The invention relates to a safety device for a sensor, in particular a rotation rate sensor, in which a sensor element and functional components provide the function of the sensor, and produce a sensor output signal.
By way of example, rotation rate sensors have been disclosed in EP 0 461 761 B1 in which a vibration gyro is excited on two radially directed axes, for which purpose a primary and a secondary control loop, with appropriate transducers, are provided on the vibration gyro. When such rotation rate sensors are used in order to stabilize the vehicle movement in vehicles, then hazards can occur as a result of failure or a malfunction. In order to avoid this, functional monitoring must be provided for the rotation rate sensor.
In the case of the safety device according to the invention, such monitoring can be carried out by the functional components forming a function section and, furthermore, by checking components being provided in a checking section and by monitoring components being provided in a monitoring section, with the checking components being designed for continuous checking of the functional components, and with the monitoring components being designed to monitor the checking components at least once during one operating cycle.
One advantage of the safety device according to the invention is that the continuous monitoring allows rapid fault reports, which signal a fault, and thus the possibly incorrect sensor output signal, to the user and to higher-level systems. This rapid reaction is supplemented by monitoring of the checking section, so that faults are also signaled which, although they do not lead directly to an incorrect sensor output signal, can lead to hazards when a second fault occurs however. Functional component redundancy is required to only a minor extent for this purpose.
One advantageous refinement provides that the checking components are designed to measure values in the function section and to compare the measured values with limit values. In this case, the checking components are furthermore preferably designed to measure the sensor output signal and to compare the measured sensor output signal with limit values.
Even better checking is made possible by a development of this refinement, which consists in that the checking components are furthermore designed to test the functional components, with test signals being produced and being supplied to the functional components, and the reaction of the functional components to the test signals being measured.
If the sensors are relatively complex, the function section contains digital and analog components, for which purpose provision is made in the device according to the invention for the checking components to be designed to access registers of the digital components and to measure analog signals at the analog components. In order to further extend the checking capabilities, provision can be made in this case for the checking section to contain its own analog components and at least one analog/digital converter.
Another advantageous requirement of the invention consists in that the monitoring components are designed essentially to monitor digital checking components. In this case, in detail, it is possible to provide for the monitoring section to have a component for monitoring the clock of a microcomputer which is contained in the checking section, and/or for the monitoring section to have a watchdog circuit for monitoring a microcomputer which is contained in the checking section. Furthermore, this refinement can be designed in such a way that the monitoring section contains a device for testing memories within the checking section.
Electronic circuits, including programmable devices, are frequently formed by application-specific integrated circuits, ASIC for short. These have a very large number of gate circuits which are frequently used in the duplicated form when the respective signal flow and the linking logic allow. In order not to endanger the high degree of safety achieved by the safety device according to the invention, one development of the invention provides that components in the function section, in the checking section and in the monitoring section be formed by an application-specific integrated circuit (ASIC), and that gate circuits which are contained in the circuit be in each case associated with only one of the sections.
The invention allows numerous embodiments. One of these will be described in the following text and is illustrated schematically in a number of figures in the drawing, in which:
The exemplary embodiment and parts of it are admittedly illustrated as block diagrams. However, this does not mean that the arrangement according to the invention is restricted to an implementation based on individual circuits corresponding to the blocks. In fact, the arrangement according to the invention can be implemented in a particularly advantageous manner by means of large-scale-integrated circuits. In this case, microprocessors can be used which carry out the processing steps illustrated in the block diagrams when suitably programmed. For the purposes of the invention, the expression components should be understood as meaning circuits, computers, memories and similar hardware, including the associated programs and program modules.
The schematic illustration shown in
Components of the sections 4, 5, 6 are illustrated in somewhat more detail in the block diagram in
On being switched on, adjustment data is loaded from the non-volatile memory 7. Data which includes the rotation rate signal is taken via a microcomputer 15 from the digital signal processing 14, and is supplied via a UART/SPI interface 16 to a further microcomputer 17.
This produces a digital rotation rate signal at the output 3. In parallel with this, a digital/analog converter 18 is connected to the digital signal processing 14, and an analog rotation rate signal is produced at its output 3′.
The checking section is formed essentially by self-diagnosis 19 by the microcomputer, with data being made available to the digital signal processing 14. Furthermore, in order to test analog components in the function section, the checking section has a test signal injector 20 which can be controlled by the self-diagnosis 19 and can supply analog test signals at selectable points to the analog circuits in the function section. A plurality of points in the analog circuits in the function section 4 are connected to a multiplexer 21, so that a selectable analog signal can be checked.
An amplifier 22 is provided for situations in which one of these analog signals has a relatively small amplitude. In the exemplary embodiment, the analog signals to be checked are at a carrier frequency. The multiplexer 21 is therefore followed by a demodulator 23. After analog/digital conversion 24, the self-diagnosis 19 can access the analog signals to be checked. The self-diagnosis 19 receives the analog output signal from the output 3′ and the alarm signal from the output 8 for further testing. If the self-diagnosis 19 finds a fault, an alarm signal is emitted via the OR circuit 25 and the output 8. The alarm signal also takes place via a status bit in the serial data message at the UART/SPI interface.
The monitoring of the program execution in the microcomputer, and of the presence of a clock signal and correct operation of the memories are carried out in the monitoring section 6 with the aid of a clock detector 26, a watchdog 27 and a RAM/ROM test 28. If one of these components finds a fault,an alarm signal is emitted via the OR circuit 25 and the output 8. A self-diagnosis process can be started via an input 29, for example during maintenance work or during a pause in operation of the vehicle.
Number | Date | Country | Kind |
---|---|---|---|
103 29 511.9 | Jun 2003 | DE | national |
Filing Document | Filing Date | Country | Kind | 371c Date |
---|---|---|---|---|
PCT/EP04/50977 | 6/1/2004 | WO | 5/1/2006 |