FR2658335A1 - COMPUTER SYSTEM, IMPLEMENTED IN SAFETY DEVICES APPLIED TO MOTOR VEHICLES. - Google Patents

Abstract

a) Computer system implemented in safety devices applied to motor vehicles, b) Computer system characterized in that it is equipped with an additional unit emitting signals, which eliminates at least one of the calculation units by a reset pulse, independent of the initialization reset signal. c) The invention relates to computer systems implemented in safety devices applied to motor vehicles.

Description

"Calculator system, implemented in

  safety measures applied to motor vehicles

the"

  The invention relates to a computing system

  with at least two computing units that are

  connected by at least one link system for

  put the exchange of data and / or communication signals

  or control, and who, when putting into service

  vice, are initialized by a reset signal, this computer system being equipped with at least one means for detecting defective states of the calculation units, and in the case where one of the calculation units is in a state defective, this unit is put back into service by a reset signal

initial.

  Such a computer system for controlling

  an operating parameter of a combustion engine

  The internal version of a motor vehicle is known from German Offenlegungsschrift No. 3,726,489. This document proposes a computer system consisting of two processors which are connected by means of a connection system for data exchange of the two control control signals For the mutual monitoring of the two processors, each processor is

  equipped with what is known as a surge device

  valiance, who delivers to another calculator respec-

  tif, control signals with which this

  The computer can check the ability to

  the computer emitting the control signal.

  A second monitoring path is constituted in the case of such a system with two computers, by the

  data transmission between the two processors.

  This data transmission is done cyclically according to a fixed time frame, and in the absence of a transmission or a data request from one of the two computers closes the other computer at least on a defect of operation and starts the faulty computer again via a reset pulse (hot restart) When the computer system is put into operation, an initialisation pulse common to both computers (power on) is issued and simultaneously returns both computers to the state

  initial for their initialization (cold start).

  The disadvantage of such a provision is that the system

  computer system can not be activated

  properly when the initialization pulse

  or the circuit device producing this pulse is affected by a fault If the computer system is used to control the critical safety functions of an internal combustion engine and / or a motor vehicle, there is the risk that in such a case of default, we may have a state of

  critical walking for safety.

  The object of the invention is therefore to improve

  improve the availability of such a system of

  For this purpose, an additional unit is

  signal emitter, which eliminates at least one of the computation units by a reset pulse independent of the initialization reset signal. DE-OS 37 90 885 discloses a circuit device for generating an initialization or reset pulse. This circuit device serves, on the one hand, to reset a computer system during a first power on, and, secondly, to reset the computer system during an undervoltage, that is to say when lowering the operating voltage

  below a predefined value In addition, the dis-

  positive circuit thus proposed generates a reset signal which, during a failure of a computer, is triggered by a computer in

  able to start the calibration again.

  culator who is not able to function.

  The invention has the advantage that in case of

  failure of the circuit device generating the

  initiating or resetting pulse, correct commissioning of the

  calculator is made possible by an additional unit

  independent of this circuit device Defective commissioning and a critical situation

  for the resulting safety, can thus be

effectively.

  In combination with the known process

  the state of the art of monitoring such a system

  me the calculator, the additional unit can be

  realized in a simple and economical way.

  Other advantages of the invention result from other characteristics of the latter in conjunction

  with the exemplary embodiment described below.

  According to one characteristic of the invention, the independent reset pulse is delivered during the commissioning of the computer system.

  According to another characteristic of the invention

  the additional unit is directly dependent

of the supply voltage.

  According to another characteristic of the invention, only one computing unit is powered by the

  independent reset signal.

  According to another characteristic of the invention

  the calculating unit fed by the sup-

  reset operation detects faulty operation of the other unit and starts the unit again when faulty operation

is detected.

  According to yet another characteristic of

  the invention, the additional unit is essential-

  constituted by an element of differentiation,

  preferably an RC element (resistance-capacitance).

  The invention will be explained hereinafter to help

  of an exemplary embodiment shown in the drawings

attached.

  FIG. 1 shows an example of a system of two computers represented in the form of a block diagram and including an additional reset unit, FIG. 2 is an overall functional diagram of the cooperation of the monitoring of the computer. calculator and the additional reset unit during system commissioning

calculator.

  Figure 3 shows a form of

  simple approach from the point of view of

  the economic and

reset.

  As an example, Figure 1 shows a dual calculator system that is designed to ensure

  certain functions in the motor vehicle.

  For example, such dual computer systems can

  be implemented in safety devices.

  such as airbags or belt tensioners

  tures, or they can be used for

  and / or the regulation of operating parameters

  the internal combustion engine of a motor vehicle, for example in an electronic control system

the power of the engine.

  The two calculation units 10 and 20 are connected via a connection system. Such a connection system can comprise links for the data, addressing links and / or control links. The connection system 30 is used to exchange data, addresses and / or control or control signals by means of which

  is commanded the communication between the two calcula-

  The two calculation units 10 and 20 are equi-

  of what are known as surge devices

  12, 22 The two device units

  are interconnected via two links 32, 33, the link 32 carrying the

  signal from the monitoring device-unit

  launches 12 and the 33 link the one coming from

  unit-monitoring device 22.

  The link 32 is further connected by the

  This combination stage 36, which corresponds to an OR logic function, is connected by its second input to an output 37 of the communication unit 36.

  calculation 10 The output link 38 of the communication stage

  Binding 36 constitutes the input link of a second combination stage 40 whose second input is combined, via a link 41, with a circuit device 42 for forming a reset pulse. initial state or signaling pulse The output link 43 of the combination stage 40 also provides a logic function

  OR is connected to the input 44 of the computing unit 20.

  In a similar way, the link 33 is connected via a switching unit 46 to a third combination stage 48, whose second input is combined with an output 50 of the computing unit 20. 52 of the combination stage 48 is connected to the input 54 of a unit 56 for the formation of an independent reset pulse At another input 58, the unit 56 is connected by the intermediate of the link 41 to the unit 42 for the formation of a reset pulse or initialization pulse A third input 60 of the unit 56 is supplied by the link 62 which constitutes at the same time the input link of unit 42 which

  brings the supply voltage of the system

  tie 64 of unit 56 is finally connected to entrance 66 of

the computing unit 10.

  The operating mode of the system

  Figure 1 is the result of the following

  42 forms, depending on the voltage values of the power supply

  applied to it through the intermediary of

  link 62, a pulsed signal which, via the medium of

  re of the link 41, the combination stage 40 and

  of the link 43, resets the calculation

  20 by means of its reset input 44 Such a reset pulse occurs for example when

  in service of the system as an initial impulse

  The reset pulse is further applied via the input 58 of the unit 56 and the output link 64 of the unit 56 to the reset input. initial state 66 of the calculation unit 10 The calculation unit 10 is simultaneously started by the calculation unit 20 under the operating conditions described above. In the example shown, the calculators are preferably

  reset by a positive signal "high".

  In the case of initialization, the outputs 12, 37 or

  well 22, 50 of which at a potential "Sas".

  Mutual monitoring of operation

  of the two calculators is carried out correspondingly

  The first monitoring channel can then reside in a cyclic data exchange operated according to a fixed time frame. One of the calculation units 10 or 20 then waits, in a fixed time frame. a request for data from the other unit via the connection system 30 The computing unit expressing the data request, waits

  then a data transmission from the other unit.

  If any of these reactions are absent, the unit of cal-

  concerned is identified as defective.

  able to operate then starts the faulty unit again via its restart output (in the case of the calculation unit 10, the output 37, in the case of the calculation unit 20, by through output 50) The computing unit

  considered, then, in the case of a functioning

  20 of the calculating unit 20, a reset pulse, via the combination stages 36 and 40 at the reset input 44, and for the case o the calculating unit exhibits a faulty operation, via the combination stage 48 and the unit 56 at the reset input 66 of the computing unit 10 new crowned boot of

  success of the faulty computing unit may be

  controlled using the data protocol described above.

  above or using the monitoring device

described below.

  Another way of monitoring is given by the reciprocal exchange of control signals of the monitoring device between the two calculation units In this case, a control signal is issued from the monitoring device unit 12 via from link 32 to the device unit

  22 of the computing unit 20 which operates

  this signal and which determines, using the form of the

  signal and / or level, the ability to

  Likewise, a similar control signal is transmitted from the unit 22 through the link 33 to the monitoring device unit 12 of the computing unit 10. it is operated The links 32 and 33 are connected to circuit units 34 or 46 which exploit the control signal and which, in the case of a fault, apply a reset pulse to

  the initial state through the stages of com-

  bination 36 and 40 at the reset input

  tial 44 of the calculation unit 20 in the case of the failure of the calculation unit 10, and which apply

  this signal through the combination link

  48 and 56, at the reset input 66 of the computing unit 10 in case of

  the defect of the calculation unit 20, the calculation unit

  defective and then again

  by the other unit Combination stages 36,

  and 48 are then made in the form of

  OR to equalize the reset pulses of the unit 42 based on a defective monitoring device signal or

  based on a restart signal.

  The unit 56, including an exemplary embodiment

  shown in Figure 3, is essentially

  by a logical OR 70 combination which guarantees equality of

  the initial state delivered from the combi stage

  48 at entrance 54 of unit 56 through

  of the link 52 and the reset signal applied in the event of a defective state of the unit 42, via the link 41 to

  the entrance 58 of the unit 56 A training floor of im-

  pulses 72 is furthermore part of the unit 56. At this pulse-forming stage 72 the output of the OR logic combination 70 and a supply voltage signal is applied via the link 62 and the output signal. 60 of the unit 56, the output of the pulse forming stage 72 being connected to the output 64 of the unit 56 and serving the input of

  resetting 66 of the computing unit 10.

  The pulse forming stage 72 may, in a preferred embodiment, be embodied as a differentiating element. If the unit 42 fails to form a reset signal at getting started,

  the pulse training unit 72 then serves to

  sea a reset signal from the

  supply voltage signal routed through the

  The stage 72 delivers, when the system is put into service, to the delivery input

  the initial state 66 of the computing unit 10, an impulse

  reset that initializes and

  starts this unit Using the monitoring channel

  previously described, the computing unit 10 can detect a faulty operation of the unit 20 and

  start it again, in that, through

  its output 37, when a faulty operation of the unit 20 is detected, it applies to the reset input 44 of this unit, a reset signal Thus, even in the case of failure of unit 42, commissioning

correct system is guaranteed.

  The concept of the invention can also be applied to systems having a larger number of computers, and it is furthermore possible that the unit 56 is associated with the computer unit.

calculation 20.

  In FIG. 2, the concept of the invention is

  represented using a functional diagram of

  seems, which in principle declines the course in the computing unit, which is associated with the unit 56,

  when commissioning the computer system.

  At step 100, when the system is put into service

  calculator, the calculation unit under consideration is

  tialized by initial reset impulses.

  tial In the case of faultless operation,

  this is done by the initiation pulse deli-

  If the latter is defective, then the unit 56 delivers an additional pulse to the computing unit associated with it. In the interrogation block 102, in the two-computer system, it is verified that the operating capacity of the second calculation unit to which the unit is not associated 56 If this is the case, it can be concluded that a correct commissioning has taken place and, in the case of

  block 110, the normal operation of the calibration system

  However, if the other computing unit is malfunctioning, this unit, so

  corresponding to block 104, is restored to the initial state

  When the calculation unit is started correctly, in step 106 the correct operating mode of the newly restarted computing unit is checked, in the case of a correct operating mode, for a start. of the system is found (110), but if the newly started computing unit is malfunctioning, this computing unit is identified as defective at step 108 is

switch off.

  FIG. 3 shows an embodiment of the unit 56. The references used in FIG. 1 of the inputs or outputs of the unit 56 have been maintained.

  is made up of two diodes, a resistor

tance and a capacitor.

  Entry 54 to which, if applicable,

  Due to a fault, a signal from the monitoring device or a restart signal from the other computer is connected to the anode of a diode.

  whose cathode is connected to a point of combination

  202 Entrance 58 to which eventually

  the initialization pulse or reset pulse of the unit 42 is connected to the anode of a second diode 204 whose cathode is also connected to the combination point 202. The two diodes then constitute the logical combination OR described above, in which case the two signals applying to inputs 54 and 58 are transmitted in

  the same conditions at exit 64 which is direct-

  The combination point 202 is further connected to a capacitor which is otherwise connected to the input 60 of the unit 56. A resistor 208 connects the ground to the ground.

combination 202.

  When starting up the computer system, a corresponding voltage signal

  applies to entry 60 of unit 56

  206 is correspondingly charged with the modification of the voltage signal so that the

  capacitor voltage takes on an exponential-

  The change over time of the capacitor voltage results in a corresponding modification.

  in time, of the pace of

  tiel at the point of combination 202 This pace of the

  potential represents a "high" signal in the form of

  drive with a stiff flank and falling flank cor-

  corresponding to the rising pace of the tension of the con-

  The pulsed signal formed in this manner is applied to the output 64 of the unit 56 and is

  the reset input of the calibration unit

  Associated ass, thanks to which, it is reset In this way, a correct start of the computer system is guaranteed independently

the signal of the unit 42.

  The procedure according to the invention may, in principle, also apply in the case

under voltage.

Claims (6)

  A computer system with at least two calculation units (10-20) which are connected by at least one linkage system (30) to enable the exchange of data and / or control or control signals, and when put into service, are initialized by a reset signal (power-on-reset), this computer system being equipped with at least one means for detecting states   faulty computing units (surrogate device   monitoring, data exchange protocol) and the case   o one of the calculation units is in a defective state   this unit is put back into service by a signal   restart system, calibration system   culator, characterized in that it is equipped with a   an additional signal-emitting unit, which eliminates at least one of the calculation units by a reset pulse independent of the signal of reset initialization.   2 Computer system according to claim   cation 1, characterized in that the independent reset pulse is delivered during the   commissioning of the computer system.   3. Computer system according to any one   shell of claims 1 or 2, characterized in that   that the additional unit is in direct dependence of the supply voltage.   4. Computer system according to any one   of claims 1 to 3, characterized in that   only one computing unit is powered by the signal   reset.   5. Calculator system according to any one   conque of claims 1 to 4, characterized in that   the computing unit powered by the additional signal   re-initialization detects a functioning   the other unit and starts the unit again when a faulty operation is detected.   6. Computer system according to any one   conque of claims 1 to 5, characterized in that   the additional unit consists essentially of a differentiating element, preferably a   RC element (resistance-capacity).