CONTROLSYSTEM FOR A MOTOR VEHICLE, MOTOR VEHICLE, METHOD FOR CONTROLLING A MOTOR VEHICLE, COMPUTER PROGRAM PRODUCT, AND COMPUTER-READABLE MEDIUM

Abstract

A control system for a motor vehicle, having a first control device for controlling a first function of the motor vehicle and a second control device for controlling a second function of the motor vehicle. The first and second control devices are each in a signal transmission connection with at least one sensor and/or at least one actuator. To ensure the proper execution of functions of a motor vehicle controlled by control devices even with a faulty control device with the least possible effort, it is provided that in dependence on the receipt of an error signal from the first control device or the second control device, the respective error-free control device is configured such that the function of the motor vehicle that corresponds to the faulty control device is controlled by the error-free control device.

Claims

1. A control system for a motor vehicle, the control system comprising: a first control device to control a first function of the motor vehicle; and a second control device to control a second function of the motor vehicle, wherein the first and the second control devices are in signal transmission connection with at least one sensor and/or at least one actuator, wherein the first control device and the second control device are in a signal transmission connection or the first and second control devices are each in a signal transmission connection with a third control device, and depending on the input of an error signal from the first control device or the second control device in the error-free control device or the third control device, each error-free control device is configured such that via the error-free control device the function of the motor vehicle corresponding to the faulty control device is controllable, and wherein the error-free control device is in a signal transmission connection with the at least one sensor and/or at least one actuator that corresponds to the faulty control device.

2. The control system according to claim 1, wherein the first function of the motor vehicle is a braking function and the second function of the motor vehicle is a steering function.

3. The control system according to claim 1, wherein the control system has a user interface and, depending on the presence of an activation signal at the user interface, is converted from a deactivated state to an activated state, wherein in the deactivated state of the control system the error-free control device does not control the function of the motor vehicle corresponding to the faulty control device independently of the input of the error signal in the error-free control device or the third control device and in the activated state of the control system controls the function of the motor vehicle corresponding to the faulty control device as a function of the input of the error signal in the error-free control device or the third control device.

4. A motor vehicle comprising: a control system with a first control device for controlling a first function of the motor vehicle and with a second control device for controlling a second function of the motor vehicle, wherein the first and the second control devices are each connected with at least one sensor and/or at least one actuator, and wherein the control system is the control system according to claim 1.

5. A method for controlling a motor vehicle, the method comprising: providing a first control device for controlling a first function of the motor vehicle; and providing a second control device for controlling a second function of the motor vehicle, wherein the first and the second control devices are each in a signal transmission connection with at least one sensor and/or at least one actuator, wherein the first control device and the second control device are in signal transmission connection or the first and second control devices are each in a signal transmission connection with a third control device and depending on the input of an error signal from the first control device or the second control device in the error-free control device or the third control device, each error-free control device is configured in such a way that it controls the function of the motor vehicle that corresponds to the faulty control device, and wherein the error-free control device is in a signal transmission connection with the at least one sensor and/or at least one actuator that corresponds to the faulty control device.

6. The method according to claim 5, wherein the error-free control device is configured such that it performs the function of the motor vehicle that corresponds to the faulty control device in a way that is restricted as compared to normal operation of this function, or that it performs the function of the motor vehicle that corresponds to the error-free control device in a way that is restricted as compared to normal operation of this function.

7. The method according to claim 5, wherein the first function of the motor vehicle is designed as a braking function and the second function of the motor vehicle is designed as a steering function.

8. The method according to claim 5, wherein the control system has a user interface and, depending on the presence of an activation signal at the user interface, is converted from a deactivated state to an activated state, wherein in the deactivated state of the control system the error-free control device does not control the function of the motor vehicle corresponding to the faulty control device independently of the input of the error signal in the error-free control device or the third control device, and in the activated state of the control system controls the function of the motor vehicle corresponding to the faulty control device depending on the input of the error signal in the error-free control device or the third control device.

9. A computer program product comprising instructions that cause a control system to perform the method steps of the method according to claim 5.

10. A computer-readable medium on which the computer program product according to claim 9 is stored.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The present invention will become more fully understood from the detailed description given hereinbelow and the accompanying drawings which are given by way of illustration only, and thus, are not limitive of the present invention, and wherein:

[0020] FIG. 1 illustrates a control system according to an exemplary embodiment of the invention for a motor vehicle; and

[0021] FIG. 2 illustrates a control system according to an exemplary embodiment invention for a motor vehicle.

DETAILED DESCRIPTION

[0022] FIG. 1 shows an exemplary embodiment of an inventive control system for a motor vehicle. The control system has a first control device 2 for a first function and a second control device 4 for a second function of a motor vehicle (not shown in more detail). The motor vehicle is designed as a highly automated motor vehicle in which the functions of the motor vehicle are selected and carried out substantially automatically by the motor vehicle.

[0023] The first function is designed as a braking function and the second function is designed as a steering function of the motor vehicle. Accordingly, the first control device 2 controls the braking function of the motor vehicle and the second control device 4 controls the steering function of the motor vehicle. The first control device 2 for controlling the braking function of the motor vehicle is in a signal transmission connection with first actuators 6 of the motor vehicle embodied as brakes and the second control device 4 is in a signal transmission connection with a second actuator 8 embodied as a steering device of the motor vehicle.

[0024] In other applications, the braking function and/or the steering function could be a different number of actuators. Depending on the individual case, the person skilled in the art will select and determine the appropriate selection and number of actuators for the respective function of the motor vehicle.

[0025] The respective signal transmission connection between the first control device 2 and the brakes 6 as well as the second control device 4 and the steering 8 is symbolized in FIG. 1 by means of continuous arrows 2.1 and 4.1. The brakes 6 and the steering 8 of the motor vehicle are safety-relevant and therefore very important functions of the motor vehicle. This applies to an even greater extent to the selected exemplary embodiment, which is an autonomous motor vehicle.

[0026] So that in the event that one of the control devices 2 and 4 fails the braking function and the steering function of the motor vehicle can be properly and thus safely executed, the first control device 2 and the second control device 4 are in a signal transmission connection with one another, which is symbolized in FIG. 1 by the double arrow 3. At the same time, the first control device 2 is also in a signal transmission connection with the steering 8 and the second control device 4 is also in a signal transmission connection with the brakes 6. This is symbolized by the dashed arrows 2.2 and 4.2.

[0027] In the following, the method according to the invention is explained in more detail using FIG. 1.

[0028] In normal operation of the control system according to the invention for the autonomous motor vehicle, the brakes 6 are controlled by means of the first control device 2 for the braking function of the motor vehicle and the steering 8 by means of the second control device 4 for the steering function of the motor vehicle. In the first control device 2 or in the second control device 4 or in a control device 2, 4 superordinate to the respective control device, the need for brake intervention by the first control device 2 or steering intervention by the second control device 4 is determined in a manner known to the person skilled in the art on the basis of input signals of sensors of the motor vehicle applied to the corresponding control device. Both a possible higher-level control device and the sensors of the motor vehicle are not shown in FIG. 1.

[0029] In the above-described normal operation of the control system according to the invention in accordance with the present exemplary embodiment, the first control device 2 does not intervene in the steering function and the second control device 4 does not intervene in the braking function of the motor vehicle. By means of the signal transmission connection 3 existing between the first control device 2 and the second control device 4, the first control device 2 monitors the proper functioning of the second control device 4 and the second control device 4 the proper functioning of the first control device 2. In the event that one of the two control devices 2 and 4 fails, a corresponding error signal from the faulty control device 2 or 4 is present at the respective error-free control device 2, 4 as an input signal.

[0030] If, for example, the first control device 2 is defective, so that the brakes 6 controlled therewith are no longer properly controlled and the braking function of the motor vehicle would therefore no longer be carried out safely, this error is reported to the second control device 4 by means of the signal transmission connection 3, whereupon the second control device 4 is configured such that it controls the braking function of the motor vehicle, i.e., controls the function of the motor vehicle that corresponds to the faulty first control device 2. For this purpose, the second control device 4 is in signal exchange by means of the signal transmission connection 4.2 with the brakes 6 of the motor vehicle. Thus, in the event the first control device 2 fails, the brakes 6 are no longer controlled by the first control device 2 but rather by the second control device 4.

[0031] The same applies analogously if the second control device 4 is defective. In this case, the first control device 2 receives a corresponding error message regarding the second control device 4 by means of the signal transmission connection 3, whereupon the first control device 2 is configured such that it controls the steering function of the motor vehicle. The steering 8 is therefore no longer controlled by the faulty second control device 4, but instead by the first control device 2, specifically by means of the signal transmission connection 2.2.

[0032] FIG. 2 shows an exemplary embodiment. In the following, only the differences to the first exemplary embodiment are explained. Otherwise, reference is made to the description of the first exemplary embodiment. The same or equivalent components are provided with the same reference numerals.

[0033] In contrast to the first exemplary embodiment, the second exemplary embodiment has, in addition to the first and second control devices 2, 4, a third control device 10. The third control device 10 is designed as a central control device 10 of the motor vehicle, not shown. The central control device 10 is in a signal transmission connection with the first control device 2 as well as the second control device 4. In FIG. 2, the signal transmission connection between the central control device 10 and the first control device 2 is symbolized by a double arrow 10.1 and the signal transmission connection between the central control device 10 and the second control device 4 is symbolized by a double arrow 10.2.

[0034] By means of the signal transmission connections 10.1 and 10.2, the central control device 10 monitors the proper functioning of the first control device 2 and the proper functioning of the second control device 4. In the event that one of the two control devices 2 and 4 fails, a corresponding error signal from the faulty control device 2 or 4 is present at the central control device 10 as an input signal. If, for example, the first control device 2 malfunctions, so that the thus controlled brakes 6 are no longer properly controlled and thus the braking function of the motor vehicle is no longer safely executed, this error is reported to the central control device 10 by means of the signal transmission connection 10.1, whereupon the second control device 4, in signal exchange with the central control device 10 by means of the signal transmission connection 10.2, is configured such that this controls the braking function of the motor vehicle, i.e., controls the function of the motor vehicle that corresponds to the faulty first control device 2. To this end, the second control device 4 is in signal exchange by means of the signal transmission connection 4.2 with the brakes 6 of the motor vehicle. In the event that the first control device 2 fails, the brakes 6 are no longer controlled by the first control device 2 but instead by the second control device 4.

[0035] The same applies analogously if the second control device 4 malfunctions. In this case, the central control device 10 receives a corresponding error message with respect to the second control device 4 by means of the signal transmission connection 10.2, whereupon the first control device 2, which is in signal exchange with the central control device 10 by means of the signal transmission connection 10.1, is configured such that this controls the steering function of the motor vehicle. The steering 8 is therefore no longer controlled by the faulty second control device 4, but rather by the first control device 2, specifically by means of the signal transmission connection 2.2.

[0036] The invention is not limited to the present exemplary embodiments. For example, it is conceivable that the control system has a user interface and, depending on the presence of an activation signal at the user interface, can be converted from an deactivated state to an activated state, wherein in the deactivated state of the control system, the error-free control device does not control the function of the motor vehicle that corresponds to the faulty control device independent of the input of the error signal at the error-free control device or the third control device and, in the activated state of the control system, controls the function of the motor vehicle that corresponds to the faulty control device depending on the input of the error signal at the error-free control device or the third control device.

[0037] The control system according to the invention for a motor vehicle would in this case be present and deactivated in a motor vehicle and could be activated for future use by means of operator intervention by a vehicle driver, repair shop staff or the like. The same applies analogously to the method according to the invention for controlling a motor vehicle.

[0038] In addition, autonomous motor vehicles may not be legally approved in some countries. In the event of a later change in the law, the motor vehicle prepared in accordance with the invention can then be switched to autonomous driving with little effort and thus be switched to using a control system according to the invention and to using a method according to the invention for controlling the motor vehicle in its activated state.

[0039] For example, it would be conceivable that the error-free control device controls a rather subordinate function of the motor vehicle during normal operation of the motor vehicle. Should an error occur, the error-free control device could be configured such that in the event of failure, it controls the function of the defective control device instead of the subordinate function. This could, as in the exemplary embodiment, involve the braking function or the steering function of the motor vehicle.

[0040] In other embodiments of the invention, for example in peer functions of the motor vehicle, however, it would also be conceivable that the error-free control device controls the function corresponding to the faulty control device in addition to the function corresponding to the error-free control device in its normal operation.

[0041] Furthermore, the error-free control device could control the function of the faulty control device in a type of emergency mode. The reverse case is also fundamentally conceivable, namely that in the event of failure, the error-free control device controls the function assigned to said control device in its normal operation in a kind of emergency mode in favor of the function of the faulty control device.

[0042] The invention is not limited to the braking function and steering function of a motor vehicle. The invention is advantageously applicable also to other functions of a motor vehicle.

[0043] The invention being thus described, it will be obvious that the same may be varied in many ways. Such variations are not to be regarded as a departure from the spirit and scope of the invention, and all such modifications as would be obvious to one skilled in the art are to be included within the scope of the following claims.