DE102019203779A1 - Control system, method, component and control program for the use of signal accuracy requirements in the context of safety concepts - Google Patents

Abstract

Method and apparatus for receiving a control signal and an accuracy signal, where the accuracy signal represents a signal accuracy of the control signal. The control system is set up to trigger an adapted error reaction on the basis of an incorrect signal value and an accuracy signal.

Description

The invention relates to the use of the signal accuracy with regard to a signal quality requirement in order to support a safety concept. Furthermore, a control program is described which carries out such a method when it is executed. A control system, particularly a motor vehicle control system, and a method for using signal accuracy requirements are also described.

In modern vehicles, more and more control devices are integrated and more and more functionalities are implemented. Due to their increasing networking and complexity, the implementation of functional safety is also becoming more and more complex.

In addition, the trend towards autonomously driving vehicles has drastically increased the requirements for functional safety. Where previously the driver often had to make the final decision in safety-relevant situations, this decision is increasingly shifting towards the vehicle or the vehicle control itself due to the use of numerous driver assistance systems.

Another important aspect is that when implementing functional safety, the focus has so far been almost exclusively on switching the system to inactive (“fail-safe”) when a system error is detected. However, in the case of systems for autonomous vehicles, it is increasingly necessary to implement a significantly more complex error reaction in order to achieve the low-risk state of the vehicle (“fail-operational”). For example, instead of parking the vehicle as quickly as possible in the event of a fault, it may be necessary to accelerate the vehicle again first, e.g. to move the vehicle away from the rails when crossing a level crossing.

Numerous signals are processed within the framework of the functionalities that are calculated and carried out on control units of a control system, in particular engine and drive control units of a motor vehicle control system. These signals can be communicated, for example, between individual control units or software components. For the consuming signal processing components that receive these signals, it can also be advantageous to adapt or adapt the signal, in particular in order to ensure the quality or signal accuracy with which a control signal is available.

For example, when a sensor signal is recorded, it can be made available by a sensor under different operating conditions with different signal accuracy. For example, in the case of a lambda probe, the accuracy of the determined value depends on the operating temperature of the sensor. Even when signals are transmitted between two control units, the quality or signal accuracy of the transmitted signal depends on the communication status between the control units.

For future functional safety concepts, especially for increasingly more autonomous systems, it is becoming increasingly important to activate or deactivate the required diagnostic functions in a very targeted manner in order to optimize the error reaction and thus the availability of the system. Particularly in the context of "fail-operational" systems, a diagnostic capability and increased availability of the system are required.

To this end, it has recently been proposed to adapt control signals at the source, since the signal accuracy calculated by the consuming signal processing components themselves may only be very imprecise due to insufficient knowledge of the consuming signal processing components about the components generating the control signals. Furthermore, the knowledge of the consuming signal processing components often does not allow a sufficiently valid statement on further use.

By transferring and evaluating an accuracy signal generated by the signal generation component itself, which instead of the status of the signal acquisition or communication directly provides the quality or the signal accuracy of the physical variable, for example as the physical bandwidth, an adaptation can always be carried out if necessary or desired for proper operation. This provides significantly higher quality information for the consuming signal processing components receiving the control signals, which can be mapped, for example, in a sensor component, independently of the signal acquisition, communication or a manufacturer.

In conventional solutions when implementing functional safety in vehicles or in engine and drive train controls, safety-relevant functions were mapped redundantly in parallel levels, for example. In the case of systematic or random errors that are detected by the monitoring level, a corresponding error reaction is triggered. As an example, the safe state of a system could be activated. For example, to protect against unintentional acceleration, the throttle valve is brought into an emergency running position or the injection is deactivated, if an error is detected in the detection of the accelerator pedal position.

In the context of functional safety, it is evaluated whether there is a safety-relevant error and if the evaluation shows that there is one, a reaction is initiated. It is in the reaction e.g. no distinction is made as to which cause leads to an incorrect accelerator pedal position being detected.

In addition, the functionalities that are used to monitor the system are often activated or deactivated, for example depending on the operating situation, in order to avoid unfounded error reactions. E.g. The plausibility check of the driver's request can be deactivated during the maneuvering out of parking spaces in the event of rapid changes in forward / backward movement in order to avoid an incorrect triggering of an error reaction.

There are also monitoring functions that are only required for certain system configurations, e.g. only if an automatic transmission is installed in the vehicle. The function should be deactivated for manual transmissions. There are also monitoring functions that are only required during certain system states, for example during a switching process.

Due to the increasing demands on the system availability, it is becoming more and more important to activate or deactivate the monitoring functions as part of the security concept in order to avoid unfounded error reactions that limit the operation of the system. There is also an increasing interaction between the operating status and the monitoring concept or sensor requirements.

For future functional safety concepts, especially for increasingly automated systems, it will be necessary not only to recognize the errors, but also to make qualitative statements about the error case, as well as to be able to make quantitative statements about the effects of the error and the error reaction of the To adapt the vehicle to the corresponding error.

The use of accuracy requirements as part of the functional safety concept can lead to a significantly reduced number of cross-system information to be evaluated, which must be used for the decision to activate a monitoring function, since all requirements, e.g. about the error propagation, in which the accuracy requirement can be expressed. This enables a significantly better encapsulation of individual functionalities and reduces the maintenance effort in the event of system changes.

Furthermore, the communication about accuracy requirements enables a much more targeted decision about the activation of monitoring functions.

The consuming functions can also provide significantly more valuable information via the transmission of accuracy requirements, since not only are states defined in which a monitoring function is activated or deactivated, but quantitative values are made available as a decision criterion.

The use of predicted values as part of the functional safety concept offers the advantage that a clearly optimized error reaction can be triggered compared with the previously only available statement that an error is present at the current time. On the one hand, the availability of the monitored system can be increased through an optimized error reaction; on the other hand, an error reaction can also be triggered more quickly and in a more targeted manner, if necessary, than with conventional safety concepts, e.g. work with a debouncing of signals.

By using accuracy requirements, on the one hand, the availability of the system can be increased through an optimized activation or deactivation of the monitoring functions; can be defined much more precisely in the event of an error.

This is a clear added value when implementing security concepts, especially for autonomous vehicles, as the availability of the system is of enormous importance here. In addition, the safe state that is sought in the event of a fault must not be limited to taking the system out of operation, but rather a precisely adapted response to the fault, the operating and environmental conditions in which the system was at the time of the If an error is found, expected. It is important that the higher-level control function can react specifically to the system status.

In a further aspect, the signal accuracies can also be used in the context of the functional safety concept to provide the information required for assessing the system status (in particular with regard to safety) To determine sensor states, which means that as before, numerous other information or signals at a higher system level no longer have to be used in order to indirectly obtain information about a valid or faulty signal. If a signal value is only valid within a range, the span of the range may depend on the signal accuracy. A signal value outside a valid range can be recognized as faulty, the span of the valid range depending on the accuracy signal and therefore the accuracy signal must be taken into account.

Via temporal trajectories of the signals and their accuracies for a prediction of the temporal course, additional information can be transmitted according to an exact scheme, which can be used by means of predictive control as part of the functional safety concept. For example, it can be taken into account how the predicted accuracy of the value that is monitored as part of the functional safety concept will behave in the future and, if necessary, the behavior can be adapted depending on the expected duration of the faulty state.

The object of the present invention is to increase the functional safety in vehicles which have a large number of sensors and where the signal accuracies can be used within the framework of the functional safety concept, on the one hand, to obtain the information required for assessing the system status (especially with regard to safety) To determine information about sensor states, which means that it is no longer necessary to use numerous other information or signals at a higher system level to obtain information about a valid or incorrect signal indirectly, and also to clearly increase the number of cross-system information to be evaluated reduce, as this information is bundled and qualitatively assessed via the sensor and signal states and is made available directly and does not have to be determined indirectly via numerous other information or signals.

According to the invention, additional information can be transmitted according to an exact scheme via time trajectories of the signals and their accuracies for a prediction of the time profile, which information can be used by means of predictive control as part of the functional safety concept. For example, it can be taken into account how the predicted accuracy of the value that is monitored as part of the functional safety concept will behave in the future and, if necessary, the behavior can be adapted depending on the expected duration of the faulty state.

The object is achieved in a first aspect by a method for using signals with their associated accuracies, since not only can it be determined whether a sensor or signal has an error, but also a quantitative statement can be made about the severity of the error.

In a further aspect, the use of predicted values in the context of the functional safety concept allows a clearly optimized error response to be triggered compared with the statement that an error is present at the current point in time. On the one hand, the availability of the monitored system can be increased through an optimized error reaction; on the other hand, however, an error reaction can also be triggered more quickly and in a more targeted manner if necessary than with conventional security concepts.

According to another aspect, the safe state that is sought in the event of a fault is not limited to taking the system out of operation, but rather a precisely adapted response to the fault present, the operating and environmental conditions. According to the invention, the higher-level control function can react more specifically to the system state.

The above object is achieved in a further aspect by a control program which is set up to run on one or more control systems, in particular motor vehicle control systems, the control program performing a method of the type explained above when it is executed. Such a control program thus advantageously implements the method shown here on a corresponding control system, so that the advantages explained here can be implemented in a simple manner within the control system.

• 1 ein schematisiertes Blockschaltbild diverser Funktionsblöcke zur Berechnung eines Gesamt-Genauigkeitssignals aus mehreren einzelnen Genauigkeitssignalen;
• 2 ein schematisiertes Blockschaltbild der Wertung eines Sensorsignales anhand des erfinderischen Konzepts;
• 3 eine detaillierte Ansicht von der Wertung eines Signals und ein zugehöriges Signalgenauigkeitssignal;
• 4 eine mögliche Entwicklung einer Signalgenauigkeit;
• 5 einen zeitlichen Ablauf der Genauigkeitsanforderung;
• 6 eine Anpassung der Genauigkeit; und
• 7 eine Abhängigkeit zwischen Spannung und Genauigkeit.

Show it:

• 1 a schematic block diagram of various function blocks for calculating an overall accuracy signal from several individual accuracy signals;
• 2 a schematic block diagram of the evaluation of a sensor signal based on the inventive concept;
• 3 a detailed view of the scoring of a signal and an associated signal accuracy signal;
• 4th a possible evolution of signal accuracy;
• 5 a timing of the accuracy requirement;
• 6th an adjustment of the accuracy; and
• 7th a dependence between voltage and accuracy.

1 shows a schematic block diagram of various functional blocks for performing a method explained above for monitoring a control signal for one or more signal processing components of a control system that consume the control signal, taking into account a signal accuracy and an accuracy requirement. Such a system could be found in motor vehicles, for example.

The ones in the 1 Function blocks shown are, for example, part of an implementation within the control system, or are distributed via communicating control systems.

First, there are several control signals 1a and 1b of a certain type as well as several accuracy signals 2a and 2 B generated. This takes place in the sphere of a signal generation component I of the control system. The respective accuracy signals 2a and 2 B each represent a signal accuracy of the corresponding control signals 1a and 1b . That means the accuracy signal 2a a signal accuracy of the control signal 1a represents while the accuracy signal 2 B a signal accuracy of the control signal 1b represents.

The signal generation component I works, for example, as an evaluation unit for evaluating measurement signals that are generated via a plurality of measurement signal generation units, the signal generation component I each generating the control signals from the acquired measurement signals 1a and 1b as well as their accuracy signals 2a and 2 B derives. The 1 shows, by way of example, the determination of an engine oil temperature, using, for example, a temperature sensor as the first measurement signal generation unit and a system model as the second measurement signal generation unit. The temperature sensor generates a first measurement signal and the system model generates a second measurement signal. This means that two signal sources are available, each of which provides an alternative measurement signal of a certain type (here to determine the engine oil temperature). The signal generation component I generates the first control signal from the first measurement signal of the temperature sensor 1a and the second control signal from the measurement signal of the system model 1b . For example, the respective control signals 1a and 1b obtained as temperature signals from electrical voltage signals of the temperature sensor or the system model.

In addition, the signal generating component I generates the first accuracy signal as a function of the measurement signal of the temperature sensor or as a function of a state or a behavior of the temperature sensor 2a , while the signal generation component I as a function of the measurement signal of the system model or as a function of a state or a behavior of the system model, the second accuracy signal 2 B generated. A respective generation of the accuracy signals 2a and 2 B takes place for example on the basis of knowledge of a state or a behavior of the temperature sensor or the system model by the signal generation component I. For example, an accuracy signal 2a respectively 2 B can be obtained from a characteristic curve behavior of the temperature sensor or the system model, which is known to the signal generation component I. If, for example, the temperature sensor has a measurement accuracy with a bandwidth of +/- 5% at a first operating point and a measurement accuracy with a bandwidth of +/- 10% at another operating point, then the signal generation component I can determine the accuracy signal, depending on the situation whether the sensor is in the first working point or in the second working point. The same applies to the system model.

The two accuracy signals are then evaluated 2a and 2 B in terms of their signal accuracy. This takes place in the sphere of an evaluation component II of the tax system. For this purpose there is an evaluation block 5 set up within the evaluation component II to which the accuracy signals generated by the signal generation component I 2a and 2 B be handed over.

The evaluation block monitors the accuracy signals and checks the signals based on an accuracy requirement. The accuracy requirement can be the same for both accuracy signals, or the accuracy requirement can be specified separately for each accuracy signal. In one embodiment, the accuracy requirements for each accuracy signal have a relationship to one another without being rigidly coupled.

The checking of the accuracy signal on the basis of the accuracy requirement can take place permanently and continuously, or it can be triggered by a change or event. Triggering can e.g. be a change in the accuracy requirement or the accuracy signal.

For example, the accuracy signal describes a bandwidth or variance of the control signal, for example a possible deviation in% from an expected value of the control signal. The The accuracy signal can assume different values for different values of the control signal. For example, the accuracy signal can represent a different bandwidth of the control signal for different values of the control signal.

The accuracy signal can provide the information required to determine that an adaptation is to be carried out or to be initiated. The accuracy signal and the adapted control signal can then be transferred to the one or more signal processing components consuming the control signal for processing the adapted control signal, possibly taking into account the accuracy signal.

In response to the check, a decision about the source for a control signal can be made or determined. The decision of the evaluation block 5 controls one switch at a time 6a and a switch 6b . Depending on a decision by the evaluation block 5 is through the toggle switch 6a either the control signal 1a , obtained from the temperature sensor, selected or the control signal 1b obtained from the system model. In the 1 is exemplary of the switch 6a the control signal 1a selected for further processing. This becomes the control signal 1a as the selected control signal 3 one or more, the control signal 3 consuming signal processing components III passed.

Alternatively or additionally, an adapted error reaction can be triggered on the basis of an incorrect signal value and an accuracy signal.

Depending on a decision by the evaluation block 5 is in the switch 6b either the accuracy signal 2a that the signal accuracy of the control signal 1a represents, selected or the accuracy signal 2 B , the signal accuracy of the control signal 1b represents, selected. In the 1 is an example of the accuracy signal 2a selected. This is hereinafter referred to as the selected accuracy signal 4th the sphere of the one or more signal processing components III consuming the accuracy signal. The signal processing components III can transmit the control signal during further operation of the control system 3 and the associated accuracy signal 4th further processing. This is the adaptation of the control signal 3 taking into account the accuracy signal 4th respectively. The accuracy signal is subject to an ongoing or constant check, and if the conditions for an adaptation of the control signal are present, an adaptation process is carried out. If the engine oil temperature is not determined using a sensor, but using a model, for example on the basis of an empirical model, the model data can be adapted analogously.

The system can recognize a certain value of a control signal as erroneous, e.g. if the signal value is outside a valid range. The system can, in turn, recognize a certain value of a control signal as valid if the signal value is within a valid range, the span of the valid range being dependent on the accuracy signal; otherwise the signal value can be recognized as invalid.

A certain value of a control signal can be recognized as faulty in a first operating state and as non-faulty in a second operating state. As a reaction to the check, an error reaction can also be called out or initiated, with the error reaction possibly being able to be determined in consideration of a temporary operating mode. The operating mode could e.g. a shifting process or an overtaking process or a braking process or an acceleration process. The error reaction can include a change in the operating mode or an adaptation or adaptation attempt of the sensor or the triggering of a warning signal or several actions simultaneously or in succession. Possible error reactions include the limitation of the maximum speed of a vehicle and the complete shutdown of the vehicle. The error reaction can also consist of the evaluation of several accuracy signals with regard to their signal accuracy and the use of that control signal with the lowest signal accuracy from the several accuracy signals.

The state or the behavior of the measurement signal generation unit is either accessible to the signal generation component for generating the accuracy signal or is known to the signal generation component. For example, the signal generating component can derive a certain behavior of the sensor or a certain state of the sensor at a certain operating point and, as a result, also a certain measurement accuracy or measurement inaccuracy of the sensor from a characteristic curve known to it of a sensor used. In the event that the measurement signal generation unit is a sensor model or a system model, the signal generation component can, for example, from its known model variables or model parameters, a certain behavior or a certain state of the sensor model or the system -Model and, as a result, a certain measurement accuracy or measurement inaccuracy, disturbance variable behavior, etc. This state or this behavior of the measurement signal generation unit is then used, on the one hand, to generate the control signal from the measurement signal supplied by the measurement signal generation unit and, on the other hand, to generate the accuracy signal generated in parallel, which represents a signal accuracy of the control signal.

The accuracy signal can be changed or adapted accordingly depending on whether the measurement signal or the state or the behavior of the measurement signal generating unit changes over time. If, for example, the operating temperature changes at a sensor that exhibits temperature-dependent behavior, then the state or the behavior of the sensor also changes, which has an impact on the measurement signal supplied by the sensor. For example, a voltage signal delivered by the sensor rises proportionally with an increasing temperature at the sensor. It is also conceivable that the sensor has a measurement accuracy that is dependent on the temperature. With increasing temperature, the signal accuracy of the measurement signal supplied by the sensor changes and consequently the signal accuracy of the control signal determined from the measurement signal. This change in the signal accuracy is detected and taken into account by the signal generation component when generating the accuracy signal. In this way, an accuracy signal can be generated which changes accordingly with a behavior of the sensor that changes over time. The accuracy signal thus reflects a changed signal accuracy of the control signal triggered by a sensor behavior that changes over time. This information can be used to determine suitable times for carrying out an adaptation process.

Has e.g. If the accuracy of a temperature sensor deteriorates during operation due to the prevailing operating conditions, the sensor characteristic curve can be adapted if another value is available which provides information about the temperature.

The adaptation of the signals can be carried out in both directions, depending on the respective accuracy.

The signal generation component can also monitor a state or behavior of a signal transmission between the signal generation component and the one or more receiving signal processing components consuming the control signal. The signal generation component generates the accuracy signal as a function of the state or behavior of the signal transmission.

The signal can be transmitted, for example, by means of a control bus, such as a CAN bus or other field bus, or by means of one or more networks. For example, the signal generation component is set up in a first control device of the control system, while the one or more signal processing components are set up in a second control device. In between, the signal is transmitted via one or more of the transmission paths mentioned.

A prediction of a future temporal course of the accuracy signal can be carried out on the basis of a past temporal course of the accuracy signal. Conventional mathematical methods can be used for such a prediction. For example, a future time profile of the accuracy signal can be estimated from a time profile of the accuracy signal recorded during operation (trajectory of the accuracy signal). As a result, it is possible for the control system or a control program that runs on the control system and carries out a method explained here to be able to estimate future operating situations of the control system. For example, signal processing components or also signal generation components of the control system can react in advance to certain changes in the operating behavior of the control system in the future, in order to either bring about or prevent this operating behavior. A prediction of the time profile of the accuracy signal can for example take place in parallel to a prediction of a time profile of the control signal based on a recorded trajectory of the control signal. This information can in turn be used to determine suitable times for carrying out an adaptation process.

In various implementations of the method, several control signals and several accuracy signals of a certain type are generated by the signal generation component or by several signal generation components. One accuracy signal can correspond to a control signal, or one accuracy signal can correspond to several control signals.

Based on 2 The options for processing signals and the associated accuracy signals are illustrated, for example in an evaluation block 5 could be realized. In step 210 the signal and the associated accuracy signal are received or recorded. In step 220 the signal is evaluated using its associated accuracy signal. For example, a speed sensor can be checked against an accuracy signal to determine if the Accuracy is sufficient to make a well-founded statement about the speed or whether an incorrect signal value is present.

The scoring of an accuracy signal, shown as 230 , can take place in the context of monitoring. With the above-mentioned monitoring function, which is only required with conventional drives if an automatic transmission is installed in the vehicle and should be deactivated for manual transmissions, the monitoring function can be activated and deactivated with the use of accuracy requirements via anonymous information and does not have to include direct states other systems as information. This results in a significantly better encapsulation of the individual systems and the individual system elements can be used both in different system configurations and individually in different systems without there being any interdependencies, which would result in enormous additional effort when reusing them.

With the rapidly increasing number of system variants, for example in the automotive industry, this creates significant added value. If e.g. If a conventional drive train with an internal combustion engine is not used in the vehicle, but a hybrid drive in which an electric machine is installed between the transmission and the internal combustion engine, the monitoring function may not be required even though an automatic transmission is installed because the electric machine in between the Information for the combustion engine already determined precisely enough. If the monitoring function does not use any accuracy requirements, but only the information whether an automatic transmission is installed (as before), then the monitoring function must be adapted every time the system is changed.

In step 232 the effect on the security requirement is determined. The effect arises dynamically from the signal and the tested and evaluated accuracy signal, but is principally based on the application. If the signal value and signal accuracy are inadequate for the given application, the request can be signaled for higher accuracy than feedback 235 to a detection unit or signal generation component 210 be transmitted. In the case of a more than sufficient accuracy, a signaling can also take place that the accuracy is more than sufficient, and possibly a low accuracy would be sufficient.

In step 231 properties of accuracy are determined or estimated. Here, for example, the current or temporal development of the accuracy can be determined or predicted. In this step, the development can be analyzed either as a change over time or as an event-driven change.

In step 240 the system response is adjusted accordingly, at least on the basis of the accuracy value and, if applicable, the signal value. For example, an acceleration can be postponed or not implemented if a temperature sensor value is marginally excessive and at the same time the signal accuracy does not allow the temperature to be adequately determined. This triggers an adapted error response.

The system response can also be adjusted proactively if the development of the accuracy makes it foreseeable that a problem or error based on the accuracy will be present soon or in a foreseeable future. A possible system reaction consists in the feedback or a changed requirement for the signal accuracy 235 , but other responses to signal values and signal accuracies may be essential.

The different steps 2 do not have to be processed sequentially, and it can be advantageous if several or all steps run in parallel.

3 illustrates the effect and interaction of weighted signal inputs and accuracy signals. A possible effect on the safety requirement can be a requirement on the signal transmitter, such as 235 in 2 , whereby a signal generation component is requested to deliver the control signal, for example with increased accuracy. Another possible effect can be a determination or a reassessment of the reliability of results based on, for example, imprecise signal values. Another possible effect is the setting or adjustment of limit values for errors. The limit values can have to be adapted by changing the signal accuracy, possibly in connection with signal values in certain areas. Ultimately, there can be an effect in the event of an error or even an emergency release, whereby a suitable error reaction is triggered when an incorrect signal value is recognized.

In 4th the development of a signal accuracy over time is shown. The accuracy A ("Accuracy") is on the vertical axis 410 and time is shown on the horizontal axis. The precision 430 develops between a maximum value 431 and a minimum value 432 . In this version, the inaccuracy increases over time, for example due to aging effects. Until time "t", 425 , the accuracy value is a measured value, and after that it is an estimated value. As the accuracy signal 430 changes, it can be advantageous to monitor the accuracy signal on the basis of an accuracy requirement. The monitoring can take place either continuously or at given or fixed times during operation.

5 illustrates a timing of the accuracy requirement 530 with higher and lower requirements. In a first time, up to time "t1" as 526 marked, becomes a lower requirement 541 put to the accuracy. In a second time, until time “t2” as 527 marked, is a higher requirement 541 to the accuracy (reduction of the inaccuracy). From time "t2" onwards there is again a lower requirement 542 put to the accuracy. In this example the accuracy is sufficient before "t1" and after "t2", but not sufficient between "t1" and "t2". In this example, the accuracy requirement is continuously adapted during operation. The accuracy requirement could be specified on the basis of a functional safety profile, or else by means of a table with states and corresponding accuracy requirements. The adaptation of the accuracy requirement could be established on the basis of an operating mode, or else on the basis of a temporary operating mode. As an example, the operating mode could be a shifting process or an overtaking process or a braking process or an acceleration process. A deviation between the signal accuracy of the accuracy signal and the accuracy requirement could, for example, lead to an error reaction or error message.

6th shows an adjustment of the accuracy 630 , with which the accuracy always meets the requirements 641 , 642 , 645 enough. For as 626 marked time "t1", the accuracy is increased or the inaccuracy is reduced so that it falls below the upper limit 645 remains. Before "t1", and after "t2" as 627 marked, the inaccuracy remains higher, but below the maximum limit of 641 and 642 . The accuracy can, for example, be brought about by a requirement on the sensor to provide improved accuracy. The adjustment of the accuracy could also be done by using a different sensor, or by another method to calculate the sensor value, or by a combination of several methods. A changed accuracy requirement can represent an increased requirement for a limited time as well as for a longer time or permanently.

The monitoring of the accuracy can be carried out based on changes in the accuracy signal or the accuracy requirement. In the case of a monitoring function, which is only required with conventional drives if an automatic transmission is installed in the vehicle and should be deactivated for manual transmissions, the monitoring function can be activated and deactivated with the use of accuracy requirements via anonymized information and does not have to direct states from others Systems as information. This results in a significantly better encapsulation of the individual systems and the individual system elements can be used both in different system configurations and individually in different systems without there being any interdependencies, which would result in enormous additional effort when reusing them.

If e.g. If a conventional drive train with an internal combustion engine is not used in the vehicle, but a hybrid drive in which an electric machine is installed between the transmission and the internal combustion engine, the monitoring function may not be required even though an automatic transmission is installed because the electric machine in between the information for the combustion engine has already been determined precisely enough. If the monitoring function does not use any accuracy requirements, but only the information whether an automatic transmission is installed (as before), then the monitoring function must be adapted every time the system is changed.

In 7th a relationship between voltage and accuracy can be seen. A sensor value 710 can be defined in a valid range. For a sensor that uses a voltage as a value 710 outputs, there is, for example, a minimum and a maximum voltage limit (VMin 712 , VMax 711 ). If the sensor value is outside the valid range, an error is generated 735 signals or the inaccuracy (acrylic, 730 ) elevated.

By evaluating the accuracy of the sensor signal (Acry), a much more precise error reaction can be triggered in the limit value range, e.g. is amplified as the accuracy deteriorates.

As a further example, an acceleration sensor is used for evaluating the vehicle acceleration as part of the safety concept. As mentioned, a certain value of a control signal can be recognized as faulty in a first operating state and as non-faulty in a second operating state. The error reaction can be determined accordingly, taking into account a temporary operating mode. One possible error reaction consists of evaluating several accuracy signals with regard to their signal accuracy and using the control signal with the lowest signal accuracy or inaccuracy (highest accuracy of the signal).

In the event that there is an error on the acceleration sensor, the vehicle acceleration is formed as a substitute value from the vehicle speed signal, which in turn is generated from the four wheel speeds. If there is an error with this signal (e.g. failure of one or more wheel speed sensors), it is no longer possible to determine sufficiently accurate information about the vehicle acceleration and a corresponding error reaction (e.g. vehicle standstill) is triggered.

With the use of signal accuracies for the signal from the acceleration sensor and the wheel speed sensors, a significantly more targeted error detection and reaction could be carried out. For example, an error reaction could depend on the existing signal accuracy of various error reactions - e.g. from the limitation of the maximum vehicle speed to the complete shutdown of the system.

Furthermore, the transmission of the signal accuracy makes it possible to evaluate and process the sensor states in much more detail. For example, not only sensor errors, but also sensor operating states that have different sensor accuracies can be processed more clearly. The error reaction can also be defined independently of the individual sensors, exclusively on the basis of the accuracy of the present value.

Claims (14)

Control system, set up to receive a control signal (1a, 1b) and an accuracy signal (2a, 2b), the accuracy signal (2a, 2b) representing a signal accuracy of the control signal (1a, 1b), characterized in that the control system is set up on Trigger an adapted error reaction based on an incorrect signal value and an accuracy signal. Tax system according to Claim 1 , the system recognizing a certain value of a control signal (1a, 1b) as faulty if the signal value is outside a valid range, and the span of the valid range is dependent on the accuracy signal (2a, 2b). Control system according to one of the preceding claims, wherein the system detects a specific value of a control signal (1a, 1b) as being faulty in a first operating state of a vehicle and as non-faulty in a second operating state of a vehicle. Control system according to one of the preceding claims, wherein an adapted error reaction consists of the evaluation of several accuracy signals (2a, 2b) with regard to their signal accuracy and the use of that control signal (3) with the lowest signal accuracy from the several accuracy signals. Control system according to one of the preceding claims, wherein the fault reaction is established with respect to a temporary operating mode of a vehicle. Tax system according to Claim 5 , the operating mode being a shifting process or an overtaking process or a braking process or an acceleration process. Control system according to one of the preceding claims, which is used for controlling a vehicle. Tax system according to Claim 7 , whereby possible error reactions include the limitation of the maximum speed of a vehicle and / or the complete shutdown of the vehicle. Method for evaluating a control signal (1a, 1b) for one or more signal processing components (III) of a control system, which receive the control signal (1a, 1b), taking into account a signal accuracy, whereby both the control signal ( 1a, 1b) and an accuracy signal (2a, 2b) are received, the accuracy signal (2a, 2b) representing a signal accuracy of the control signal (1a, 1b), characterized in that when an incorrect signal value is detected, a suitable error reaction is based on triggered by an accuracy signal. Procedure according to Claim 9 , an incorrect signal value being recognized on the basis of an accuracy requirement that is defined by a functional safety profile. Method according to one of the Claims 9 to 10 , where a suitable error response is the selection of another control signal. Procedure after one of the Claims 9 to 11 , which is used to control a motor vehicle. A signal generation component (I) which is set up and determined with a method according to one of Claims 9 to 12th to be operated. Control program for execution on one or more control systems, the control program when it is executed a method according to one of Claims 9 to 12th performs.

Images