EP1401690A1

EP1401690A1 - Method for actuating a component of a distributed security system

Info

Publication number: EP1401690A1
Application number: EP02729790A
Authority: EP
Inventors: Hans Heckmann; Reinhard Weiberle; Bernd Kesch; Peter Blessing
Original assignee: Robert Bosch GmbH
Current assignee: Robert Bosch GmbH
Priority date: 2001-03-15
Filing date: 2002-03-14
Publication date: 2004-03-31
Also published as: WO2002074596A1; CN1253333C; RU2284929C2; CN1458889A; US20040011579A1; JP2004518578A; DE10291055D2; DE10211278A1

Abstract

The invention relates to a method for actuating a component (Akt 1) of a distributed security system, especially a component (Akt 1) of an X-by-wire system in a motor vehicle. Said component (Akt 1) is actuated by a first actuating module (R 1) associated with the component (Akt 1), using at least one first microcomputer system (P 1). A monitoring unit which is independent from the first microcomputer system (P 1) is provided for monitoring the same (P 1). According to the invention, the distributed security system comprises, along with the first microcomputer system (P 1), at least one other microcomputer system (P m) which is connected to said first microcomputer system (P 1), for example by means of a physical data bus (K l), for the transmission of data. The other microcomputer systems (P m) thus take on the tasks of the monitoring unit. A separate monitoring unit is therefore not required.

Description

Method for controlling a component of a distributed security-relevant system

State of the art

The present invention relates to a method for only controlling a component of a distributed safety-relevant system, in particular a component of an X-by-wire system in a motor vehicle. The component is provided by at least one first control module assigned to the component

Microcomputer system controlled. The control of the component comprises the following steps:

a) determining at least one control signal for the component by the first microcomputer system in

Dependence on at least one input signal;

b) determining at least one logic control signal, the at least one logic control signal being at least partially derived from one of the first

Monitoring unit independent of the microcomputer system is determined as a function of the at least one input signal; ^'C) comparing the at least one drive signal to the at least one logical drive signal;

d) determining at least one release signal as a function of the result of the comparison; and

e) forwarding the at least one control signal or at least one signal dependent thereon to the component if the at least one enable signal has a predeterminable value.

The invention also relates to a computer program that can run on a microcomputer system of a control module. The control module is provided for controlling a component of a distributed security-relevant system, in particular a component of an X-by-wire system in a motor vehicle.

A method of the type mentioned is known, for example, from DE 198 26 131 AI. In this document, the distributed safety-related system is described as an electrical braking system of a motor vehicle. The components are designed as the brakes of the motor vehicle or more precisely as actuators for controlling the brakes. Such a system is to a high degree relevant to safety, since faulty control of the components, in particular faulty actuation of the brakes, can lead to an unforeseeable safety risk. For this reason, incorrect control of the components must be excluded with certainty.

Essential features of the known brake system are a pedal module for the central driver request recording, four Wheel modules for wheel-specific control of the brake actuators and a processing module for calculating higher-level brake functions. Communication between the individual modules can be achieved through one or more communication systems. In FIG. 2 of the present patent application, the internal structure of a thread module with various logical levels is shown as an example. The logical level Ll includes at least the calculation of the control functions for the wheel brakes, while the logical levels L2 to L4 contain various functions for computer monitoring and function checking of Ll.

The control of the brakes or the electric motors for actuating the brake shoes comprises the following steps equally for each wheel module

a) determining at least one control signal (f_l) for the brake by a first microcomputer system (R_1A) m as a function of at least one input signal (a_R2, a_R3, a_R4; a_V, ref; s_R2, s_R3, s_R4;

Δs_V, ref; v__F; n__l; F_lι; s_lH). The input signals are made available to the microcomputer system (R_1A) via a communication system (K_l), for example a bus system.

b) determining at least one logical control signal (e_lH). The logic control signal (e__lH) W.ιd at least partially determined by a monitoring device (R_1B) which is independent of the first microcomputer system (R_1A) as a function of the at least one input signal.

c) comparing the at least one control signal (f _]) with the at least one logic control signal (e_lH) m of power electronics (LE_1K).

d) determining at least one enable signal (within the power electronics LE) m Abhanαιg eιt from d ^ m

Result of the comparison of the control signal (f_l) and α of the logical control signal (e_lH); and

e) forwarding the at least one control signal (f_l) or a signal (ι_lK) dependent on the control signal (f_l) to the brake, or to an actuator Akt_l for the brake shoes, if the at least one enable signal has a predefinable value.

The monitoring unit (R_1B) is used in particular to detect systematic (so-called common mode) errors. Faults in the power supply are an example of such faults. In the known brake system, the monitoring unit (R_lBj is an independent one

Microcomputer system trained. Alternatively, the monitoring unit (R_1B) can also be designed as a hardware module without its own processor, which, however, can perform specific logic functions or, if it has a register, even switching functions. An example of such a hardware module is, for example, an ASIC (Applied Specific Integrate Circuit), an FPGA (Field-Programmable Gate Array) or a monitoring circuit (so-called watchdog).

A disadvantage of the prior art is that the logic level L4 is always implemented in a separate component, which — for example in wheel modules of an electrical braking system — within the distributed safety-relevant system must also be provided several times.

The present invention is based on the object of simplifying the structure of a distributed safety-relevant system and at the same time at least maintaining the achievable safety when the components are released.

To solve this problem, the invention proposes, based on the method of the type mentioned at the outset, that the security-relevant system has, in addition to the first microcomputer system, at least one further microcomputer system which is connected to the first microcomputer system for the purpose of data transmission, at least one of steps b ) to d) m at least one of the other microcomputer systems is executed.

Advantages of the invention

According to the invention, it is therefore proposed to dispense with a separate monitoring unit and instead to have the tasks of the monitoring unit carried out by those units of the distributed security-relevant system that are provided in the system anyway. These units must have their own intelligence in order to be able to make their own calculations, at least to a limited extent. Such system units, which, according to the invention, can take over the tasks of the monitoring unit, are in particular the microprocessors of one or more further microcomputer systems.

A program code is processed on the microprocessor of the first microcomputer system in order to make the control signal for the component n dependent on the input signals determine. The program code is also processed on at least one of the other microcomputer systems in order to determine the logical control signal for the component as a function of the same input signals. The processing of the program code on the other

Microcomputer systems can be e.g. on the microprocessor or other suitable units (e.g.

Kommumkat onscontroller) that have sufficient intelligence to process the program code i. The input signals are made available to the further microcomputer systems, for example via a data bus, via which the microcomputer systems are connected to one another for the purpose of data transmission.

The control signal determined by the first microcomputer system is compared with the logic control signals in order to determine whether the control signal is faulty or not. If all microcomputer systems have matching control signals or local signals

Determine control signals, it can be assumed that the control signal is error-free. It goes without saying that with an increasing number of further microcomputer systems, each of which determines logical control signals, the checking of the functionality of the first microcomputer system becomes more reliable. If several microcomputer systems monitor each other, it may be even a defective microcomputer system can be identified or localized.

According to an advantageous development of the present invention, it is proposed that the safety-relevant system have at least one further control module in addition to the first control module, the at least one further microcomputer system is part of the at least one further control module. According to this further development, the distributed safety-relevant system thus comprises a plurality of similar control modules in which the first microcomputer system and the further microcomputer systems are arranged. The advantage of this further development is that the control modules generally have similar tasks (for example, activating and releasing a wheel brake depending on the best input signals ) and the program code for calculating the control signals in the

Microcomputer systems largely coincide So if the other microcomputer systems of the other control modules take over the tasks of the monitoring unit, they do not have to have a separate program code available and, if necessary, executed to determine the logical control signals. Rather, the program code already available to the other microcomputer systems can be executed, albeit with the input signals of the first microcomputer system. An example of a distributed system on which the process according to this development can be realized is an electrical braking system which has almost identical wheel modules for all wheels of a motor vehicle. In this development, the redundancy that is often contained in distributed systems is used to reduce the effort required to safely control the components.

According to an advantageous embodiment of the present invention, it is proposed that step b) and step c) be carried out in at least one of the further microcomputer systems. According to this embodiment, the comparison between the control signal and the logical control signals is carried out in the at least one other microcomputer system run out. For this purpose, the control signal determined by the first microcomputer system must be transmitted to the at least one further microcomputer system, for example via a data bus that connects the two to one another.

The first microcomputer system is advantageously connected to a physical bus system via a first communication controller, step b) of at least one of the further microcomputer systems and step c; is executed in the first communication controller. According to this embodiment, the comparison between the control signal and the logical control signals is carried out in the first communication controller, via which the first microcomputer system is connected to the bus system. Communication controllers from newer bus systems, such as TTCAN (Time Triggered Controller Area Network), TTP / C (Time Triggered Protocol Class C according to SAE) or FlexRay, do not simply serve as a "stupid" interface between the microcomputer system and the data bus, but run one own, sometimes quite complex processing of the data to be transmitted. To do this, they have their own intelligence, which can perform at least simple operations, such as comparisons, but also possibly more complex calculations. In order to be able to carry out the comparison of the first communication controller, the at least one logic control signal must be transmitted from the at least one further microcomputer system to the communication controller, for example via a data bus that connects the two to one another.

According to another preferred embodiment of the present invention, it is proposed that the step d) n at least one of the further microcomputer systems is executed. Accordingly, at least one enable signal m is determined in the further microcomputer systems as a function of the result of the comparison of the control signal and the logical control signal. For this purpose, the control signal determined in the first microcomputer system must be transmitted to the other microcomputer systems, for example via a data bus. It is then compared in the other microcomputer systems with the logical control signals determined there. The release signal is in turn transmitted to the first microcomputer system, for example via a data bus. The at least one control signal or at least one signal dependent thereon is then forwarded to the component to be controlled if the m the further

Microcomputer systems determined release signals have predeterminable values. For example, a simple comparison of the release signals or a majority decision can be made.

According to an alternative embodiment of the present invention, it is proposed that the first microcomputer system be connected via a first communication controller to <= m physical bus ° system, step d) being the first

Communication controller is running. This means that the logical control signals determined in the further microcomputer systems must be transmitted to the first communication controller, for example via a data bus.

Of particular importance is the implementation of the method according to the invention in the form of a computer program which is based on a microcomputer system Control module for controlling a component of a distributed safety-relevant system is capable of being ablau. The computer program is executable on a microprocessor of the microcomputer system and is suitable for executing the method according to the invention. In this case, the invention was thus implemented by a computer program, so that the computer program m represents the invention in the same way as the method for the execution of which the computer program is suitable.

According to an advantageous development of the present invention, it has been proposed that the computer program be stored on a memory element, in particular on a flash memory. In order to process the computer program and to carry out the method according to the invention, the computer program is transferred to the processor as a command or as a whole.

The computer program in particular coordinates the data transmission between the various units of the distributed system in such a way that the method according to the invention can be implemented. Which data must be transmitted to which units depends in particular on which units steps b) to d) are carried out. However, the computer program also ensures in the various system units that the control signals and the logic control signals are determined and / or compared with one another.

drawings

Further features, application possibilities and advantages of the invention result from the following description of exemplary embodiments of the invention, which Drawing are shown. All of the described or illustrated features, alone or in any combination, form the subject of the invention, regardless of their summary in the claims or their relationship, and regardless of their wording or representation in the description or in the drawing. Show it :

1 shows a distributed security-relevant system in the cutout for realizing an inventive method according to a first preferred embodiment;

FIG. 2 shows a control module of a distributed safety-relevant system known from the prior art;

FIG. 3 shows a distributed security-relevant system in the cutout for realizing an inventive method according to a second preferred embodiment; and

Figure 4 shows a distributed security-relevant system in the cutout to implement an inventive method according to a third preferred embodiment.

Description of the exemplary embodiments

The method according to the invention is explained in more detail below using an electrical braking system. However, the present invention is not limited to electrical braking systems, but rather can be used for any distributed safety-related systems. The The present invention permits secure release of components of the security-relevant system without the use of additional monitoring units. Rather, the tasks of the monitoring units are taken over by units of the security-relevant system, which are anyway present in the system.

The braking system comprises a wheel module R_l, R_m for each vehicle wheel to be braked. Each wheel module R_l, R_m comprises a microcomputer system P_l, P_rcι and an enabling circuit FS_1, FS_m. The microcomputer systems P_l, P_m each include a microprocessor Pro_l, Pro_m and an intelligent communication controller S_l, S_m. The microprocessor Pro_l, Pro_m and the communication controller S_l, S_m of a microcomputer system P__l, P_m can be combined on a semiconductor module (so-called chip); however, they are always designed as separate, independent units. JPCIPS wheel module R_l, R_m is connected to a physical data bus K_l via a communication controller e < ^~ S_l- S_m. Data are transmitted via the data bus, for example according to the TTCAN, TTP / C or FlexRay protocol. The wheel modules R__l, R_m each control an actuator Akt_l, Akt_m, which are designed, for example, as electric motors for actuating or releasing the wheel brakes.

FIG. 1 shows the internal structure of two wheel modules and the signal flow running therein of a method according to the invention in accordance with a first preferred embodiment ^c > f <-ιrm. The Ve, driving is used to control the actuators Akt_l of the electric braking system by the wheel module R__l or by the microcomputer yste P_l. It is important to control the actuator Akt_l to prevent the actuator Akt 1 from being faulty Control signal of the microcomputer system P_l controlled: is. This means that the control signal should only be forwarded to the Akt__l actuator if it is sufficiently likely that it is error-free. Actuator Akt_l therefore essentially comprises the following steps:

a) The processor Pro_l of the microcomputer system P_l determines by executing a program des C_l as a function of at least one input signal F_l at least one control signal A_ll for the actuator Akt_l. The input signals E_l contain information about the actual state of the brake system and the motor vehicle and are transmitted to the first wheel module R_l via the data bus K_l.

b) The processors Pro_m (e.g. m = 2 ... 4) of the further microcomputer systems P_m likewise determine a logical control signal by executing the program code C_l m as a function of the input signals E_l

A__lm. This presupposes that in addition to a program code C_m for determining the control signals A_ml for the actuators Akt_m, the process code C_l must also be available to the processors Pro_m. In the present example with several identical wheel modules R_l, R_m, this means no or only minimal additional effort, since the program codes C_l, C_m running on the processors Pro__l, Pro_m are essentially the same. So it can be used in the Pro_m processors anyway

Available program code C_m can be processed with the input signals E_l in order to receive the logical control signals A_lm. This simplification applies to all distributed systems similar control modules. The input signals E__i can be transmitted to the microcomputer systems P_m via the data bus K_l. If the microprocessors Pro_l, Pro_m are functioning correctly, the control signals A_ll and the logical control signals A_lm must be identical.

c) The control signal A_ll is compared in the microprocessors Pro__m with the logical control signals A__lm previously determined there. For this purpose, the control signal A_ll must be transmitted to the microcomputer systems P_m via the data bus K__l. The microprocessors Pro_m generate status information SF_lm, which in turn is transmitted again to the first microcomputer system P__l via the data bus K_l. The status information consists, for example, of one or more bits. It is conceivable to include the status information SF_lm in the protocol of the data bus for transmission to the first microcomputer system P__l.

d) The communication controller S__l of the first microcomputer system ems P_l evaluates the incoming status information SF_lm and generates an enable signal F__l in the event of a corresponding status (i.e. when the correct functioning of the microprocessor Pro_l is signaled). The status information SF_lm can be evaluated in different ways. For example, it can be a comparison, a logical (preferably an AND) link or a majority decision of the status information SF_lm.

e) Finally, the at least one Ans euersignal A_ll or at least one signal dependent on it the actuator Akt_l is forwarded if the at least one enable signal F_l has a predeterminable value. To check this, the enable circuit FS_1 is AND-linked to the control signal A_ll. If that

If the enable signal F_l is logic "1", the control signal A_ll is forwarded to the actuator Akt_l. If the enable signal F__l is logic "0", the control signal A__ll is not forwarded to the actuator Akt_l

Using the described method according to the invention, the functionality of the processor Pro__l of the microcomputer system P_l can be checked and a safe release of the actuators Akt_l can be achieved. To check the

Processors Pro_l mainly use the processors Pro_m of the other microcomputer systems P_m. In the same way, however, the method according to the invention can also be used to check the functionality of the processors Pro_m of the further microcomputer systems P_l and to safely release the actuators Akt_m. Then the other processors Pro_m (without the processor to be checked) and the processor Pro_l of the first microcomputer system P__l are used for the check. Each individual microcomputer system within the safety-relevant distributed brake system therefore has on the one hand the primary task of determining the control signals A__ll, A_ml for the actuators Akt__l, Akt__ m assigned to it, and on the other hand the secondary task of checking the function of the other processors when fulfilling their primary tasks. Without the use of additional monitoring units, the present invention thus creates the possibility of a safe and even redundant release of the actuators Act 1, Act m. FIG. 3 shows the internal structure of two wheel modules and the signal flow running therein of a method according to the invention in accordance with a second preferred embodiment. This method differs from the method shown in FIG. 1 in particular in that step c) is carried out in the communication controller S_l of the first microcomputer system P_l.

The logical control signals A_lm determined in the processors Pro__m of the further microcomputer systems P_m in step b) are transmitted to the first microcomputer system P__l via the data bus K_l. There, the logic control signals A_lm are then compared to the communication controller S_l of the first microcomputer system P__l with the at least one control signal A_ll (step c)). Depending on the result of the comparison, status information SI_lm is determined in the communication controller S_l, from which the release signal F_l is then determined, or else the release signal F__l is determined immediately (step d)).

FIG. 4 shows the internal structure of two wheel modules and the signal flow running therein of a method according to the invention in accordance with a third preferred embodiment. This method differs from the method shown in FIG. 1 and FIG. 3 in particular in that step d) is carried out in the release circuit FS_1 of the first wheel module R 1.

As step c), a comparison is carried out in the microprocessors Pro_m of the further microcomputer systems R_m between the control signal A_ll and the logical control signals A_lm previously determined there. The Microprocessors Pro__m generate status information SF__lm, which is transmitted via the data bus K_l to the first microcomputer system? __ 1 and from there to the release circuit FS__1. This evaluates the status information SF_lm, SF_lx coming from all other microcomputer systems P_m and ^' forwards the at least one control signal A_ll or at least one signal dependent thereon to the actuator Akt__l if the status information SF_lm, SF_lx has a corresponding status. Alternatively, depending on the result of the comparison, status information SI_lm can first be determined in the enable circuit FS_1, from which the enable signal F_l is then determined. A so-called voting mechanism is used to evaluate the status information SF_lm, SF_lx in the enable circuit FS__1. With only two control signals A 11, A_12, the voting mechanism is an AND operation of the two signals A_ll and SF_lm. If there are several control signals A_ll, Ä_lm, the voting mechanism can be a majority decision.

Claims

Expectations

1. Method for controlling a component (Akt_l) of a distributed security-relevant system, in particular a component (Akt_l) of an X-by-wire system in a motor vehicle, the component (Akt__l) being assigned by a first one assigned to the component (Act 1) Control module (R_l) is controlled with at least one first micro-computer system (P_l), and the control of the component (Akt_l) comprises the following steps:

a) determining at least one control signal (A 11) for the component (Akt_l) by the first micro-computer system (P_l) as a function of at least one input signal (E_l);

b) determining at least one logical Ans euersignais (A_lm), the at least one logical

Control signal (Ä_lm) is at least partially determined by a monitoring unit n which is independent of the first microcomputer system (P_l) and is dependent on at least one input signal (E_l);

c) comparing the at least one control signal (A_ll) with the at least one logic control signal (A 12); d) determining at least one release signal (F_l) depending on the result of the comparison; and

e) forwarding the at least one control signal (A_ll) or at least one signal dependent thereon to the component (Äkt__l), if the at least one enable signal (F_l) has a predeterminable value,

characterized in that the security-relevant system has, in addition to the first microcomputer system (P_l), at least one further microcomputer system (P_m), which is used for data transmission with the first

Microcomputer system (P_l) is connected, wherein at least one of steps b) to d) is carried out in at least one of the further microcomputer systems (P_m).

2. The method according to claim 1, characterized in that the security-relevant system in addition to the first

Control module (R_l) has at least one further control module (R_m), the at least one further microcomputer system (P__m) being part of the at least one further control module (R__m).

3. The method according to claim 1 or 2, characterized in that step b) and step c) is carried out in at least one of the further microcomputer systems (P_m).

4. The method according to claim 1 or 2, characterized in that the first microcomputer system (P_l) is connected via a first communication controller (S__l) to a physical bus system (K_l), wherein d = r step b) at least one of the further microcomputer systems (P_m ) and step c) is carried out in the first communication controller (S 1).

5. The method according to any one of claims 1 to 4, characterized in that step d) is carried out in at least one of the further microcomputer systems (P_m).

6. The method according to any one of claims 1 to 4, characterized in that the first microcomputer system (P_l) via a first communication controller (S_l) is connected to a physical bus system (K_l), step d) in the first communication controller (Ξ_i) is performed.

7. Computer program running on a microcomputer system

(P_l) of an actuation module (R_l) is executable, the actuation module (R__l) being provided for actuating a component (Akt_l) of a distributed safety-relevant system, in particular a component of an X-by-wire system in a motor vehicle, characterized in that that the computer program is suitable for executing a method according to one of claims 1 to 6 when it runs on the microcomputer system (P_l).

8. Computer program according to claim 9, characterized in that the computer program on a

Storage element (SP_1, SP_m), in particular on a flash memory, is stored.