WO2010046200A1 - Procédé de surveillance de l’aptitude fonctionnelle d’un module électronique - Google Patents

Procédé de surveillance de l’aptitude fonctionnelle d’un module électronique Download PDF

Info

Publication number
WO2010046200A1
WO2010046200A1 PCT/EP2009/062522 EP2009062522W WO2010046200A1 WO 2010046200 A1 WO2010046200 A1 WO 2010046200A1 EP 2009062522 W EP2009062522 W EP 2009062522W WO 2010046200 A1 WO2010046200 A1 WO 2010046200A1
Authority
WO
WIPO (PCT)
Prior art keywords
electronic
electronic component
comparator
test pattern
fpga
Prior art date
Application number
PCT/EP2009/062522
Other languages
German (de)
English (en)
Inventor
Tobias Stumber
Dietmar Merten
Michael Smuda Von Trzebiatowski
Original Assignee
Robert Bosch Gmbh
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Robert Bosch Gmbh filed Critical Robert Bosch Gmbh
Publication of WO2010046200A1 publication Critical patent/WO2010046200A1/fr

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1479—Generic software techniques for error detection or fault masking
    • G06F11/1487—Generic software techniques for error detection or fault masking using N-version programming
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • B60W50/04—Monitoring the functioning of the control system
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • B60W50/04—Monitoring the functioning of the control system
    • B60W2050/041—Built in Test Equipment [BITE]

Definitions

  • the invention relates to a method for monitoring the functionality of an electronic component in a control unit, such a control unit and a computer program and a computer program product for carrying out the method.
  • Electronic control units are used in motor vehicles in various areas to control and / or regulate various processes. That is how it is
  • control devices in devices for driving state recognition known in which different sizes, such as.
  • the steering angle speed, but also optical signals or image signals are recorded and evaluated to detect a critical driving condition.
  • the publication DE 10 2005 057 267 A1 describes a method and a device for driving state recognition, in which the course of a signal characterizing the driving state is evaluated and in a typical course a signal characterizing the driving state is generated.
  • the device in this case has an electronic control unit, which consists essentially of components such as input circuit, computer and output circuit, wherein the individual components are connected for mutual data and information exchange with a bus system.
  • an electronic control unit which consists essentially of components such as input circuit, computer and output circuit, wherein the individual components are connected for mutual data and information exchange with a bus system.
  • a video camera is used, which is connected to the input circuit.
  • video-based driver assistance systems have a very high resource requirement due to the complexity of the environment. This is also reflected in the hardware used.
  • ISO 26262 is an intended ISO standard for automotive safety-related systems that defines a process framework and process model together with required activities and work products as well as applicable methods.
  • the implementation of the standard is intended to ensure the functional safety of an electronic system in motor vehicles.
  • hazard analysis and risk assessment method that identifies potentially dangerous situations based on the system description.
  • Each hazard is then classified with a safety requirement level from A to D or classified as non-safety relevant.
  • the level of injury, the frequency of the situation and the value of the situation by the driver must be estimated individually for each identified hazard.
  • the classification QM (quality managed) or ASIL (automotive safety integrity level) A to D can then be read for each hazard.
  • the standard addresses the protection of systems in the automotive sector, if it can come through a failure of the hardware or by software implementation errors in the technical sense to a hazard. Functional inadequacies, which, for example, result from inadequate detection of the surroundings, are not addressed by the standard. If necessary, these must be addressed via further measures outside the standard.
  • the software has a negligible error in understanding the standard if it is developed according to the processes of the standard. This safety concept shows the protection of E / E / PES systems in the sense of the standard. This protection is generally driven by the hardware.
  • errors are u.a. permanently random errors, such as a defective RAM cell, systematic errors, such as, for example, an incorrectly designed operating temperature, transient errors, such as, for example, a single event upset (bit dump). These errors can affect program and data.
  • the specifications are that the system under consideration is fail-safe, ie that switching off the system in the event of a fault is always safe. In addition, an error that leads to failure of any communication (fail-silent), also in the safe state.
  • the method according to the invention serves to monitor the operability of an electronic component in a motor vehicle.
  • a quantity relating to a driving state of the motor vehicle is supplied to the electronic module as an input signal for processing.
  • An output signal from the The electronic module is forwarded to an electronic processing unit in which the output signal is processed further with diverse software algorithms, the outputs of the diversified software algorithms being compared in a comparator.
  • two software algorithms are used whose outputs are compared in the comparator.
  • the control unit with the electronic component is used, for example, in a video-based driver assistance system in which a driving condition monitoring is performed.
  • the electronic module an image signal can be supplied as an input signal.
  • the electronic component which is designed, for example, as FPGA (field programmable gate array: locally modifiable logic module), can be monitored with a test coverage of, for example, more than 90%.
  • the electronic component is additionally supplied with a test pattern, which is processed in the electronic component.
  • the processed test pattern is then forwarded to the electronic processing unit.
  • the processed test pattern and the output signal can be processed separately in the electronic processing unit, for example a microcontroller.
  • test pattern verification In the electronic processing unit, a test pattern verification can be performed. A failure of the test pattern analysis regularly leads to an error.
  • the functionality of the comparator is monitored.
  • SCON safety controller
  • the described control unit for a motor vehicle is used in particular for carrying out a method of the type described above.
  • This has an electronic component, for example an FPGA, and an electronic processor, for example a microcontroller, wherein the electronic component is designed for receiving and processing a driving condition of the motor vehicle size and the electronic processing unit is designed for further processing of an output signal of the electronic component.
  • di- versitive software algorithms are used for further processing in the electronic processing unit.
  • a comparator is also provided which is adapted to compare outputs of the diversified software algorithms.
  • a safety device for monitoring the comparator for example a hardware-independent SCON, is provided.
  • the presented computer program comprises program code means for carrying out all the steps of a method described above when the computer program is executed on a computer or a corresponding computing unit, in particular in a control unit of the type described.
  • the computer program product comprises these program code means which are stored on a computer-readable data carrier in order to carry out all the steps of a presented method when the computer program is stored on a computer-readable data carrier
  • the presented method has, at least in some of the embodiments set out, a number of advantages.
  • a generic monitoring of the electronic component and thus an FPGA without the use of explicit hardware properties of the FPGA can be performed.
  • the use of divergent algorithms in the electronic arithmetic unit greatly simplifies the complex self-diagnosis of the arithmetic unit at a high level of abstraction. Therefore, even complex microcontrollers can be used in an ASIL-B control unit.
  • existing hardware concepts can be used for both QM and ASIL A / B.
  • Figure 1 shows a schematic representation of an embodiment of a control device.
  • Figure 2 shows a schematic representation of a hardware concept of a device for detecting the driving condition.
  • Figure 3 shows a block diagram of the structure of the software in a device for driving condition detection.
  • FIG. 4 shows the transition from an uncritical to a critical transient error.
  • FIG. 5 shows a system concept for a control unit for driving state detection.
  • FIG. 6 illustrates the detection of permanent FPGA errors.
  • FIG. 7 shows a possible comparator concept.
  • control unit 10 has an electronic
  • Module 12 in this case an FPGA, and an electronic processing unit 14, in this embodiment, a microcontroller on. Furthermore, a comparator 16 and a controller 18 for monitoring the comparator 16 are provided in the control unit 10. In the electronic module 12, an area 20 for storing an algorithm and a generator 22 for generating a test pattern is provided.
  • a first region 24 for a first algorithm, a second region 26 for a second algorithm, and a third region 28 for a test pattern verification are provided in the electronic unit 14.
  • An imager 30 passes captured image signals to the electronic device 12. In the data flow of the image signals before the processing by the electronic module 12 test pattern both before and after the relevant
  • Input image data The test patterns are processed by the module 12 without special treatment.
  • the result of the calculations can be stored in a block RAM (not shown) between the block 12 and the arithmetic unit 14. In this case, it is not relevant whether the module 12 and the computing unit 14 are separate or integrated components.
  • the results of the block 12 are processed separately according to image and test pattern in the arithmetic unit 14.
  • a test pattern verification compares the block 12 result of the test pattern with known setpoints.
  • the comparator 16 represents the single-point failure of the arithmetic unit 14. In this, the two diverse software channels are compared and given a detected equivalence on a vehicle bus 32. The comparator 16 is monitored by the hardware-independent SCON (safety controller).
  • FIG. 2 shows a schematic representation of a device for FahrSchser- recognition is shown.
  • This device designated by the reference numeral 50, includes a power port 52 which is connected to the electrical system of the
  • Vehicle (arrow 54), a controller 56, a nonvolatile memory (NVM) memory 58, an FPGA 60, an imager 62, a block memory 64 and a lens unit 70.
  • Incident light 72 is detected by the lens unit 70 and relayed to the imager 62.
  • the imager 62 passes image data to the FPGA 60, as indicated by arrow 74.
  • the FPGA 60 includes a logic unit 76, an embedded core 78 and an area 80 for storing the algorithms. Furthermore, the FPGA 60 is connected to the block memory 64, and the NVM memory 58. To the outside, the FPGA 60 communicates with an on-board CAN bus (double arrow 82) and via the controller 56 with another fieldbus system (double arrow 86), for example a FlexRay.
  • an on-board CAN bus double arrow 82
  • another fieldbus system double arrow 86
  • FIG. 3 shows a block diagram of the structure of the software used in a driving state identification device. External data is contained in a first block 100, in a second block the data and programs of the driver condition detection device and in a third block
  • Block 104 the output data.
  • the external data includes image sensor data 106 and vehicle sensor data 108.
  • the image sensor data 106 is passed to the FPGA 110, where image preprocessing and data reduction is performed (block 1 12).
  • a microcontroller 1 14 is further provided. This captures the image data of the FPGA 1 10 and performs object formation in the image plane (block 1 16).
  • the vehicle sensor data 108 is used in addition to the real object formation (block 1 18) and the state estimation (block 120).
  • the FPGA 1 10 in the context of the considered function thus serves the data reduction at the level of low-level image processing. From the point of view of the FPGA 1 10, every picture is completely new and without reference to previous pictures.
  • Transient errors in the data flow of the FPGA 1 10 correspond to the general sensor noise.
  • the processing of noisy input signals is a functional requirement for the algorithms.
  • the implemented security concept therefore focuses on the detection of permanent faults of the FPGA 1 10.
  • the algorithmic logic of the object formation is calculated in the microcontroller 14. In this case, not only a single image evaluation, as is the case with the FPGA 1 10 carried out. Due to the temporal correlation, it is not possible to neglect transient errors.
  • the detection of transient and permanent errors is addressed by the security concept.
  • FIG. 4 illustrates the transition from an uncritical to a critical transient error.
  • a two-dimensional image plane 150 is juxtaposed with a real environment 152.
  • a region 154 shows non-critical transient errors and a region 156 transient errors that must be detected.
  • An imager 158 generates the data of the image plane 150, which is converted into a real model or the real environment 152 and forwarded to a vehicle bus 160.
  • the amount of data is plotted against the information content per date 164.
  • FIG. 5 shows a possible system concept for a control unit that is used in a driving condition detection.
  • the illustration shows an imager, an FPGA 402, a RAM 404, a microcontroller 406 and a vehicle bus 408.
  • the FPGA 402 includes a test pattern 410 and a first algorithm 412.
  • a first algorithm 414 In the microcontroller 406, a first algorithm 414, a second algorithm 416, a test pattern verifier 418 and a comparator 420 are provided.
  • the data flow is, for example, one-channel from the imager 400 to the FPGA 402.
  • the data preprocessing takes place.
  • the result is stored in common memory of FPGA 402 and microcontroller 406, namely RAM 404.
  • microcontroller 406 calculates in microcontroller 406 two diverse algorithms the object data.
  • the results of the diverse algorithms are compared in the comparator 420.
  • the image data is expanded by defined and non-static test patterns 410, which are processed in the FPGA 402 without special treatment.
  • the result of the test pattern 410 is checked in the microcontroller 406.
  • a prerequisite is sufficient diversification of the algorithms on the basis of the same FPGA results, which allows preprocessing, and that sufficiently diverse algorithms on a faulty hardware do not come to the same result.
  • the advantage is that the basic hardware concept can be adopted.
  • Another advantage is the good recognition of systematic and random transient / permanent errors.
  • FIG. 6 illustrates the detection of permanent FPGA errors.
  • An imager outputs image data 452 to an FPGA 454.
  • a test pattern 456 is generated in this FPGA 454.
  • a test pattern verification takes place, so that a data record 460 with image data 452 and test pattern 456 is present.
  • the test patterns 456 at the beginning and at the end of each image allow complete test coverage of the FPGA 454 (pipelining in the FPGA).
  • the record 460 is forwarded (arrow 462).
  • the test pattern 456 at the beginning and at the end of the actual image ensures for the current cycle that there are no permanent errors.
  • the patterns are not constant, but are shuffled against each other each cycle.
  • the memory in the FPGA 454 is completely scanned.
  • the results are stored in blocks in the result list.
  • the position of the result block within the list is also rotated. The relevant memory area is thereby protected.
  • FIG. 7 shows a possible comparator concept.
  • the illustration shows a comparator 500 with two inputs, namely a channel A 502 and a channel B 504. It should be noted that in each multi-channel system, the comparison of the channels 502 and 504 is the only "single point of failure".
  • the illustration also shows a SCON 506, a cyclic redundancy check (CRC) 508, a message counter 510 and a vehicle bus 512.
  • CRC cyclic redundancy check
  • the SCON 506 sends a so-called challenge (arrow 514) and receives a response (arrow) 516). Depending on the outcome of the check, the SCON 506 sends an enable or disable to the
  • CRC cyclic redundancy check
  • Vehicle bus 512 (arrow 518).
  • stuck-at-1 permanent approval
  • the SCON 506 makes a request that must lead to a rejection. If the comparator 500 answers incorrectly, the SCON 506 gives the
  • Vehicle bus 512 not free (disable).

Landscapes

  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Theoretical Computer Science (AREA)
  • Human Computer Interaction (AREA)
  • Transportation (AREA)
  • Mechanical Engineering (AREA)
  • Quality & Reliability (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Debugging And Monitoring (AREA)
  • Traffic Control Systems (AREA)

Abstract

L'invention concerne un procédé de surveillance de l'aptitude fonctionnelle d'un module électronique (12). Selon le procédé, une grandeur relative à un état de marche du véhicule est amenée au module électronique (12) en tant que signal d'entrée, et un signal de sortie du module électronique (12) est transmis à une unité de calcul (14) dans laquelle ce signal de sortie est traité en utilisant des algorithmes logiciels diversitaires. Les résultats des algorithmes logiciels diversitaires sont comparés les uns aux autres dans un comparateur (16).
PCT/EP2009/062522 2008-10-22 2009-09-28 Procédé de surveillance de l’aptitude fonctionnelle d’un module électronique WO2010046200A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE200810043089 DE102008043089A1 (de) 2008-10-22 2008-10-22 Verfahren zur Überwachung der Funktionsfähigkeit eines elektronischen Bausteins
DE102008043089.7 2008-10-22

Publications (1)

Publication Number Publication Date
WO2010046200A1 true WO2010046200A1 (fr) 2010-04-29

Family

ID=41314652

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/EP2009/062522 WO2010046200A1 (fr) 2008-10-22 2009-09-28 Procédé de surveillance de l’aptitude fonctionnelle d’un module électronique

Country Status (2)

Country Link
DE (1) DE102008043089A1 (fr)
WO (1) WO2010046200A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102016203266A1 (de) * 2016-02-29 2017-08-31 Zf Friedrichshafen Ag Verfahren zum Betreiben einer Anzeigevorrichtung und Anzeigevorrichtung

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102012200423A1 (de) * 2011-05-11 2012-11-15 Continental Automotive Gmbh Ansteuermodul für eine elektrische Vakuumpumpe
CN105759763B (zh) * 2016-04-01 2018-05-29 沈阳东软医疗系统有限公司 一种多叶光栅的控制方法及系统
DE102022211670A1 (de) 2022-11-04 2024-05-08 Robert Bosch Gesellschaft mit beschränkter Haftung Verfahren zur frühzeitigen Erkennung von Fehlern von wenigstens einer auf einer Leiterplatine montierten elektronischen Komponente

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002032742A1 (fr) * 2000-10-21 2002-04-25 Robert Bosch Gmbh Procede de commande d'un systeme de direction d'orientation par cables
WO2003056427A2 (fr) * 2001-12-21 2003-07-10 Robert Bosch Gmbh Procede et dispositif de commande d'une unite fonctionnelle d'un vehicule automobile
DE10229342A1 (de) * 2002-06-29 2004-01-29 Robert Bosch Gmbh Grafik-Datenverarbeitungs-Einrichtung sowie Grafik-Datenverarbeitungs-System und Verfahren zur Aufbereitung eines grafischen Elements
WO2007054275A2 (fr) * 2005-11-12 2007-05-18 Diehl Aerospace Gmbh Procede pour surveiller la commande de presentations d'images, notamment a partir de donnees brutes relatives a la securite
WO2008046686A1 (fr) * 2006-10-19 2008-04-24 Robert Bosch Gmbh procédé d'utilisation d'un appareil de commande

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102005057267A1 (de) 2005-12-01 2007-06-06 Robert Bosch Gmbh Verfahren und Vorrichtung zur Fahrerzustandserkennung

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002032742A1 (fr) * 2000-10-21 2002-04-25 Robert Bosch Gmbh Procede de commande d'un systeme de direction d'orientation par cables
WO2003056427A2 (fr) * 2001-12-21 2003-07-10 Robert Bosch Gmbh Procede et dispositif de commande d'une unite fonctionnelle d'un vehicule automobile
DE10229342A1 (de) * 2002-06-29 2004-01-29 Robert Bosch Gmbh Grafik-Datenverarbeitungs-Einrichtung sowie Grafik-Datenverarbeitungs-System und Verfahren zur Aufbereitung eines grafischen Elements
WO2007054275A2 (fr) * 2005-11-12 2007-05-18 Diehl Aerospace Gmbh Procede pour surveiller la commande de presentations d'images, notamment a partir de donnees brutes relatives a la securite
WO2008046686A1 (fr) * 2006-10-19 2008-04-24 Robert Bosch Gmbh procédé d'utilisation d'un appareil de commande

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
KOPETZ H ED - KOPETZ H: "Chapter 6: fault tolerance", REAL-TIME SYSTEMS : DESIGN PRINCIPLES FOR DISTRIBUTED EMBEDDED APPLICATIONS; [KLUWER INTERNATIONAL SERIES IN ENGINEERING AND COMPUTER SCIENCE], NORWELL, MA : KLUWER ACADEMIC PUBL, US, 1 January 1998 (1998-01-01), USA, pages 119 - 143, XP002561456, ISBN: 978-0-7923-9894-3 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102016203266A1 (de) * 2016-02-29 2017-08-31 Zf Friedrichshafen Ag Verfahren zum Betreiben einer Anzeigevorrichtung und Anzeigevorrichtung

Also Published As

Publication number Publication date
DE102008043089A1 (de) 2010-04-29

Similar Documents

Publication Publication Date Title
EP3709166B1 (fr) Procédé et système de manipulation sécurisée de signal pour l'essai des fonctionnalités de sécurité intégrées
EP2447843B1 (fr) Procédé de vérification d'un programme d'application d'une commande par programme enregistré protégée contre les erreurs et commande par programme enregistré destinée à l'exécution du procédé
DE102017107284A1 (de) Verfahren und steuergerät zum überwachen eines bordnetzes eines fahrzeugs
EP3642716A1 (fr) Dispositif et procédé de commande d'un module de véhicule en fonction d'un signal d'état
DE102018002156A1 (de) Ein verbessertes Steuerungssystem und ein verbessertes Steuerungsverfahren für das autonome Steuern eines Kraftfahrzeugs
DE102017210156B4 (de) Vorrichtung und Verfahren zum Ansteuern eines Fahrzeugmoduls
WO2010046200A1 (fr) Procédé de surveillance de l’aptitude fonctionnelle d’un module électronique
DE102017103724B4 (de) Vorrichtung und Verfahren zum Steuern eines Sensorbauelements eines Sicherheitssystems eines Objekts, Steuerungssystem für ein Automobilfahrzeug und Sensorbauelement für ein Sicherheitssystem eines Automobilfahrzeugs
DE102017105174B4 (de) Verfahren zum Erzeugen von Trainingsdaten für die Überwachung einer Gefahrenquelle
EP1533505A2 (fr) Méthode de diagnostic d'erreurs d'un appareil de contrôle d'un moteur automobile à combustion
DE102015202326A1 (de) Verfahren zum Betreiben einer Datenverarbeitungseinheit eines Fahrerassistenzsystems und Datenverarbeitungseinheit
EP3535965B1 (fr) Procédé et dispositif de surveillance d'un capteur d'image
WO2017080942A1 (fr) Procédé servant à faire fonctionner un appareil de commande d'un véhicule automobile
EP1860565A1 (fr) Procédé destiné à la vérification du fonctionnement d'un appareil de commande pour un véhicule automobile
EP3378006B1 (fr) Procédé pour charger unne image mémoire sécurisée d'un microcontrôleur et arrangement avec un microcontrôleur
EP2405317B1 (fr) Procédé de paramétrage assuré sûr d'un appareil
EP3470939B1 (fr) Procédé et système de surveillance de l'intégrité de sécurité d'une fonction de sécurité fournie par un système de sécurité
DE102009012887B4 (de) Verfahren zum Prüfen einer nicht korrekten Installation von Fahrzeugsensoren
DE102017123911A1 (de) Verfahren und Vorrichtung zum Überwachen der Reaktionszeit einer durch ein Sicherheitssystem bereitgestellten Sicherheitsfunktion
DE102017214610B4 (de) Verfahren zum Überprüfen von zumindest einer Fahrzeugfunktion sowie Prüfvorrichtung
EP3789832B1 (fr) Dispositif et procédé d'exécution d'une fonction de sécurité
EP2435915B1 (fr) Réduction du délai de réaction dans un système de surveillance d'un calculateur fonctionnel
WO2019020322A1 (fr) Procédé de fonctionnement d'un appareil de commande et dispositif doté de l'appareil de commande correspondant
DE102019201708A1 (de) Vorrichtung und Verfahren zum Betreiben eines Systems
DE102015221951A1 (de) Verfahren zur Überprüfung einer Überwachungsfunktion

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09783481

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 09783481

Country of ref document: EP

Kind code of ref document: A1