1 and E 3 is functioning properly. When certain faults are detected, the system—here the engine control—is either changed to a specified emergency operation or is switched off

At the E 1 level, the driver's intention is acquired in block 1 a , and a desired drive torque, a desired longitudinal acceleration or a desired wheel torque is determined therefrom, which is forwarded into the block 1 b for the desired input of the automatic control, and is finally converted in block 1 c as the torque adjuster module to the actuating signals for the actuators (for example, the injection, ignition and air supply in the case of internal-combustion engine or to the driving current in the case of electric motors or in a hybrid drive). Input signals of the driver intention acquisition are particularly the accelerator pedal position or also inputs by an automatic cruise control apparatus (ACC) or a braking system (ABS, ASC, DSC).

At the level E 2 , according to the state of the art, the monitoring of the driver intention acquisition is carried out in block 2 a , in which case, the input signals of block 2 a are the same as in block 1 a , and the monitoring is carried out by a duplication of the driver intention acquisition. A more detailed representation of block 2 a according to the state of the art is shown in FIG. 5 . Accordingly, for the monitoring, the desired input is calculated and checked twice independently of the level E 1 . Subsequently, in block 2 b of FIG. 3 , a comparison is carried out of the desired values with the actual values of the longitudinal acceleration or a quantity proportional thereto. Finally, in block 2 c , a monitoring of the torque adjusters takes place.

In FIG. 4 , the torque adjuster is illustrated in connection with the monitoring, which torques are (directly proportionally) acceleration-effective. In this case, the engine torque M mot may not be or may only indirectly be acceleration-effective. Acceleration-effective torques are particularly the transmission output torque or the wheel torque M Rad-ist . These torques are directly proportional to the vehicle longitudinal acceleration a Fzg — ist and their actual values can therefore be used, for example, together with a vehicle acceleration sensor S_a, for the desired-actual comparison in block 2 b of level E 2 .

The circuit arrangement according to the invention here relates to block 2 a for the monitoring of the driver intention acquisition and is illustrated in detail in FIG. 6 . According to FIG. 6 , instead of a duplication of the function software, an inherent plausibility block 100 is provided. The inherent plausibility block 100 has at least one fault detection program (SF_ 01 , SF_ 02 , SF_ 03 , SF_ 04 ) by which a fault can be detected when a defined correct relationship does not exist between the accelerator pedal position (α FP ) and/or the accelerator pedal position change (Δα FP /Δt) to the determined quantity (M Rad — soll or α Fzg — soll ) proportional to the desired longitudinal acceleration for a specified time period (for examples of concrete fault detection programs, see FIG. 7 ). When no fault is detected (“j” for ok), the function is implemented in the desired manner. When a fault is detected (“n” for not ok), either a change takes place to an emergency operation, in which a reduced desired longitudinal acceleration or a reduced desired wheel torque M_NL is specified, or the control unit is switched off completely.

By use of the circuit arrangement according to the invention, as a result of the plausibility block 100 , which acquires at least the accelerator pedal position (α FP ) and the desired longitudinal acceleration of the motor vehicle a Fzg — soll from block 1 a of level E 1 as input signals, for example, a first fault detection program SF_ 01 is implemented, unless another fault detection program precedes the first fault detection program. As illustrated by the broken line in FIG. 8 , accordingly, a fault is basically detected when a defined desired longitudinal acceleration gradient Δa Fzg — soll /Δt dependent on a accelerator pedal position change Δα FP /Δt is exceeded longer than for a specified time period. By means of the solid line, the actual course is outlined which, in this case, would not result in a fault detection.

By way of the first fault detection program SF_ 01 , in particular, acceleration changes are to be prevented which are not controlled by the driver (dynamic situation).

According to FIG. 8 , by use of the first partial fault detection program SF_ 01 a , particularly for positive accelerator pedal position changes Δα FP /Δt, an acceleration gradient Δa Fzg — soll /Δt dependent on an accelerator pedal change Δα FP /Δt is defined according to a maximally admissible acceleration change [Δa Fzg — soll /Δα FP ] max derived from FIG. 9 .

The defined acceleration gradient Δa Fzg — soll /Δt dependent on an accelerator pedal position change Δα FP /Δt is limited by the maximal slope Δa Fzg — soll /Δα FP in a characteristic curve of the actual function extent, by which, as a function of the accelerator pedal position α FP , a desired vehicle acceleration a Fzg — soll is specified. In this case, a tolerance range TB about [Δa Fzg /Δα FP ] max is preferably additionally permitted (see FIG. 8 ). According to FIG. 8 , by use of a first partial fault detection program SF_ 01 b , particularly for negative accelerator pedal position changes Δα FP /Δt, a minimal acceleration gradient Δa Fzg — soll /Δt, here of [Δa Fzg /Δα FP ] min dependent on an accelerator pedal position change Δα FP /Δt=zero is defined; because, as a result, a braking power is demanded by the driver by which an acceleration increase should never take place.

FIG. 10 illustrates a second fault detection program SF_ 02 which replaces the first fault detection program SF_ 01 when the accelerator pedal α FP =0 is not actuated. Accordingly, when the accelerator pedal α FP =0 is not actuated, a fault is detected in the plausibility block 100 independently of the first level E 1 when a defined acceleration threshold value a Fzg — soll preferably dependent on the vehicle speed v Fzg is exceeded longer than for a specified time period; because, also in the coasting operation, there should be no higher acceleration.

FIGS. 11 and 12 show an additional special case of a not activated wheel slip control system when wheel slip occurs that is not settled by the brake control unit DSC. In this case, a third fault detection program SF_ 03 is implemented in addition to or instead of the first fault detection program SF- 01 in the plausibility block 100 , by which a fault is detected when, while the accelerator pedal α FP =0 is not actuated or while the accelerator pedal angle is decreasing Δα FP /Δt<0, an acceleration gradient Δa n — R /Δt not determined from the rotational wheel speeds n_R is positive longer than for a specified time period and simultaneously a vehicle acceleration gradient Δa Fzg /Δt determined from the rotational wheel speeds n_R is also positive. By way of this fault detection, the engine control unit DMS, instead of the wheel slip control system or the brake control unit DSC, can carry out a drive torque reduction and thus provide a stable driving condition.

Accordingly, no fault is detected in FIG. 11 because the trigger for the wheel slip is a change from a high friction value μ high to a low friction value μ low while the drive torque remains the same: Courses of the two acceleration gradients Δa n — R /Δt and Δa Fzg /Δt occur in opposite directions (always with a Fzg :a Fzg — soll ). According to FIG. 12 , however, a fault is detected within the scope of the function extent because, despite the unchanging high friction value μ high , obviously as a result of a fault in the drive system (for example, in the internal-combustion engine control unit DMS or in the transmission control unit EGS, FIG. 1 ) the drive torque is increased prohibitively. By comparing the course directions of the acceleration gradients Δa n — R /Δt and of the vehicle acceleration gradient Δa Fzg /Δt (positive courses in FIG. 12 ), it is excluded according to FIG. 12 that the permissible situation according to FIG. 11 is present (courses in opposite directions).

In addition, a fourth fault detection program SF_ 04 is illustrated in FIG. 7 which can be carried out in the plausibility block 100 . Here, a fault is detected when, in the case of a defined constant accelerator pedal position (α FP =constant) not equal to zero, a specified longitudinal acceleration threshold value a Fzg — soll — SW is exceeded. Accelerations, which are not controlled by the driver, are thereby to be prevented (static situation).

Basically, by use of all fault detection programs SF_ 01 (in the form of an acceleration change monitoring), SF_ 02 (in the form of an acceleration coasting monitoring) SF_ 03 (in the form of preventing unintentionally spinning wheels) and/or SF_ 04 (in the form of an absolute threshold monitoring), in the event of a fault detection, the drive torque will be reduced or completely switched off.

By way of this circuit arrangement according to the invention, a system-covering, but simple, monitoring concept is created which is assigned to the engine control.

The foregoing disclosure has been set forth merely to illustrate the invention and is not intended to be limiting. Since modifications of the disclosed embodiments incorporating the spirit and substance of the invention may occur to persons skilled in the art, the invention should be construed to include everything within the scope of the appended claims and equivalents thereof.