GB2241361A

GB2241361A - Computer system

Info

Publication number: GB2241361A
Application number: GB9102732A
Authority: GB
Inventors: Karl-Heinrich Preis
Original assignee: Robert Bosch GmbH
Current assignee: Robert Bosch GmbH
Priority date: 1990-02-15
Filing date: 1991-02-08
Publication date: 1991-08-28
Anticipated expiration: 2011-02-08
Also published as: DE4004709C2; GB2241361B; JPH04215140A; GB9102732D0; JP3217077B2; DE4004709A1; FR2658335B1; FR2658335A1

Abstract

A computer system, particularly for use in a motor vehicle, comprises at least two computing units (10, 20), wherein during putting of the system into operation a reset pulse is produced by a first pulse-forming unit (42) and is fed to the computing units. Faulty operation of one of the computing units can be recognised by a mutual monitoring arrangement. The computer system also includes an additional pulse-forming unit (56) which, for one of the computing units, produces (by means of 62, 72) an independent reset pulse in order to ensure orderly putting into operation of the computer system. <IMAGE>

Description

COMPUTER SYSTEM The present invention relates to a computer system.

A computer system for the control of an operating parameter of an internal combustion engine of a motor vehicle is disclosed in DE-OS 37 26 489. The computer system consists of two processors, which are connected by way of a line system for the exchange of data and control or check signals. For mutual monitoring of the two processors, each processor is equipped with a so-called watch-dog monitoring device which delivers check signals to the respective other computer, by means of which check signals the other computer can check the functional capability of the computer emitting the check signal. A further monitoring path in such a two-computer is formed by the transmission of data between the processors. The data transmission takes place cyclically in a fixed time raster and, in the absence of a data transmission or request from either or both computers, the respective other computer concludes that there is a functional fault and starts the faulty computer again by way of a reset pulse (warm start). When the computer system is placed in operation, an initialising pulse (power on) common to both computers is produced and resets the two computers at the same time for initialis- ing (cold start). It is disadvantageous in an arrangement of that kind that the computer system cannot be taken into operation in an orderly manner when the initialising pulse or the circuit arrangement producing this pulse is faulty. When the computer system is serving for the control of functions critical for the safety of an internal combustion engine and/or a motor vehicle, the danger exists that a mode of engine or vehicle operation critical in terms of safety can arise in such a fault case. There is thus scope for improvement in the utilisation availability - 2 of a computer system of that kind.

A circuit arrangement for the production of an initialising or reset pulse is described in WO 88/05569. This circuit arrangement serves on the one hand for resetting of a computer system when first switched on (power on) and on the other hand for resetting of the computer system in the case of under-voltage, i.e. if the operating voltage falls below a preset value. The circuit arrangement also produces a reset signal which, in the case of a failure of a computer, is issued by a functionally capable computer in order to restart the computer that is incapable of function.

According to the present invention there is provided a computer system comprising at least two interconnected computing units, signal providing means for providing an initialising reset pulse to initialise each computing unit, fault recognition means for recognition of faulty states of the computing units and for causing any uch unit recognised as faulty to be restarted by a reset signal, and additional signal providing means for delivering a reset signal independent of the initialising reset signal to at least one of the computing units.

A system embodying the invention may have the advantage that, in the case of failure of the signal providing means producing the initialising reset pulse, an orderly putting into operation of the computer system is made possible by additional signal providing means independent of the first-mentioned signal providing means. A faulty putting into operation, and consequently a state critical to safety, may thereby be able to be effectively avoided.

The additional signal providing means may be able to be realised in simple manner at favourable cost in connection with monitoring 1.

processors, which are known from the state of the art.

An embodiment of the present invention will now be more particularly described with reference to the accompanying drawings, in which:

Fig. 1 is a block circuit diagram of a two-computer system embodying the invention; Fig. 2 is a flow chart showing the interplay of computer. monitoring and additional reset unit in the computer system of Fig. 1 when put into operation; and Fig. 3 is a circuit diagram of a preferred form of additional reset unit in the computer system.

Referring now to the drawings, there is shown in Fig. 1 a twocomputer system which serves for the control of certain functions in a motor vehicle. For example, the system can be used in safety equipment such as an air bag or a belt tightener or for the control and/or regulation of operational parameters of the vehicle engine, such as electronic engine power control.

The two computer units 10 and 20 are connected together by way of a line system 30, which can comprise data lines, address lines and/or control lines. The line system 30 serves for the exchange of data, addresses and/or control or check signals, by means of which the communication between the two units is controlled. The computing units 10 and 20 are equipped with so-called watch dog units 12 and 22. The two units 12 and 22 are connected to each other by way of two lines 32 and 33, wherein the line 32 carries the signal produced by the unit 12 and the line 33 carries that produced by the unit 22.

The connecting line 32 is also connected, by way of a circuit unit 34, to a first input of an interlinking stage 36. This interlinking 1 - 4 stage 36, which corresponds to a logic OR function, is connected at a second input with an output 37 of the computing unit 10. An output line 38 of the interlinking stage 36 is connected to a first input of a second interlinking stage 40, a second input of which is linked by way of a line 41 with a circuit device 42 for the formation of a reset or initialising pulse. An output line 43 of the interlinking.stage 40, which also carries out a logic OR-function, is led to an input 44 of the computing unit 20.

In analogous manner, the connecting line 33 is connected by way of a circuit unit 46 to a first input of a third interlinking stage 48, a second input of which is linked with an output 50 of the computing unit 20. An output line 52 of the interlinking stage 48 is led to a first input 54 of a unit 56 for the formation of an independent reset pulse. The unit 56 is connected at a second input 58 thereof by way of the line 41 with the unit 42. A third input 60 of the.unit 56 is connected to a line 62 which forms the input line of the unit 42 and carries the supply voltage of the system. An output 64 of the unit 56 is connected to a reset input 66 of the computing unit 10. In operation of the system illustrated in Fig. 1, the unit 42, in dependence on the supply voltage value fed to it by way of the line 62, forms a pulse signal which by way of the line 41 resets the interlinking stage 40, which in turn resets the computing unit 20 by way of the line 43 and reset input 44. Such a reset pulse occurs as, for example, an initialising pulse on putting the system into operation. The reset pulse is furthermore applied by way of the input 58 and output line 64 of the unit 56 to the reset input 66 of the computing unit 10. The computing unit 10 is started at the same time as the computing unit - 5 20 in the operating condition described above. In the described embodiment, the computers are preferably reset by a positive "high" signal. In the initialising case, the outputs 12, 37 or 22, 50 carry 1 ow, ' potent i a].

A mutual monitoring of functional capability of the two computers is performed in accordance with the method described in DE-OS'37 26 489. A first monitoring path is represented by the cyclic data exchange operated in a fixed time raster. One of the computing units 10 or 20 in that case expects a data request of the respective other unit by way of the line system 30 within a fixed time raster. The computing unit expressing the data request thereupon expects a data transmission from the respective other computing unit. If either of these reactions is absent, the respective computing unit is recognised as faulty. In that case, the functionally capable computing unit, by way of its restart output (the output 37 in the case of the unit 10 and the output 50 in the case of the unit 20) restarts the faulty unit. The computing unit 10 - in the case of a faulty function of the computing unit 20 - then sends a reset pulse by way of the interlinking stages 36 and 40 to the reset input 44. Conversely, the computing unit 20 - if it is the computing unit 10 that is faulty - sends a reset pulse by way of the interlinking stage 48 and the unit 56 to the reset input 66 of the unit 10. The successful start of the faulty computing unit can be performed by means of the afore-described data protocol or by means of the watch dog monitor ing arrangement described below.

In particular, a further monitoring path is represented by the mutual exchange of watch dog check signals between the two computing units. In that case, a check signal is delivered from the unit 12 by way of the line 32 to the unit 22 of the computing unit 20, which evaluates this and, by reference to the signal shape and/or height, ascertains the functional capability of the computing unit 10. Analogously, a similar check signal is delivered from the unit 22 by way of the line 33 to the unit 12 of the computing unit 10 and evaluated therein. The lines 32 and 33 are connected with the respective units 34 and 46, which evaluate the check signal and feed a reset pulse by way of the interlinking stages 36 and 40 to the reset input 44 of the unit 20 in the case of a fault in the unit 10 and by way of the inter- linking line 48 and the unit 56 to the reset input 66 of the unit 10 in the case of a fault in the unit 20. Subsequently thereto, the faulty computing unit is restarted by the respective other computing unit. The interlinking stages 36, 40 and 48 are in that case constructed to provide logic OR-interlinking in order to achieve an equal authority of the reset pulses of the unit 42 by reason of a faulty watch dog signal or by reason of a new start signal.

The unit 56, of which an example is shown in Fig. 3, essentially consists of a logic OR-interlinking device 70, which ensures equal authority between the reset signal supplied from the interlinking stage 48 by way of the connecting line 52 to the input 54 and the reset signal fed in the fault-free state from the unit 42 by way of the line 41 to the input 58. Moreover, a pulse-forming state 72 is a component of the unit 56. The output of the device 70, and the supply voltage signal on the line 62, are fed to the stage 72, the output signal of which is issued at the output 64 of the unit 56 and applied to the reset input 66 of the computing unit 10.

The pulse-forming stage 72 can, in a preferred embodiment,be a differentiating element. If the unit 42 fails when put into operation, the unit 72 serves for formation of a reset signal from the supply voltage signal fed by way of the line 62. When the system is put into operation, the unit 72 supplies a reset pulse to the reset input 66 of the computing unit 10, which pulse initialises and starts the latter. By means of the afore-described monitoring paths, the computing unit 10 can recognise a faulty function of the unit 20 and restart this by feeding a reset signal from its output 37 to the reset input 44 when a faulty function of the unit 20 has been recognised. Consequently, an orderly initialis- ation of the system operation is ensured even in the case of failure of the unit 42.

The mutual monitoring arrangement described above is also applicable to multi-computer systems and it is also possible that the unit 56 is associated with the computing unit 20.

In Fig. 2 there is shown a flow chart illustrating the sequence in the computing unit 10, which is associated with the unit 56, when the computer system is being put into operation. In step 100, the respective computing unit is initialised by reset pulses. In the faultfree operational case, this is effected by the initialising pulse supplied by the unit 42. If this is defective, the unit 56 supplies an additional pulse to the unit 10. In the interrogation block 102, the functional capability of the second computing unit 20, which is not associated with the unit 56, in the two-computer system is checked. If it is found to be functionally capable, it can be concluded that an orderly putting into operation has taken place and the normal operation of the computer system is ascertained in block 110. If the other computing unit however operates in faulty manner, this is reset according to block 104 by the - 8 computing unit started in orderly manner. In step 106, the orderly mode of operation of the newly started computing unit is checked and an orderly start of the system is ascertained in the block 110 in case of an orderly mode of operation of that unit. If, however, the newly started computing unit operates in faulty manner, this computing unit is recognised as faulty and switched off in step 108.

Fig. 3 shows a possible form of construction of the unit 56. The reference numerals, used in Fig. 1, for the inputs and outputs of the unit 56, have been retained in that case. A simple construction with favourable costs consist of two diodes, a resistor and a capacitor. In particular, the input 54, at which a signal may be present by reason of a faulty watch dog signal or a new start signal of the respective other computer, is connected to the anode of a diode 200. The cathode thereof is linked with an interlinking point 202. The input 58, at which the initialising or reset pulse of the unit 42 may be present, is connected to the anode of a second diode 204, the cathode of which is also connected with the interlinking point 202. The two diodes in that case provide the logic OR-interlinking described further above, wherein the two signals present at the inputs 54 and 58 are passed on with equal authority to the output 64, which is connected directly with the interlinking point 202. Also connected to the interlinking point 202 is one terminal of a capacitor, the other terminal of which is connected with the input 60 of the unit 56. A resistor 208 connects the interlinking point 202 to ground.

When the computer system is placed in operation, a corresponding voltage signal is present at the input 60 of the unit 56. The capacitor 206 is charged up in accordance with the change in the voltage signal, i - 9 so that the capacitor voltage assumes an exponential course. The temporal change in the capacitor voltage leads to a corresponding inverse temporal change of the potential course at the interlinking point 202. This potential course represents a pulse-shaped "high" signal with a steep edge and an edge falling in correspondence with the rising course of the capacitor voltage. The pulse signal formed in this mafiner is present at the output 64 of the unit 56 and is fed to the reset input of the associated computing unit, whereupon this is reset. In this manner, an orderly start of the computer system is ensured independently 10 of the signal of the unit 42.

The monitoring arrangement described above can in principle also find application in the case of undervoltages.

Claims

CLAIMS 1. A computer system comprising at least two interconnected

computing units, signal providing means for providing an initialising reset pulse to initialise each computing unit, fault recognition means for recognition of faulty states of the computing units and for causing any such unit recognised as faulty to be restarted by a reset signal, and additional signal providing means for delivering a reset signal independent of the initialising reset signal to at least one of the computing units.
2. A computer system as claimed in claim 1, the additional signal providing means being arranged to deliver the independent reset signal when the computing units are placed in operation.
3. A computer system as claimed in either claim 1 or claim 2, the additional signal providing means being directly connected to supply voltage means for the system.
4. A computer system as claimed in any one of the preceding claims, the additional signal producing means being arranged to deliver the independent reset signal to only one of the computing units.
5. A computer system as claimed in any one of the preciding claims, wherein the computing units are so arranged that a computing unit receiving the independent reset signal is operable to recognise faulty operation of the other computing unit and, in response to recognition of such faulty operation, to cause the other unit to be restarted.

1 1
6. A computer system as claimed in any one of the preceding claims, the additional signal providing means comprising a differentiating device.
7. A computer system as claimed in claim 6, wherein the differentiatin device comprises a resistance-capacitance element.
8. A computer System substantially as hereinbefore described with reference to the accompanying drawings.

Published 1993 at The Patent Office. Concept House. Cardiff Road. Newport. Gwent NP9 1RH. Further copies may be obtained from Sales Branch. Unit 6. Nine Mile Point. Cwrnfelinfach. Cross Keys. Newport. NPI 7HZ. Printed by Multiplex techniques ltd. St Mary Cray. Kent.