WO2009100472A1

WO2009100472A1 - Redundant bus system

Info

Publication number: WO2009100472A1
Application number: PCT/AT2009/000049
Authority: WO
Inventors: Stefan Poledna
Original assignee: Tttech Computertechnik Aktiengesellschaft; Ipgate Ag
Priority date: 2008-02-11
Filing date: 2009-02-11
Publication date: 2009-08-20
Also published as: AT506439A1; AT506439B1

Abstract

The invention relates to a bus system (SYS) for motor vehicles, comprising at least two bus nodes (BK1, BK2) disposed in regions (BE1, BE2) of the motor vehicle that are arranged spatially at a distance from each other, wherein the bus nodes (BK1, BK2) are connected to each other for communication, each of the bus nodes (BK1, BK2) having two redundant microprocessors (MC11, MC12; MC21, MC22), wherein signals can be read in and/or emitted via said microprocessors (MC11, MC12; MC21, MC22). The mutually connected bus nodes (BK1, BK2) are connected to each other in each case via two redundant high-speed cables (FR1, FR1’), wherein each microprocessor (MC11, MC12) of one bus node (BK1) is connected via such a high-speed cable (FR1, FR1) to one microprocessor (MC21, MC22) of a bus node (BK2) connected thereto. According to the invention, at least one of the bus nodes (BK1) furthermore comprises at least one third microprocessor (MC13), wherein the third microprocessor (MC13) is connected to the two other microprocessors (MC11, MC12) of the bus node (BK1) thereof, and the third microprocessor (MC13) is equipped to monitor the other two microprocessors (MC11, MC12) with respect to the functionalities thereof.

Description

REDUNDANT BUS SYSTEM

The invention relates to a bus system for motor vehicles, comprising at least two bus nodes arranged in spaced-apart regions of the motor vehicle, the bus nodes being connected to each other for communication, each of the bus nodes having two redundant microprocessors, via which microprocessors signals can be read in and output connected bus nodes are connected to each other via two redundant high-speed lines, and wherein a microprocessor of a bus node is connected to a microprocessor of a bus node connected to him via such a high-speed line.

Redundant bus systems based on CAN ("Controller Area Network"), LIN ("Local Interconnect Network"), MOST ("Media Oriented Systems Transport", optical fiber) and more recently also FlexRay and Ethernet are known, however For many information transmissions, as signals from sensors or signals in infotainment used separate lines, so that despite bundling of information and transmissions, the scope of the lines in a motor vehicle in the interior even in such systems with approximately 300 - 500 lines is still considerable.

An aforementioned bus system, in which bus nodes have a plurality of microprocessors, which are connected by means of high-speed lines, are known from EP 0851 614 A1 and JP 5-3483. With such systems, a significant reduction in the number of lines used for signal transmission in a motor vehicle can be achieved because the wiring between two areas in a motor vehicle, especially from front to back, significantly simplifies and the number of lines are significantly reduced, thereby also a Weight savings go hand in hand.

In this document, the term "motor vehicles" in addition to the passenger cars (PKW) also cars with trailers, but also commercial vehicles (commercial vehicles) and commercial vehicles consisting of towing vehicle and trailer to understand and aircraft under the term motor vehicle subsumed.

By reading in signals in a bus node or by the output of the signals via a bus node and optionally the forwarding of the signals in another bus node lines can be kept short. An approximately located in a rear area sensor passes its signals over a short line to the rear bus node from which the signal can then be routed via the Hochgeschwmdigkeitsverbindung (s) in the front area. Previously, it was necessary for each sensor to lay its own line from front to back.

In sensor cabling, in particular, according to the known conventional technique, a cable-tailed sensor is connected in the rear of the vehicle with one to two intermediate plugs to a controller (front bus node) in the front of the vehicle. According to the aforementioned system, these are plugged directly to the rear module (rear bus node).

It is an object of the invention to continue to ensure the security and reliability of the signal transmission in systems mentioned above or to increase even more compared to existing systems.

This object is achieved with a system mentioned in the introduction in that according to the invention at least one of the bus node further comprises at least a third microprocessor, wherein the third microprocessor is connected to the other two microprocessors of its bus node and the third microprocessor is adapted to the other two microprocessors in terms to monitor their functioning.

By monitoring the microprocessors by a supervisor, namely the third microcontroller in the at least one excellent bus node, the full functionality of this bus node can be guaranteed even if one microprocessor fails, and emergency operation is still possible. For this purpose, the third microprocessor, at least for the emergency function (s) assume the arithmetic tasks of one of the other two microprocessors.

At the same time, the observer himself can be monitored for its functionality by means of the two other microcontrollers of this bus node.

The functionality of the entire system can continue to be ensured in the event of a failure of a microprocessor in a bus node when the third microprocessor or the three microprocessor-containing bus node is adapted to monitor the microprocessors of the one or more bus nodes connected to it with regard to their functionality ,

In conventional systems such as ABS (Antilock Braking System) or in the airbag control, however, in the case of non-identity of, for example, the output signals, the entire system is switched off, so that an emergency operation is not possible.

It is particularly advantageous if the third microprocessor or the three microprocessor-containing bus nodes is set up to switch off a monitored microprocessor in the event of an error function. As a result, a malfunction of the bus node can be prevented, at the same time at least one emergency operation is still possible by the redundant design of the system, in which the relevant functions of the bus node are still available.

In this connection, it is furthermore expedient for the third microprocessor or the three microprocessor-containing bus nodes to be set up to emit a warning signal in the event of an error function of a monitored microprocessor. In this way, the operator of the motor vehicle can be warned and caused to make a repair to the vehicle.

Preferably, the warning signal is transmitted via at least one, preferably via both high-speed lines to another bus node, which is set up to issue a warning, for example in optical or acoustic form, or to cause the delivery of such.

In a preferred variant of the invention, all signals relating to the safety and / or operation of the vehicle are transmitted redundantly via high-speed lines connecting in each case both bus nodes. In this way, a particularly reliable transmission of the relevant signals between the bus nodes can be ensured.

In order to be able to reduce the bus load, ie the load on the high-speed connections, it is further provided that high-speed signals are transmitted in divided fashion to both high-speed lines connecting the two bus nodes.

In automobiles it can be provided that the two microcontrollers of a vehicle dynamics control unit in a motor vehicle, which e.g. ABS and ESP (Electronic Stability Program) controls are used as microcontrollers for one of the bus nodes, which makes the invention cheaper and easier to implement, since already existing equipment in the vehicle can be used.

In a specific variant of the invention, it is provided that two or more bus nodes are arranged in series with one another. Furthermore, it may be favorable if one or more bus nodes, which each comprise at least one microcontroller, are connected in parallel to a bus node with three microcontrollers, bus nodes connected in parallel being connected to the third microcontroller of the bus node provided with three microcontrollers.

In the following the invention is explained in more detail with reference to the drawing

In this shows

1 shows a bus system according to the invention in a schematic block diagram representation with two bus nodes,

2 is a rough schematic representation of a bus system with four bus nodes in a series circuit,

3 is a rough schematic representation of a bus system with additionally three parallel to the excellent bus node connected further bus node,

Fig. 4 in detail the interaction of the three microprocessors in the excellent bus node, and

Fig. 5 shows the bus system of Figure 1 in a more detailed representation.

FIG. 1 shows a bus system SYS according to the invention for a motor vehicle. Bus system SYS comprises two bus nodes BK1, BK2 arranged in spaced-apart regions BE1, BE2 of the motor vehicle, bus nodes BK1, BK2 being connected to one another for communication. Each of the bus nodes BK1, BK2 has two redundant microprocessors MCI1, MC12; MC21, MC22 on which microprocessors MCI1, MC12; MC21, MC22 signals can be read in and / or output.

Sensors, actuators, controllers, such as slaves, etc. are via single bus systems, e.g. via a respective LIN bus connected to a bus node, as shown in Figure 5 again in detail.

The bus nodes BK1, BK2 are connected to one another via two redundant high-speed lines FR1, FR1, one microprocessor MC1, MC12 of the first bus node BK1 being connected to a microprocessor MC21, MC22 of the second bus node BK2 via such a high-speed line FR1, FR1 '. With such an arrangement, the line set between two areas BEI, BE2 in a kraft tfahrzeug, especially from the front (area BEI) to the rear (area BE2), significantly simplifies and the number of lines are significantly reduced, which also goes along with a weight saving ,

By reading in signals in a bus node or by the output of the signals via a bus node and optionally the forwarding of the signals in another bus node and thus in another area of the vehicle lines can be kept short. An approximately located in a rear area sensor forwards its signals via a short line to the rear bus node, from which then the signal via the high-speed connection (s) can be passed in the front area. So far, as mentioned earlier elaborate solution, which is also less safe, necessary.

One of the two bus nodes BK1, also referred to below as "excellent" bus node, comprises, in addition to the two microprocessors MC11, MC12, a third microprocessor MC13, this third microprocessor MC13 being connected to the two other microprocessors MC1, MC12 of its bus node BK1 and the third Microprocessor MC13 is configured to monitor the other two microprocessors MCIl, MC12 with regard to their functionality.

By monitoring the microprocessors MCI1, MC12 by a supervisor, namely the third microcontroller MC13 in the excellent bus node BK1, the full functionality of this bus node BK1 can be guaranteed even if one microprocessor MCI1, MC12 fails, and emergency operation is still possible.

At the same time, the observer MC13 itself can be monitored for its functionality by means of the two other microcontrollers of this bus node BKl.

In addition, it is provided that the third microprocessor MC13 of the excellent bus node BKl is furthermore set up to monitor the functionality of the microprocessors MC21, MC22 of the bus node BK2 connected to it. Thus, the functionality of the entire system in the event of a failure of a microprocessor in a bus node BKL, BK2 continue to be guaranteed.

In addition, the third bus node MC13 for emergency functions can perform the arithmetic tasks of a failed microprocessor. Figure 2 shows an extended system SYS consisting of four bus nodes BKL, BK2, BK3, BK4, which are arranged in series with each other. The distinguished bus node BK1 again comprises three microprocessors MCI1, MC12, MC13, while the other bus nodes BK2 - BK4 each have two microprocessors MCZL ₇ MC22; MCBl ₇ MC32; Include MC41, MC42. The bus nodes are each redundant by means of two high-speed transmission lines FR1, FR1 '; FR2, FR2 '; FR3, FR3 'interconnected.

FIG. 3 shows a further conceivable arrangement of a bus system according to the invention. In this arrangement, which is in principle similar to that in FIG. 1, an excellent bus node BK1 with three microprocessors MCI1, MC12, MC13 is connected to a series-arranged bus node BK2 with two microprocessors MC21, MC22. In parallel with this arrangement, three further bus nodes BK5, BK6, BK7 are connected to the excellent bus node BK1. One of the three parallel bus nodes, bus node BK5, comprises two microprocessors MC51, M52, each of the two microprocessors MC51, MC52 being connected via a high-speed line FR4, FR4 'to the third microprocessor MC13 of the designated bus node BK1.

The two other bus nodes BK6, BK7 each have a microprocessor MC6, MC7, wherein the one microprocessor MC6 is redundantly connected via the two bus lines FR5, FR5 'to the bus node BKl, while the microprocessor MC7 of the other bus node BK7 only via a line FR6 is connected to the bus node BKL.

The bus node BK5 is typical of a safety-related system in which 2 processors are used, which switch off in the event of non-identity of the output signals X or by parallel comparison X '.

The bus node BK6 may be e.g. serve to relieve the bus systems FR1, FR1 'if signals (for example antenna signals or signals originating from a camera or corresponding functions) are divided from the rear vehicle area onto the bus systems FR1, FR1' and then processed in the bus node BK6. Such a bus node is particularly suitable for infotainment.

The bus node BK7 is a bus node which contains no safety-relevant functions.

FIG. 4 shows the construction of an excellent bus node BK1 with the three microprocessors MCI1, MC12, MC13 and their mode of operation in detail. It should also be mentioned in advance that it is particularly advantageous if the third microprocessor MC13 or the three microprocessor-containing bus node BK1 is set up to switch off a monitored microprocessor MCI1, MC12 in its bus node BK1 in the event of an error function. As a result, a malfunction of the bus node BKL be prevented, at the same time at least one emergency operation is still possible by the redundant design of the system, in which the relevant functions of the bus node BKL are still available.

It is particularly advantageous, if the microprocessor MC13 is also further equipped, the microprocessors of the other bus nodes BK2; BKl - BK4; BKl, BK2, BK5 - BK7 monitor and shut down if necessary.

In this context, it is furthermore expedient if the third microprocessor MC13 or the three microprocessor-containing bus node BK1 is set up to emit a warning signal in the event of an error function of a monitored microprocessor. In this way, the operator of the motor vehicle can be warned and caused to make a repair to the vehicle. This signal is fed to both bus systems FR1, FR1 'and e.g. from an instrument cluster, which will be discussed later, evaluated and displayed.

Referring now to Figure 4, the main output signals are monitored for parity P during operation, e.g. various arithmetic operations, interrupts, etc. are compared.

A reset starts and compares a comprehensive test cycle on each microprocessor.

As part of the examination, the third microprocessor MC13 receives the input signals El, E2 of the two other microprocessors MCI1, MC12 (incoming via the buses FR1, FR1) and their output signals A1, A2. If these do not match in the direct comparison, then in the. Microcontroller MC13 compared, which of the output signals Al, A2 with its own output signals Al ', A2' - which the microcontroller MC13 for deciding which of the two other microcontroller MCIl, MC12 incorrectly generated generates - does not match. That microcontroller in which a mismatch occurs is then turned off.

Of course, the above illustration is simplified insofar as it only refers to one signal. In reality, all safety-relevant signals are compared. The same applies if additional, not implemented in bus systems, eg originating from sensors input signals Sl, S2 are processed by the microprocessors MCIl, MC12 and MC13. The further processed signal is also performed in a comparison test of the output signals Bl, B2 or the corresponding message in the bus FRl, FRl '.

Furthermore, output signals Bl, B2 are conceivable as shown in the figure, which are indeed monitored by the third microprocessor MC13, but are not output via an OR switch as the signals Al, A2.

Finally, FIG. 5 shows as an example a bus system with preferably a FlexRay architecture for an entire motor vehicle with a bus system SYS according to the invention. As already described above, the system consists of 2 bus nodes BK1, BK2. The bus nodes are also referred to as domain computers or master basic modules. The first bus node BK1, which has the three microprocessors MCI1-MC13, is located in a front area BEI of the vehicle. For example, a suitably adapted central driving dynamics control unit of a passenger car can be used as a basis for the front bus node BK1.

In the rear part of the vehicle there is a second bus node BK2 with two microprocessors MC21, MC22, which in the manner already described above is connected to the front bus node BK1 via the redundant bus lines FR1, FR1 '.

The bus node BK1 according to FIG. 5 is again shown simplified, but may have the monitoring structure according to FIG.

The bus node BK1 communicates to the outside with a slave control unit SLl, for example via a LIN bus. An actuator AKl is redundantly connected via the OR circuit. Microcontrollers MCIl and MC12 controlled. Sensor signals from a sensor SEI are read redundantly into the microcontroller MCI1, MC12 and according to FIG. 4 also into the microcontroller MC13. The same applies to the slave control devices SL2 and the sensor SE2, wherein the sensor signal of this sensor SE2 is not processed redundantly as shown in FIG.

The buses FRI, FRI 'communicate with other control devices, such as the domain MOT (eg motor) and with a combination display instrument KO. The same applies to the external connections of BK2 (slave SL3, sensors SE3, SE4, actuator AK2). Furthermore, a domain computer for information / communication INFO / COMM is connected to the bus node to the bus FRI '. This domain computer INFO / KOMM is additionally with a known digital MOST ring bus MOST, which is usually designed in the form of optical fibers connected.

For cost savings, e.g. one or more bus nodes with these expensive MOST ring to be connected via a corresponding HO to the bus node BK2, the further signal transfer then takes place via the bus FRl 'or FRl.

The same applies to control units / sensors ana, which have analog signals. Here, too, these can be connected directly to the Info / Communication Donαänen INFO / KOMM directly or with a shorter line length to the bus node BK2.

Further, a controller FMO of the MOST ring, e.g. a CD player is shown.

Finally, the responsibilities of the front bus node (domain computer) BK1 and the rear bus node BK2 are briefly mentioned by way of example. The front domain computer BKl is, for example, responsible for EPS, light, windscreen wiper, window heating damping, sensors for ABS and level control, door functions, locking systems, driving permissions, tire pressure monitoring and forms a central gateway. The rear domain computer BK2 is also for light, locking systems, sensors for ABS, level control and tank, camera (reversing), windscreen wipers, seat heating, damping, engines for tank, air pump, rear blind, for solenoid valves for air suspension and for a parking brake of the motor vehicle responsible. This list is in no way complete and merely serves as an example for a better understanding.

In addition to or instead of FlexRay, other high-speed bus systems can also be used, some TTP or Ethernet bus systems.

Claims

1. bus system (SYS) for motor vehicles, comprising at least two spaced apart in spatially spaced areas (BEl ₇ BE2) of the motor vehicle bus node (BKl, BK2), wherein the bus nodes (BKL, BK2) are interconnected for communication, each of the bus node (BKl, BK2) has two redundant microprocessors (MCIl, MC12, MC21, MC22), via which microprocessors (MCIl, MC12, MC21, MC22) signals can be read in and / or output, wherein interconnected bus nodes (BKL, BK2) via in each case two redundant high-speed lines (FR1, FR1 ') are connected to one another, and wherein in each case a microprocessor (MC11, MC12) of a bus node (BK1) is connected to a microprocessor (MC21, MC22) of a bus node (BK2) connected to it via such a high-speed line ( FRI, FRI '),

characterized in that

at least one of the bus nodes (BKl) further comprises at least a third microprocessor (MC13), wherein the third microprocessor (MC13) with the other two microprocessors (MCIl, MC12) of its bus node (BKl) is connected and the third microprocessor (MC13) set up is to monitor the other two microprocessors (MCIl, MC12) in terms of their functionality.

2. System according to claim 1, characterized in that the third microprocessor (MC13) or the three microprocessor-containing bus node (BKl) is adapted to the microprocessors (MC21, MC22) of the one or more bus nodes connected to it (BK2) to monitor their functioning.

3. System according to claim 1 or 2, characterized in that the third microprocessor (MC13) or the three microprocessors containing bus node (BKl) is adapted to disable a monitored microprocessor (MCIl, MC12, MC21, MC22) in the case of an error function ,

4. System according to one of claims 1 to 3, characterized in that the third microprocessor (MC13) or the three microprocessor-containing bus node (BKl) is adapted to, in the case of an error function of a monitored microprocessor (MCIl, MC12, MC21, MC22 ) send a warning signal.

5. System according to claim 4, characterized in that the warning signal on at least one, preferably via both high-speed lines (FRl, FRl ') is transmitted to another bus node (BK2), which is adapted to deliver a warning, such as in optical or acoustic form or to cause the delivery of such.

6. System according to one of claims 1 to 5, characterized in that all signals relating to the safety and / or operation of the vehicle, redundantly via each both two bus nodes (BKl, BK2) connecting high-speed lines (FRl, FRl ') transmitted become.

7. System according to one of claims 1 to 6, characterized in that high-speed signals on both two bus nodes (BKl, BK2) connecting high-speed lines (FRl, FRl ') are transmitted split.

8. System according to any one of claims 1 to 7, characterized in that the two microcontrollers of a vehicle dynamics control unit in a motor vehicle, which, e.g. ABS and ESP controls to be used as a microcontroller for one of the bus nodes.

9. System according to one of claims 1 to 8, characterized in that two or more bus nodes (BKL, BK2) are arranged in series with each other.

10. System according to one of claims 1 to 9, characterized in that one or more bus nodes (BK5, BK6, BK7), each comprising at least one microcontroller (MC51, MC52, MC6, MC7), parallel to a bus node (BKl) with three microcontrollers (MCH, MC12, MC13).

11. System according to claim 10, characterized in that parallel-connected bus nodes (MC51, MC52, MC6, MC7) to the third microcontroller (MC13) of the three micro-controllers (MCH, MC12, MC13) provided bus node (BKL) are connected ,