DE102018112584A1 - Configurable sensor device and method for monitoring its configuration - Google Patents

Abstract

The invention relates to the monitoring of the configuration of a sensor device that can be configured by means of configuration data stored in a volatile data memory, in particular a configurable ultrasonic sensor device. Specifically, the invention relates to a corresponding method, to a corresponding sensor device configured for carrying out the method, and to a computer program for carrying out the method on the sensor device. The method comprises: reading configuration data stored in a volatile data memory by a data source to configure the sensor device; Calculating at least one initial check value according to a predetermined error detection coding method from the read configuration data and storing the at least one initial check value in the data memory; Detecting an occurrence of a predetermined trigger event and in response thereto: recalculating the at least one check value from the configuration data stored in the data memory in accordance with the error detection coding method, comparing the newly calculated at least one check value with the respectively corresponding initial check value previously stored in the data memory to determine a monitoring result depending on the result of the comparison, and providing the monitoring result.

Description

The present invention relates to the monitoring of the configuration of a sensor device that can be configured by means of configuration data stored in a volatile data memory, in particular a configurable ultrasonic sensor device. Specifically, the invention relates to a corresponding method, to a corresponding sensor device configured for carrying out the method, and to a computer program for carrying out the method on the sensor device.

In addition to the group of non-configurable sensors, the properties of which are fixed at least essentially unchangeable already during their production, a further group of sensors is known whose properties, in particular their functionality, can be dynamically configured. This can be done, in particular, by changing corresponding configuration parameters determining the configuration of the respective sensor, which can be present in particular in the form of configuration data. An example of such configurable sensor devices are motor vehicle parking assistance systems based on ultrasound technology, and in which the functionality of ultrasound sensors of the sensor device is determined in dependence on variable configuration parameters. For example, the frequency with which an ultrasonic sensor emits an acoustic signal can be changed in some sensor devices by means of a variably adjustable parameterization. Thus, by means of such a parameterization, in particular different operating modes can be set, such as a first operating mode in which the ultrasonic sensor emits ultrasonic signals for the purpose of distance measurement and senses the detection of ultrasonic signals reflected on objects, and a second operating mode in which instead signals for humans or certain Audible range, such as for warning purposes. Another motor vehicle-related operating mode can be, for example, that the ultrasound-based distance measurement is linked to an automatic braking function of the motor vehicle to allow automatic emergency braking. An operating mode in which a message transmission is effected by means of modulation, in particular frequency modulation, of the transmitted signal is also possible.

The more complex the different functions to be carried out by the sensor device, the more extensive is typically the parameterization required for their configuration in the form of corresponding configuration data.

In some cases, such configurable sensor devices are used in safety-related applications, such as in vehicle distance measurement systems, such as in ultrasound-based parking assistance systems or emergency braking systems. Such systems require, in particular in the field of motor vehicle technology, a corresponding safety classification, for example in accordance with the so-called "Automotive Safety Integrity Level (ASIL)" scheme (a risk classification scheme defined in the international standard ISO 26262) in order to obtain an authorization.

In many industries, especially in the automotive industry, sensor devices are typically subject to a constant high cost pressure. It is therefore generally necessary to design sensor devices on the one hand as cost-effectively as possible and on the other hand at least as securely and reliably as required for a corresponding successful approval.

It is an object of the present invention to further improve the safety and reliability of configurable sensor devices, particularly ultrasound-based sensor devices, in an efficient manner.

The solution to this problem is achieved according to the teaching of the independent claims. Various embodiments and modifications of the invention are subject of the dependent claims.

A first aspect of the invention relates to a method for monitoring the configuration of a configurable sensor device, in particular a configurable ultrasonic sensor device, the method comprising: (i) reading configuration data stored in a volatile data memory by a data source to configure the sensor device; (ii) calculating at least one initial check value according to a predetermined error detection coding method from the read configuration data and storing the at least one initial check value in the data memory; (ii) detecting an occurrence of a predetermined triggering event and in response thereto: (iii-1) recalculating the at least one check value from the configuration data stored in the data memory according to the error detection coding method, (iii-2) comparing the newly calculated at least one check value with the respectively corresponding initial check value previously stored in the data memory for determining a monitoring result as a function of the result of the comparison, and (iii-3) providing the monitoring result.

In particular, the data source can be a control unit of a vehicle (electronic control unit, ECU) which can use the sensor device, but in any case can configure it. As a volatile data memory in particular a random access memory (English Random Access Memory, RAM) is in question.

In the sense of the invention, an "error recognition coding method" is to be understood as meaning a coding method for coding data with the aid of which at least one error occurring in the data, for example an altered data bit, can be detected. Optionally, the coding method can additionally have an error correction capability and thus at the same time be an error correction (coding) method (English Error Correction Coding, ECC). Such methods for detecting or correcting data errors occurring during the transmission of data over a channel (which may also include the storage of data in and the reading out of data from a memory) are known in particular in the field of telecommunications channel coding. These methods are based on adding data-generated redundancy to the data prior to their transmission over the channel, by means of which they are checked at the receiver end by determining and evaluating a check value from the received data including redundancy, or at least to some extent whether the received data correspond to the originally transmitted data or whether at least one data error, for example with respect to a single bit in a binary data representation, has occurred during the transmission. In the case where the channel is or includes a data store, sending data is equivalent to writing the data to the data store and communicating data over the channel to the combination of such writing data and subsequently reading that previously written data from the data store. Although not to be construed as limiting, an example of such an ECC method may be the Bose-Chaudhuri-Hocquenghem (BCH) method, which is particularly related to the storage and retrieval of data from a data store often used error correction method.

By means of the method according to the first aspect of the invention, it is possible in a fast and particularly efficient manner to monitor the integrity (in the sense of information security) of the configuration data of a configurable sensor device. In particular, this is also possible in a cost-effective manner, since the monitoring only requires a one-time data transmission of the configuration data from the data source, including a narrow-band and therefore cost-effective communication connection, for example a "1-wire" connection limited to the minimum required for line-bound data transmission, can be used. Also, unlike known configurable sensor devices which use slower and more complex and thus usually more expensive memory types, especially non-volatile memories (NVM) such as flash memories, such can be dispensed with, as in the method only one volatile one Memory is needed.

In addition, a transmission of information to the data source or another communication counterparty is required only if a data error was detected during the monitoring. The method thus makes it possible to dynamically change the configuration of the sensor device without the need to have different sets of configuration parameters stored in the data memory at the same time. Also, the size of the data store, which is also cost-relevant, can be kept low. At the same time, the proposed solution, by means of the monitoring data stored in the volatile memory, enables the attainment and maintenance of required safety and reliability levels, possibly safety-related faulty configurations of the monitored sensor device, in particular before its further use (whose request can be defined in particular as a trigger event ) can be recognized and responded to.

In the following, preferred embodiments of the method will be described which, unless expressly excluded or technically impossible, may be combined as desired with one another as well as with the other described aspects of the invention.

In some embodiments, reading the configuration data stored in the data memory from the data source is at least partially from a first defined physical memory area of the data memory. In addition, the first test value is stored in a second physical memory area of the data memory that is functionally decoupled from the first memory area. In this way, the likelihood is reduced that both the configuration data, as well as the initial test value (or possibly several initial test values) are corrupted at the same time, for example by a partial failure or malfunction of the data memory itself or by an external influence acting only locally in data memory , For example, a heat or radiation effect on individual portions of the memory. The various physical storage areas that are "decoupled" within the meaning of the invention can be used in particular be defined by different physical memory blocks, sectors or pages of the data memory subdivided into such memory units, so that a defect, especially in the first memory area, does not affect the function of the second memory area, and vice versa.

In some embodiments, reading the configuration data is block-wise with respect to separate data blocks. Likewise, the calculation of an initial check value is performed in blocks on the basis of these individual data blocks, wherein an associated initial check value is calculated from each of these data blocks and stored separately in the data memory. The determination and provision of the monitoring result also takes place in blocks on the basis of these individual data blocks, wherein for each of the data blocks stored in the data memory an associated test value from this particular data block is recalculated according to the error detection coding method and this newly calculated test value with the corresponding, previously stored in the data memory initial test value is compared and an individual monitoring result associated with the data block is determined and provided as a function of the result of this comparison.

This treatment of the data block-based configuration data can bring a number of different advantages. So it is for example possible to change the configuration data only in terms of data blocks, if the configuration is to be modified, which can bring a smaller amount of data required to transfer data from the data source and thus both a speed gain and a security gain, since not the whole Set of configuration data must be transmitted and stored. This also reduces the probability of a data error occurring in the data stored in the data memory. Furthermore, the monitoring can also be performed on a data block basis, so that, in particular, depending on the application, only those data blocks which are relevant, for example, for a mode of operation currently in use or a soon to be provided operating mode are monitored. Also, the error detection coding method may be performed on a data block basis, whereby, in certain applications or in the case of only selective modifications of the configuration data on a data block basis, unnecessary (de-) coding calculations with respect to other data blocks can be avoided. In addition, the ratio of user data (ie configuration data) and redundancy information can be set individually on a data block basis. For example, in the case of data blocks which are assigned to particularly safety-relevant operating modes, the redundancy information takes up a greater proportion in relation to the configuration data in order to achieve increased safety and possibly error correction capability, while for other data blocks that result in less safety-critical operating modes can be the other way around, which can then result in more complex configurations based on a larger portion of configuration data.

In some embodiments, the predetermined error detection coding method includes a cyclic redundancy check, CRC, for at least one of the check values. The use of CRC is a particularly efficient and scalable way to implement an error detection coding method and even an ECC method, which is characterized in particular by low computational effort, and thus by the possibility of a particularly efficient and thus cost-effective and high-performance implementation. In particular, the CRC coding is particularly suitable for a hardware-based implementation, that is to say by means of a corresponding hard-wired circuit instead of a variably deployable microprocessor, which may entail cost, space and / or performance advantages in particular.

In some embodiments, the method further comprises: (i) receiving at least one derived check value transmitted by the data source previously derived from the configuration data communicated from the data source to the data store for storage therein according to the predetermined error detection coding method; (ii) comparing this received check value with the corresponding check value calculated from the configuration data read from the data store; and (iii) detecting a transmission error if a deviation of the compared test values occurs in this comparison according to a predetermined test criterion. In this way, the security and reliability achievable by means of the monitoring can be further increased, since not only the configuration data already stored in the data memory are monitored, but the configuration data transmitted by the data source to the data memory during writing are already checked to see if they are error-free transmitted to the data store and stored therein. Thus, the case is also ensured that, although no errors occur in the data memory itself with respect to the configuration data stored therein, but this configuration data already before the transmission process of the data source suffered a faulty modification.

Based on this, in some embodiments, when a transmission error is detected, at least one request is sent to the data source for re-storing the configuration data in the data memory and / or retransmitting the at least one derived test value. In this way, such errors that typically occur as a non-systematically repeating single-fault can be repaired by re-transmission to and storage of the configuration data in the data storage in a simple and automated manner, especially during the process itself, without requiring an external maintenance or a temporary deactivation of the sensor device would be. If the error occurs again, however, other security measures, such as the aforementioned deactivation, can be initiated instead.

In some embodiments, the provision of the monitoring result by means of storing monitoring data characterizing the monitoring result takes place in the data memory. In this way, the data memory as at least part of a communication channel in the opposite direction, for example, with the data source or another dependent on the monitoring result function unit that has at least read access to the data memory, can be used as a receiver. In this way, it is possible to dispense with an additional communication connection to be used for data transmission in this opposite direction, for example by means of a dedicated communication line, and instead use the already existing data memory as the communication channel, which enables further efficiency gains, in particular with regard to space requirements and costs. The monitoring data can be stored in the data memory, in particular in the form of one or more status flags, which are preferably each represented by a single bit in the data memory, which represents a particularly efficient, especially space-saving variant.

In some embodiments, the triggering event is determined by, or by a combination of, at least two of: (i) a sensory measurement request to be made by the sensor device; (ii) a lapse of a certain amount of time since the last trigger event or activation of the sensor device; (iii) receipt of a trigger signal, which may originate in particular from the data source; (iv) a time schedule defining a plurality of trigger events; (v) occurrence of a predetermined state of the sensor device; (vi) an occurrence of measurement results satisfying a predetermined trigger criterion when performing a sensory measurement by the sensor device. In this way, depending on the variant, it is possible to trigger the monitoring continuously or only at predetermined, in particular safety-relevant, times or when certain situations and conditions occur, and thus to achieve an application-specific configuration of the monitoring itself. In particular, as in variant (i), the trigger event may be defined such that each measurement made by the sensor device immediately precedes monitoring of the configuration data in the data memory, whereby the safety and reliability of the sensor device can be optimized.

In some embodiments, in the event that the monitoring result indicates a deviation of the initial check value from the recalculated check value, one of the following measures or a combination of at least two of these actions is triggered: (i) transferring the sensor device from an operating state to a deactivated state, failing to comply with a received request for a sensory measurement to be made by the sensor device; (ii) requesting reinitialization by transmitting a corresponding request to the data source; (iii) Output an error message. All of these measures have in common that in response to a negative monitoring result, a safety-relevant reaction to establish a safe state is initiated, in order to ensure the required safety even in the event of a fault. In particular, the error message may be output at a data interface, such as a data interface to the data source, and / or at a man-machine interface, which need not be part of the sensor device itself.

A second aspect of the invention relates to a configuration monitoring device for monitoring the configuration of a configurable sensor device, in particular a configurable ultrasonic sensor device, wherein the configuration monitoring device is set up to carry out the method according to the first aspect. In particular, it may be arranged to carry out this method in accordance with one or more of the associated embodiments described herein.

In the following, preferred embodiments of the configuration monitoring device will be described which, unless expressly excluded or technically impossible, may be combined as desired with each other and with one or more of the other aspects of the invention described herein.

In some embodiments, the configuration monitoring device is configured to use the predetermined error detection coding method both for monitoring the configuration of a configurable sensor device in accordance with the method and also for securing a communication connection with the data source and / or another communication counterparty. In this way, an existing implementation of the error detection coding method, for example in software and / or hardware can be used in two ways ("dual-use"), so that it is possible to achieve further efficiency gains, in particular again from a space and cost perspective, while at the same time the securing of the data transmission over the communication connection as well as the monitoring of the data stored in the data storage configuration data is achieved.

In some embodiments, the configuration monitoring device is embodied as an integrated unit, in particular as an integrated circuit (IC), for example as an application-specific IC (ASIC). This allows a particularly space and cost-saving, and thus efficient implementation, in particular, an integration of the device in a one or more sensors having sensor device that is subject to demanding size limitations allows.

A third aspect of the invention relates to a configurable sensor device comprising: (i) at least one sensor configurable by means of volatile data memory configuration data; and (ii) a configuration monitoring device according to the second aspect of the invention for monitoring the configuration effected by the held configuration data. In this way, a particularly high degree of integration and thus, in particular, high space efficiency can be achieved in that, in addition to the at least one sensor, the sensor device itself also contains the configuration monitoring device required for carrying out the method. The sensor device can in particular be designed as an integrated unit, for example as a sensor module that can be integrated as a whole.

In addition, in some embodiments, the data source, which may in particular be a control unit (ECU), may also be part of the sensor device and in particular may also be part of the said integrated unit.

Finally, a fourth aspect of the invention relates to a computer program comprising instructions which, when executed on a configuration monitoring device according to the second aspect or a sensor device according to the third aspect, cause them to carry out the method according to the first aspect of the invention. The computer program may in particular be stored on a nonvolatile data carrier. This is preferably a data carrier in the form of an optical data carrier or a flash memory module. This can be advantageous if the computer program as such is to be handled independently of a processor platform on which the one or more programs are to be executed. In another implementation, the computer program may be downloadable as a file on a computing device, particularly on a server, and may be downloadable via a data link, such as the Internet or a dedicated data link, such as a proprietary or local area network. In other embodiments, the computer program is permanently integrated in the configuration monitoring device and stored, for example, in a read only memory (ROM) or only once programmable memory (OTP) stored data memory. In addition, the computer program may have a plurality of cooperating individual program modules.

The features and advantages explained in relation to the first aspect of the invention also apply correspondingly to the further aspects of the invention.

Further advantages, features and possible applications of the present invention will become apparent from the following detailed description taken in conjunction with the figures.

• 1 in schematischer Blockbilddarstellung und in verschiedenen Integrationsgraden ein konfigurierbares Sensorsystem mit einem Steuergerät, einem flüchtigen Datenspeicher, einer durch in dem Datenspeicher abgelegte Konfigurationsdaten konfigurierbare Sensoranordnung sowie eine Konfigurationsüberwachungsvorrichtung zur Überwachung der in dem Datenspeicher abgelegten Konfigurationsdaten, gemäß einer Ausführungsform der Erfindung; und
• die 2 bis 4 unter Bezugnahme auf das Sensorsystem aus 1 eine schematische Illustration eines Verfahrens gemäß einer Ausführungsform der Erfindung.

Show

• 1 a schematic block diagram representation and in different degrees of integration a configurable sensor system with a control unit, a volatile data memory, a configurable by stored in the data storage configuration data sensor arrangement and a configuration monitoring device for monitoring the stored in the data storage configuration data, according to an embodiment of the invention; and
• the 2 to 4 with reference to the sensor system 1 a schematic illustration of a method according to an embodiment of the invention.

Throughout the figures, the same reference numerals are used for the same or corresponding elements of the invention.

This in 1 illustrated sensor system 1 has a sensor arrangement 4 with at least one sensor. The sensor (s) may be in particular an ultrasonic sensor arrangement for a motor vehicle, for example for a distance measuring system, in particular parking assistance system act. Furthermore, the sensor system 1 a volatile data store 5 , in particular of the RAM type, which among other things is intended to store configuration data with the aid of which the functionality and / or other properties of the sensor arrangement 4 can be configured. In particular, the configuration data in the case of at least one ultrasonic sensor having sensor arrangement 4 define different profiles for the generation of acoustic signals by the sensor array. Thus, in a simple case, a first profile could serve for a first functionality of the sensor arrangement 4 to define, for the purpose of a transit time detection, and based on a distance measurement this emits ultrasonic signals and their reflections on objects detected. An alternative second profile could then be, for example, the sensor arrangement 4 configure it so that when activated, it emits audible signals in the audible range for humans or certain animals, such as to generate warning signals.

The data store 5 has two or more different memory areas 5a . 5b auf¬, which are formed independently of each other in such a way or so decoupled that a disturbance of the one memory area not, at least not necessarily and usually not, leads to a failure of the or other memory areas, so in this sense an independence of Memory areas consists of each other. This means, in particular, that if data losses or data modifications take place in one of the memory areas, the data stored in the other memory area (s) will generally not be affected thereby. Each of the memory areas is separate, ie addressable independently of the respective other memory areas in the sense of a read and write access. A first storage area 5a In the present example, it is intended to store a plurality N of configuration data blocks CDB -1 to CDB-N, which together form configuration data for configuring the functionality of the sensor arrangement 4 represent.

The sensor system 1 also has a data source 6 for the configuration data, which may be designed in particular in the form of a control unit (ECU), in particular as a control unit for a motor vehicle. In its basic form is the sensor system 1 composed of several discrete components, in particular the configuration monitoring device 3 , the sensor arrangement 4 , the non-volatile memory 5 as well as the data source 6 each already as such integrated component or units may be formed. Alternatively, however, higher degrees of integration may also be present. In particular, the sensor system 1 have a configurable sensor device in the unit in a first degree of integration 2a already the configuration monitoring device 3 as well as sensor arrangement 4 contains and may be formed as a module, for example. In an alternative, second degree of integration 2 B , The configurable sensor device in assembly additionally also has the volatile data memory 5 on. In an even greater degree of integration 2c the configurable sensor device also has the data source 6 on, so that the sensor device in the degree of integration 2c especially with the sensor system 1 can coincide. In the 1 illustrated degrees of integration 2a to 2c only provide particularly expedient exemplary possibilities for the design of the sensor device 1 without being understood as a limitation thereto.

The aforementioned individual components 3 to 6 of the sensor system 1 are, as in 1 represented connected in various ways via communication links. Where is the data source 6 at least via a write access W with the data store 5 connected so that they configuration data, in particular in the form of the aforementioned configuration data blocks CDB , in the data store 5 , in particular in its first storage area 5a , can write. Furthermore, the data source has 6 via a read access R to the data store 5 , in particular another memory area, optionally also the second memory area 5b may correspond to diagnostic information stored therein SF to be able to read. The diagnostic information SF can in particular as to the configuration data blocks CDB-1 to CDB-N corresponding data units SF-1 to SF-N , which in the simplest form can each be a single bit (bit flag), be defined.

The configuration monitoring device 3 also has read access R to the data store 5 , in particular to its first storage area 5a for the configuration data CDB , In addition, it has a read / write access R / W at least to the second memory area 5b in particular (also) intended by the configuration monitoring device 3 from the configuration data CDB to save calculated CRC codes. The CRC codes can in turn according to the diagnostic information SF , than to the configuration data blocks CDB-1 to CDB-N corresponding data units CRC 1 to CRC-N be defined. In addition, the configuration monitoring device has 3 at least write access W on the memory area of the data memory 5 . for example, the memory area 5b into which the diagnostic information SF is to be written by her.

In addition, there are other, typically, but not limited to, wireline communication links in the sensor system 1 intended. This includes a first communication connection between the data source 6 and the configuration monitoring device 3 over which the data source 6 Information, in particular update messages or signals AT 1 respectively. AT 2 O'CLOCK to the configuration monitoring device 3 can transmit. Also between the sensor arrangement 4 and the configuration monitoring device 3 can, as shown, a similar communication link exist, in particular a further update messages or signals UM3 from the sensor array 4 to the configuration monitoring device 3 can be transmitted. Finally, another communication link between the data source 6 and the sensor assembly 4 consist, in particular, of the data source 6 outgoing measurement requirements MR to the sensor arrangement 4 can be transmitted.

With additional reference to the others 2 to 4 Now an embodiment of the method according to the invention based on the sensor system 1 out 1 explained. The core of the process is that of the configuration monitoring device 3 executed steps S1 to S9 , That of the other components, especially the data source 6 and the sensor assembly 4 executed steps of the method described, belong to a parent, through the configurable sensor system 1 a total executable method, which only then the inventive, by the configuration monitoring device 3 executable method, if the degree of integration 2c correspondingly all components of the sensor system 1 at the same time to the configuration monitoring device 3 belong.

That through the sensor system 1 executable method has one in the 2 and 3 illustrated, initialization phase, and a subsequent, in 4 illustrated, monitoring phase on. In a first section of the initialization phase, the in 2 is represented by the data source 6 in one step SE-1 new configuration data in the first memory area of the data memory 5 written. As already mentioned, the configuration data can be present in particular in blocks. The writing of the configuration data takes place in particular in the context of a first-time configuration, and subsequently as an update to this every time when the configuration data for the sensor array 4 be at least partially modified, such as to configure another operating mode or another function profile so. Correspondingly, the writing of the configuration data can depend on the situation also on only one or a subset of the data blocks CDB-1 to CDB-N Respectively. For example, different configurations may differ only in individual ones of the data blocks while other data blocks are shared by both. In this case, only the differing data blocks need to be rewritten in case of reconfiguration. The configuration data monitoring device 3 as well as the sensor arrangement 4 are usually at the writing of the configuration data CDB in step SE-1 not involved.

In another section of the initialization phase, the in 3 is shown, sends the data source 6 in one step SE-2 an update message or an update signal AT 1 to the configuration monitoring device 3 , and to inform them about that in the data store 5 new or changed configuration data CDB available. Optionally contains the message or the signal AT 1 In addition, CRC information is provided by the data source 6 in step SE-1 to the data store 5 transmitted configuration data CDB correspond and on the part of the data source 6 obtained using a suitable CRC error detection coding method. The configuration monitoring device 3 receives the message or signal AT 1 in one step S1 , In a further step S2 reads the configuration monitoring device 3 the configuration data CDB , in particular block by block, from the data memory 5 out and calculated in one step S3 for each of the configuration data blocks read out CDB-1 to CDB-N with an on the side of the data source 6 previously used CRC error detection coding methods, error detection coding methods correspond to a respective CRC code. In a further step S4 finds a blockwise comparison of the corresponding CRCs AT 1 with the in step S3 calculated CRCs, depending on the respective comparison result per block CDB a corresponding bit flag from the set of bit flags representing the diagnostic information SF-1 to SF-N is set. For example, setting to "1" may indicate an error (CRCs of the block when comparing in S4 were different) while setting to "0" signaled error-free, or vice versa.

At least if, when comparing in the step S4 no mistakes, but everyone CRC out AT 1 with its corresponding CRC from the calculation in step S3 will agree in a further step S5 from the configuration monitor 3 the in step S3 calculated CRCs into the data store 5 written, preferably in the second memory area 5b or a third (not shown) of the storage areas 5a and 5b different memory area of the data memory 5 ,

Subsequently, the data source 6 in one step SE 3 the set bit flags (diagnostic information) per read access R to the corresponding memory area of the data memory 5 read. If, on the basis of the diagnostic information, the occurrence of an error is detected, ie if at least one of the bit flags is set accordingly, the data source can be used in a further step SE-4 respond appropriately. In particular, it may optionally re-initialize by going to step SE 1 (see. 2 ) of the method. Alternatively or additionally, for example, it can also issue an error message, for example at a man-machine interface, and / or corresponding diagnostic information in a diagnostic data memory of a higher-level system, for example a motor vehicle
or a subsystem of it.

After the in the 2 and 3 initialization phase is completed, the actual monitoring phase can begin, which is now with reference to 4 is described. In particular, it can be initiated by means of a trigger event which, as in FIG 4 represented, a Messanforderungsnachricht MR for making a measurement by the sensor arrangement 4 can be. The measurement request message MR is from the data source 6 to the sensor arrangement 4 transmits and solves a transmission there (step SS1 ) one of the sensor assembly 4 to the configuration monitoring device 3 directed update message AT 3 out. Additionally or alternatively, in step SE5 as a trigger event also one from the data source 6 to the configuration monitoring device 3 directed update message AT 2 O'CLOCK be transmitted.

The configuration monitoring device 3 receives the message AT 2 O'CLOCK respectively. AT 3 in one step S6 , then reads in one step S7 in the data store 5 in its first storage area 5a stored configuration data CDB and calculated in blocks each again the CRC to. In one step S8 are already in the second memory area during the initialization phase 5b of the data memory 5 stored CRCs and in step S9 in blocks with those in the step S7 compared to calculated CRCs. In the same manner as before in the initialization phase, the diagnostic information in the form of the bit flags SF in the data memory then depending on the comparison 5 set. The data source 6 then reads in one step SE6 the set diagnostic information SF from the data memory and outputs in the case that at least one of the bit flags indicates an error, an error message, for example, at a man-machine interface. In addition, or alternatively, in this case, it may also have a corresponding control of the sensor arrangement 4 directly or indirectly via the configuration monitoring device 3 , the sensor arrangement 4 set to a disabled state to another, possibly incorrect, using the sensor array 4 Block accordingly. Such an error may have occurred in particular due to the fact that in the data memory 5 stored configuration data were affected or even deleted, for example, by temporary loss of power to the data memory 5 , in particular its first storage area 5a , a malfunction of the first memory area 5a , or by external influences, such as excessive heat input or influences of an external radiation source.

The method presented here is thus suitable for data storage 5 stored configuration data to detect errors encountered in an efficient manner. In particular, in the configuration monitoring device 3 be provided for CRC calculation not only for the purpose of checking the configuration data CDB, but also for hedging, in terms of channel coding, any other communication, be it with the data source 6 , the sensor arrangement 4 or any other communication counterpart (dual-use).

This through the configuration monitor 3 In this case, the method to be carried out can be embodied, in particular, by means of a hard-wired circuit, or else, at least partially, by means of a computer program that is either in the configuration monitoring device 3 itself, for example in a (low-cost) read-only memory (ROM) or a one-time programmable memory (OTP) memory, or in a memory external to it, which in some embodiments in particular the data memory 5 can match, is filed.

While at least one exemplary embodiment has been described above, it should be understood that a large number of variations exist. It should also be understood that the described exemplary embodiments are nonlimiting examples only and are not intended to thereby limit the scope, applicability, or configuration of the devices and methods described herein. Rather, the foregoing description will provide those skilled in the art with guidance for implementing at least one example embodiment, it being understood that various changes in the operation and arrangement of the elements described in an exemplary embodiment may be made without departing from the scope of the appended claims deviated from, and its legal equivalents.

LIST OF REFERENCE NUMBERS

1

configurable sensor system

2a - 2c

different degrees of integration of the sensor device of the sensor system

3

Configuration monitoring device, in particular ASIC

4

Sensor arrangement, with at least one sensor

5

volatile data memory, in particular RAM

5a

first memory area, for configuration data

5b

second memory area, for CRC and SF

6

Control unit, ECU

W

(at least) write access

R

(at least) read access

W / R

Read / write access

UM1-UM3

Update messages or signals

MR

Measurement request message or signal

Claims (14)

A method for monitoring the configuration of a configurable sensor device (3, 4), in particular a configurable ultrasonic sensor device, the method comprising: Reading (S2) configuration data (CDB) stored in a volatile data memory (5) by a data source (6) to configure the sensor device; Calculating (S3) at least one initial check value (CRC) according to a predetermined error detection coding method from the read configuration data (CDB) and storing (S5) the at least one initial check value (CRC) in the data memory (5); and Detecting (S6) an occurrence of a predetermined trigger event (UM2, UM3) and in response thereto: Recalculating (S7) the at least one check value (CRC) from the configuration data (CDB) stored in the data memory (5) according to the error detection coding method, Comparing (S9) the newly calculated at least one test value (CRC) with the respectively corresponding initial test value (CRC) previously stored in the data memory (5) to determine a monitoring result (SF) as a function of the result of the comparison, and - Provision of the monitoring result (SF). Method according to Claim 1 in which: reading (S2; S7) of the configuration data (CDB) stored by the data source (6) in the data memory (S5) is effected at least partially from a first defined physical memory area (5a) of the data memory (5); and storing (S5) the initial check value (CRC) into a second physical memory area (5b) of the data memory (5) functionally decoupled from the first memory area (5a). Method according to one of the preceding claims, wherein: the reading (S2) of the configuration data (CDB) is block by block with respect to separate data blocks (CDB-1, ..., CDB-N); calculating (S3) an initial check value (CRC) block-wise on the basis of these individual data blocks (CDB-1, ..., CDB-N), whereby from each of these data blocks (CDB-1, ..., CDB-N) an associated initial check value (CRC-1, ..., CRC-N) is calculated and stored separately addressable in the data memory (5); and the determination and provision (S7 to S9) of the monitoring result (SF-1, ..., SF-N) also takes place block-wise on the basis of these individual data blocks (CDB-1, ..., CDB-N), wherein for each of the an associated test value from this respective data block (CDB-1, ..., CDB-N) is recalculated in the data memory (5) according to the error detection coding method and this newly calculated test value with the corresponding previously stored in the data memory initial test value (CRC -1, ..., CRC-N) and an individual monitoring result (SF-1, ..., SF-N) associated with the data block (CDB-1, ..., CDB-N) depending on the result of this Comparison is determined and provided. The method of any one of the preceding claims, wherein the predetermined error detection coding method comprises a cyclic redundancy check, CRC, for at least one of the check values (SF, SF-1, ..., SF-N); The method of any one of the preceding claims, further comprising: Receiving (S1) at least one derived check value transmitted by the data source (6) previously derived according to the predetermined error detection coding method from the configuration data (CDB) transmitted from the data source (6) to the data memory (5) for storage therein; Comparing (S4) this received check value with the corresponding check value calculated from the configuration data (CDB) read from the data memory (6); and Determining a transmission error, if in this comparison (S4) according to a predetermined test criterion, a deviation of the compared test values occurs. Method according to Claim 5 , further comprising: if a transmission error is detected, transmitting at least once a request (SF) to the data source (6) for retiring (SE-1) the configuration data in the data memory (5) and / or retransmitting (UM1) the data at least one derived check value. Method according to one of the preceding claims, wherein the provision (S9) of the monitoring result (SF) by means of storing the monitoring result (SF) characterizing monitoring data (SF-1, ..., SF-N) in the data memory (5). Method according to one of the preceding claims, wherein the trigger event is determined by one of the following or by a combination of at least two of the following: a request for a sensory measurement (MR, UM3) to be carried out by the sensor device; a lapse of a certain period of time since the last trigger event or activation of the sensor device; a receipt of a trigger signal (UM2); - a timetable; an occurrence of a predetermined state of the sensor device; - An occurrence of a predetermined trigger criterion sufficient measurement results when performing a sensory measurement by the sensor device. Method according to one of the preceding claims, wherein, in the event that the monitoring result (SF) indicates a deviation of the initial check value (CRC) from the newly calculated check value, one of the following measures or a combination of at least two of these actions is triggered: - transferring the sensor device from an operating state to a deactivated state in which it does not comply with a received request of a sensory measurement to be carried out by the sensor device; Requesting a re-initialization by transmitting a corresponding request (SF) to the data source (&); - Output an error message. Configuration monitoring device (3; 2a-c) for monitoring the configuration of a configurable sensor device (3,4), in particular a configurable ultrasonic sensor device, wherein the configuration monitoring device (3; 2a-c) is set up, the method according to one of the preceding claims is to be carried out. Configuration monitoring device (3; 2a-c) according to Claim 10 wherein the configuration monitoring device (3; 2a-c) is set up, the predetermined error detection coding method both for monitoring the configuration of a configurable sensor device (3,4; 2a-c) according to the method and for further securing a communication connection with the data source (6) and / or another communication counterpart (4) to use. Configuration monitoring device (3; 2a-c) according to Claim 10 or 11 wherein the configuration monitoring device (3; 2a-c) is designed as an integrated unit, in particular as an integrated circuit. Configurable sensor device (3,4; 2a-c), comprising: at least one sensor (4) configurable by means of configuration data held in a volatile data memory (5); and a configuration monitoring device (3) according to any one of Claims 10 to 12 for monitoring the configuration effected by means of the stored configuration data. Computer program comprising instructions which, when executed on a configuration monitoring device (3), follow one of the Claims 10 to 12 cause them to follow the procedure of one of the Claims 1 to 9 perform.

Images