EP4702456A1

EP4702456A1 - Control integrated circuit for a computing unit and computing unit for a motor vehicle

Info

Publication number: EP4702456A1
Application number: EP24722265.6A
Authority: EP
Inventors: Mena NAGIUB
Original assignee: Valeo Schalter und Sensoren GmbH
Current assignee: Valeo Schalter und Sensoren GmbH
Priority date: 2023-04-28
Filing date: 2024-04-26
Publication date: 2026-03-04
Also published as: KR20260003786A; WO2024223861A1; CN121039638A; DE102023111017A1

Abstract

A control integrated circuit (3) for a computing unit (2) of a motor vehicle (1) comprises a watchdog unit (12), which is connectable to a first data processing device (4, 5, 18) to receive a first watchdog refresh signal and to a second data processing device (4, 5, 18) to receive a second watchdog refresh signal. The watchdog unit (12) is configured to determine, based on the watchdog refresh signals, whether a local failure of the first or the second data processing device (4, 5, 18) and whether a global failure is present. The watchdog unit (12) is configured to trigger a safety measure for the first or the second data processing device (4, 5, 18) in case of a respective local failure and a global safety measure in case of the global failure.

Description

2022PF01909 1 Control integrated circuit for a computing unit and computing unit for a motor vehicle The present invention is directed to a control integrated circuit for a computing unit of a motor vehicle and to a computing unit for a motor vehicle comprising such a control integrated circuit. Computing units of motor vehicles, such as electronic control units, ECUs, and in particular zone control units, ZCUs, or domain control units, DCUs, may be equipped with more than one data processing device, such as microcontrollers, ethernet switches, low- power backup processors, and so forth. It is desirable to monitor each of these data processing devices in view of failures or malfunctions and, if such are detected, initiate suitable safety measures. Providing individual monitoring systems for each data processing device leads to unnecessary redundancies und thus may increase costs, required space, and power consumption. Furthermore, individual monitoring systems may not allow for a synchronized or global monitoring of all relevant data processing devices. It is an objective of the present invention to overcome said drawbacks at least in part. This objective is achieved by the respective subject matter of the independent claims. Further implementations and preferred embodiments are subject matter of the dependent claims. The invention is based on the idea to provide a single control integrated circuit, IC, which contains a multi-channel watchdog unit for monitoring at least two data processing devices of a computing unit for a motor vehicle. According to an aspect of the invention, a control IC for a computing unit of a motor vehicle is provided. The control IC comprises a multi-channel watchdog unit, which is connectable or connected to a first data processing device of the computing unit, and which is configured to receive a first watchdog refresh signal from the first data processing device. The multi-channel watchdog unit is connectable or connected to a second data processing device of the computing unit and configured to receive a second watchdog refresh signal from the second data processing device. The multi-channel watchdog unit is 2022PF01909 2 configured to determine, based on the first watchdog refresh signal and based on the second watchdog refresh signal whether a local failure of the first data processing device is present and whether a local failure of the second data processing device is present and whether a global failure affecting the first data processing device and the second data processing device is present. The multi-channel watchdog unit is configured to trigger a safety measure for the first data processing device in case the local failure of the first data processing device is present, to trigger a safety measure for the second data processing device in case the local failure of the second data processing device is present and to trigger a global safety measure for the first data processing device and the second data processing device in case the global failure is present. A computing unit may in particular be understood as a data processing device, which comprises processing circuitry. The computing unit can therefore in particular process data to perform computing operations. This may also include operations to perform indexed accesses to a data structure, for example a look-up table, LUT. In particular, the computing unit may include one or more computers, one or more microcontrollers, and/or one or more integrated circuits, for example, one or more application-specific integrated circuits, ASIC, one or more field-programmable gate arrays, FPGA, and/or one or more systems on a chip, SoC. The computing unit may also include one or more processors, for example one or more microprocessors, one or more central processing units, CPU, one or more graphics processing units, GPU, and/or one or more signal processors, in particular one or more digital signal processors, DSP. The computing unit may also include a physical or a virtual cluster of computers or other of said units. In various embodiments, the computing unit includes one or more hardware and/or software interfaces and/or one or more memory units. A memory unit may be implemented as a volatile data memory, for example a dynamic random access memory, DRAM, or a static random access memory, SRAM, or as a non- volatile data memory, for example a read-only memory, ROM, a programmable read-only memory, PROM, an erasable programmable read-only memory, EPROM, an electrically erasable programmable read-only memory, EEPROM, a flash memory or flash EEPROM, a ferroelectric random access memory, FRAM, a magnetoresistive random access memory, MRAM, or a phase-change random access memory, PCRAM. 2022PF01909 3 A data processing device may for example be a microcontroller unit or a system-on-a- chip, SOC, an ethernet switch, a processor, a hardware accelerator, a data processing peripheral, et cetera. The first data processing device may be external to the control IC or may be a part of the control IC. In the latter case, the first data processing device is connected to the multi- channel watchdog unit, while in the former case it is connected or connectable to the multi-channel watchdog unit via a corresponding terminal or pin of the control IC. The second data processing device may be external to the control IC or may be a part of the control IC. In the latter case, the second data processing device is connected to the multi- channel watchdog unit, while in the former case it is connected or connectable to the multi-channel watchdog unit via a corresponding terminal or pin of the control IC. The multi-channel watchdog unit is denoted as multi-channel, since it is receiving at least the first watchdog refresh signal and the second watchdog refresh signal and triggers the respective safety measures depending on them. The multi-channel watchdog unit may for example operate according to the functionality of a timeout watchdog or a window watchdog or a more complex implementation. The multi- channel watchdog unit is, in particular, a hardware unit, also denoted as hardware watchdog. The safety measure for the first data processing device may for example include resetting, turning off or restarting the first data processing device. The safety measure for the second data processing device may for example include resetting, turning off, or restarting the second data processing device. The global safety measure may for example include resetting, turning off or restarting the first data processing device and the second data processing device. However, depending on the actual implementation, that safety measures may also include further actions affecting additional components of the control IC or the computing unit, for example a transfer of responsibilities or tasks, an activation or deactivation of certain components or backup systems, et cetera. In particular, the local failures of the first second data processing device and the second data processing device, respectively, may be software-related failures or malfunctions, in particular of the respective data processing device. 2022PF01909 4 For triggering a corresponding safety measure, the multi-channel watchdog unit may send one or more respective commands or signals to an control unit of the control IC and the control unit may for example initiate or cause the respective safety measure in response to the one or more respective commands or signals. By means of the control IC according to the invention, two or more data processing devices may be monitored at the same time by a single IC. In particular, the multi-channel watchdog system allows providing watchdog functionality for the first data processing device and the second data processing device, which may for example be a main microcontroller of the computing unit, an ethernet switch or a low-power processing core, which may be for example integrated in the control IC in some implementations. The multi-channel watchdog unit may, in particular, be able to synchronize the watchdog functionality between the first and the second data processing device and, in some implementations, even one or more further data processing devices. The multi-channel watchdog unit may trigger individual resets for each data processing device individually in case of local failures and can also trigger a reset or another global safety measure for all data processing devices in case of a global failure. According to several implementations of the control IC, the multi-channel watchdog unit is connectable or connected to a third data processing device of the computing unit. The third data processing device may be external to the control IC or may be integrated in the control IC in some implementations. The third data processing device may be external to the control IC or may be a part of the control IC. In the latter case, the third data processing device is connected to the multi- channel watchdog unit, while in the former case it is connected or connectable to the multi-channel watchdog unit via a corresponding terminal or pin of the control IC. According to several implementations, the multi-channel watchdog unit receives a third watchdog refresh signal from the third data processing device and is configured to determine whether a local failure of the first data processing device is present and whether the local failure of the second data processing device is present and whether a local failure of the third data processing device is present and weather a global failure affecting the first data processing device and the second data processing device and the third data processing device is present, based on the first watchdog refresh signal and the 2022PF01909 5 second watchdog refresh signal and the third watchdog refresh signal. The multi-channel watchdog unit is configured to trigger a safety measure for the third data processing device in case the local failure for the third data processing device is present. Furthermore, the global safety measure may be a global safety measure for the first data processing device, the second data processing device and third data processing device. The concepts described for the third data processing device can analogously be extended to more than three data processing devices of the computing unit. According to several implementations, the multi-channel watchdog unit is configured to determine a temporal receiving sequence of the first watchdog refresh signal and the second watchdog refresh signal and, in some implementations, of the third watchdog refresh signal. The multi-channel watchdog unit is configured to determine whether the local failure of the first data processing device, the local failure of the second data processing device and/or the global failure is present depending on the temporal receiving sequence. In some implementations, the watchdog unit is configured to determine whether the local failure of the third data processing device is present depending on the temporal receiving sequence. In particular, the multi-channel watchdog signal may distinguish between the global failure and the various local failures depending on the temporal receiving sequence. In this way, more differentiated safety measures may be triggered. According to several implementations, the control IC comprises a multi-channel safety- monitoring unit. The multi-channel safety-monitoring unit is connectable or connected to the first data processing device to receive a first error signal from the first data processing device and is connectable or connected to the second data processing device to receive a second error signal from the second data processing device. The multi-channel safety- monitoring unit is configured to determine, based on the first error signal and the second error signal, whether a further local failure of the first data processing device is present and whether a local failure of the second data processing device is present and whether a further global failure affecting the first data processing device and the second data processing device is present. The multi-channel safety-monitoring unit is configured to trigger at least one further safety measure for the control IC and/or the computing unit depending on the respective presence of the further local failure of the first data processing device, the further local failure of the second data processing device and the further global failure. 2022PF01909 6 In case the first data processing device is a part of the control IC, the first data processing device is connected to the multi-channel safety-monitoring unit, otherwise it is connected or connectable to the multi-channel safety-monitoring unit via a corresponding terminal or pin of the control IC. The same holds analogously for the second data processing device. For example, the first data processing device and the second data processing device may be transmitting the error signal to the multi-channel safety-monitoring unit in case they have detected a respective failure of the respective data processing device. In other words, the error signals then indicate the presence of a corresponding failure. Therefore, the multi-channel safety-monitoring unit can monitor different types of failure compared to the multi-channel watchdog unit. The further safety measure for the control IC and/or the computing unit may for example include resetting, turning off or restarting the respective data processing device. Alternatively or in addition, the further safety measure may include activating or deactivating or resetting further components of the control IC and/or the computing unit accordingly. In this way, a more failure monitoring may be achieved by a single control IC. According to several implementations, wherein the computing unit or the control IC comprises the third data processing device, the multi-channel safety-monitoring unit is be connected or connectable to the first data processing device and the third data processing device instead of being connected to the first data processing device and the second data processing device. The corresponding explanations above regarding the second data processing device carry over analogously to the third data processing device. Furthermore, the concepts described for the first, second or third data processing device can analogously be extended to more than three data processing devices of the computing unit. In further implementations, the multi-channel safety-monitoring unit is connectable or connected to the first data processing device, the second data processing device and the third data processing device to receive respective error signals from each of the data processing devices. The multi-channel safety-monitoring unit may then for example 2022PF01909 7 additionally determine whether a further local failure of the third data processing device is present and if so, trigger the at least one further safety measure accordingly. In case the third data processing device is a part of the control IC, the third data processing device is connected to the multi-channel safety-monitoring unit, otherwise it is connected or connectable to the multi-channel safety-monitoring unit via a corresponding terminal or pin of the control IC. For triggering a corresponding further safety measure, the multi-channel safety-monitoring unit may send one or more respective commands or signals to the control unit and the control unit may for example initiate or cause the respective further safety measure in response to the one or more respective commands or signals. According to several implementations, the control IC comprises a wake-up system. The wake-up system is connected to at least one wake-up terminal of the control IC and configured to receive at least one wake-up signal at the at least one wake-up terminal. The wake-up system is configured to trigger a wake up of the first data processing device and/or of the second data processing device and/or of the third data processing device, if applicable, depending on the at least one wake-up signal. The at least one wake-up terminal may be connected to at least one wake-up source, which is located externally to the control IC and, for example, also externally to the computing unit, for example corresponds to a further component of the motor vehicle. The at least one wake-up source may provide the at least one wake-up signal at the at least one wake-up terminal. In this way, wake-up commands from different wake-up sources, which may be directed to different data processing devices, may be managed by a single control IC. According to several implementations, the at least one wake-up signal comprises two or more wake-up signals and the wake-up system is configured to identify a respective wake-up source based on each wake-up signal of the two or more wake-up signals. The wake-up system is configured to prioritize the two or more wake-up signals according to a predefined priority, in particular a predefined priority of the identified wake-up sources, 2022PF01909 8 and to trigger the wake-up of the first data processing device and/or of the second data processing device depending on the prioritized wake-up signals. For example, a time sequence of waking up the first data processing device and/or the second data processing device and/or, for example, further components of the control IC or the computing unit, may be determined depending on the prioritized wake-up signals. The concepts described for the first, second or third data processing device can analogously be extended to more than three data processing devices of the computing unit. According to several implementations, the control IC comprises a power management unit, which is connected to a power supply terminal of the control IC and configured to control, in particular to supervise and/or monitor, a power supply of the first data processing device and the second data processing device and, if applicable the third data processing device. In particular, the power management unit receives electrical power at the power terminal from an external power supply unit and controls the supply of the first and the second data processing device and, if applicable, the third data processing device, with the received electrical power. Consequently, the power management unit may ensure that each of the data processing devices receives the electrical power with the appropriate voltage levels and current levels et cetera. The control IC may for example comprise one or more power rails and the power management unit may control the power supply of the first data processing device and the second data processing device and, if applicable, the third data processing device, via the one or more power rails. The power management unit monitors, in some implementations, power failures of the different data processing devices and for example trigger respective safety measures in case of power failures. The power management unit monitors, in some implementations, a temperature and/or a voltage and/or a current of the respective data processing devices and reacts accordingly. 2022PF01909 9 The concepts described for the first, second or third data processing device can analogously be extended to more than three data processing devices of the computing unit. According to several implementations, the control IC comprises the second data processing device as an internal processing device or the third data processing device as the internal data processing device. The internal data processing device may for example be a low-power processing core or a low-power microcontroller or the like. The internal data processing device may for example be used to handle low-power functions, maintain the required power output for safety-critical power outputs, et cetera. For example, when there is a global failure or a local failure or a further global failure or a further local failure as described above, the internal data processing device may be activated directly, for example by the control unit, to start as soon as possible to handle the required activities. According to several implementations, the control IC comprises the control unit, which is configured to activate the internal data processing device in response to the triggering of the at least one further safety measure by the multi-channel safety-monitoring unit. In other words, the at least one further safety measure consists of or comprises activating the internal data processing device. Alternatively or in addition, the control unit may be configured to activate the internal data processing device in response to the triggering of the safety measure for the first data processing device by the multi-channel watchdog unit and/or in response to the triggering of the safety measure for the second data processing device by the multi-channel watchdog unit and/or in response to the triggering of the global safety measure by the multi-channel watchdog unit. According to several implementations, the control IC comprises a debugging interface for debugging the internal data processing device. The debugging interface is accessible from outside of the control IC. 2022PF01909 10 In particular, a debugging unit may be connected to the internal data processing unit via the debugging interface to carry out the debugging. The debugging interface may for example be a so-called JTAG interface. In other words, the debugging interface may be standardized according to the industrial standard IEEE 1149.1, which is commonly denoted as JTAG. According to several implementations, the internal data processing device comprises at least one data interface, which is connected to a data terminal of the control IC. The data terminal may be connected to external devices for establishing respective communication channels with the internal data processing device. According to a further aspect of the invention, a computing unit for a motor vehicle is provided. The computing unit comprises a control IC according to the invention. As far as not already contained by the control IC, the computing unit further comprises the first data processing device and the second data processing device. According to several implementations of the computing unit, the first data processing device is implemented as a microcontroller, also denoted as microcontroller unit, MCU. In other implementations, the first data processing device is implemented as a system-on- a-chip or as an advanced computing unit, for example a graphics processing unit, GPU. According to several implementations, the second data processing device is implemented as an ethernet switch. According to several implementations of the computing unit, the computing unit comprises the first data processing device, which is implemented as a microcontroller and arranged externally to the control IC, the second data processing device, which is implemented as the ethernet switch and is arranged outside the control IC, and the control IC comprises the third data processing device as an internal data processing device. According to several implementations, the computing unit is implemented as an electronic control unit, ECU, a zone control unit, ZCU, or a domain control unit, DCU. 2022PF01909 11 If it is mentioned in the present disclosure that a component of the control IC or the computing unit according to the invention, is adapted, configured or designed et cetera, to perform or realize a certain function, to achieve a certain effect or to serve a certain purpose, this can be understood such that the component, beyond being usable or suitable for this function, effect or purpose in principle or theoretically, is concretely and actually capable of executing or realizing the function, achieving the effect or serving the purpose by a corresponding adaptation, programming, physical design and so on. Further features of the invention are apparent from the claims, the figures and the figure description. The features and combinations of features mentioned above in the description as well as the features and combinations of features mentioned below in the description of figures and/or shown in the figures may be comprised by the invention not only in the respective combination stated, but also in other combinations. In particular, embodiments and combinations of features, which do not have all the features of an originally formulated claim, may also be comprised by the invention. Moreover, embodiments and combinations of features, which go beyond or deviate from the combinations of features set forth in the recitations of the claims may be comprised by the invention. In the following, the invention will be explained in detail with reference to specific exemplary implementations and respective schematic drawings. In the drawings, identical or functionally identical elements may be denoted by the same reference signs. The description of identical or functionally identical elements is not necessarily repeated with respect to different figures. In the figures, Fig.1 shows schematically a motor vehicle with an exemplary implementation of a computing unit according to the invention; and Fig.2 shows a schematic block diagram of an exemplary implementation of a control IC according to the invention. Fig.1 shows schematically a motor vehicle 1 with an exemplary implementation of a computing unit 2 according to the invention. 2022PF01909 12 The computing system 2 may for example be implemented as a ZCU and may for exam- ple be adapted for controlling one or more sensors 7 of the motor vehicle 1 and/or further components 6 of the motor vehicle 1. The computing system 2 comprises an exemplary implementation of a control IC 3 ac- cording to the invention. The computing system 2 comprises a first data processing device 4, for example a main microcontroller, and a second data processing device 5, for exam- ple an ethernet switch. The first data processing device 4 and/or the control IC 3 may for example output data and/or control signals via an output module 8 of the computing unit 2, which comprises for example one or more switching devices, such as MOSFETs, in par- ticular so-called smart MOSFETs. The control IC 3 may for example comprise a data terminal, which is connected to one or more network transceivers 9, for example CAN transceivers, LIN transceivers, and/or ethernet transceivers, of the computing unit 2 for receiving data from one or more commu- nication systems, for example communication busses, of the motor vehicle 1. The control IC 3 may for example comprise a wakeup terminal, which is connected to one or more wakeup switches 10 of the computing unit 2 for receiving respective wakeup signals from one or more wakeup sources of the motor vehicle 1. The control IC 3 may for example comprise a power supply terminal, which is connected to a battery line filter 11 of the com- puting unit 2 for receiving electric power from a power source of the motor vehicle 1, for example via a KL30 line. The control IC 3 comprises a multi-channel watchdog unit 12 (see Fig.2), which is connected to the first data processing device 4 to receive a first watchdog refresh signal from the first data processing device 4. The multi-channel watchdog unit 12 is connected to the second data processing device 5 to receive a second watchdog refresh signal from the second data processing device 5. The multi-channel watchdog unit 12 is configured to determine, based on the first watchdog refresh signal and the second watchdog refresh signal, whether a local failure of the first data processing device 4 is present and whether a local failure of the second data processing device 5 is present and whether a global failure affecting the first data processing device 4 and the second data processing device 5 is present. The multi-channel watchdog unit 12 is configured to trigger a safety measure for the first data processing device 4 in case the local failure of the first data processing device 4 is present, to trigger a safety measure for the second data processing device 5 in case the local failure of the second data processing device 5 is present, and to trigger a 2022PF01909 13 global safety measure for the first data processing device 4 and the second data processing device 5 in case the global failure is present. Fig.2 shows schematically a block diagram of a further exemplary implementation of a computing unit 2 according to the invention, which is based on the computing unit 2 of Fig.1. In this implementation, the control IC 3 may be used as an extended power management IC with features that can overcome several limitations of the prior art. The control IC 3 may for example support power management and power supply at least for the first data processing device 4 and the second data processing device 5. The control IC 3 may for example provide watchdog support and safety state monitoring at least for the first data processing device 4 and the second data processing device 5. The control IC 3 may for example provide battery failure monitoring or power failure monitoring. The control IC 3 may for example monitor different wakeup sources, prioritize them and provide information about the wakeup source. The control IC 3 may for example power the external network transceivers 9 to enable independent wakeup source monitoring. The control IC 3 may act as a main power supply system for the complete computing unit 2 and/or may handle the wakeup management, failure monitoring, and/or safety monitoring. The control IC 3 may comprise an integrated third data processing device 18, which may be a low-power limb home system that can react to fast limp home wakeup functions and treatments, for example. The control IC 3 may contain a power management unit 15, which may act as a main power distribution source inside the control IC 3. It may provide power to power rails 16a, 16b of the control IC 3 to distribute the power to further interfaces. It may monitor the respective power drains and monitors the temperature, voltage and current, in particular to detect conditions of too high temperature, voltage and/or current, for the first data processing device 4 and/or the second data processing device 5 and/or the third data processing device 18. For example, an control unit 17 of the control IC 3 may be connected to the first data processing device 4 and may be configured through a serial peripheral interface, SPI, to configure the respective features of the control IC 3, for example the power management 2022PF01909 14 unit 15, the multi-channel watchdog unit 12, a wakeup system 14 of the control IC 3, the third data processing device 18, and/or a multi-channel safety-monitoring unit 13 of the control IC 3. The wakeup system 14 may accepts wakeup signals from different sources, prioritize them, and store information about the wakeup sources. It may wake for example the first data processing device 4 and/or the second data processing device 5 and/or the third data processing device 18. The multi-channel watchdog unit 12 allows providing watchdog functionality for several devices including the first data processing device 4 and/or the second data processing device 5 and/or the third data processing device 18. The multi-channel watchdog unit 12 may synchronize the watchdog functions between the different devices and can trigger individual reset signals for any of the data processing devices 4, 5, 18 individually in case of respective local failures and can also trigger a reset of all data processing devices 4, 5, 18 together in case of a global failure. The multi-channel safety-monitoring unit 13 may monitor respective safety signals or error signals for several devices including the first data processing device 4 and/or the second data processing device 5 and/or the third data processing device 18. The multi-channel safety-monitoring unit 13 may synchronize the safety-monitoring function between the different devices and can trigger safe-states for any of the data processing devices 4, 5, 18 individually in case of respective local failures and/or can trigger a safe-state for all data processing devices 4, 5, 18 together in case of global failure. The third data processing device 18 may be a low-power core device, for example a low- power microcontroller. It may comprise an analog-to-digital converter, ADC, 22, a DIN interface 21, an output interface 27, a timer 24, a LIN transceiver 23, a CAN transceiver 20, a random access memory, RAM, 26, and/or a read-only memory, ROM, 25. The control IC 3 may comprise one or more ports 19 connected for example to the DIN interface 21, the ADC 22, the timer 24, and/or the output interface 27. The control IC 3 may comprise a debugging interface 28, for example a JTAG interface, which can be used to program the third data processing device 18 with a firmware, for example a specific firmware that can be executed for fast boot scenarios and/or limp 2022PF01909 15 home scenarios. For example, the third data processing device 18 can monitor the CAN transceiver 20 and the LIN transceiver 23. When there is a global failure or a local failure, third data processing device 18 can for example be activated directly by the control unit 17 to start as soon as possible with handling the required limp home activities. The control IC 3 is for example powered directly from the KL30 line. The control IC 3 may power the data processing devices 4, 5, 18 or put them in low-power modes based on individual configurations for each of the data processing devices 4, 5, 18. The control IC 3 may also power the network transceivers 9 and monitor their wakeup sources. By means of the control IC 3, several additional components may be saved, such as individual power management ICs, which would have to be configured individually with their own watchdogs and safety monitors. The control IC 3 may synchronize a global watchdog concept and global safety concept.

Claims

2022PF01909 16 Claims 1. Control integrated circuit (3) for a computing unit (2) of a motor vehicle (1), the control integrated circuit (3) comprising a multi-channel watchdog unit (12), which is - connectable to a first data processing device (4, 5, 18) of the computing unit (2) to receive a first watchdog refresh signal from the first data processing device (4, 5, 18) and to a second data processing device (4, 5, 18) of the computing unit (2) to receive a second watchdog refresh signal from the second data processing device (4, 5, 18); - configured to determine, based on the first watchdog refresh signal and the second watchdog refresh signal, whether a local failure of the first data processing device (4, 5, 18) is present and whether a local failure of the second data processing device (4, 5, 18) is present and whether a global failure affecting the first data processing device (4, 5, 18) and the second data processing device (4, 5, 18) is present; and - configured to trigger a safety measure for the first data processing device (4, 5, 18) in case the local failure of the first data processing device (4, 5, 18) is present, to trigger a safety measure for the second data processing device (4, 5, 18) in case the local failure of the second data processing device (4, 5, 18) is present, and to trigger a global safety measure for the first data processing device (4, 5, 18) and the second data processing device (4, 5, 18) in case the global failure is present and comprising a wakeup system (14), which is - connected to at least one wakeup terminal of the control integrated circuit (3) and configured to receive at least one wakeup signal at the at least one wakeup terminal; and - configured to trigger a wakeup of the first data processing device (4, 5, 18) and/or of the second data processing device (4, 5, 18) depending on the at least one wakeup signal. 2. Control integrated circuit (3) according to claim 1, wherein the multi-channel watchdog unit (12) is configured to determine a temporal receiving sequence of the first watchdog refresh signal and the second watchdog refresh signal and to 2022PF01909 17 determine whether the local failure of the first data processing device (4, 5, 18), the local failure of the second data processing device (4, 5, 18) and/or the global failure is present depending on the temporal receiving sequence. 3. Control integrated circuit (3) according to one of the preceding claims comprising a multi-channel safety-monitoring unit (13), which is - connectable to the first data processing device (4, 5, 18) to receive a first error signal from the first data processing device (4, 5, 18) and connectable to the second data processing device (4, 5, 18) to receive a second error signal from the second data processing device (4, 5, 18); and - configured to determine, based on the first error signal and the second error signal, whether a further local failure of the first data processing device (4, 5, 18) is present and whether a further local failure of the second data processing device (4, 5, 18) is present and whether a further global failure affecting the first data processing device (4, 5, 18) and the second data processing device (4, 5, 18) is present; and - configured to trigger at least one further safety measure for the control integrated circuit (3) and/or the computing unit (2) depending on the respective presence of the further local failure of the first data processing device (4, 5, 18), the further local failure of the second data processing device (4, 5, 18), and the further global failure. 4. Control integrated circuit (3) according to claim 1, wherein the at least one wakeup signal comprises two or more wakeup signals and the wakeup system (14) is configured to - identify a respective wakeup source based on each wakeup signal of the two or more wakeup signals; - prioritize the wakeup signals according to a predefined priority of the identified wakeup sources; and - trigger the wakeup of the first data processing device (4, 5, 18) and/or of the second data processing device (4, 5, 18) depending on the prioritized wakeup signals. 5. Control integrated circuit (3) according to one of the preceding claims, comprising a power management unit (15), which is connected to a power supply terminal of the control integrated circuit (3) and configured to control a power supply of the first data processing device (4, 5, 18) and the second data processing device (4, 5, 18). 2022PF01909 18 6. Control integrated circuit (3) according to one of the preceding claims, wherein the control integrated circuit (3) comprises the second data processing device (4, 5, 18) as an internal data processing device (18) or a third data processing device (4, 5, 18) as the internal data processing device (18). 7. Control integrated circuit (3) according to claim 6, comprising a control unit (17), which is configured to activate the internal data processing device (18) in response to the triggering of the safety measure for the first data processing device (4, 5, 18) by the multi-channel watchdog unit (12) and/or in response to the triggering of the global safety measure by the multi-channel watchdog unit (12). 8. Control integrated circuit (3) according to claims 6 and 3, comprising a control unit (17), which is configured to activate the internal data processing device (18) in response to the triggering of the at least one further safety measure by the multi- channel safety-monitoring unit (13). 9. Control integrated circuit (3) according to one of claims 6 to 8, comprising a debugging interface (28) for debugging the internal data processing device (18), which is accessible from outside of the control integrated circuit (3). 10. Control integrated circuit (3) according to one of claims 6 to 9, wherein the internal data processing device (18) comprises at least one data interface (20, 23), which is connected to a data terminal of the control integrated circuit (3). 11. Computing unit (2) for a motor vehicle (1) comprising a control integrated circuit (3) according to one of the preceding claims, the first data processing device (4, 5, 18) and the second data processing device (4, 5, 18). 12. Computing unit (2) according to claim 11, wherein - the first data processing device (4, 5, 18) is implemented as a microcontroller or a system-on-a-chip or a graphics processing unit; and/or - the second data processing device (4, 5, 18) is implemented as an ethernet switch. 2022PF01909 19 13. Computing unit (2) according to one of the preceding claims, wherein the computing unit (2) is implemented as an electronic control unit, a zone control unit, or a domain control unit.