Device for preventing overvoltage damage caused by failure propagation of safety-related systems

Abstract

An apparatus for controlling safety-related electronic systems, particularly those of a vehicle, comprising: a power supply unit (10) having at least one voltage regulator (11, 12), wherein, during operation, a battery voltage (Vbatt) is supplied to the power supply unit (10) at a first power supply potential input terminal (14), and the power supply unit provides a first power supply voltage (Vss) at a first power supply potential output terminal (15), the first power supply voltage (Vss) being less than the battery voltage (Vbatt). The first power supply voltage (Vss) is supplied at a second power supply potential input terminal (21) to a microcontroller (20) for generating a first control signal (Ctrl), the first control signal being provided at a first control output terminal (22) of the microcontroller (20) for processing by a control unit (40). The first power supply voltage (Vss) is supplied at a third power supply potential input terminal (31) to a monitoring unit (30) for generating a second control signal (dabl), the second control signal being provided at a second control output terminal (32) of the monitoring unit (30) for processing by the control unit (40). The third power supply potential input terminal (31), the second control output terminal (32), and the second data port (35) of the monitoring unit (30) are constructed in a manner that withstands the battery voltage (Vbatt).

Description

Technical Field

[0001] This invention relates to a device for controlling safety-related electronic systems. In particular, this invention relates to a device for controlling safety-related electronic systems in a vehicle. Background Technology

[0002] Safety-related electronic systems employ redundantly constructed components for controlling loads and / or ensuring communication. To this end, the device is configured such that components have physical independence from clock and supply voltage, as well as decoupled signal connections, to prevent interaction in the event of a failure.

[0003] A key feature of safety-related electronic systems is that they can detect and trigger fault responses independently of each other through redundantly designed components, such as shutting down safety-related loads via dedicated paths. Another characteristic of safety-related electronic systems is the avoidance, through appropriate design measures, of faults simultaneously associated with redundantly designed components (so-called common cause faults).

[0004] The unresolved problem to date is that, due to fault propagation, critical voltages can damage components of the equipment, even those not directly applied to them. Consequently, reliable control of safety-related electronic systems is no longer guaranteed. Summary of the Invention

[0005] The objective of this invention is to describe a device for operating a safety-related electronic system, the device being structurally and / or functionally improved and reliably preventing fault propagation, particularly due to critical overvoltage.

[0006] This task is accomplished using equipment used to operate safety-related electronic systems.

[0007] A device for controlling safety-related electronic systems is proposed. Safety-related electronic systems can be any type of technological system where special protection is required for the components to be controlled, such as in industrial environments. Safety-related electronic systems are particularly relevant to vehicle technologies, for example, for providing partially autonomous, highly autonomous, or fully autonomous driving functions.

[0008] The device includes a power supply unit with at least one voltage regulator. During operation, a battery voltage is supplied to the power supply unit at a first power supply potential input terminal. The power supply unit provides a first power supply voltage at the first power supply potential output terminal, the first power supply voltage being less than the battery voltage.

[0009] The device further includes a microcontroller for generating a first control signal. The control signal is provided at a first control output of the microcontroller for processing by a safety-related control unit. A first supply voltage is supplied to the microcontroller at a second supply potential input terminal. The microcontroller further includes a first data port.

[0010] As other components, the device includes a monitoring unit for generating a second control signal, which is provided at a second control output of the monitoring unit for processing by the safety-related control unit. A first supply voltage is supplied to the monitoring unit at a third supply potential terminal. The monitoring unit further includes a second data port.

[0011] The monitoring unit is a component independent of the microcontroller that monitors the microcontroller's functionality. For both components to operate as intended, the first and second control signals must be consistent in a predetermined manner. If the first and second control signals do not have this predetermined consistency, this is detected by the safety-related control unit, which then, for example, shuts down the safety-related electronic system. If the first and second control signals are identical, then, for example, there is a predetermined consistency, indicating that the components are operating as intended. If the first and second control signals have different values, the safety-related electronic system is shut down by the safety-related control unit. Alternatively, if diversity is desired... If the first control signal and the second control signal are opposite to each other, then there is also a consistency in a predetermined manner. If the first control signal and the second control signal have the same value, then the safety-related electronic system is shut down by the safety-related control unit.

[0012] The device also includes a communication connection between the first data port of the microcontroller and the second data port of the monitoring unit.

[0013] According to the present invention, the second power supply potential terminal, the second control output terminal of the monitoring unit, and the second data port are constructed in a manner relating to the battery voltage withstand voltage.

[0014] In this specification, "constructed in a voltage-resistant manner" should be understood as the aforementioned input and output terminals having a withstand voltage exceeding the maximum voltage present in the device, for example, due to suitable manufacturing processes. The maximum voltage present in the device is the battery voltage. The voltage-resistant input and output terminals of the monitoring unit are thus, for example, 20%, 30%, or 50% higher than the nominal battery voltage. If the battery voltage is, for example, 12V, the input and output terminals of the monitoring unit are set to a withstand voltage of, for example, 18V (i.e., 50% higher than the nominal battery voltage of 12V). The voltage-resistant design of the input and output terminals of the monitoring unit can be achieved, for example, by adapting the manufacturing process of the monitoring unit accordingly, such as by using different semiconductor materials, larger dimensions, larger insulating layers, etc. In principle, each suitable measure contributing to the specified withstand voltage can be selected. Since these measures are known in principle from the prior art, they will not be described in further detail.

[0015] According to a suitable design, the monitoring unit includes a controllable switch unit for generating control signals. A second supply voltage is supplied to the controllable switch unit at a fourth supply potential input terminal. This second supply voltage is less than a first predetermined voltage value, which corresponds to the microcontroller's maximum allowable voltage, at which no damage occurs. This design avoids internal faults in the monitoring unit caused by erroneous voltages at the fourth supply potential input terminal. Here, the second supply voltage is selected to ensure the function of the controllable switch unit, but the voltage level is not critical for internal faults in the monitoring unit.

[0016] In particular, the second supply voltage can be greater than a second predetermined voltage value, which is greater than the first supply voltage. In other words, the second supply voltage at the fourth supply potential input terminal is less than the maximum allowable voltage of the microcontroller, and in particular greater than the first supply voltage, wherein no damage occurs at the maximum allowable voltage.

[0017] Another suitable design specifies that the power supply unit has a first voltage regulator for generating a second supply voltage and a second voltage regulator for generating the first supply voltage as voltage regulators. The first and second voltage regulators can be cascaded, wherein the second supply voltage generated by the first voltage regulator is supplied as an input voltage to the second voltage regulator. The first voltage regulator can be constructed, for example, using a pre-regulation device, and the second voltage regulator can be constructed as a linear or SMPS regulator.

[0018] Another suitable design specifies that all inputs and outputs of the monitoring unit are constructed to withstand battery voltage. In particular, in addition to the second power supply potential input terminal, the third control output terminal, and the second data port, the fourth power supply potential input terminal is also constructed to withstand voltage.

[0019] Another suitable design specifies that the monitoring unit includes a monitoring module configured to receive and process data from the microcontroller via a second data port, and, upon determining that the microcontroller is functioning as intended, cause the controllable switching unit to generate a second control signal. This design technique allows faults to be triggered independently of each other via a dedicated shutdown path and the outputs of the first and second control signals.

[0020] This invention offers several advantages. Because the monitoring unit and microcontroller can be powered from a common power supply unit, the voltage regulator for the monitoring module itself can be eliminated. Safety is maintained by constructing all inputs and outputs of the monitoring unit in a voltage-resistant manner. Eliminating the need for a separate voltage regulator for the monitoring unit also eliminates the need for redundant protection circuitry, such as protection against overvoltage and reverse polarity.

[0021] Another advantage is that, because the monitoring unit is supplied with a first power supply voltage different from the battery voltage, there is no direct correlation between the shutdown path and the battery voltage. Furthermore, the controllable switching unit that generates the second control signal is preferably supplied with the second power supply voltage, so that faults caused by the battery voltage cannot be externally applied. This is then transferred to the monitoring unit. Thus, the safety concept enables the elimination of so-called single faults. Attached Figure Description

[0022] The invention will now be described in more detail with reference to the embodiments shown in the accompanying drawings. Wherein:

[0023] Figure 1 A schematic diagram of a conventional device used to operate safety-related electronic systems is shown; and

[0024] Figure 2 A schematic diagram of the components required for operating a safety-related electronic system according to the present invention is shown. Detailed Implementation

[0025] Figure 1 A schematic diagram of a known device for controlling a safety-related electronic system is shown, based on which the problem upon which the present invention is based is illustrated. The safety-related electronic system may be, for example, a vehicle system, such as a partially autonomous, highly autonomous, or fully autonomous driving function for the lateral and / or longitudinal movement of the vehicle. The technical system may also be located in other technical fields.

[0026] The device includes a power supply unit 10, a microcontroller 20, a monitoring unit 30, a safety control unit 40, and a logic control unit 50 as main components.

[0027] In this example, the power supply unit 10 includes a first voltage regulator 11 and a second voltage regulator 12. The first voltage regulator 11 represents a pre-regulating device. The second voltage regulator 12 is, for example, a linear or SMPS (Switched Mode Power Supply) regulator. Alternatively, the power supply unit 10 may also include only one voltage regulator. In addition, the power supply unit 10 may include one or more other functional components 13. The components mentioned are integrated on a chip.

[0028] The battery voltage Vbatt is supplied to the power supply unit 10 via a first power supply potential input terminal 14. Here, the battery voltage Vbatt is not fed directly to the first power supply potential input terminal 14, but via a protection circuit 10S. The protection circuit 10S may, for example, include one or more diodes, capacitors, ESD (Electrostatic Discharge) components, etc. Since the components of the protection circuit 10S cannot or can only be provided in integrated form at economically disproportionate cost, the one or more components of the protection circuit 10S are provided outside the power supply unit 10.

[0029] External input and output data (control data, communication data) can be fed to the power supply unit 10 at the input / output port 17. The input and output data are preferably also conducted via the protection circuit 10S to the input / output port and, for example, processed by the one or more functional components 13. The input and output data can also be conducted via their own protection circuit. Another input / output port 18 is provided for internal data communication of the power supply unit 10.

[0030] As shown in the embodiment of Figure 1 the battery voltage can be fed to the functional components 13 at terminals not shown in more detail.

[0031] The battery voltage Vbatt supplied to the power supply unit 10 is reduced to a first supply voltage Vss by means of the first and second voltage regulators 11, 12, where the first supply voltage Vss is less than the battery voltage Vbatt (Vss < Vbatt). The supply voltage Vss is provided at a first power supply potential output terminal 15 of the power supply unit 10.

[0032] The microcontroller 20 generates a first control signal ctrl, which is provided at a first control output 22 for processing by the safety-related control unit 40. The first control signal ctrl is used, for example, to shut down the safety-related load 40L controlled by the safety control unit 40.

[0033] In order to operate the microcontroller 20, the microcontroller receives a first supply voltage Vss provided by the power supply unit 10 at the first supply voltage input terminal at the second supply voltage input terminal 21.

[0034] The microcontroller 20 also has an input / output port 24, which is connected to the input / output port 18 of the power supply unit 10 for exchanging data. Data can be received and / or processed and / or transmitted, for example, by the one or more functional components 13. Additionally, an input / output port 23 is provided for exchanging data with the monitoring unit 30.

[0035] The microcontroller 20 is also connected to the input / output port 51 of the logic control unit 50 via input / output port 25. The logic control unit 50 is configured to control a non-safety-related load 50L. For this purpose, the logic control unit 50 is connected to the load 50L via a protection circuit 50S1 at the control signal output terminal 52. The logic control unit 50 can be connected to other components for data exchange via the control signal output terminal 53 or the input / output port.

[0036] The logic control unit 50 and the components connected thereto are part of the control functions, which are not described in more detail, such as those for actuators or communication interfaces. Since the exact functions of not only safety-related systems but also the components connected to the logic control unit 50 are irrelevant to understanding the invention, these functions are not described in further detail.

[0037] The monitoring unit 30 includes a monitoring module 33 and a controllable switch unit 34. The monitoring unit 30 includes a third power supply potential input terminal 31, a second control output terminal 32, a second data port 35, and a fourth power supply potential input terminal 36.

[0038] The battery voltage Vbatt is supplied to the monitoring unit 30 via the third power supply potential input terminal 31 through the protection circuit 30S. Similar to the protection circuit 10S, the protection circuit 30S includes diodes, capacitors, and ESD components, and is specifically designed to prevent overvoltage.

[0039] The second control signal dabl, generated by the monitoring unit 30, or more specifically the controllable switch unit 34, is provided at the second control output terminal 32 for processing by the safety-related control unit 40. To generate the second control signal dabl, the controllable switch unit 34 is connected to the battery voltage Vbatt at the fourth power supply potential input terminal 36. The battery voltage Vbatt can also be internally supplied to the monitoring module 33.

[0040] The controllable switch unit 34 is configured solely to generate the second control signal dabl, which is triggered by the monitoring module 33. The monitoring module 33 is configured to receive and process signals from the microcontroller 20 via the second data port 35, and to determine the microcontroller's specified... When the function is active, it causes the controllable switching unit to generate a second control signal, such that the second control signal corresponds to the first control signal.

[0041] In other words, the monitoring module 33 monitors the microcontroller's prescribed functions. Given the prescribed functions of the microcontroller 30, the monitoring unit 30 generates, for example, a second control signal dabl corresponding to the first control signal ctrl. If a deviation from the prescribed functions is determined, the second control signal dabl deviates from the first control signal ctrl in content, thereby prompting the safety-related control unit 40 to deactivate the load 40L.

[0042] Data communication between the monitoring module 33 and the microcontroller 20 is conducted via communication connection 20C. Depending on the selected communication protocol, communication connection 20C may include one or more data lines.

[0043] The monitoring unit is constructed, for example, as an ASIC (Application Specific Integrated Chip).

[0044] The safety-related control unit 40 receives a first control signal ctrl at a first input terminal 41 and a second control signal dabl at a second input terminal 42. The safety control unit 40 is configured to logically associate the first and second control signals 41 and 42 with each other. For this purpose, an AND operation can be selected, for example. If, in this embodiment, the first and second control signals ctrl and dabl are inconsistent, a signal for shutting off the safety-related load 40L is output at the control signal output terminal 43.

[0045] For safety reasons, the safety-related load 40L is connected to the control signal output terminal 43 via the protection circuit 40S. The protection circuit 40S is constructed similarly to the protection circuits 10S and 30S. The safety-related load 40L may be, for example, a second control device that receives data via a bus interface (e.g., CAN, Ethernet, Flexray) through a safety control unit.

[0046] Therefore, various components of the equipment used to operate safety-related electronic systems are connected to the battery voltage. In the event of component failure, for example, due to aging effects, the battery voltage may propagate between different components, potentially damaging them if necessary. The possible propagation paths of the critical voltage, based on the fed battery voltage Vbatt, are visualized using arrows shown with dashed or solid lines. Here, solid arrows represent faults that directly have an impact, while dashed arrows represent fault propagation between components.

[0047] The microcontroller 20 and the monitoring unit 30 are of decisive importance to the safety concept. Because the microcontroller and the monitoring unit are directly connected to each other via a communication connection 20C connected to input / output ports 23 and 35, overvoltages may also propagate through this communication connection 20C and potentially damage the components there.

[0048] Figure 2 Show Figure 1 The fragments of the device described herein can prevent the spread of damage or the propagation of faults. Figure 2 In this context, the same elements are equipped with the same reference numerals.

[0049] According to Figure 1 Unlike existing devices, this device supplies voltage to the monitoring unit 30 not by means of a battery voltage Vbatt, but by a first supply voltage Vss. This first supply voltage is provided at the first supply potential output terminal 15 of the power supply unit 10 and also powers the microcontroller 20. Here, the first supply voltage Vss is a voltage that is downwardly adjusted relative to the battery voltage by the first and second voltage regulators 11 and 12. If the battery voltage is, for example, 12V, then the first supply voltage Vss can be, for example, 5V.

[0050] To prevent fault propagation originating from power supply unit 10, as a first measure, the input and output terminals of monitoring unit 30 are configured to withstand voltage. The relevant input and output terminals are: a third power supply potential input terminal 31, at which a first power supply voltage Vss is applied; a second control output terminal 32, through which a second control signal dabl is output for processing by the safety-related control unit 40; a second data port 35, through which communication with the microcontroller 20 takes place; and a fourth power supply potential input terminal 36, through which power is supplied to the controllable switching unit 34.

[0051] Here, constructing the input and output terminals in a voltage-resistant manner is understood to mean that these input and output terminals of the monitoring unit 30 (e.g., due to manufacturing techniques) have the characteristic that they cannot be damaged by voltages within the range of the battery voltage. For example, in the case of a battery voltage Vbatt of 12V, the aforementioned input and output terminals are designed based on a withstand voltage of 1.5 times, i.e., 18V. Of course, different voltage rise factors f can also be chosen, where f>1, preferably f>1.2.

[0052] As an alternative measure, the controllable switching unit 34 is powered neither via battery voltage nor via the first supply voltage Vss, but via a second supply voltage Vin, which is provided at the second supply potential output terminal 16 of the power supply unit 10. Here, the second supply voltage Vin (e.g., an existing pre-regulator voltage) is provided at the output of the first voltage regulator 11 and then at the supply potential output terminal 16 of the power supply unit 10, where this voltage is also supplied as an input voltage to the second voltage regulator 12. The second supply voltage Vin is selected such that it is less than a first predetermined voltage value Vsw1, which corresponds to the maximum allowable voltage of the microcontroller 20 at which no damage occurs. If the supply voltage of the microcontroller is, for example, 5V, the second supply voltage Vin can be set to, for example, 5.8V or 6V. In any case, the second supply voltage is less than the battery voltage but greater than the first supply voltage Vss.

[0053] As from Figure 2 As can be easily seen from the diagram, savings in the protection circuitry or voltage regulator used for monitoring unit 30 are achieved. Therefore, redundant protection structures, such as diodes or capacitors, are unnecessary. Furthermore, the direct correlation between the shutdown path and the battery voltage Vbatt is eliminated.

[0054] Therefore, the functional safety of equipment used to operate safety-related electronic systems can be improved.

[0055] List of reference numerals

[0056] 10 power supply units

[0057] 10S Protection Circuit

[0058] 11 First voltage regulator (pre-regulation device)

[0059] 12. Second voltage regulator (linear or SMPS regulator)

[0060] 13 Functional Components

[0061] 14 First power supply potential input terminal

[0062] 15 First power supply potential output terminal

[0063] 16 Second power supply potential output terminal

[0064] 17 Input / Output Ports

[0065] 18 Input / Output Ports

[0066] 20 microcontrollers

[0067] 20C Communication Connection

[0068] 21. Second power supply potential input terminal of the microcontroller

[0069] 22. First control output of the microcontroller

[0070] 23 First Data Port

[0071] 24 Input / Output Ports

[0072] 25 Input / Output Ports

[0073] 30 monitoring units

[0074] 30S Protection Circuit

[0075] 31. The third power supply potential input terminal of the monitoring unit

[0076] 32. Second control output terminal of the monitoring unit

[0077] 33 Monitoring Module

[0078] 34 Controllable Switching Unit

[0079] 35 Second Data Port

[0080] 36. The fourth power supply potential input terminal of the monitoring unit

[0081] 40 Safety Control Unit

[0082] 40S Protection Circuit

[0083] 40L load (safety related)

[0084] 41 First input terminal for the first control signal ctrl

[0085] 42 Second input terminal for the second control signal dabl

[0086] 43 Control signal output terminal

[0087] 44. The fifth power supply potential input terminal of the safety control unit

[0088] 50 Logic Control Unit

[0089] 50S1 protection circuit

[0090] 50S2 protection circuit

[0091] 50L load (non-safety related)

[0092] 51 Input / Output Ports

[0093] 52 Control signal output terminal

[0094] 53 Control signal output terminal or input / output port

[0095] Vbatt battery voltage

[0096] Vss First power supply voltage

[0097] Vin Second Power Supply Voltage

[0098] Ctrl is the first control signal.

[0099] dabl Second control signal

[0100] Vsw1 is the first pre-defined voltage value.

Claims

1. An apparatus for controlling a safety-related electronic system, the apparatus comprising: - A power supply unit (10) having at least one voltage regulator (11, 12), wherein during operation, a battery voltage (Vbatt) is supplied to the power supply unit (10) at a first power supply potential input terminal (14), and the power supply unit provides a first power supply voltage (Vss) at a first power supply potential output terminal (15), the first power supply voltage (Vss) being less than the battery voltage (Vbatt). - A microcontroller (20) for generating a first control signal (ctrl), the first control signal being provided at a first control output (22) of the microcontroller (20) for processing by a safety-related control unit (40), wherein the first supply voltage (Vss) is supplied to the microcontroller (20) at a second supply potential input (21), and wherein the microcontroller (20) includes a first data port (23). - A monitoring unit (30) for generating a second control signal (dabl), the second control signal being provided at a second control output terminal (32) of the monitoring unit (30) for processing by the safety-related control unit (40), wherein a first power supply voltage (Vss) is supplied to the monitoring unit (30) at a third power supply potential input terminal (31), and wherein the monitoring unit (30) includes a second data port (35). - Communication connection (20C) between the first data port (23) of the microcontroller (20) and the second data port (35) of the monitoring unit (30); The third power supply potential input terminal (31), the second control output terminal (32), and the second data port (35) of the monitoring unit (30) are constructed in a manner that withstands the battery voltage (Vbatt).

2. The device according to claim 1, wherein the device is used to control the vehicle's safety-related electronic systems.

3. The device according to claim 1, wherein the monitoring unit (30) includes a controllable switch unit (34) for generating the second control signal (dabl), wherein the controllable switch unit (34) is supplied with a second supply voltage (Vin) applied to a fourth supply potential input terminal (36), the second supply voltage being less than a first predetermined voltage value (Vsw1), the first predetermined voltage value corresponding to the maximum allowable voltage of the microcontroller (20), under which no damage occurs.

4. The device according to claim 3, wherein the second supply voltage (Vin) is greater than a second predetermined voltage value (Vsw2), and the second predetermined voltage value is greater than the first supply voltage (Vss).

5. The device according to any one of claims 1 to 4, wherein the power supply unit (10) comprises a first voltage regulator (11) for generating the second supply voltage (Vin) and a second voltage regulator (12) for generating the first supply voltage (Vss) as voltage regulators (11, 12).

6. The device according to claim 5, wherein the second supply voltage (Vin) generated by the first voltage regulator (11) is supplied as an input voltage to the second voltage regulator (12).

7. The device according to any one of claims 1 to 4, wherein all inputs and outputs of the monitoring unit (30) are configured to withstand voltage with respect to the battery voltage (Vbatt).

8. The device according to any one of claims 3 to 4, wherein the monitoring unit (30) includes a monitoring module (33) configured to receive and process data from the microcontroller (20) via the second data port (35), and to cause the controllable switching unit to generate the second control signal (dabl) when the microcontroller (20) is determined to be functioning as specified.

Images