DEVICE AND METHOD FOR CONTROLLING A VEHICLE MODULE DEPENDING ON A STATUS SIGNAL

Abstract

The invention provides a device for controlling a vehicle module based on a status signal of a power processor that acquires and evaluates sensor signals. Based on the status signal of the power processor, the vehicle module is controlled with either the power processor or a fallback processor. The fallback processor enables an emergency operation of the vehicle module. Furthermore, a device for controlling a vehicle module with a safety processor is provided, via which the vehicle module is controlled with sensor signals evaluated by either the first or second power processor, based on a state of a first and second power processor. A driver assistance system process is also provided, in which one of the devices according to the invention is used.

Claims

1. A device for controlling a vehicle module, comprising: a control interface configured to interface with the vehicle module such that the vehicle module can be controlled via the control interface; at least one first power processor configured to acquire and evaluate sensor signals; at least one first monitoring device coupled to the first power processor and configured to output a monitoring signal based on a status signal of the first power processor; and at least one fallback processor core coupled to the first monitoring device and configured to control the vehicle module via the control interface for at least an emergency operating mode, based on the monitoring signal.

2. The device according to claim 1 further comprising: a first signal channel and a redundant second signal channel for conducting the sensor signals to the device, wherein the sensor signals can be sent to the first power processor via the first signal channel, and the sensor signals can be sent to the fallback processor core via the second signal channel.

3. The device according to claim 1, further comprising: a monitoring processor core configured to monitor the sensor signals and output the sensor signals, wherein the monitoring processor core is coupled to the fallback processor core such that sensor signals output by the monitoring processor core are input to the fallback processor core.

4. The device according to claim 1, wherein the first power processor is configured to: acquire and evaluate the sensor signals from numerous sensors; and acquire and evaluate a first sensor signal of the sensor signals from a first sensor independently of a second sensor signal of the sensor signals from a second sensor.

5. The device according to claim 3, wherein at least one of the fallback processor core or a monitoring processor core are safety processor cores, and wherein the control interface is located between the safety processor and the vehicle module.

6. The device according to claim 5, further comprising: a second information interface located between the first power processor and the safety processor and configured to forward evaluated sensor signals from the first power processor to the safety processor.

7. The device according to claim 5, wherein, the safety processor is configured to check evaluated sensor signals from the first power processor for plausibility.

8. The device according to claim 5, wherein the safety processor has a second monitoring device configured to monitor the fallback processor core and the monitoring processor core.

9. The device according to claim 5, wherein at least one of the power processor the safety processor are coupled to a redundant power supply.

10. (canceled)

11. A device for controlling a vehicle module, comprising: a control interface configured to interface with the vehicle module such that the vehicle module can be controlled via the control interface; a first power processor configured to acquire and evaluate sensor signals; at last one second power processor configured to acquire and evaluate the sensor signals; and a safety processor coupled to the first power processor and the second power processor and configured to control the vehicle module based on a first evaluation result of the sensor signals evaluated with the first power processor and a second evaluation result of the sensor signals evaluated with the second power processor.

12. The device according to claim 11, further comprising an information interface located between the first power processor and the safety processor, and between the second power processor and the safety processor, the information interface configured to forward the first evaluation result from the first power processor and the second evaluation result from the second power processor to the safety processor.

13. The device according to claim 11, wherein the safety processor comprises: has at least one first core; at least one second core; and at least one third core; wherein the at least one first core is connected to the first power processor such that the at least one first core implements the first evaluation result from the first power processor, wherein the at least one second core is connected to the second power processor such that the second core implements the second evaluation result from the second power processor, and wherein the at least one third core is configured to compare a result of the implementation of the first evaluation result implemented on the first core with a result of the implementation of the second evaluation result implemented on the second core, wherein the vehicle module is controlled, at least in part, on a basis of a result of the comparison.

14. The device according to claim 11, further comprising a redundant power source for at least one of the first power processor, the second power processor, and the safety processor.

15. (canceled)

16. (canceled)

17. The device according to claim 11, wherein the first power processor and the second power processor execute artificial neural networks configured to evaluate the sensor signals to obtain information for controlling the vehicle module.

18. The device according to claim 11, wherein the first power processor and the second power processor are configured to acquire the sensor signals from environment detection sensors comprising at least one of a camera, a radar system, or a lidar system.

19. The device according to claim 18, wherein the first power processor and the second power processor each comprise a control device configured to monitor an environment recorded by the environment detection sensors.

20. The device according to claim 11, wherein the vehicle module corresponds to at least one of a chassis domain, drive, an interior domain, or a safety domain.

21. (canceled)

22. A driver assistance method comprising: acquiring sensor signals from at least one environment detection sensor in at least a first power processor; evaluating the sensor signals in the first power processor to obtain information for controlling a vehicle module; monitoring, by a first monitoring device coupled to the first power processor, a state of the first power processor and outputting, by the first monitoring device, a monitoring signal based on the state of the first power processor; and controlling the vehicle module with a fallback processor coupled to the first monitoring device for an emergency operating mode of the vehicle module based on the monitoring signal.

23. The driver assistance method according to claim 22, further comprising: controlling the vehicle module with a second power processor in response to the first power processor becoming deactivated.

24. The driver assistance method according to claim 22, further comprising: checking, by a control device of the first power processor, the sensor signals prior to the first power processor acquiring the sensor signals, to determine whether the environment detection sensors have correctly recorded an environment.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The invention shall be explained below in reference to the following figures. Therein:

[0048] FIG. 1 shows an exemplary embodiment of a device according to the invention for controlling a vehicle module,

[0049] FIG. 2 shows an exemplary embodiment of another device according to the invention for controlling a vehicle module,

[0050] FIG. 3 shows another exemplary embodiment of a device according to the invention for controlling a vehicle module, and

[0051] FIG. 4 shows an exemplary embodiment of a driver assistance system process according to the invention.

[0052] If not otherwise indicated, identical reference numerals refer to identical components that have the same functions in the figures. For purposes of clarity, only the respective relevant components are numbered in the individual figures.

DETAILED DESCRIPTION

[0053] The device 1 in FIG. 1 for controlling a vehicle module has a first power processor 10 and a fallback processor core 21. Sensor signals 31 are conducted in a first signal channel 4 of the device 1 to the first power processor 10, and in a second signal channel 5 to the fallback processor core 21. The sensor signals 31 can be signals from environment detection sensors, e.g. a camera, radar, or lidar.

[0054] The state of the first power processor 10 is detected by a first monitoring device 11 by means of a status signal of the first power processor. The first monitoring device 11 checks, e.g., whether the first power processor functions correctly with respect to hardware, or whether the software for evaluating the acquired sensor signal 31 functions correctly and outputs a corresponding monitoring signal. A malfunctioning state of the first power processor can be determined on the basis of the monitoring signal. When the first monitoring device 11 detects a malfunctioning state of the first power processor, the first monitoring device 11 can activate the fallback processor core 21, which enables it to actuate the vehicle module 2 for an emergency operating mode via the control interface 3.

[0055] When the first power processor 10 is functioning properly, the sensor signals 31 are evaluated by the first power processor 10 to obtain information 40. The vehicle module 2 is controlled with the information 40 via the control interface 3. Controlling with information 40 also means that with more information 40, a fusion of the information first takes place, and the vehicle is controlled with the information 40 from the fusion, or with the information 40 itself.

[0056] The power processor 10 has a control device 13, a data acquisition device 14 and an evaluation unit 15 for evaluating the sensor signals 31. The control device 13 checks whether the sensor signals 31 have correctly reproduced an environment. The sensor signals 31 that correctly reproduce an environment are accumulated in the data acquisition device 14, and subsequently evaluated in the evaluation unit 15.

[0057] The evaluation unit 15 exhibits artificial intelligence that can identify traffic-relevant objects in camera images, for example, e.g., pedestrians, other vehicles, or traffic signs. The information 40 evaluated in this manner is sent to a control interface 3, which generates corresponding commands for controlling the vehicle module 2.

[0058] A monitoring processor core 22 is also shown in FIG. 1, which has an input to which the sensor signals 31 are sent. Sensor signals 31 monitored by the monitoring processor core 22 then form the input for the fallback processor core 21.

[0059] FIG. 2 shows a device 8 that has a second power processor 12 in addition to the first power processor 10. The sensor signals 31 are redundantly supplied to the first power processor 10 and the second power processor 12.

[0060] The first power processor 10 and the second power processor 12 are each monitored by a monitoring device 11.

[0061] The device 8 also has a safety processor 20. The safety processor 20 receives the information 40 evaluated by the first power processor and the second power processor via the information interface 6.

[0062] The safety processor has a first core 23, which processes the evaluated information 40 of the first power processor 10. The safety processor 20 also has a second core 24, which processes the evaluated information of the second power processor. The results of the processing of the information 40 evaluated in the first core 23 and second core 24 by the safety processor are forwarded to a third core 25 of the safety processor and compared with one another in the third core 25. In a comparison, the third core 25 determines whether the first power processor 10 and the second power processor 12 are each functioning correctly, or whether one of the power processors 10, 12 is malfunctioning.

[0063] If the first power processor 10 is malfunctioning, only the information 40 evaluated by the second power processor 12 is used by the third core 25 of the safety processor 10 for controlling the vehicle module 2. The same applies respectively if the second power processor 12 is malfunctioning.

[0064] As a further safety measure, the safety processor 20 also has a second monitoring device 26.

[0065] The first power processor 10 and the second power processor 12 are also each connected to a redundant power supply 7.

[0066] FIG. 3 shows that the fallback processor core 21 and the monitoring processor core 22 of the device 1 can also be cores of a safety processor 20.

[0067] A vehicle module can be actuated for an emergency operating mode with the driver assistance system process shown in FIG. 4. Sensor signals 31 are acquired and processed in a power processor 10. The vehicle module 2 is controlled via the control interface 3 with the evaluated sensor signals 31.

[0068] The acquisition and evaluation process is monitored by the monitoring device 11. By way of example, the power processor 10 sends a signal with a predefined value and/or predefined temporal course to the monitoring device 11 at regular time intervals when it is functioning correctly. This signal is the status signal for the power processor 10. If the power processor is malfunctioning, whether it is a hardware and/or a software failure, the status signal can differ from the predefined value and/or predefined temporal course, or the power processor 10 does not send a status signal to the monitoring device 11.

[0069] The monitoring device 11 outputs a monitoring signal based on this status signal. If, for example, the monitoring device 11 receives a status signal with the predefined value, the monitoring signal can be the number 1, which then indicates a properly functioning state of the power processor 10. If the monitoring device 11 does not receive a status signal in a predefined time interval, the monitoring signal can be the number 0, which then indicates a malfunctioning state of the power processor.

[0070] If the monitoring device 11 determines that the power processor 10 is functioning correctly, i.e. the monitoring signal is the number 1, the vehicle module 2 is then controlled with the sensor signals 31 evaluated in the power processor 10. If the monitoring device 11 determines that the power processor 10 is malfunctioning, i.e. the monitoring signal is the number zero, for example, the vehicle module is then controlled with the fallback processor 21.

REFERENCE SYMBOLS

[0071] 1 device [0072] 2 vehicle module [0073] 3 control interface [0074] 4 first signal channel [0075] 5 second signal channel [0076] 6 information interface [0077] 7 redundant power supply [0078] 8 device [0079] 10 first power processor [0080] 11 first monitoring device [0081] 12 second power processor [0082] 13 control device [0083] 14 data acquisition device [0084] 15 evaluation unit [0085] 20 safety processor [0086] 21 fallback processor core [0087] 22 monitoring processor core [0088] 23 first core [0089] 24 second core [0090] 25 third core [0091] 26 second monitoring device [0092] 30 sensor [0093] 31 sensor signal [0094] 40 information