Patent Application
20100174448
1. Field of the Invention
The present invention relates to a method for operating a control unit in a motor vehicle having a computer system which has two pairs of execution units, the two execution units of each pair processing the same program and the output signals of the execution units of one pair being compared with each other, an error signal being output in the event of a difference in the output signals of the execution units of one pair.
2. Description of Related Art
Published international patent application WO 2007/017381 A1 discloses a device which includes a multiprocessor system having four execution units, two execution units always processing the same tasks and processes. Using a comparing unit, the output signals output by two execution units, which process the same programs, are compared and when these two output signals differ from one another, an error signal is output. This case, referred to as lockstep mode, is primarily used in such applications having high error detection requirements, e.g., in safety-relevant applications.
In the case of an error, in virtually all automotive states the shutdown of a control unit is considered the safest state. If a control unit is shut down, the driver is informed about it, because operation of the vehicle may not continue after the shutdown of the control unit, provided that the control unit is a prerequisite for operating the vehicle (e.g., engine control, steering, etc.).
An object of the present invention is to provide a method and a device for operating a control unit in which operation of the vehicle may continue even in the event of an error.
A method for operating a control unit according to the present invention has the advantage that the driver may continue driving without restrictions. Due to the fact that, when the error signal for a first pair of execution units occurs, the control unit is shut down and the computer system continues to operate using the second pair of execution units and a pre-warning signal is output to the driver, the core function of the control unit being maintained while the driver receives only a warning. This method is always advantageously usable when the two pairs are so-called “lockstep pairs” which means that two execution units of one pair always process the same program steps and the output signals of the two execution units, which form one pair, are compared. The two execution units of one pair may be interconnected asynchronously or with the aid of a clock-pulse offset which is taken into account during the comparison.
No further measures are needed for safeguarding since the normative requirements are still met due to the remaining, still active, lockstep pair. No speed reduction is necessary, for example.
In one embodiment, the computer system is only shut down when error signals occur from both pairs of the execution units and a visual and/or acoustic warning signal is output to the driver. The driver must stop the driving operation of the vehicle immediately, since the safety of the vehicle is no longer ensured. Two-step error signaling is thus made possible. The driver receives a pre-warning signal when one pair of execution units fails, and a warning signal is output if both pairs are defective.
The pre-warning signal is advantageously output during the entire continuing operation of the computer system using the second, still active pair of execution units. The driver is thus informed during the entire remaining driving cycle that a safety-relevant error exists in the control unit. The driver is thus prompted at an early stage to look for a repair shop to have the error corrected.
In one embodiment, the second, still active pair of execution units is informed about the error in the first pair of execution units, the second pair of execution units initiating the output of the pre-warning signal. There is the option that the second pair of execution units may access various units of the computer system, thereby making it possible to use signaling devices which are already present in the vehicle and are not needed during driving operation.
In one refinement, the first pair of execution units is tested after the error has been detected and the pre-warning signal is output to the driver only when the first pair of execution units has been shut down after the error was confirmed. This has the advantage that error signaling to the driver takes place only when it is certain that a hardware error really exists and the first pair of execution units must be shut down. Transient errors, which influence the execution units by EMV effects, radioactive, or cosmic radiation, do not result in error signaling because they do not leave any permanent damage and occur only sporadically.
The occurrence of the error signal is advantageously counted and the pre-warning signal is only output when a predefined number of error signals has been ascertained. A signal is not triggered at the first occurrence of an error signal, because it is not certain in this case whether a permanent error really exists. In this way, the pair which is affected by transient errors may return to its normal processing state after the cessation of the transient errors. Disturbing of the driver by a premature error display is thus prevented. In one embodiment, the error signal is memorized, the first pair of execution units being tested at a restart of the computer system and the pre-warning signal being suppressed when the error signal fails to occur. The computer system is restarted normally when the vehicle engine is started, i.e., in a new driving cycle. After the shutdown pair of execution units is regenerated during the vehicle standstill or a vehicle reset, a warning to the driver may be omitted.
In one refinement, the computer system is shut down despite correct mode of operation of the second pair of execution units when the number of memorized error signals exceeds a certain value. The memorized error signals indicate the vulnerability of the computer system. If a certain number of faults are registered, the control unit must be tested in a repair shop for possibly sporadically occurring hardware errors in order to prevent permanent failure of both pairs of execution units.
In another refinement, a device for operating a control unit in a motor vehicle has a computer system which includes two pairs, each having two execution units, the two execution units of each pair processing the same program and the output signals of each execution unit of one pair being compared with one another using one comparing unit each, an error signal being output by the comparing unit when a difference in the output signals of the execution units of one pair occurs. In a device where operation of the vehicle may continue also in the event of an error, means are present which, when the error signal for a first pair of execution units occurs, shuts it down and continues to operate the computer system using the second pair of execution units, a pre-warning signal being output to the driver. Although the full operability of the computer system is reliably ensured due to the presence of the second pair of execution units, which additionally processes at least part of the programs of the execution units of the first pair, the damage to the first pair of execution units is indicated to the driver for safety reasons.
The comparing units are advantageously connected to a signaling device which is associated with the defective pair of execution units and which is activated when the comparing unit outputs the error signal. Immediately after the error is detected, the driver is informed so he is able to initiate countermeasures if needed.
In one embodiment, the comparing unit of the first pair and the comparing unit of the second pair are connected to a holding element which is connected to the signaling device. Via the holding element, the signaling device is activated by the error signal of at least one comparing unit and kept active during the entire driving cycle of the vehicle, so that the driver is continuously informed about the error. One holding element is sufficient here which may be activated by both comparing units.
In one refinement, the signaling device is contained in a second control unit, the first and the second pair of execution units being connected to the second control unit via a data line and the second, still active pair of execution units, transmitting a signal to the second control unit for activating the signaling device following information from the first pair about the output of an error signal. In this case, communication of the two control units takes place which is initiated in the first control unit by the second, still active pair of execution units. The information of the second, still active pair of execution units about the error in the first pair of execution units is provided via an interrupt or via a signal to be cyclically checked.
The signaling device is alternatively situated in a peripheral unit of the computer system which is connected to the first and the second pair of execution units via a data line, and the second, still active pair of execution units transmits a signal to the peripheral unit for activating the signaling device after having received information about the output of an error signal by the first pair. Signaling devices may thus be used which are advantageously already present in the vehicle and which are connected to other devices of the computer system and are not in use during the driving operation of the vehicle.
In one refinement, a memory unit containing a counter is connected to the data line, the counter being incremented by a certain value when the error signal is output by one of the two comparing units and the signaling device is only activated by the counter when a predefined counter value is reached. To prevent transient errors from occurring and to be sure that a hardware fault which is permanently repeated is present, the driver is alerted only when a predefined counter value is reached.
An error memory of the control unit is advantageously connected, via the data line, to the first and the second execution units in which an entry is made at each activation of the signaling device. With the aid of such an error memory, the behavior of both pairs of execution units may be continuously registered and may be read out and interpreted at any time. These error entries may be deleted only in a repair shop.
In one embodiment, the control unit is permanently shut down when the number of error entries in the error memory is exceeded. This measure ensures that a vehicle unsuitable for driving, which does not meet the prevailing safety requirements, is not operated. Even if it is not definitely known which errors resulted in the entries in the error memory, it must be assumed that, starting from a predefined number of error entries which have been registered either currently or within a certain period, the vehicle's safety is no longer ensured.
Computing units 110, 120 of first pair 100 are connected to a first comparing unit 130, while computing units 210, 220 of second pair 200 are connected to a second comparing unit 230. First comparing unit 130 and second comparing unit 230 are connected to a communication line 1000. A memory 110 and additional peripheral units 1200, 1300, and 1400 are connected to communication line 1000.
Furthermore, comparing units 130, 230 of both pairs 100, 200 are connected to a holding element 300 which in turn is connected to a warning device 310. Warning device 310 includes two lamps, one yellow and one red.
In addition, a counter 320 is contained in holding element 300 which registers the error signals of both comparators 130, 230. However, two counters may also be provided where one counter is fixedly associated with one comparing unit and counts its error signals.
The mode of operation of this device is described with the aid of
However, it is also possible that the programs, which are processed in both computing units 110, 120; 210, 220 of a pair 100, 200, have a clock-pulse offset in the comparing mode or are themselves implemented asynchronously. Such clock-pulse offset or such asynchronicity is known to comparing units 130, 230 associated with both computing units 110, 120 and 210, 220 and is reset before the actual comparison takes place. Comparing units 130, 230 may thus contain memories for enabling asynchronicity or may process control signals which inform whether a comparison for a certain computing result is to be carried out, since not all computing results in comparator 130, 230 communicated via the output signals have to necessarily be compared with one another.
If a comparison error is detected in block 610 by a comparator 130, 230 then a signal is output to holding element 300 by comparator 130, 230. Counter 320 is incremented in block 620. If the counter value of counter 320 is below a predefined value, which is checked in block 630, then control unit 2000 continues to operate unchanged, the counter value of counter 320 being incremented by the value one with each error message. If it is detected in block 630 that the counter value has reached or exceeded the predefined value, then holding element 300 is activated in block 640.
It is checked in block 650 whether one comparing unit 130 or 230 or both comparators 130, 230 have output an error signal to holding element 300. If it is detected that the error signal is output by only one comparator 130, 230 then the yellow light of warning device 310 is activated in block 660 and pair 100, 200 of computing units 110, 120 or 210, 220, which is connected to comparing unit 130, 230 indicating the error, is deactivated. The warning device remains in operation during the entire ongoing drive cycle of the motor vehicle, since holding element 300 sets the signal permanently. The yellow light is used for informing the driver of the motor vehicle that an error has occurred and he is supposed to look for a repair shop. The current driving operation of the motor vehicle is not affected by this since the second, still active pair 100, 200 continues to ensure operation either with curtailed functionality or, after an error-free test of the still active pair 100, 200, with full functionality (block 670).
If, however, it is detected in block 650 that both comparators 130, 230 have output an error message, then the red light of warning device 310 is activated in block 680. Control unit 2000 is shut down in this case and the driver must stop the driving operation because of safety considerations in block 690.
According to
If no error is detected in block 720, the computer system returns to the comparing mode as it is executed in block 700.
Possibilities of communicating to pairs 100, 200 of computing units 110, 120; 210, 220 within control unit 2000 that one pair 100, 200 operates erroneously are illustrated in
In
As illustrated in
Alternatively, a counter (not further depicted), which is situated in memory 1100, for example, may be incremented by the error-free operating pair 200 while the erroneous pair 100 is restarted after a successful hardware test. Only when the counter content of the counter contained in memory 1100 has reached a predefined value, i.e., when a comparison error has occurred multiple times in pair 100, is the yellow light of warning device 310 activated.
According to
Information about the faultiness of a pair 100, 200 may alternatively be obtained via a signal which is cyclically checked.
An error memory 1400 of control unit 2000 is shown in
If, however, the absolute error number or a number of errors occurring during a certain period has exceeded a certain value, control unit 2000 is permanently shut down irrespective of pair 200 still operating error-free.
| Number | Date | Country | Kind |
|---|---|---|---|
| 10 2009 000 045.3 | Jan 2009 | DE | national |
