EP3024707A1

EP3024707A1 - Method and electronic circuit assembly for the redundant signal processing of a safety-relevant application, motor vehicle brake system, motor vehicle having said motor vehicle brake system, and use of such an electronic circuit assembly

Info

Publication number: EP3024707A1
Application number: EP14733999.8A
Authority: EP
Inventors: Christoph BROCKMANN; Andreas Goers; Jann Löll; Marco Michel; Otmar Struwe
Original assignee: Wabco GmbH
Current assignee: ZF CV Systems Hannover GmbH
Priority date: 2013-07-26
Filing date: 2014-06-18
Publication date: 2016-06-01
Also published as: KR20160037939A; CN105555624A; CN105555624B; US10053079B2; US20160144844A1; DE102013012497A1; JP2016529610A; WO2015010756A1

Abstract

The invention relates to a method for the redundant signal processing of a safety-relevant application, in particular of a safety control unit of a motor vehicle, wherein at least two redundant signals are fed from at least one sensor (4) to an electronic circuit assembly (2) as input signals (6) for processing of the sensor information. At least one input signal (6) is converted into a different test signal (16). In the electronic circuit assembly (2), the one or more input signals (6) are fed to a first peripheral module (12) of a microcontroller (10), and the test signal (16) is fed to an additional peripheral module (18) of the microcontroller (10). The sensor information of the input signals (6) and of the test signal (16) are thus redundantly processed independently of each other in a respective peripheral module (12, 18) of the microcontroller (10). The invention further relates to an electronic circuit assembly (2) for performing such a method, a motor vehicle brake system, a motor vehicle having said brake system, and a use of such an electronic circuit assembly.

Description

Method and electronic circuit arrangement for redundant signal processing of a security-relevant application,

Motor vehicle brake system and motor vehicle with it as well

Use of such electronic circuitry

The invention relates to a method for redundant signal processing of a safety-relevant application, in particular a safety control unit of a motor vehicle, according to the preamble of claim 1 and an electronic circuit arrangement for carrying out such a method according to the preamble of claim 2. Furthermore, the invention relates to a motor vehicle brake system and a motor vehicle Such an electronic circuit arrangement and a use of this circuit arrangement.

Electronic automotive control devices, such as ABS and / or EBS brake control devices, often have redundant signal processing systems to be suitable for modern safety-related applications. The demands on the components are steadily increasing. However, with the increasing complexity of the individual components, the possibility of malfunctions also increases. Due to increasing demands on the components, e.g. Control units, these are manufactured according to specified safety regulations.

An example of an anti-lock vehicle brake system is off

DE 32 34 637 C2. Here, the input data are fed in parallel to two identically programmed microcontrollers and processed synchronously there. In between and at the output, the signals are compared. If a deviation of the signals from each other, a shutdown signal is output. Due to a second microcontroller, which is identical in construction and in its programming with the first microcontroller, data processing errors can be at least partially detected. However, such a system requires two high-quality microcontrollers, although to generate the actual Control signals a single microcontroller would suffice, which doubles the cost of microcontrollers for security reasons.

In addition, to eliminate a potential source of error due to a systematic design flaw or systematic manufacturing error of the microcontroller, both systems would have to be developed by independent programmers, increasing the overhead even further.

The invention is therefore based on the object to provide a simple and inexpensive method and an electronic circuit arrangement, with the reliability, which is required for safety-relevant applications, can detect malfunctions of the system.

The invention solves this problem with the features of a method for redundant signal processing according to claim 1, with an electronic circuit arrangement according to claim 2, with a motor vehicle brake system according to claim 6, with a vehicle according to claim 7 and with a use of an electronic circuit arrangement according to claim 8.

To carry out the method according to the invention for redundant signal processing of a safety-relevant application, such as an ABS or EBS control unit of a motor vehicle, at least one sensor supplies at least two redundant signals for processing sensor information of the sensors as input signals to an electronic circuit arrangement.

Preferably, the input signals are provided by two independent sensors to detect errors in the generation of the sensor signal due to a faulty sensor or to provide the reliability of the system in case of failure of a sensor.

The transmission device for transmitting the sensor signals is also designed to be redundant in order to detect transmission errors if necessary. Therefore, according to the invention, the electronic circuit arrangement has at least two sensor signals as input signals for processing the sensor information to disposal. The input signals are transferred either directly or via a protective circuit against overvoltage to a peripheral module of a microcontroller. The peripheral module preferably has a software module which is configured in such a way as to compare the received signals with one another. Due to existing deviations, possible sources of error can be determined and the safety-relevant application converted into a safe state.

However, the aforementioned functionally independent paths across the two redundant input signals may be simultaneously affected if there is a systematic design error or a systematic manufacturing fault in the peripheral device of the microcontroller. This error could affect both input signals simultaneously and lead to a simultaneous failure or malfunction of the system.

In order to minimize the risk of malfunctioning of safety-relevant electronic circuit arrangements, according to the invention at least one input signal is converted into a test signal. For this purpose, the electronic circuit arrangement has at least one input circuit which is designed in such a way as to generate from the input signal a test signal which differs from the input signal but retains the sensor information.

Like the input signal or signals, the test signal is likewise transmitted to the microcontroller for processing. Since the test signal differs from the input signal, the respective peripheral modules are constructed differently and the test signal is processed in a further peripheral module independently of the input signal, whereby the processing of the sensor information is advantageously made redundant. Since the I / O modules fulfill the same processing target, the signals or data can be compared after processing and possible systematic errors within the I / O modules can be detected.

According to a preferred embodiment of the invention, the peripheral components of the microcontroller have a redundant signal processing capability. the different software modules with different software drivers. Thus, malfunctions or failures of the system, which are based on a faulty programming, can advantageously be avoided.

In a further preferred embodiment of the invention, the input circuit which converts the input signal into an analog test signal is designed as a low-pass filter if the input signal is a pulse width modulated signal. Alternatively, the input circuit which converts the input signal into a pulse width modulated test signal has a voltage controlled oscillator (VCO) if the input signal is an analog voltage or current signal. With such input circuits, existing input signals can be converted into other signals in a particularly simple manner in order to be able to process them redundantly from two independent different peripheral components.

Another preferred embodiment of the invention provides means for detecting significant differences between the results of the redundantly processed sensor information of the input signal and the test signal. If such deviations are present, the control systems affected by the deviating data can advantageously be converted into a secure state. Thus, it is advantageous to avoid misjudgments of systems that may pose a threat to humans.

The invention solves o. Task further with a motor vehicle brake system, for example an ABS or EBS system, with means for carrying out the method according to the invention and / or with at least one electronic circuit arrangement according to the invention, in particular a safety control unit.

Furthermore, the invention solves the above object with a motor vehicle, which has at least one electrical circuit arrangement, in particular a safety control unit, for redundant signal processing and / or a motor vehicle brake system with such electronic circuitry and / or means for performing a method according to the invention for redundant signal processing of a security-relevant application , Finally, the invention solves the above object by using an electronic circuit arrangement according to the invention for redundant signal processing of a security-relevant application, wherein the inventive electronic circuit for redundant signal processing in a motor vehicle braking system and / or can be applied in a motor vehicle.

Such a use of a circuit arrangement according to the invention advantageously ensures the functional safety of a system, in particular of a motor vehicle brake system or of a motor vehicle, with electronic components.

Further embodiments of the invention will become apparent from the claims and from the exemplary embodiments explained with reference to the drawing. In the drawing shows:

Fig. 1 is a block diagram of an electronic circuit arrangement with

Sensor system and transmission device.

1 shows schematically a redundantly operating system with an electronic circuit arrangement 2, which comprises at least one control functionality.

It is known in electronic circuit arrangements, such as e.g. Control devices for motor vehicle brake systems to provide safety devices with which occurring errors can be detected in the system. Upon detection of such a fault, appropriate countermeasures can be taken and the control unit can be switched off or switched into an emergency mode. To detect faults, safety-related circuit parts are often redundant, i. several times, executed. A corresponding comparison of the functions of the multiply existing circuit parts indicates possible errors.

Therefore, in Fig. 1, a sensor system 4 is provided with two sensors which detect the same variable independently. The sensor information of the two sensors are contained in two received signals 6, which via a Transfer device, eg via two separate bus systems, the electronic circuitry 2 are passed.

The input signals 6 are first supplied to two input circuits 8 of the electronic circuit arrangement 2. However, the input circuits 8 serve merely to protect against possible overvoltages and are therefore to be regarded as optional, so that the input signals 6 are transferred to a microcontroller 10, in particular to a first peripheral component 12 of the microcontroller 10.

In the exemplary embodiment illustrated in FIG. 1, the received signals 6 are pulse-width-modulated signals of the sensor system 4. The sensors sense e.g. the way of the brake pedal and output this as an electrical signal pulse width modulated.

The first peripheral module 12 is preferably a pick-and-place unit that can pick up and compare signals. By comparing the input signals 6, the transmission device is checked for possible errors.

The first peripheral module 12 also has a first software module with associated software driver, whereby a brake request is determined from the sensor information and a corresponding release of the pressure control takes place.

However, the first peripheral device 12 has a systematic error, e.g. a faulty programming of the first software module, it may lead to a malfunction of the system, in particular of the microcontroller 10, despite the redundant transmission of the sensor information.

In order to exclude such common cause failures (CCF), which can affect simultaneously functionally independent paths in a system, an input signal 6 in a further input circuit 14 is converted into a test signal 16. According to the exemplary embodiment from FIG. 1, the further input circuit 14 is a low-pass filter with which the pulse-width-modulated input signal 6 is converted into an analog test signal 16. The test signal 16 thus differs from the input signal 6, but still has all the sensor information.

For further processing of the test signal 16, this is passed to a second peripheral module 18 of the microcontroller 10. The second peripheral module 18 is used for redundant signal processing of the microcontroller 10, i. the first peripheral module 12 and the second peripheral module 18 pursue the same processing target.

However, since the test signal 16 differs from the input signal 6, the second peripheral module 18 uses a second software module other than the first peripheral module 12 and another software driver for further processing the sensor information. Preferably, the second peripheral module 18 is essentially an analog-digital converter with subsequent processing of the digital signal.

A subsequent comparison of the determined brake request of the first peripheral module 12 with the determined brake request of the second peripheral module 18 advantageously enables the detection of a singular error cause in one of the peripheral modules 12, 18, if the result of the redundant signal processing of the two peripheral modules 12, 18 deviates significantly from one another.

However, the invention is not limited to the embodiment described above. Alternatively, instead of the pulse-width-modulated input signals 6, two redundantly transmitted analog current or voltage signals can also be transferred as input signals 6 of the electronic circuit arrangement 2. These analog current or voltage signals represent, for example, the brake pressure to be generated, which is predetermined by the actuation of the brake pedal. If analog input signals 6 of the electronic circuit arrangement 2 are present, they are processed in a first peripheral module 12 with the aim of releasing the pressure control if the received signals 6 were transmitted without errors.

In the further input circuit 14, a physically different test signal 16 is now generated from the analog input signal 6. By way of example, the test signal 16 is a pulse-width-modulated signal which is generated by means of a voltage-controlled oscillator and which is passed to the second peripheral module 18 for further processing.

Instead of a pulse width modulated signal, other types of modulation, such as e.g. Pulse frequency modulation, pulse amplitude modulation, pulse code modulation or pulse phase modulation, be provided or any other type of modulation, such. Amplitude modulation, angle modulation or frequency / phase modulation to transmit and / or convert the sensor signals.

In principle, it is possible to transfer any type of input signals 6 to an electronic circuit arrangement 2, wherein at least one input signal is converted into another test signal 16.

In order to ensure the functional safety of the system, in particular of the motor vehicle brake system, the software and hardware used in the microcontroller 10 for processing the sensor signals are tested for error-free operation in addition to the redundant transmission device to ensure error-free transmission of sensor signals by the input signal 6 is converted into another test signal 16 and the subsequent evaluation of the received signal 6 in a peripheral module 12 and the evaluation of the test signal 16 in an independent peripheral module 18 separately.

With the aid of the circuit arrangement 2 according to the invention, consequently, a high level of security of the system can be achieved. In doing so, the inventions The circuit arrangement 2 according to the invention can advantageously be realized with low production costs, since only one microcontroller 10 is used.

The invention thus complies with the new ISO (International Organization for Standardization) 26262 ("Road Vehicle - Functional Safety") standard, which is intended to ensure the functional safety of an electrical or electronic system in motor vehicles.

All mentioned in the foregoing description and in the claims characteristics can be combined both individually and in any combination with the features of the independent claims. The disclosure of the invention is therefore not limited to the described or claimed feature combinations. Rather, all in the context of the invention meaningful combinations of features are to be regarded as disclosed.

Claims

Expectations

Method for redundant signal processing of a safety-relevant application, in particular a safety control unit within a motor vehicle, wherein at least two redundant signals for processing sensor information are supplied from at least one sensor (4) as input signals (6) to an electronic circuit arrangement (2), of which at least one input signal (6) is processed in a peripheral module (12) of a microcontroller (10) of the electronic circuit arrangement (2),

characterized in that

at least one input signal (6) is converted into a test signal (16), the test signal (16) differing from the input signal (6) but retaining the sensor information,

the test signal (16) is fed to a further peripheral module (18) of the microcontroller (10) for processing the sensor information of the test signal (16) and

the processing of the sensor information of the input signal (6) in a peripheral module (12) of the microcontroller (10) and the processing of the test signal (16) in a further peripheral module (18) of the microcontroller (10) are carried out independently of each other and redundantly.

Electronic circuit arrangement, in particular a safety control unit of a motor vehicle, for redundant signal processing for safety-relevant applications with at least one microcontroller (10) with at least one peripheral module (12) for processing at least one received signal (6) of at least one sensor (4), characterized by

at least one input circuit (14), which is designed to receive an input signal (6) of the circuit arrangement

(2) to convert into a test signal (16), the test signal (16) being different from the input signal (6) and

at least one further peripheral module (18) of the microcontroller (10), which is designed in such a way as to transmit signals contained in the test signal (16). to process sensor information, wherein the processing of the sensor information of the input signal (6) in a peripheral module (12) of the microcontroller (10) and the processing of the test signal (16) in a further peripheral module (18) of the microcontroller (10) are carried out independently and redundantly .

3. Electronic circuit arrangement according to claim 2,

characterized in that

the peripheral components (12, 18) of the microcontroller (10) have different software modules with different software drivers for redundant signal processing.

4. Electronic circuit arrangement according to claim 2 or 3,

characterized in that

the input circuit (14), which converts the input signal (6) into an analog test signal (16), is a low-pass filter if the input signal (6) is a pulse width modulated signal or

the input circuit (14), which converts the input signal (6) into a pulse width modulated test signal (16), has a voltage-controlled oscillator (VCO) if the input signal (6) is an analog voltage or current signal.

5. Electronic circuit arrangement according to one of claims 2 to 4, characterized in that

in the event of significant deviations between the redundantly processed sensor information of the input signal (6) and the test signal (16), the control systems affected by the deviating data are transferred to a safe operating mode.

6. Motor vehicle braking system

marked by

Means for carrying out the steps of a method according to claim 1 and/or

at least one electronic circuit arrangement (2) according to one of claims 2 to 5.

7. Motor vehicle with an electronic circuit arrangement (2), in particular a safety control unit, according to one of claims 2 to 5 and / or

a motor vehicle brake system according to claim 6 and/or

Means for carrying out the steps of a method according to claim 1.

8. Use of an electronic circuit arrangement (2) for redundant signal processing of a safety-relevant application, characterized in that

the electronic circuit arrangement (2) is designed according to one of claims 2 to 5 or

the electronic circuit arrangement (2) is used for redundant signal processing in a motor vehicle brake system according to claim 6 and/or in a motor vehicle according to claim 7.