WO1997049028A1

WO1997049028A1 - Electronic control unit with detachable storage elements connected to the bus that contain the entire software program

Info

Publication number: WO1997049028A1
Application number: PCT/CH1996/000233
Authority: WO
Inventors: Martin Ineichen
Original assignee: Ginova Ag
Priority date: 1996-06-18
Filing date: 1996-06-18
Publication date: 1997-12-24
Also published as: AU5890596A; DE19681520D2

Abstract

The electronic control unit has a first hardware module (2) fitted with a microcomputer (3) that operates with a software program. A bus system (4) having at least one address bus (6), one data bus (5) and one control bus (7) is likewise mounted on a mother board of the first hardware module (2). The electronic control unit has at least one second hardware module (8, 9), which can be connected to the first hardware module (2) using a detachable electrical connection (10, 11). At least one of the second hardware modules (8, 9) is preferably designed as a data carrier card in PCB format and contains electronic storage elements (12, 13, 14, 15, 16). When the two hardware modules (2, 8, 9) are connected together the storage elements (12, 13, 14, 15, 16) of at least one of the second hardware modules (8, 9) are connected directly to the bus system (4) of the first hardware module (2). The storage elements (12, 13) of at least one of the second hardware modules (8, 9) contain the entire software program for the microcomputer (3). This has the advantage that, if the control unit fails, the first hardware module (2) is simply replaced and operation may continue with at least one of the second hardware modules (8, 9) of the control unit that contains the software. In this way control function is maintained with absolutely the same program code and absolutely the same operating data.

Description

CONTROL UNIT WITH TO THE BUS CONNECTED, DETACHABLY SPEICHERELE _¬ MENTEN THAT THE ENTIRE SOFTWARE PROGRAM INCLUDED

The present invention relates to an electronic control device with a first hardware block with a microcomputer that works together with a software program, with a bus system with at least one address bus, a data bus and a control bus.

Electronic control devices with integrated hardware and software are used in many industrial applications. It is often the case that the supplier supplies the hardware and basic software for operating a device. The hardware can, for example, be a personal

10 nalcomputer or a compact computer. In many cases, the user will add their own software to the computer. This supplement can consist of simple parameters or entire software parts that are added before the control unit is started up. However, parameters can also be entered, changed or adjusted during operation.

15 den.

Robots, dosing systems, processing, handling or cleaning and sterilization machines can be mentioned as examples of use for electronic control devices. Known control devices are used as finished hardware in the devices mentioned above. The user must

20 then program or configure the desired processes themselves using a meta-language created by the manufacturer, using dynamically linkable libraries (DLLs) or using a human / machine interface. In the case of larger systems, this means that several operations are required to start up the control device in order to start up the system.

25 For example, initialization files must be created and a setup with parameter settings must be carried out. If a defect occurs in the control unit in such a system, it often takes several hours to restart the system after the control unit has been repaired. All settings must be made again. With one on one

In a system based on a personal computer, the parameters are mostly still present on files. Extensive tests may also have to be carried out again to ensure that the system is switched on again. works wall-free. It is often the case that a new control unit, for example, has a newer bios installed, which suddenly does not or is incompatible with the existing software. Operating system user software conflicts can suddenly arise.

The failure of a control unit in environments requiring validation in the pharmaceutical and food industry is particularly serious. Here, the user of a computer-controlled system must be able to guarantee that a repaired control unit will be put back into operation with the exact parameters set at the time of validation. This can only be guaranteed if both the manufacturer software and the parameters are identical. With longer installation procedures, e.g. on personal computers, this can be expensive, since errors can occur during the installation that influence the functionality of the software in such a way that it is still running, but not exactly as it should. This e.g. because a parameter has not been adjusted or because operating system and software components suddenly no longer match. Such errors can only be found through extensive testing. In some cases, a new validation may even be necessary. Under certain circumstances, however, this can take several man weeks.

In order to start up such a complicated system, a specialist is required who on the one hand knows the system well and on the other hand has the necessary knowledge of the control unit. In the case of systems that are far apart from one another, maintenance can be very expensive if a specialist has to travel to do this.

It is therefore the object of the present invention to improve an electronic control device such that the aforementioned disadvantages no longer occur. In particular, it should no longer be necessary to carry out any validation or adjustment work on the new control unit after changing the control unit.

According to the invention, this object is achieved in that, in the case of an electronic control device of the type mentioned at the beginning, at least one there is a second hardware block which can be connected to the first hardware block via a detachable electrical connection, that the at least one second hardware block contains electronic memory elements, the memory elements of the at least one second hardware block being connected when the two hardware blocks are connected are directly connected to the bus system of the first hardware block and that the entire software program for the microcomputer is completely contained in the memory elements of the at least one second hardware block.

The hardware blocks are preferably designed such that the first hardware block is constructed essentially without memory elements and the memory elements are completely accommodated in the at least one of the second hardware blocks. This means that not only the software program for starting (booting), but all computer software is stored in the at least one second hardware block in the memory elements there.

This has the advantage that, in the event of a failure of the control device according to the invention, the first hardware block can simply be exchanged and operated with the at least one second hardware block of the old control device, which contains the software. The new control system continues to run with the absolutely same program code and the absolutely same operating data.

This procedure can be used if it can be assumed that the second or the second hardware blocks are still in perfect condition and do not contain any corrupt data. In order to also protect a defect in the second hardware block, which contains the boot program and other software, a second further hardware block with memory elements can be used at runtime of the control device, on soft online or with a time recording, all software and data of the memory elements of the at least one second hardware blocks are backed up. With the ability to enter the second second hardware block

Creating a backup also results in simple cloning for the creation of identical behavior controls. It is therefore preferably see that a so-called clone can be created on the second second hardware block backup block by means of a control button in the control unit. Such a cloned hardware block can then be used to operate a new, identical controller without the need for installation work, such as initializations, parameter setting, etc.

In order to ensure the correct operation of the control device according to the invention with second hardware blocks, special security mechanisms are provided. These must ensure that only the second hardware block with valid online and program data can boot. If a second hardware block is unsuccessful, the control unit either does not start at all in the event of a data defect or only starts the program again without accepting the data still available in the relevant second hardware block for further processing of the program. In the latter case e.g. a corresponding message is issued to the operator. In such a case, all special settings and the user programs as well as any parameters must be reinstalled or, if this is to be prevented, the backup must be continued with the second hardware block.

Preferred embodiments of the control device of the first hardware block or of the at least one hardware block are listed in the dependent patent claims.

The second hardware blocks preferably correspond to the known PC cards (PCMCIA). The first hardware block is installed in an aluminum housing and is closed from it as completely as possible. Not least in order to nip EMC problems in the bud. A flat front plate made of aluminum serves as a mounting plate. To completely encase the first hardware block, an aluminum cover can be mounted on the front board from behind.

A human / machine interface consists of a display element, preferably an LC display with backlight, from one Trackpad for moving a mouse pointer on the LC display and from some control and operating buttons.

Cold cathode tubes are used as backlighting in LC displays. Since such tubes have a relatively short lifespan, the background lighting of the LC display is controlled by a proximity switch or motion detector which is provided on the front board. The backlight of the LC display is only switched on when there is a person in front of the control unit.

Instead of an LC display and the trackpad, a touchscreen can also be used, in which a certain, appropriately marked area of the screen surface is touched by the operator of the control device to trigger a function.

In order to enable data exchange with a third hardware block, an infrared interface can preferably be arranged on the front board. With this a contactless transmission of data from and to the third hardware block is determined. The third hardware block can be, for example, a keyboard with a corresponding infrared interface. Instead of the infrared interface, a plug can of course also be provided, in which case contactless data transmission is no longer provided in the latter case.

For every second hardware block, i.e. for each PC card, there is an opening in the housing which surrounds the first hardware block, through which an appropriate second hardware block can be plug-connected to the first hardware block.

The aforementioned special security mechanisms in the first hardware block include a parity generator for generating a parity bit per byte or per word, which parity bit for each data byte or each data word or each program word that is present in the at least one second hardware block, there in a special one Storage area is saved. Another security mechanism includes the correct functioning, in particular the supply voltage supply for the second hardware block or the PC cards and a monitoring circuit as to whether a PC card has been replaced at any time, regardless of whether the control device is switched on or off is.

A third security mechanism comprises identification circuits which contain identification data of the corresponding hardware blocks or corresponding removable or plug-in modules installed in hardware blocks. Using the identification data, software can be used to determine whether the entire hardware is correctly constructed and whether the individual assemblies or hardware blocks fit together and match the software.

A more detailed description of the security mechanisms only briefly mentioned here follows later on the occasion of the description of a preferred exemplary embodiment for a control device according to the invention.

Such is described in more detail below, for example, using figures. Show it

1 is an external view of an electronic control unit in an isometric view,

2 shows a block diagram of the control device according to FIG. 1,

Fig. 3 is a block diagram showing the interconnection of several

1 for a multiprocessor system,

Fig. 4 is a flowchart showing the sequence of a first step for starting the control unit, and

Fig. 5 is a flow chart showing a second step to start the control unit. 1 shows the external view of an electronic control device 1 according to the invention. This is surrounded by a metal, all-round closed housing 18, preferably made of aluminum. The metal housing 18 serves to nip EMC problems in the bud. A cost-saving, flat front plate 19, also made of aluminum, serves as a mounting plate. The human / machine interface is essentially built on the front board 19. This consists of a display element 25, which can either be an LC display, preferably a colored LC display, or which can have a touchscreen instead of the LC display. Six software-programmable keys 24 are arranged below the display element 25, to which various functions can be assigned in software. A start button 20 and a stop button 21 for starting and stopping a machine program or a preprogrammed program sequence complete the operating elements. A trackpad 23 is provided, in the case of an LC display 25, to position a mouse pointer at a specific point on the LC display, in order to then start a function shown on the LC display with an execution key 22.

LC displays are backlit to make the display more visible. This consists of a cold cathode tube, which has a relatively short lifespan. According to the invention, a proximity switch 26 or a motion detector 26 is now provided, which only switches on the backlighting of the LC display when an operator approaches. This increases the life of the backlight of the LC display.

In the event that the display element is a touchscreen 25, the

Trackpad 23 and the execution button 22 are not necessary. A certain function or a certain part of the program is started on the touchscreen by the operator touching the screen surface at a certain, predefined point. The human / machine interface can furthermore have a keyboard connection 39, which is intended for connecting, for example, a PC keyboard, with which certain parameters or initialization data can be entered into the control unit 1. An infrared interface 27 can also be provided in order to transmit contactlessly a data transmission from control device 1 to a further device (not shown) with an equivalent infrared interface or vice versa.

A first hardware block 2 (FIG. 2) is accommodated in the interior of the housing 18 of the electronic control unit 1, which is constructed in modules and comprises various modules. At least a second hardware block 8, preferably a data carrier card with the format of a PC card (PCMCIA), can be plug-connected to the first hardware block 2 via an opening 28. Further openings 28 can be provided for plugging and unplugging two further hardware blocks 8, 9.

Reference number 33 shows a first interface, preferably a plug connection, which is intended for the electrical connection of a system which is not visible in the figures and which is to be controlled by control unit 1. A second interface 34, preferably also in the form of a plug, is used to connect the electronic control unit 1 to other electronic control units in order to produce a multiprocessor system.

The control device 1 according to the invention is shown in block diagram form in FIG. 2. It essentially comprises the already mentioned first hardware block 2 installed in the housing 18 and at least one or more second hardware blocks 8, 9, which can be connected to the first hardware block 2 via plug connections 10, 11.

The first hardware block 2 is constructed in modules and comprises various peripheral modules 37, such as a real-time clock, an LC display, an interface for a touchscreen, an interface for connecting a keyboard, a fieldbus interface, an analog / digital converter, one Digital / analog converter, an acoustic system, serial and parallel interfaces as well as digital inputs and outputs. This list is not exhaustive or exhaustive. Depending on the application of the control unit, individual assemblies can be omitted or others that are not called peripheral modules are used. Each peripheral module is connected to the microcomputer module 3 in a known manner via a bus system 4 consisting of at least one address bus 6, a data bus 5 and a control bus 7. In a special unit 40 (Gluelogic) the necessary signal processing such as chip select and interrupt requests are carried out. There are microprocessors that have already integrated this special unit 40. In this case, it would no longer have to be set up externally.

As already mentioned, the bus system 4 has an address bus 6, a data bus 5 and a control bus 7. The data transmission between the microprocessor 3, on the motherboard of the first hardware block 2 existing modules 35, 36, a peripheral module 37 or the second hardware blocks 8, 9 takes place in a known manner as follows: to the desired module 35, 36 or the desired peripheral module 37 a specific address is created by the microprocessor 3, with which the module or the peripheral module is selected. The signals on the control bus are now used to exchange data in both directions between the selected component or the selected peripheral module and the microprocessor via the data bus. The control bus 7 leads through the special unit 40, the Gluelogic, in the block diagram. In some cases, signals are carried out directly or signals from the control bus are used to generate further control bus signals. The mode of operation of the Gluelogic 40 is known and is therefore not described further here. Other existing modules 29, 30 are not addressed with addresses, but directly via module 35 (digital ON / OFF module). This is done via discrete lines.

In the block diagram of FIG. 2, the interrupt system is routed via another separate bus connection 41. The gluelogic 40, to which the interrupt bus 41 is connected, decodes an interrupt request from various sources and forwards it to the microprocessor 3 in a suitable format.

For the sake of clarity and simplicity, a watchdog system has been completely omitted from the block diagram. Such a system may also be assumed to be known. It is absolutely necessary for an industrial control unit.

The hardware described so far corresponds to the microprocessor systems commonly used to control devices and machines. A more detailed description is therefore not given.

In addition to the previously described, generally customary hardware assemblies, there are additional assemblies which are new and characteristic of the electronic control device according to the invention described here. These are the second hardware blocks 8, 9, which are constructed as PC cards and essentially only comprise memory elements 12, 13, 14, 15, 16 as I O data carrier cards.

Furthermore, a monitoring circuit 29 for monitoring whether the second hardware blocks 8, 9 have been plugged in or changed at any time is provided on the motherboard of the first hardware block 2, and a further monitoring circuit 30 for monitoring the correct voltage supply , in particular the second hardware blocks 8, 9. In addition, a parity generator module 36 is provided, which, as will be described later, is used to detect corrupt data. Hardware identification circuits 38 in each removable module, 0 for determining whether all the necessary, provided modules are present and correspond to the required type, further increase the operational safety of the electronic control device according to the invention.

The assemblies and components mentioned last are described in more detail below.

5 The second hardware blocks 8, 9, which are preferably in the PC card

Format (PCMCIA) and housed in a PC card housing are designed as data carrier cards in the present exemplary embodiment and essentially comprise the memory elements 12, 13, 14, 15 and 16. The memory element 12 is designed as RAM memory, the memory 0 elements 13, 16 as non-volatile EEPROM memory or flash memory and the memory elements 14, 15 are again constructed as RAM memories. Furthermore, every second hardware block 8, 9 comprises an identification circuit 38, which, as already mentioned briefly above, contains identification data with which it can be determined whether the correct second hardware block 8, 9 is connected to the first hardware block 2 at the correct location is. Furthermore, every second hardware block 8, 9 comprises its own voltage supply circuit 17, in which a buffer element for temporarily holding the data stored in the RAM memories 12, 14, 15 determines when the second hardware block 8, 9 is pulled out is. The buffer element can be a capacitor, a battery or an accumulator. A battery is preferably used. This guarantees data retention over a longer period of time, so that second hardware blocks can easily be sent from the supplier to a customer without loss of data.

Typical and advantageous for the electronic according to the invention

The control device is that the second hardware blocks 8, 9, the data carrier cards, are connected directly to the bus system of the microcomputer 3 of the first hardware block 2 via connecting plugs 10, 11, which can be PC card standard plugs. In the first hardware block 2 itself, essentially no memory elements are required. The software, the boot and user programs, parameters, initial data and other data are completely contained in the memory elements of the second hardware block 8, all program code preferably being stored in the flash memory 13, that is to say in a non-volatile memory element is. Since the second hardware blocks 8, 9 are connected directly to the bus system 4 of the microcomputer 3 without an interface, the control device can be started from one of the second hardware blocks 8. This with the advantages mentioned at the beginning.

In the first second hardware block 8, which in the example shown represents a boot card, in the case of the mixed construction of the memory elements from flash memory or EE-PROM and RAM, the data which are already known at the time of the programming are preferably in the EE in addition to the program code -PROM or flash memory housed while in RAM Data are stored which are generated during the operation of the control device.

If the correct supply voltages on the boat card are adhered to, it can be guaranteed that the same card will continue to run with a different control unit with both the same program code and the same run-time data.

In addition to the boot card 8, there is advantageously a second second hardware block 9, the so-called backup card. This is inserted into the housing 18 of the control unit via a second opening 28 and connected to the first hardware block 2 with the plug 11. The backup card is constructed in exactly the same way as the boot card and is intended so that, at the operator's request, the contents of the various memory elements 12, 13, 14, 15, 16 of the boot card 8 can be mapped onto the identical memory elements 12, 13 at a certain point in time , 14, 15, 16 of the backup card 9 can be created. Alternatively, a memory map can also be created and carried along permanently. In the latter case, during operation of the control device, both cards 8, 9 are written to simultaneously in each write cycle of the microcomputer 3. Only the boat card 8 is read in each case. At certain, predetermined intervals, an instantaneous comparison of the two cards 8, 9 can be carried out. In the event of a fault, a warning, for example an acoustic or optical signal, can be issued.

As already mentioned above, each hardware module, which is not permanently connected to the motherboard of the first hardware block 2, comprises an identification circuit 38. This essentially has a non-volatile memory element, for example an EE-PROM, in which a module number, a serial number , a manufacturing date and calibration data or, depending on the module, other data are entered. The hardware module can be clearly identified with the identification data. The hardware parts are fully traceable. The individual identification circuits 38 are connected to one another by their own bus 42, the identification bus, and end digitally on / off on the module 35, via which the identification data of the individual modules 2, 8, 9, 37 can be called up by the microcomputer 3 and processed further. The identification data of the individual modules are determined during production and permanently programmed. Checksums can also be used to increase data security. The identification system is based on a single address which is predefined and which must be the same for all variants of first hardware blocks 2 to which the second hardware blocks 8, 9 are intended to match. This address is that of the digital on / off module 35. The software uses this module to access the identification system. The address of the named block is the gateway to the description of the hardware configuration. Through this gate, all connected hardware modules can be addressed via identification bus 42.

All pluggable hardware modules 8, 9, 37 and the basic circuit board of the first hardware block 2 receive a unique type identification after manufacture. This enables the user software to recognize the entire hardware configuration by querying all the existing identification circuits 38. When defined, the first identification circuit 38 is always the identification circuit 38 of the motherboard of the first hardware block 2. In this circuit, e.g. in the form of a list, all addresses or chipselect settings of the slots on the motherboard for the hardware modules 8, 9, 37 and the associated identification circuit addresses. By addressing the identification circuit addresses, the software can find out where which additional hardware is plugged in. After all identification modules have been read in, the software is completely familiar with the configuration of the present hardware. It can also find out whether it even fits the hardware configuration found. It also finds out whether a module has been replaced in the meantime, namely when the current identification data are stored in one of the memory elements 12 of one of the second hardware blocks 8, 9 during each boot process.

To increase data security, data storage areas in the second hardware blocks 8, 9 with additional storage elements 14, 15, 16 equipped for storing parity bits. These are generated in the block parity bit generator 36. For data words from the flash memory 13 of the second hardware block 8, parity is generated over 16 bits each and for the RAM memory 12 of the second hardware block 8 over 8 bits or byte-by-byte, since this memory can also be written and read byte-by-byte.

For each bus cycle that accesses the memory elements 12, 13, a parity bit is generated per byte or per word. In the case of a write cycle, the parity bit is written into the corresponding parity memory 14, 15, 16. In the case of a read cycle, the existing parity bit stored at the corresponding address is compared with the newly generated one. In the event of an error, a signal is generated which stores the error and triggers a parity error signal 43.

The parity generator 36 is equipped with an additional buffer in order to detect a double parity error. It is thus possible, in the case of a simple error, to find out by software in which memory area the error is located. A simple error exists if e.g. a single bit changes its state illegally or if the area in which the software for examining and displaying the parity error is not affected by errors. In the event of a double parity error, a reset must be triggered and maintained. In this case, it must be assumed that neither an executable program code nor consistent data are present in the memory area. The double parity error 56 must be cleared by switching control unit 1 off and on again. However, the double parity error can only be remedied by using a new corresponding hardware block or a new boot card 8. For this purpose, the backup card 9 can be used, for example.

In order to further increase the functional reliability of the control device according to the invention, the monitoring circuit 29 is provided, which is intended in particular for recognizing a change in one of the second hardware blocks 8, 9 during operation or outside the operation of control device 1. The task of the monitoring circuit 29 is, more precisely in other words, to recognize at any time whether a second hardware block, in our example the boot card 8, or the backup card 9 is present, whether one or both of these cards have been inserted and reinserted or replaced, and whether these cards have their own correct supply voltage. gene.

The monitoring circuit 29 is on the one hand via the software and on the other hand by signals 57, 58 (boot card unplugged, backup card unplugged), 59, 60 (monitoring of the boot card voltage or backup card voltage) of the second hardware blocks 8, 9 controlled. The signals come from the monitoring circuit 29 via signal lines 48, 49 (boot card 8 changed, backup card 9 changed) 50, 51 (information voltage supply boot card or backup card) via the digital on / off Module 35 for further processing in the microcomputer 3. With digital outputs of the digital on / off module 35, the monitoring circuit can be reset via software if necessary via lines 44, 45 (reset signal boot card changed or backup card changed) become.

A change of one or more of the second hardware blocks 8, 9, in particular the boot card 8, should only take place when the control device is switched off. The removal of the boot card is recognized with a signal 57 (boot card not inserted). The monitoring circuit 29 reports this event via a signal 46 (no boot card) to the further monitoring circuit 30, which triggers a reset signal 32. As long as no boot card 8 is inserted, the further monitoring circuit 30 cannot release the reset signal 32. Therefore, the control unit 1 will never start without a boot card 8.

The monitoring circuit 29 reports an unplugged boot card 8 or backup card 9 to the digital ON / OFF circuit 35 via the signal lines 48, 49. The state of the two signals on the lines mentioned remains stored in the monitoring circuit 29. The signals mentioned on lines 48, 49 are reset via signals 44, 45. Since the monitoring circuit 29 must recognize and save a change of the cards 8, 9 even when the device is switched off, a system battery 47 is present in the first hardware block 2, which also supplies the monitoring circuit 29 with voltage via one of the lines 31 (5 VRT). worries.

If the voltage of the system battery 47 is too low when the control device 1 is switched off, the monitoring circuits 29, 30 can no longer work correctly. The status of the system battery 47 is monitored by the further monitoring circuit 30. In the event of an error, a signal 52 changes its level. When a new battery is reinserted, the signal 52 mentioned has to change back to the original levels with a delay. With this level change, the signals 48, 49 are set to TRUE and the state of the batteries 17 of the boot card 8 and the backup card 9 is recorded with the signals 50 and 51. For this purpose, the voltages of the boot card 8 and the backup card 9 are measured via the signal lines 59, 60 (voltage of the boot card 8 or voltage of the backup card 9) by the monitoring circuit 29.

Signals 48, 49 (boot card changed, backup card changed) are set when the card has been changed. Each time the card is changed, the battery 17 of the card 8, 9 concerned is automatically measured. In order not to load the battery unnecessarily long, the measurement is only carried out for a short time. Therefore, after a booting process, the signals 50, 51 indicate the state of the corresponding card battery 17 at the time of changing one of the cards 8, 9. As long as the cards 8, 9 are inserted, the voltage supply is taken over by the system battery 47 via the lines 31. By setting a signal 61 (measure card voltage), the microcomputer module 3 can request a measurement of the state of the batteries 17 of the second hardware blocks 8, 9 via the digital ON / OFF module 35. The signals 50, 51 are then set accordingly and remain stored.

The further monitoring circuit 30 is the last link in the safety chain of the control device according to the invention. This building block summarizes the generation of the supply voltage (5 V) and the voltage for the non-volatile data storage (5 VRT), the generation of the reset signal 32 and a reset signal 52 for the monitoring circuit 29. The module 30 further contains a battery voltage monitoring unit. In the switched-off state, the further monitoring circuit 30 continuously monitors the voltage of the system battery 47. If the voltage is lost, ie if the voltage level drops below a minimum value, after the correct voltage has been restored, a signal 65 (battery error) will remain as true when the device is switched off until it is signaled by the software via another signal 64 (reset battery error) is reset. In the switched-on state of the control device 1, software can be used via a line

62 (measurement of the battery voltage) a measurement of the system battery voltage can be triggered. The result comes from another signal line

63 (battery voltage ok) in the digital ON / OFF circuit and can be read there by software. The measurement only takes a short time to complete the

To protect system battery 47 accordingly.

As long as the signal 46 (no boot card) is active, the reset signal 32 remains active and at the same time an output 53 fatal system error is set and an acoustic or optical warning signal 54 is triggered.

FIG. 3 shows how a plurality of control units 1 connect to one another via a multi-port RAM 55 via the built-in second interfaces 34, to which the address bus 6, the data bus 5 and the control bus 7 of the bus system 4 are each connected can be connected to a multiprocessor system. This type of connection is known and therefore need not be described further here.

The control device 1 according to the invention must be started (booted) using a special procedure. This is because the correct functioning is ensured via a chain of various monitoring or safety circuits 29, 30, 35, 36, 37, 38. Starting the device can be roughly divided into two steps. A first boot step is shown in the flow diagram of FIG. 4. It is based on the detection of a boot card 8 and the non-occurrence of a double parity error. In order to be able to detect a parity error at all, the software must first be started. After starting up

5 the hardware is checked by the software as described above. That is, it is checked with the aid of the predetermined and fixed address of the digital on / off module 36 whether the cards 8, 9 have not been changed and whether the battery voltages are sufficiently high. If something is wrong, an operator dialog is automatically switched on and displayed on the display unit 25.

In a second boot step, which is shown in the flowchart in FIG. 5, it is checked whether the software in the existing boot card 8 fits the recognized and checked hardware configuration. This is done by querying all identification circuits 38 of the system.

15 The heart of the control device 1 according to the invention is the boot card 8. In order to be able to operate the control device at all, a consistent boot card must be present. The boot card must contain an executable program code with correctly set parity in the addressed memory area 13, 14, 15, 16 (flash memory, parity memory). This can only be achieved by first of all writing the boot card with a boot program during the manufacturing process. In the description, the parity is automatically set for the first time for all the memory locations described. During a subsequent reading while the card is in operation, a parity error can no longer occur, except when the memory is defective. A boot card booted up in this way is considered to be consistent. The system can be booted with it. During normal operation, the parity bit is automatically generated and stored online by the parity generator 36 with each word stored, or is compared with the existing parity.

0

Claims

claims

1. Electronic control unit (1), with a first hardware block (2) with a microcomputer (3), which works together with a software program, with a bus system (4) with at least one address bus (6), data bus (5) and a control bus (7), characterized in that there is at least one second hardware block (8, 9) which can be connected to the first hardware block (2) via a detachable electrical connection (10, 11) such that the at least one a second hardware block (8, 9) contains electronic storage elements (12, 13, 14, 15, 16), the storage elements (12, 13, 14, 15, 16) of the at least one second hardware block (8, 9) are connected directly to the bus system (4) of the first hardware block (2) and that the entire software program for the microcomputer (3) is completely in the memory elements (12, 13) of the at least one second hardware blocks (8, 9) is included.

2. Control device according to claim 1, characterized in that the at least one second hardware block is a data carrier card (8, 9), the dimensions of which correspond to the PC card format (PCMCIA).

3. Control device according to claim 1 or 2, characterized in that at least some of the memory elements (12, 14, 15, 16) of the second hardware block (8, 9) are buffered with a buffer element (17), the buffer element being a battery, is an accumulator or a capacitor.

4. Control device according to one of claims 1 to 3, characterized in that the first hardware block (2) of a metal housing (18), preferably made of aluminum, is substantially completely surrounded, with one side of the housing (18) as Front board (19) is formed, on which operating elements (20, 21, 22, 23, 24) and at least one display element (25) are arranged.

5. Control device according to claim 4, characterized in that the display element is an LC display (25), that a trackpad (23) is present for moving a mouse pointer on the LC display and that for triggering a function on which the mouse pointer is directed, an execution button (22) is present.

6. Control device according to claim 4 or 5, characterized in that on the front board (19) there is a proximity switch (26) which is intended to switch on a backlighting of the display element (25) when a person is present.

7. Control device according to claim 4, characterized in that the

The display element is a touch screen (25), in which a certain, appropriately marked area of the screen surface is touched by the operator of the control device to trigger a function.

8. Control device according to one of claims 4 to 7, characterized in that an infrared interface (27) is arranged on the front board (19), which is intended for contactless transmission of data from and to a third hardware block.

9. Control device according to one of claims 4 to 8, characterized gekenn¬ characterized in that for every second hardware block (8, 9) there is an opening (28) in the housing (18) through which one of the second hardware blocks (8, 9) can be connected to the first hardware block (2), in particular via a plug arrangement (10, 11).

10. Control device according to one of claims 1 to 9, characterized in that at least one of the second hardware blocks (8, 9) comprises a memory (14, 15, 16) in which a byte or word-by-word storage of a parity Bits per byte or word of a data storage area (12) and / or a program storage area (13) of the corresponding second hardware block (8, 9) is provided.

11. Control device according to one of claims 1 to 10, characterized ge indicates that at least one of the second hardware blocks (8, 9) comprises an energy-independent, non-volatile memory (13, 38), in which data for the unique identification of the corresponding second hard - Wareblocks (8, 9) are present.

12. Control device according to one of claims 2 to 11, characterized ge indicates that one of the second hardware blocks (8) is a boot card and another of the second hardware blocks (9) is a backup card, wherein on the backup card ( 9) either at the operator's request, an image of the memory element or elements (12, 13, 14, 15, 16) of the boot card (8) can be created, or that an image is permanently carried with each change in the memory content of the boot card (8) .

13. Control device according to one of claims 1 to 12, characterized in that a monitoring circuit (29) for detecting a change of one of the second hardware blocks (8, 9) is present in the first hardware block (2) and that the monitoring circuit (29) is also intended to identify a correct or incorrect supply voltage supply for the second hardware blocks (2).

14. Control device according to one of claims 1 to 13, character- ized in that a further monitoring circuit (30) for generating and monitoring the supply voltages (31) for the second hardware blocks (8, 9) is present, this circuit (30) in the event of a faulty supply voltage (31), a reset signal (32) is intended for resetting to an initial state of the first hardware block (2) and the second hardware block (8, 9).

15. Control device according to one of claims 1 to 14, characterized ge indicates that the first hardware block (2) has a first interface (33), via which the control device can be connected to a system to be controlled.

16. Control device according to one of claims 1 to 15, characterized ge indicates that the first hardware block (2) has a second interface (34), which for creating a multiprocessor system with second interfaces (34) of further first hardware blocks (2) of others Control device (1) can be interconnected.

17. Control device according to one of claims 1 to 16, characterized ge indicates that the first hardware block (2) is built up in modules, with each assembly (2, 37) each having an identification circuit (38) and each second Hardware block (8, 9) should also be considered as a module and has an identification circuit (38) that when the control unit (1) is started (booted) in a first step using the identification circuits (38) in the second hardware blocks (8, 9) the check is carried out as to whether one of the second hardware blocks (8, 9) has been replaced, whether all the modules (2, 8, 9, 37) specified in advance are present and that in a second step there is a check as to whether the software in at least one of the existing second hardware blocks (8, 9) matches the existing modules (2, 8, 9, 37).