CONTROL UNIT FOR A DRIVER ASSISTANCE SYSTEM, AND DRIVER ASISSTANCE SYSTEM

Abstract

The invention relates to a control device for a driver assistance system, wherein the control device comprises a sensor interface via which the control device can be connected to at least one sensor module to receive data from the at least one sensor module, a power processor which is adapted to detect objects and to provide object data based on the data from the at least one sensor module, and a system interface via which the control device can be connected to a higher-level control device of the driver assistance system for forwarding object data provided by the power processor.

Claims

1. A control device (10) for a driver assistance system (1), comprising a sensor interface via which the control device (10) can be connected to at least one sensor module for receiving data from the at least one sensor module (4, 6, 8), a power processor (30) which is adapted to detect objects and to provide object data based on the data from the at least one sensor module (4, 6, 8); a system interface via which the control device (10) can be connected to a higher-level control device of the driver assistance system (1) for forwarding object data provided by the power processor (30), and characterized by a sensor voltage supply unit (40) which provides operating energy for the at least one sensor module (4, 6, 8).

2. The control device (10) according to claim 1, wherein it comprises a safety processor (50) which is connected to the sensor voltage supply unit (40) and adapted to monitor the sensor voltage supply unit (40).

3. The control device (10) according to any claim 1, wherein it has a safety processor (50) which is connected to the power processor (30) and adapted to check at least one processing step of the power processor (30) for errors and/or check a processing status of the power processor (30).

4. The control device according to claim 3, wherein it is configured and adapted for the safety processor (50) to check a processing step in the object detection of the power processor (30) for data from the sensor module and/or to access object data via an interface to the power processor (30).

5. The control device (10) according to claim 1, wherein the sensor interface is configured to be connected to at least three sensor modules (4, 6, 8) simultaneously, and the control device (10) is further adapted to chronologically synchronize data received via the sensor interface from the at least three sensor modules (4, 6, 8).

6. The control device (10) according to claim 1, wherein the power processor (30) is adapted and configured to determine an area passable by a motor vehicle based on the data from the at least one sensor module (4, 6, 8).

7. The control device (10) according to claim 1, wherein the device comprises a control module (28) for a cooling system (20) of the control device (10).

8. The control device (10) according to claim 1, wherein the device comprises power electronics (29) for controlling a cleaning system for the at least one sensor module (4, 6, 8).

9. The control device (10) according to claim 1, wherein the power processor (30) is connected to the sensor interface for receiving data from the at least one sensor module (4, 6, 8) and the system interface and is configured to forward determined object data to the system interface based on the data from the at least one sensor module (4, 6, 8).

10. The control device according to claim 1, wherein the device comprises a housing, wherein the housing is dustproof and/or waterproof.

11. The control device according to claim 1, wherein the at least one sensor module is a LIDAR sensor module.

12. A control device (10) for a driver assistance system (1), comprising a sensor interface via which the control device can be connected to at least one sensor module for receiving data from the at least one sensor module, a power processor which is adapted to detect objects and to provide object data based on the data from the at least one sensor module; a system interface via which the control device can be connected to a higher-level control device of the driver assistance system for forwarding object data provided by the power processor; a safety processor (50), which is connected to the power processor (30) and configured to check at least one processing step of the power processor (30) for errors and/or to check a processing status of the power processor (30); and which has another power processor (31) which is connected to the power processor (30).

13. The control device (10) according to claim 12, wherein the power processor (30) and the other power processor (31) are connected to one another via two independent data transmission channels, wherein particularly the data transmission channels use different transmission protocols.

14. A control device (110) for a driver assistance system (1), comprising a sensor interface via which the control device (110) can be connected to at least one sensor module for receiving data from the at least one sensor module (4, 6, 8), a power processor (130) which is adapted to detect objects and to provide detected objects based on the data from the at least one sensor module (4, 6, 8); and another power processor (150), which is connected to the power processor (130) for transmitting control commands and/or data from the at least one sensor module, wherein the power processor (130) and the additional power processor (150) are configurable for a safe operating mode in such a way that the additional power processor is adapted to detect objects and to provide detected objects based on the same data from the at least one sensor module (4, 6, 8), and wherein the power processor (130) and the other power processor (150) are configurable for a maximum performance operating mode, such that the power processor (130) and the other power processor (150) are each adapted to select part of the data from the at least one sensor module and to assign it to a respective one of the power processors based on the data from the at least one sensor module (4, 6, 8) and to detect objects and provide detected objects based on the assigned data.

15. A driver assistance system (1) for a motor vehicle, the driver assistance system (1) comprising: a domain controller (100) with a power processor (130) and a safety processor (150), wherein the power processor is configured to process object data received via a vehicle network (200) relating to an environment of the motor vehicle to provide a driver assistance function, and the safety processor (150) is configured and adapted to check at least one processing step of the power processor (130) for its correctness, and a control device (10) that can be connected to the domain controller (100) and has a sensor interface via which the control device (10) can be connected to at least one sensor module for receiving data from the at least one sensor module (4, 6, 8), with a power processor (30) which is adapted to detect objects based on the data from the at least one sensor module and to provide object data, and with a safety processor (50) for checking a processing status of the power processor (30) and/or a processing step of the power processor (30) for errors.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Further features, advantages and properties of the invention are explained on the basis of the description of preferred embodiments of the invention with reference to the figures, wherein:

[0035] FIG. 1: shows a perspective view of a control device according to a first embodiment;

[0036] FIG. 2: shows a schematic view of the first control device according to the embodiment of FIG. 1;

[0037] FIG. 3: shows a scheme of data streams between in a vehicle network in which a control device according to the invention is integrated to implement a driver assistance system according to the invention;

[0038] FIG. 4a: shows a schematic view of a second embodiment of a control device according to the invention;

[0039] FIG. 4b: shows a schematic view of a third embodiment of a control device according to the invention;

[0040] FIG. 5: shows a schematic view of a first embodiment of a driver assistance system according to the invention;

[0041] FIG. 6: shows a schematic view of another control device according to the invention according to the embodiment of FIG. 1;

[0042] FIG. 7: shows a schematic view of another embodiment of a control device according to the invention;

[0043] FIG. 8: shows a schematic view of another embodiment of a control device according to the invention.

DESCRIPTION

[0044] FIG. 1 shows a first embodiment of a control device 10 according to the invention for a driver assistance system not shown in detail in the figure, for example a system for automated driving according to VDA level 2 or higher, such as a freeway autopilot. The control device 10 comprises an electronic circuit that is arranged on one or more printed circuit boards. At least some of the electrical interfaces of the control device 10 are arranged on the printed circuit board 14, namely a connection socket 13, a network socket 15 according to the RJ-45 standard, and sensor module connections 17. The sensor module connections 17 use a coaxial plug-in system for coaxial cables. Further electrical interfaces are not shown, but can be provided by this exemplary embodiment, as can be seen from the further description.

[0045] The circuit board 14 is arranged in a housing 12. The housing 12 is made of a thermally conductive material, for example a metal such as aluminum or a metal alloy such as an aluminum alloy. The housing 12 has openings through which the electrical interfaces of the control device 10 are accessible to the outside of the housing.

[0046] The control device 10 also has a cooling system 20. The cooling system 20 comprises cooling fins 21 formed in the housing 12, which fins increase the surface area of the housing 12 which is available for heat exchange. The cooling system 20 also includes a cooling system carrier 22 which connects essential components of the cooling system 20 to one another. The cooling system carrier 22 defines the orientation and the distance between the fan 24 and the cooling fins 21. Furthermore, the cooling system carrier 22 forms a ventilation duct which extends along the cooling fins 21. The fan 24 is operated electrically and its speed can be controlled. Heat exchange capacity and noise generation are adapted optimally by suitable orientation and compliance with a minimum distance from the cooling fins to avoid turbulence on the cooling fins 21 as well as by the dimensioning of the ventilation duct. The cooling system 20 also includes one or more temperature sensors, not shown in detail, within the housing 12 of the control device 10, and a control module 28 which is shown in the example according to FIG. 2, for example. The control module 28 uses operating data from the control device 10 and the temperature sensors to determine a current and future cooling requirement and controls the fan 24 in such a way that the cooling requirement is covered with the least possible noise development.

[0047] The cooling system carrier 22 and the housing 12 of the control device 10 include a plug-in system that provides a mechanical and an electrical connection between the cooling system carrier 22 and the control device 10 . This makes assembly easier.

[0048] In a variant of the cooling system 20 that is not shown, a pipeline extends in a meandering manner along the cooling fins 21 within the space delimited by the cooling system carrier 22. A cooling fluid is driven through the pipeline by means of an electrically operated pump to absorb heat and dissipate it to a heat exchanger. The heat exchanger may be remote from the control device 10, and the piping may extend to the heat exchanger. In this variant of the cooling system 21, the control system of the pump takes the place of the control system 28 of the fan 24 and/or of the heat exchanger.

[0049] FIG. 2 shows a schematic view of the functional components of the embodiment of the control device 10, the external view of which is shown in FIG. 1. The control device 10 is supplied with electrical energy via the connection socket 13. The energy supply module 44 takes over basic energy supply functions, such as reverse polarity protection, voltage and/or current stabilization, buffering, and distributes electrical energy received via the connection socket 13 within the control device 10 via the power supply network 41.

[0050] A sensor interface of the control device 10 is formed by sensor module connections 17 and a sensor communication module 70. The sensor communication module 70 is designed, for example, according to the Gigabit Multimedia Serial Link (GMSL) standard, and the sensor module connections are designed as a coaxial connector system. Alternatively, the sensor communication module 70 is designed according to the Ethernet standard and the sensor module connections are designed as an RJ-45 plug-in system. The sensor interface comprises a respective GMSL sensor module connection for each sensor module to be connected or an Ethernet connection for each sensor of a sensor module to be connected. In particular, a sensor module has two sensors each.

[0051] The control device 10 comprises three sensor module connections, two of which are connected to sensor modules of two sensors each and one of which is connected to a sensor module with one sensor.

[0052] The sensor communication module 70 forwards data received from the sensor modules to a power processor 30 that is connected to the sensor communication module 70. The power processor 30 is powered by a processor supply unit 43, which in turn is powered by the power grid 41. The power processor 30 is also connected to a system interface, which is implemented by a network module 72 and a network connection 15. The control device 10 can use the system interface to communicate data processed by the power processor 30 to the driver assistance system and receive data therefrom. The power processor prepares the data received from the sensor modules and processes them with object recognition algorithms to detect objects in the area surrounding the vehicle that is equipped with the control device 10.

[0053] The control device 10 comprises a sensor voltage supply unit 40 which is fed from the energy supply network 41. The sensor modules can be supplied with energy from control device 10 via a plug-in connection 42. The sensor voltage supply unit comprises separate power electronics for a respective sensor of the sensor modules for independent provision of a stable supply. The sensor voltage supply unit 40 is configured such that at least 20%, particularly at least 30%, preferably 60% of the energy requirement of a sensor or at least 15% of the total energy requirement of the sensor modules is available as standby energy.

[0054] The sensor voltage supply unit 40 is also connected to a safety processor 50. The safety processor 50 is adapted to enable an implementation of the ASIL D standard. For this purpose, the safety processor 50 has at least one lockstep arithmetic core. The safety processor 50 is also adapted to monitor the sensor voltage supply unit 40. Since an error or a failure of data from the sensor modules can have serious consequences for automated driving, monitoring the sensor voltage supply unit 40 contributes to increasing the reliability of control device 10 and the driver assistance system. With the help of the safety processor 50, input or output voltage curves, corresponding current curves, a temperature and/or other electrical operating parameters of the sensor voltage supply unit 40 are recorded and evaluated to detect functional limitations at an early stage.

[0055] The safety processor 50 also monitors the processor supply unit 43 of the power processor 30, a processor supply unit 45 of the safety processor 50 itself and the energy supply unit 44. The entire energy supply of the control device 10 is thus monitored using the respective operating parameters, such that potential problems can be identified immediately.

[0056] The safety processor 50 is also adapted and configured to check the processing steps that the power processor 30 carries out when processing data from the control device 10, in particular when detecting objects and forwarding object data. The safety processor 50 also handles checking and/or control tasks for the control system 28 of the cooling system and for the network module 72, via which the power processor 30 communicates with the driver assistance system.

[0057] Finally, the safety processor 50 is connected via a bus communication module 74 and a bus connection 19 to a communication bus, such as a CAN bus, of the motor vehicle, via which bus data can be exchanged within the vehicle.

[0058] FIG. 3 shows the control device 10 according to the embodiment of FIGS. 1 and 2 or 5 to 7, which exchanges information with a domain control device via a vehicle network 200. The vehicle network 200 is represented by the entirety of the interacting means of communication within the motor vehicle equipped with the control device 10. As for the control device 10, the interface to the vehicle network 200 is formed by the network module 72 and the bus communication module 74 and the corresponding connections or sockets. The control device 10 receives vehicle data 220 via the vehicle network 200, which data is processed by the power processor 30, for example, when the objects are detected. The control device 10 provides at least object data 210, which was determined from the data of the sensor modules, via the vehicle network. In addition, specific diagnostic data or control commands can be transmitted to other systems connected to the vehicle network 200, such as the domain control device 100, by means of the safety processor 50.

[0059] FIG. 4a shows a second embodiment of a control device according to the invention, which is essentially identical to the control device 10 of FIGS. 1 and 2. Like components are therefore provided with like reference numbers. The control device 10 in FIG. 4a differs from the control device 10 in FIG. 2 only in that a pump actuator 29 is provided in addition. The pump actuator 29 comprises power electronics with a driver circuit for a brushless motor that drives a pump. The pump delivers a cleaning fluid to clean the sensor modules. The pump actuator 29 is connected to the power supply network 41. In this version, the safety processor 50 also monitors the pump actuator 29.

[0060] FIG. 4b shows a third embodiment of the control device 10, which is substantially identical to the control device 10 according to the embodiment in FIG. 4a. Like components are therefore provided with like reference numbers. The control device 10 of FIG. 4b differs from the control device 10 of FIG. 4b in that it has a power coprocessor 31 in addition to the power processor 30. The power co-processor 31 is connected to the power processor 30 via a bus system such as PCI Express. However, the safety processor 50 only monitors the power processor 30 directly and is only indirectly connected to the power co-processor 31 via the power processor 30. The power co-processor 31 is powered by a further separate processor supply unit 47. The processor supply unit 47 is monitored by the safety processor 50. With the help of the power co-processor 31, a redundant computing system is provided for processing tasks that require high performance. Processing security is further increased by the redundancy. Alternatively or in addition, the power co-processor 31 is used to increase the overall computing power of the control device 10 at least temporarily.

[0061] The configuration with a power co-processor 31 can also be combined with the arrangement according to FIG. 1, according to which the pump actuator 29 would then be eliminated.

[0062] FIG. 5 shows an exemplary embodiment of a driver assistance system 1 with three sensor modules 4, 6, 8. The sensor modules 4, 6, 8 each have up to 2 sensors. The sensor modules 4, 6, 8 are connected to a sensor interface of a control device 10 via communication lines. The control device 10 can assume any of the embodiments described above. The sensor modules 4 , 6 , 8 are supplied with energy via the sensor voltage supply unit 40 of the control device 10 . In any case, the control device 10 comprises a power processor 30, which is configured to detect objects from the data of the sensor modules, and a safety processor 50, which checks the power processor 30 and the sensor voltage supply unit 40 with regard to their function and/or reliability. The control device 10 is connected to a domain control device 100 on which the actual driver assistance function is implemented. That is, an action of the vehicle is triggered by the domain control device 100. For this purpose, the domain control device 100 has a power processor 130, which carries out calculations for the assistance function, and a safety processor 150, which at least partially verifies the calculations of the power processor 130.

[0063] As shown in FIG. 6, according to a further embodiment, a second power processor 31 is provided in addition to the power processor 30. The power co-processor 31 is connected to the power processor 30 via two data transmission channels. A data transmission channel is formed by bundling four transmission channels according to the Ethernet standard. For this purpose, an Ethernet switch is integrated in each of the two power processors. Another, independent data transmission channel is implemented using PCI Express technology. The safety processor 50 only monitors the power processor 30 directly and is only indirectly connected to the power co-processor 31 via the power processor 30. The power co-processor 31 is supplied with energy by another separate processor supply unit 47. The processor supply unit 47 is monitored by the safety processor 50. With the help of the power processor 31, a redundant computing system is provided for processing tasks that require high performance. Processing security is further increased by the redundancy. Alternatively or in addition, the power processor 31 is used to increase the overall computing power of the control device 10 at least temporarily.

[0064] The sensor communication module 70 forwards data received from the sensor modules to a power processor 30 that is connected to the sensor communication module 70. The power processor 30 is powered by a processor supply unit 43, which in turn is powered by the power grid 41. The power processor 30 is also connected to a system interface, which is implemented by a network module 72 and a network connection 15. The control device 10 can use the system interface to communicate data processed by the power processor 30 to the driver assistance system and receive data therefrom. The power processors 30, 31 prepare the data received from the sensor modules and process it with object recognition algorithms to detect objects in the area surrounding the vehicle that is equipped with the control device 10.

[0065] The control device 10 comprises a sensor voltage supply unit 40 which is fed from the energy supply network 41. The sensor modules can be supplied with energy from control device 10 via a plug-in connection 42. The sensor voltage supply unit comprises separate power electronics for a respective sensor of the sensor modules for independent provision of a stable supply. The sensor voltage supply unit 40 is configured such that at least 20%, particularly at least 30%, preferably 60% of the energy requirement of a sensor or at least 15% of the total energy requirement of the sensor modules is available as standby energy.

[0066] The sensor voltage supply unit 40 is also connected to a safety processor 50. The safety processor 50 is adapted to enable an implementation of the ASIL D standard. For this purpose, the safety processor 50 has at least one lockstep arithmetic core. The safety processor 50 is also adapted to monitor the sensor voltage supply unit 40. Since an error or a failure of data from the sensor modules can have serious consequences for automated driving, monitoring the sensor voltage supply unit 40 contributes to increasing the reliability of control device 10 and the driver assistance system. With the help of the safety processor 50, input or output voltage curves, corresponding current curves, a temperature and/or other electrical operating parameters of the sensor voltage supply unit 40 are recorded and evaluated to detect functional limitations at an early stage.

[0067] The safety processor 50 also monitors the processor supply units 43, 47 of the power processors 30, 31, a processor supply unit 45 of the safety processor 50, and the energy supply unit 44. The entire energy supply system of the control device 10 is thus monitored using the respective operating parameters, such that potential problems can be identified immediately. The safety processor 50 is also adapted and configured to check the processing steps that the power processors 30, 31 carry out when processing data from the control device 10, in particular when detecting objects and forwarding object data. The safety processor 50 also handles checking and/or control tasks for the control system 28 of the cooling system and for the network module 72, via which the power processor 30 communicates with the driver assistance system.

[0068] Finally, the safety processor 50 is connected via a bus communication module 74 and a bus connection 19 to a communication bus, such as a CAN bus, of the motor vehicle, via which bus data can be exchanged within the vehicle.

[0069] FIG. 7 shows another embodiment of a control device according to the invention, which is substantially identical to the control device 10 of FIGS. 1 and 6. Like components are therefore provided with like reference numbers. The control device 10 in FIG. 7 differs from the control device 10 in FIG. 6 only in that a pump actuator 29 is provided in addition. The pump actuator 29 comprises power electronics with a driver circuit for a brushless motor that drives a pump. The pump delivers a cleaning fluid to clean the sensor modules. The pump actuator 29 is connected to the power supply network 41. In this version, the safety processor 50 also monitors the pump actuator 29.

[0070] FIG. 8 shows another embodiment of a control device 110 according to the invention, which substantially matches the control device 10 of FIGS. 2 and 4a. Like components with the same function are therefore provided with like reference numbers. The controller 110 differs from the previously mentioned control devices by a power processor 130 and a power processor 150, which have two different configuration modes. In a secure operating mode, one of the power processors 130, 150 is available as a standby unit if the other of the power processors 130, 150 should fail or calculate incorrectly. In this safe operating mode, a power processor 130, 150 can take over the tasks of the other power processor 130, 150 at any time. The control device 110 is configured in such a way that both power processors 130, 150 can receive the same data from the sensor module and can provide detected objects via identically configured interfaces. In particular, both power processors 130, 150 use at least some of the same interfaces, such as the bus connection 19.

[0071] The control device 110 can also be configured for a high-performance mode, in which the power processors 130, 150 split up the calculations for detecting the objects on the basis of the data from the at least one sensor module 4, 6, 8. For this purpose, a respective power processor 130, 150 selects part of the data from the at least one sensor module 4, 6, 8, which data is received via the sensor module connections 17, and works out object recognition algorithms on a respective part of the data. In this high-performance mode of operation, a higher amount of object detection calculations per time unit are possible than in the safe mode of operation.

[0072] The failure or error of a power processor 130, 150 is detected in the control device 110 by diagnostic units 131, 151 of the respective power processors 130, 150. The diagnostic units 131, 151 are each configured as hardware, for example as a reserved processor core, a separate processor or FPGA which processes predefined diagnostic tasks. The function of the diagnostic units 131, 151 is preset and not freely programmable. The diagnostic units 131, 151 check the functional readiness and correct functionality of an SRAM, a flash memory, one or more processor cores that can be used for applications, a processor clock, a temperature, and/or the energy supply units 43, 45 of the respective power processor 130, 150. The diagnostic units 131, 151 can each or jointly be configured in such a way that they implement a lockstep method.

[0073] In addition, diagnostic software is executed on the power processors 130, 150, which implements the further diagnostic functions for the power processors 131, 151 and the control device 110, e.g. checks whether specific software modules are called up and/or provide plausible results. In addition to the hardware diagnostic unit, the control device 110 is also provided with a software diagnostic unit, which can take on further diagnostic functions without negatively affecting the security of control device 110, since this runs on hardware tested by the hardware diagnostic unit.

REFERENCE SYMBOLS

[0074] 1 driver assistance system [0075] 4, 6, 8 sensor modules [0076] 10 control device [0077] 12 housing [0078] 13 connection socket [0079] 14 printed circuit board [0080] 15 network socket [0081] 17 sensor module connectors [0082] 19 bus connection [0083] 20 cooling system [0084] 21 cooling fins [0085] 22 cooling system carrier [0086] 24 fan [0087] 28 control system [0088] 29 pump actuator [0089] 30, 130 power processor [0090] 31 power co-processor [0091] 40 sensor voltage supply unit [0092] 41 power supply network [0093] 42 plug-in connector [0094] 43 processor supply unit [0095] 44 energy supply unit [0096] 45 processor supply unit [0097] 50, 150 safety processor [0098] 70 sensor communication module [0099] 72 network module [0100] 74 bus communication module [0101] 100 domain controller [0102] 131, 151 diagnostic unit [0103] 200 vehicle network [0104] 210 object data [0105] 220 vehicle data