WO2009103371A1

WO2009103371A1 - Method for providing an emergency operation function

Info

Publication number: WO2009103371A1
Application number: PCT/EP2008/066320
Authority: WO
Inventors: Joerg Jehlicka; Thomas Jauch; Stefan Harport; Achim Mahler
Original assignee: Robert Bosch Gmbh
Priority date: 2008-02-19
Filing date: 2008-11-27
Publication date: 2009-08-27
Also published as: DE102008009905A1

Abstract

The invention relates to a method for providing an emergency operation function, by means of which a function is redundantly actuated, wherein at least one input signal (52) intended for actuating the function is redundantly transmitted along a number of redundant paths to a device designed for implementing the function, and wherein a diagnostic of at least one redundant path is performed.

Description

description

title

Method for providing an emergency function.

The invention relates to a method for providing an emergency function, a device for providing an emergency function, a computer program and a computer program product

State of the art

So-called. System Basic Chips (SBCs) or Integrated System Basic Chips (SBICs) may become obsolete. a. used in ECUs for automotive applications and typically combine different functions, such as voltage regulation and monitoring, reset functions (reset), monitoring functions (watchdog), interface functions and the like. Commercially available SBICs are, for example, TLE6263 from Infineon, UJAl 065 from Philips or MC33889 from Freescale.

Disclosure of the invention

The invention relates to a method for providing an emergency function, via which a

Function is controlled redundantly. In this method, an input signal intended to trigger the function is redundantly transmitted along a number of redundant paths to a device designed to implement the function. In addition, a diagnosis of at least one redundant path is performed.

With this method, by providing the emergency function, a delay-free and multi-redundant activation of a function plus a complete, typically operation-accompanying, diagnosis of the at least one redundant path, which also serves as an emergency operation path can be designated, or realized a corresponding signal path. The input signal can thus be securely transmitted via several redundant paths, so that the function is safely implemented. By making the diagnosis of the at least one path, its functionality can be checked.

The redundant paths used in the method can be structured in different ways. Along such paths, for example emergency run paths, different electronic and / or circuit-related devices can be arranged. It is thus possible to transmit the input signal directly to the device via a first redundant path or emergency run path. In addition, the input signal can be transmitted to the device via a second redundant path, which is designed as an operating path and comprises a microcontroller. In addition, multiple paths can be diagnosed by this microcontroller. Thus, this microcontroller can also diagnose paths along which this microcontroller is not located.

In a further variant of the method, at least one redundant path and the microcontroller are monitored by a system base circuit, which is also designed here as a monitoring unit.

The method is, for example, suitable for applications in the automotive sector or in the automotive sector. It is u. a. possible that in the context of the method, a brake light is controlled redundantly. In this case, the input signal is provided by a brake switch or a corresponding brake device. In this case, a brake light is to be generated by this input signal, wherein the input signal is transmitted redundantly to the brake light, so that this brake light indicates a braking. Thus, with the

Procedure, the brake light is operated and controlled.

As part of the described diagnosis, errors can also be diagnosed in addition to the redundant paths or emergency routes. Thus, for example, a shutdown of faulty signals is possible.

The invention also relates to a device for providing a redundancy function intended for the redundant activation of a function, this device having a number of redundant ones Paths along which a provided for triggering the function input signal to the device, which is designed to implement the function to be transmitted redundantly. Furthermore, the device is designed to carry out a diagnosis of at least one redundant path.

This device may typically comprise a microcontroller, a system base circuit designed as a monitoring unit, and a module, which may also be referred to as an emergency running module. The module may comprise a number of logic elements, so that this module is designed in a variant as a logical switching element. The logic switching elements are connected to each other via line sections. Thus, it is possible that the redundant paths or Notlaufpfade run at least in sections along the logic switching elements within the module, which means that along the redundant paths logic elements can be arranged.

The microcontroller of the device can be arranged at the beginning of a branch of a redundant path, so that the input signal is transmitted via the microcontroller directly to this redundant path. In addition, the device can have a number of readback lines, the microcontroller being connected to one of the redundant paths via in each case one such readback line, so that the diagnosis of the paths via these readback lines can be carried out with the microcontroller.

The system base circuit is configured to monitor the microcontroller and in a further embodiment the redundant paths. For this purpose, the system base circuit is connected to the microcontroller. In addition, the system base circuit can also at the beginning of a second branch of the described redundant path, at the first branch of the

Microcontroller is connected, be arranged.

With the invention u. a. a controllable, delay-free control of at least one function, d. H. Also possible from several functions that are triggered by respective input signals. It is clear that in one variant also several different ones

Input signals can be transmitted redundantly via redundant paths of the module within a device. In addition, additional redundant control for the - A -

Failure of the first redundant control plus a complete diagnosis in normal operation are performed.

Thus, a direct control by an input signal under provision of different control options can be realized. A monitoring unit can, for. B. as a system base IC or circuit with an integrated monitoring module (Watchdog) for monitoring a microcontroller, which in case of failure, in addition to the readback signal, which also as Rücksetzbzw. Reset signal is suitable, a high (high) or low (low) active error signal that can control the at least one function redundant, be formed.

In an embodiment of the invention, a combination of the above variants, d. H. an optionally multi-redundant control as well as an example. Operation-accompanying diagnosis done. This results in fast reaction times, flexible control options, a generally complete diagnosis for the detection of sleeping errors and / or a shutdown of a function with a faulty input signal, eg. For a short-circuit protection.

In a refinement, the invention also relates to an emergency function with delay-free and multiple redundant activation of a function including complete diagnosis of at least one redundant signal path or at least one redundant line provided for providing signals and thus at least one redundant path within the module. The module may, for example, comprise logic switching elements, usually AND and OR elements. Such logic switching elements are usually arranged along the at least one redundant path within the module, so that two logic switching elements can be connected to one another via a section of the at least one redundant path. In this case, a logical switching element can be arranged along a redundant path and thus also along a plurality of redundant paths.

The controllable, delay-free activation of the at least one function can typically be carried out directly by the input signal. There is also the possibility of triggering the at least one function in the normal operating case by the microcontroller and a multi-redundant control in case of failure of the microcontroller or other components of the device or a corresponding system. A complete diagnosis of the redundant drive or signal paths, which run at least in sections within the module, eg emergency module, and are thus arranged at least in sections as redundant paths within the module, can take place during operation, inter alia, by detecting dormant errors. A shutdown of a function with a faulty input signal, eg. B. by short circuit, can be provided in addition.

In an embodiment, a delay-free control of the function takes place, wherein this function can optionally be integrated in a trained as emergency run path.

The device described is adapted to all steps of the presented

Procedure to perform. In this case, individual steps of this method can also be carried out by individual components of the device. Furthermore, functions of the device or functions of individual components of the device may be implemented as steps of the method.

The invention further relates to a computer program with program code means for carrying out all the steps of a described method when the computer program is executed on a computer or a corresponding arithmetic unit, in particular in a device according to the invention.

The computer program product according to the invention with program code means which are stored on a computer-readable data carrier is designed to carry out all the steps of a described method when the computer program is executed on a computer or a corresponding computing unit, in particular in a device according to the invention.

A function, described here by way of example based on the function of the brake light, is almost instantaneous, d. H. without software reaction time, and application-specific, eg. B. with a pulse width modulated (PWM) signal driven. The application-specific control by the control signal for pulse width modulation and for testing ("PWM & test") by the

In this case, the microcontroller is not first activated with the function request by the input signal but set in advance and then immediately by the input signal activated. The invention thus opens up the possibility of a delay-free control without software reaction time in a variant.

Thus, the input signal (brake switch input) of a brake switch controls the corresponding function directly and without delay with the correct control signal by hardware control (HW control). It is also possible to control the function via the microcontroller while providing software control. The control can usually take place without an active input signal, if the direct control should be deactivated by the input signal, redundant by the microcontroller.

Moreover, in case of a short circuit to the battery voltage of the input signal, the function can be switched off in order not to erroneously control the function and / or to protect an output driver.

In a further embodiment, a dimming of a light bulb by means of a pulse width modulated signal is possible. The control signal ("PWM & test") can u. a. also be used to diagnose at least one redundant path, which typically runs within the module.

A first redundant control by the monitoring unit (system base chip, SBIC) is usually implemented in case of failure of the microcontroller to provide an error signal.

A second redundant control can be done by the absence of a signal. Ie. the redundant control is immediately or with a delay by turning on a

Supply voltage or a supply current, z. B. KL15, activated. By an error signal (Micro Limp) of the microcontroller, this control is deactivated again, so that in the absence of this error signal from the microcontroller, the redundant control is activated. This error signal (Micro Limp) can also be used to diagnose the at least one redundant path.

For a complete diagnosis, in one embodiment, typically two readback lines (FB1, FB2) are provided. A first readback line is used to Übeφrüfung a first OR element ORl and a second OR element OR2, which are arranged along the at least one redundant path within the module. For checking, a corresponding error signal (SBIC limp or micro limp), which is provided on the system base circuit designed as a monitoring module and / or on the microcontroller, is activated and diagnosed on the basis of a signal level via a first read-back line (FB1) without a function being activated. If the activation of the function is accepted during the test, this first readback line may be omitted in future tests.

A second readback signal provided via the second readback line (FB2) serves at the end of a drive to Übeφrüfung an AND element ANDl and a third OR element OR3 within the module, wherein the function is activated. For this, the input signal and control signal ("PWM & test") can be active.

This read-back signal (FB2), which is provided via the second read-back line (FB2), can also be used for diagnosis when actuated by the microcontroller during normal operation.

In a combination of the embodiments described above, the signals (Micro Limp or PWM & Test) of the microcontroller can each be used for testing and correct application-specific control. Depending on the system design, only one of the named signals of a microcontroller may be sufficient for this purpose.

The emergency function, which can be carried out as part of an implementation of an emergency mode, is generalized for outdoor lighting, usually provided brake or stop lights and / or for a long-term supply relay. In the event that the conditions for emergency running are given, a continuous specific path for energizing the exterior lighting, for example at least one brake light, is activated. Furthermore, an output for the permanent supply is set to an OFF or OFF position. To activate the emergency function, two redundant paths are provided in an embodiment. The

Monitoring module of the system base circuit monitors the microcontroller. In the event of a fault, a suitable signal ("SBIC Limp") is provided to provide emergency running by means of the system base circuit, thus activating the limp home function. Of the Microcontroller prevents the emergency function, as long as it is sufficiently supplied with electrical energy. In case of loss of a signal ("Micro Limp") of the microcontroller for emergency operation of the microcontroller, the emergency function is activated. The logic to provide the emergency function can be activated by an internal signal ("Limp_home_supply_5V"). This signal can be generated by suitable switching elements, which may also be designed as microprocessors.

A diagnosis, for example of the emergency function, for the exterior lighting is possible with any functional request to activate the exterior lighting. At least one trained as Notlaufpfad redundant path is activated in this case via a Notlauffunktion starting from the system base circuit or by an output signal of the microcontroller. To confirm such activation, a readback signal (feedback signal) is transmitted to a driver. After that, the at least one redundant path, in this case the emergency running path, can be deactivated, wherein further method steps are transferred to the microcontroller and thus performed by the latter. As a rule, the microcontroller is monitored by the system base circuit independently of a function currently to be performed. It is further provided that redundant paths, which are normally designed as emergency run paths, for monitoring dormant faults are monitored.

A diagnosis of an emergency running function for at least one brake light is one for each request

Function for activating such a brake light possible. A switch for the brake light is activated for activation via the microcontroller by means of a signal ("Stop PWM / Test"). When the brake light switch is pressed, it is typically activated immediately so that it lights up. The microcontroller recognizes a request transmitted by a signal to activate the brake light. In this case, the microcontroller can activate an activation of a through-connection of the brake light via at least one redundant path via a read-back signal of the driver. Furthermore, the microcontroller can take over the activation of the brake light and thereby deactivate a switching of the switch for the brake light. If the switch for the brake light is triggered, a switching on of the switch for the brake light is activated again by the microcontroller. In this context, a pulse width modulated signal for the brake light can be provided. The brake light can continue to be activated immediately, with no delay by a Monitoring of the microcontroller takes place. To indicate dormant errors, at least one redundant path is monitored when switching on a signal for the brake light.

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

It is understood that the features mentioned above and those yet to be explained below can be used not only in the particular combination indicated, but also in other combinations or in isolation, without departing from the scope of the present invention.

Brief description of the drawings

FIG. 1 shows a schematic representation of an embodiment of a device according to the invention.

Figure 2 shows a schematic representation of waveforms of signals that are implemented in one embodiment of the method according to the invention.

Embodiments of the invention

The invention is illustrated schematically by means of embodiments in the drawings and will be described in detail below with reference to the drawings.

The embodiment of the device 2 according to the invention shown schematically in FIG. 1 comprises an integrated system base circuit 4 (SBIC) which serves as a monitoring unit, a microcontroller 6 and a module 8 embodied here as an emergency running module, the OR and AND elements 18, 24 described below , 28, 30 and accordingly comprises logic circuit elements or logic modules. In this case, the integrated system base circuit 4 and the microcontroller 6 are connected via a serial peripheral interface 10 (serial perephial interface,

SPI) interconnected. The integrated system base circuit 4 and the microcontroller 6 are connected via a first line 12 to a voltage V _REG or VCC. Via a second line 14, the system base circuit 4 provides the microcontroller 6 with either a monitoring signal (watchdog, WD) or a reset signal (reset). In addition, it is provided that the integrated system base circuit 4 can transmit to the module 8 via a third line 16 an S error signal (SBIC limp) for the redundant realization of an emergency function. This S error signal (SBIC Limp) of the system base circuit 4 is supplied to a first OR element 18 (OR1) of the module 8 in the present embodiment.

Via a fourth line 20, starting from the microcontroller 6, the first OR element 18 (OR1) of the module 8 is sent an M error signal (Micro Limp). A fifth line 22 is provided so that the microcontroller 6 a second OR element 24th

(OR2) of the module 8 transmits a pulse width modulated (PWM) signal or a test signal. Via a sixth line 26, the microcontroller 6 transmits to a third OR element 28 (OR3) of the module 8 a signal for software control (SW control).

Furthermore, the module 8 also has an AND element 30 (AND1). The second OR element 24 (OR2) and the AND element 30 (AND1) are connected to the microcontroller 6 via a first readback line 32 (FB1) to provide a first readback signal. Furthermore, the third OR element 28 (OR3) is connected to the microcontroller 6 via a second readback line 34 (FB2) for providing a second readback signal. During operation of the device 2, the module 8 is supplied via a supply line 36 with a current (KLl 5 supply).

The first readback line 32 (FB1) is here used to check the first and second OR elements 18, 24 (OR1, OR2) of the module 8. For verification, either the S error signal (SBIC Limp) of the system base circuit 4 or the M error signal (Micro Limp) of the

Microcontroller 6 is activated and diagnosed based on a signal level on the first readback line 32 (FBl), without a function is controlled.

The second readback signal is provided for checking the AND element 30 (AND1) and the third OR element 28 (OR3). In this case, the function is activated, wherein the pulse-width-modulated signal and an input signal provided via a supply line 38 are active. In addition, the second readback signal is used in the control of the microcontroller 6 for the diagnosis of at least one path within the module 8 in normal operation. The application-specific control by the control signal for pulse width modulation and for testing ("PWM &test") by the microcontroller 8 is set in advance in this case and activated by the input signal.

It is provided that the present embodiment of the device 2 for implementing a limp home function is designed for brake or stop lights of a motor vehicle. It is provided that the AND element 30 (ANDl) of the logic switching element 8 via the supply line 38, the input signal of a brake switch is provided. Via a switching line 40, starting from the logical switching element 8, a brake light is transmitted to an output signal for providing a brake light as a function to be triggered here. In addition, this input signal is transmitted via a branch line 42 of the lead 38 to the microcontroller 6. Thus, it is possible to supply redundantly the input signal via the microcontroller of the switching line 40 and to drive the brake light redundant.

It is also possible to control the brake light only by the microcontroller by the PWM signal 22 is turned off. This allows a diagnosis of the path 6 via the fifth line of the microcontroller by means of feedback via the second readback line 34. This is a so-called. Normal function, there is a delay-free switching, then

Taking over the control by the microcontroller 6 and switching off the direct access. After the function request disappears and the brake light is turned off, the PWM signal is reactivated to allow quick turn-on.

A first redundant control by a monitoring unit (system base chip SBIC) is usually delivered in the case of failure of the microcontroller as an error signal (Limp).

A second redundant control can be done in the absence of a signal. Ie. the redundant control is immediate or delayed by switching on a supply voltage or a supply current, eg. B. KL15, activated. Through an M

Error signal (Micro Limp) of the microcontroller, this control is disabled again, so that in the absence of this M error signal, the redundant control is activated. The module 8 of the device 2 in the present embodiment comprises three redundant lines, which are referred to as redundant paths and are provided for the activation of the emergency function. The first redundant path begins at the end of the lead 38 and passes through the AND element 30 (AND1) and the third OR element 28 (OR3) to the switching line 40. The second redundant path includes the first OR element 18 (OR1 ) and extends along the second OR element 24 (OR2), the AND element 30 (AND1) and the third OR element 28 (OR3) and terminates at the switching line 40. Depending on which redundant drive is provided has this second redundant path at its beginning the system base circuit 4 and the third line 16 or the microcontroller 6 and the fourth line 20 on.

The supply line 36 activates the second redundant path from the first OR element 18 (OR1). The microcontroller 6 prevents this emergency function as long as its supply is present. A signal provided for this purpose "Micro Limp" is typically transmitted immediately upon startup, after a reset or after switching on a voltage of the system circuit 4 (VCC ON), assuming a correctly running system, and thus provided. In the case of a failure of the integrated system base circuit 4, for example, in the event of failure of the supply voltage VCC, which is provided via the first line 12 for the microcontroller 6, the microcontroller 6 can not provide the signal, so that the emergency function is activated.

Accordingly, a logic for emergency operation via the redundant provided internally via the supply line 36 KL15 signal can be generated. In the event that conditions for the emergency operation are given, a direct passage of the input signal of the brake light switch is activated to the switching line 40 via the first redundant path for the input signal, so that

Brake light via this redundant path, here along the AND element 30 and the third OR element 28, is controlled directly.

It is further provided that with the present device 2 a direct control and a direct test of the brake light is possible. For this purpose, either the pulse-width-modulated signal or the test signal is activated in a pre-run for control application-specific starting from microcontroller 6. The input signal of the brake switch outputs the pulse-width-modulated signal or the test signal for checking by means of the lead 38 provided input signal free. Readback or feedback signals provided via the two readback lines 32, 34 (SW1, FB2) are transmitted for checking a signal for emergency operation as well as a signal for normal operation.

In the diagram of FIG. 2, along a time axis 50, during a check of FIG

Brake lamp, the course of an input signal 52 of the brake switch, a control signal 54, here a combination of a pulse width modulated signal and a test signal, an output signal 56 for the brake light and a software control signal 58 plotted. Within this diagram, a first dashed line 60 indicates a first time point by which a minimum hardware response time is indicated. A second time line 62 indicates the time that begins after a software response time 64 has elapsed. The output signal 56 for the brake light is controlled in the implementation of the method via a first control mechanism 66 from the control signal 54 (PWM and test) or via a second control mechanism 68 from the software control signal 58 and the control signal 54 (PWM and test) off that the output signal 56 for the

Bram light during normal operation is under the control of the microcontroller. The diagram serves for the representation of the normal operation and the delay-free control of the function (brake light). The control signal 54 and the software control signal 58 are input signals of the OR element 28 shown in Figure 1, the output signal 56 whose output signal.

The first trained as a logic device OR element 18 also generates, immediately or with delay, when applying the supply voltage KL15 via the supply line 36, a signal for activating the emergency operation when the signal "Micro Limp" is not active. Ie. In normal operation, the microcontroller 6 deactivates this emergency running path as fast as possible. In case of error z. B. in case of failure of the voltage of the system basic circuit 4, this path is activated because the signal "Micro Limp" is missing, but the first OR element 18 logic is still supplied. Other errors, eg. B. Software errors are covered by monitoring the microcontroller 6 by means of the monitoring module in the system basic circuit 4.

Claims

claims

A method for providing a Notlauffunktion over which a redundant function is controlled, in which a provided for triggering the input signal (52) along a number of redundant paths to a device that is designed to implement the function is transmitted redundantly, and in which a diagnosis of at least one redundant path is performed.

2. The method of claim 1, wherein the input signal is transmitted directly via a first redundant path to the device, and wherein the input signal via a second redundant path, which includes a microcontroller (6), is transmitted to the device.

3. The method of claim 2, wherein the paths are diagnosed by the microcontroller (6).

4. The method of claim 2 or 3, wherein at least one redundant path and the microcontroller (6) are monitored by a system base circuit (2).

5. The method according to any one of the preceding claims, wherein at least one brake light is controlled redundantly.

6. The method according to any one of the preceding claims, wherein the function is controlled without delay and integrated into the at least one redundant path.

7. An apparatus for providing an emergency function provided for the redundant activation of a function, wherein this apparatus comprises a number of redundant paths along which an input signal (52) provided for triggering the function Means, which is designed to implement the function to be transmitted redundantly, and wherein the device is adapted to perform a diagnosis of at least one redundant path.

8. The apparatus of claim 7, wherein the redundant paths along logical

Elements within a module.

9. Device according to claim 7 or 8, comprising a microcontroller (6), which is arranged at the beginning of a first branch of a redundant path.

10. The apparatus of claim 9, wherein the microcontroller (6) via a respective read-back line (32, 34) is connected to one of the redundant paths.

An apparatus according to claim 9 or 10, comprising a system base circuit connected to the microcontroller (6) and located at the beginning of a second branch of the redundant path.

12. Computer program with program code means to perform all the steps of a method according to one of claims 1 to 6, when the computer program on a computer or a corresponding computing unit, in particular in a device according to one of claims 7 to 11, is executed.

A computer program product comprising program code means stored on a computer readable medium for performing all the steps of a method as claimed in any one of claims 1 to 6 when the computer program is run on a computer or equivalent computer

Computing unit, in particular in a device according to one of claims 7 to 11, is executed.