ACTIVATION SYSTEM, CONTROL MODULE, AND METHOD FOR OPERATING

Abstract

An activation system for at least one receiving device that is redundantly activatable via a first communication network and via at least one second communication network that is independent of the first communication network. The activation system includes at least two transmitting modules, each of which is designed to generate messages for the receiving device and to transmit them to the receiving device via at least one of the communication networks. At least one transmitting module is connectable to both communication networks, and the transmitting modules are coordinated with one another and/or with the receiving device in such a way that messages from one transmitting module are to be transmitted via a communication network and/or processed by the receiving device with priority over messages from another transmitting module.

Claims

1. An activation system for at least one receiving device that is redundantly activatable via a first communication network and via at least one second communication network that is independent of the first communication network, the activation system comprising: at least two transmitting modules, each of the transmitting modules being configured to generate messages for the receiving device and to transmit the messages to the receiving device via at least one of the communication networks, at least one transmitting module of the transmitting modules being connectable to both the first and the second communication networks, and the transmitting modules being coordinated with one another and/or with the receiving device in such a way that messages from one of the transmitting modules are to be transmitted via a communication network of first and second communication networks and/or processed by the receiving device with priority over messages from another of the transmitting modules.

2. The activation system as recited in claim 1, wherein at least the transmitting module whose messages are to be processed with priority by the receiving device is connectable to both of the first and the second communication networks.

3. The activation system as recited in claim 1, wherein a first transmitting module of the transmitting modules is assigned a role of activating the receiving device during normal operation of the activation system, and a second transmitting module of the transmitting modules is assigned a role of activating the receiving device in the event of an error that deviates from normal operation, when the first transmitting module is unavailable.

4. The activation system as recited in claim 3, further comprising: at least one third transmitting module that is provided as an additional fallback level for the second transmitting module and is connectable only to the second communication network, the first, second, and third transmitting modules being coordinated with one another in such a way that messages sent via the second communication network: have highest priority when they originate from the first transmitting module, have medium priority when they originate from the second transmitting module, and have lowest priority when they originate from the third transmitting module.

5. The activation system as recited in claim 1, wherein the first communication network is a FlexRay network according to ISO 17458-1 through 17458-5.

6. The activation system as recited in claim 5, wherein the first, second, and third transmitting modules are coordinated in such a way that they transmit messages at predefined positions within a FlexRay frame.

7. The activation system as recited in claim 1, wherein the second communication network is a CAN bus.

8. The activation system as recited in claim 7, wherein the transmitting modules are coordinated to set arbitration fields to different values in messages sent via the CAN bus.

9. The activation system as recited in claim 1, wherein the transmitting modules are configured to encode an identification indicating a particular transmitting module, and/or a priority assigned to the particular transmitting module, into a data field, to be evaluated by the receiving device, in the messages sent by the transmitting modules.

10. A control unit for at least one actuator that is redundantly activatable via a first communication network and via at least one second communication network that is independent of the first communication network, wherein: the control unit is connectable to both the first and the second communication networks, and is configured to ascertain messages for the actuator and to send the messages to the actuator via both the first and the second communication networks, and is configured to send via both the first and the second communication networks and/or to claim mutually corresponding priorities for processing the messages sent via both the first and the second communication networks.

11. The activation system as recited in claim 1, wherein the activation system is configured to activate an actuator in an at least semi-automatedly traveling vehicle, using messages that represent a trajectory to be traveled by the vehicle.

12. A method for operating an activation system, comprising the following steps: connecting the activation system to at least two communication networks; connecting at least one receiving device to the communication networks; in response to at least one valid message that originates from a primary transmitting module of the activation system arriving at the receiving device, processing the valid message originating from the primary transmitting module by the receiving device; and in response to no valid message that originates from the primary transmitting module arriving at the receiving device, but a valid message that originates from a secondary transmitting module of the activation system, arriving at the receiving device, processing the valid message originating from the secondary transmitting module by the receiving device.

13. The method as recited in claim 12, wherein, wherein in response to also no valid message that originates from the secondary transmitting module of the activation system arriving at the receiving device, but a valid message that originates from a tertiary transmitting module of the activation system arriving at the receiving device, the valid message originating from the tertiary transmitting module is processed by the receiving device.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0037] FIG. 1 shows a first exemplary embodiment of activation system 1 including two transmitting modules 5a, 5b, in accordance with the present invention.

[0038] FIG. 2 shows a second exemplary embodiment of activation system 1 including three control units 5a through 5c, in accordance with the present invention.

[0039] FIG. 3 shows one exemplary embodiment of method 100 for operating activation system 1 or control unit 5a, 5b, in accordance with the present invention.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

[0040] FIG. 1 shows a first exemplary embodiment of activation system 1. Two transmitting modules 5a, 5b are provided, which may be, for example, independent control units or also independent channels within the same control unit. In the example shown in FIG. 1, a primary transmitting module 5a is dominant, and during normal operation is intended to send messages 6a, in the present case control commands, to receiving device 2, in the present case an actuator. Secondary transmitting module 5b is used as a fallback level in order to supply receiving device 2 with messages 6b, once again control commands in the present case, within the scope of a degraded operation in the event of a failure of primary transmitting module 5a.

[0041] Two communication networks 3, 4 that are independent of one another are available for the communication with receiving device 2. Primary transmitting module 5a is connected to both communication networks 3, 4. In contrast, secondary transmitting module 5b is connected only to second communication network 4. Actuator 2 is connected to first communication network 3 via a first interface 2a, and to second communication network 4 via a second interface 2b.

[0042] In the example shown in FIG. 1, network 3 is a FlexRay network and network 4 is a CAN bus. During normal operation, primary transmitting module 5a transmits messages 6a to particular interfaces 2a, 2b of receiving device 2 via both communication networks 3, 4. Secondary transmitting module 5b attempts, simultaneously with primary transmitting module 5a, to transmit messages 6b to interface 2b of receiving device 2 via communication network 4. However, primary transmitting module 5a prevails for the bitwise arbitration on the CAN bus, so that receiving device 2 obtains only messages 6a of primary transmitting module 5a. As explained above, receiving device 2 may be configured in such a way that it preferably processes messages 6a that are obtained via first communication network 3.

[0043] Receiving device 2 is thus coordinated with transmitting modules 5a, 5b in such a way that whenever it receives valid messages 6a from primary transmitting module 5a, it processes these messages 6a and possibly ignores additionally arriving messages 6b from secondary transmitting module 5b.

[0044] In the state shown in FIG. 1, a failure of first network 3 only results in receiving device 2 from that moment on obtaining control commands 6a of primary control unit 5a via second network 4. However, nothing changes the fact that primary control unit 5a remains dominant.

[0045] However, in the event of a failure of primary transmitting module 5a, any valid message 6a of primary transmitting module 5a is absent on the part of receiving device 2. For this case, it is provided that receiving device 2 processes valid messages 6b which it receives from secondary transmitting module 5b.

[0046] As indicated by the dotted-line connection, secondary transmitting module 5b may optionally also be connected to first communication network 3, and via same may continually send messages 6b to receiving device 2. However, this does not change the fact that receiving device 2 processes valid messages 6a from primary transmitting module 5a with priority.

[0047] FIG. 2 shows a further exemplary embodiment of activation system 1. This activation system 1 is connected to receiving device 2 similarly as in FIG. 1. However, in contrast to FIG. 1, a tertiary transmitting module 5c is provided which in comparison to secondary transmitting module 5b is designed to activate actuator 2 within the scope of an even further degraded operation. For an automatedly traveling vehicle, such a further degraded operation may involve, for example, the vehicle immediately stopping while observing traffic regulations, or removing it from the flow of traffic in some other way. Tertiary control unit 5c is connected only to second network 4, not to first network 3.

[0048] Receiving device 2 is configured to process [0049] valid messages 6a from primary transmitting module 5a with priority, [0050] next-highest ranking valid messages 6b from secondary transmitting module 5b in the absence of valid messages 6a, and [0051] lastly, valid messages 6c from tertiary transmitting module 6c in the absence also of valid messages 6b.

[0052] The bitwise arbitrage in second communication network 4 is controlled in such a way that messages 6a of primary transmitting module 5a are preferably transferred there. Thus, if first communication network 3 fails, this results in the receiving device now obtaining messages 6a from primary transmitting module 5a via second communication network 4.

[0053] If primary transmitting module 5a is no longer functioning, valid messages 6b of second transmitting module 5b are next processed by receiving device 2 with priority. Only when second transmitting module 5b is likewise no longer functioning do messages 6c from tertiary transmitting module 5c arrive at receiving device 2. These messages 6c contain control commands for an even further degraded operation. All these transfers run via second communication network 4 after the failure of first communication network 3. If first communication network 3 is restored in the meantime, it is once again used seamlessly.

[0054] FIG. 3 is a schematic flowchart of one exemplary embodiment of method 100 for operating activation system 1.

[0055] Activation system 1 or control unit 5a, 5b, 5c is connected to at least two communication networks 3, 4 in step 110.

[0056] At least one actuator 2 is likewise connected to these communication networks in step 120.

[0057] It is checked in step 130 whether at least one valid message 6a originating from a primary transmitting module 5a of activation system 1 arrives at receiving device 2. If this is the case (truth value 1), this message 6a is processed in step 140. However, if no message 6a is present (truth value 0), it is checked in step 150 whether a valid message 6b originating from a secondary transmitting module 5b of activation system 1 is present at receiving device 2. If this is the case (truth value 1), this message is processed in step 160. In contrast, if no valid message 6b is present (truth value 0), it is checked in step 170 whether a valid message 6c originating from a tertiary transmitting module 5c of activation system 1 is present at receiving device 2. If this is the case (truth value 1), this message is processed in step 180.