Monitoring unit for safety-critical devices

Abstract

The invention relates to a monitoring unit (10) for a safety-critical device, comprising at least one logic unit (12), which is designed to generate and / or receive a reset signal, the monitoring unit (10) having a switching device (14), which is designed to generate and / or receive a reset signal. Wherein the switching device (14) is configured to generate an active signal for a predetermined time period when the logic unit (12) receives and / or generates a reset signal.

Description

Technical Field

[0001] The invention relates to a monitoring unit for a safety-critical device and to a vehicle. Background Art

[0002] Currently, there are a large number of different solutions for resetting monitoring units in the vehicle sector. Due to the increase in the number of electrically controllable components in vehicles and due to the increasing requirements for automated driving, the need for inventive and robust error correction options continues to increase.

[0003] The ongoing reduction in weight in the vehicle sector in order to reduce fuel consumption and increasing competition are leading to cost pressures, so that cheaper and more efficient components for vehicles are being sought more and more intensively.

[0004] WO 2016005187 A1 describes a control device for a safety-related actuator, which has a reset unit and a monitoring unit. The reset unit can at least reset components of the control device.

[0005] Furthermore, WO 9904324 A1 compares a ramp consisting of the negative and positive edges of a pulse with a level value in order to generate a reset signal for the electronic safety circuit when the level value is exceeded. Summary of the invention

[0006] Compared to the known state of the art, the monitoring unit for safety-critical devices according to the invention having the features of claim 1 has the advantage that the safety function is not triggered due to the active signal and is not necessarily placed in a safe state. This can have an impact in particular on a large number of other components. Another advantage is that redundant systems do not have to be used for the duration of the restart of the monitoring unit, which in particular can result in additional costs.

[0007] According to the invention, this is achieved in that the monitoring unit for the safety-critical device comprises at least one logic unit which is designed to generate and / or receive a reset signal. In addition, the monitoring unit has a switching device, wherein the switching device is designed to generate an active signal for a predetermined period of time when the logic unit receives and / or generates a reset signal.

[0008] In other words, the switching device generates an active signal so that the safety function does not switch to a safe state despite the restart of the monitoring unit or the device associated therewith, because it indicates to the safety function that it only involves restarting and not an accident or the like. After a predetermined time period, the safety function switches to a safe state. Thus, a second unit or a redundant unit can be saved in particular. Preferably, the logic is set up to generate and / or receive a reset signal. Here, the reset signal can especially mean the restart of the monitoring unit and / or the control unit or the like. In addition, it is preferred that the switching device generates an active signal in a predetermined time period, wherein the switching device is especially connected to the safety function or the actuator to transmit a signal. Thus, the monitoring unit can generate an active signal in a predetermined time period when the logic unit receives and / or generates a reset signal, wherein the predetermined time period is especially the duration for restarting. In addition, another component can generate a reset signal so that the logic unit receives the reset signal from other components. Here, reset may become necessary in particular due to SW faults or electromagnetic radiation. Furthermore, the predetermined time period can in particular be selected such that a “fault tolerance time” is not exceeded. After the predetermined time period has expired, the activity signal disappears and the “fault tolerance time” has expired, so that a safe state is reached.

[0009] The dependent claims describe preferred developments of the invention.

[0010] The active signal is preferably designed to keep at least one actuator in its switching state for a predetermined period of time.

[0011] The advantage of this embodiment is that components that are switched into the safe state during the reset, such as high-side or low-side drivers, remain in their previous switching state for a predetermined period of time because they receive the active signal. As a result, control can also be continued after the reset so that the previous switching state can be maintained despite the reset. In this case, the active signal can be transmitted in particular to the actuator by means of the monitoring unit and / or the switching device.

[0012] Furthermore, it is preferred that the switching device has at least one timing element, wherein the timing element is designed to generate an activity signal during a predetermined period of time.

[0013] The advantage of this embodiment is that, if, for example, a capacitor or a similar energy storage device is discharged in the timing element, the active signal disappears automatically when the capacitor is discharged and can thus be switched to the safe state. For example, the timing element is an RC element or any other type of energy storage device. It is also preferred that the timing element is configured in this case so that it begins to drain when a voltage or current is no longer applied due to a restart. The switching state of the actuator is maintained for the duration of the draining of the timing element so that a switchover to the safe state is not possible during the predetermined period of time.

[0014] The monitoring unit is preferably designed to charge the timing element in the absence of a reset signal.

[0015] This embodiment has the advantage that the timing element can again be automatically charged and thus the activity signal can be generated for a large number of processes.

[0016] In this case, the timing element can be charged by means of the prevailing voltage and current, so that when the reset signal occurs, the timing element begins to empty.

[0017] Furthermore, it is preferred that the timing element has a capacitance, wherein the capacitance is designed to determine the duration of the predetermined time period.

[0018] This embodiment has the advantage that the exact duration of the predetermined time period can be set by dimensioning the capacitance, such as, for example, a capacitor. Based on the duration, in particular the duration for which the activity signal is generated can be determined.

[0019] Preferably, the switching device is designed to generate an active signal for a predetermined period of time until a reference value of the timing element falls below a predetermined limit value.

[0020] This embodiment has the advantage that it is possible to check with the aid of the detection unit whether the level of the activity signal is sufficient to maintain the safety state. If it is below a predetermined limit value, the activity signal is eliminated and in particular the safety state is released. If the detection unit has a constant power supply, a switch or a switching device can be provided in order to be able to determine whether the reference value of the time element is below a predetermined limit value.

[0021] Preferably, the monitoring unit has a detection unit, wherein the detection unit is designed to adjust the predetermined time period.

[0022] The advantage of this embodiment is that the predetermined time period can be adjusted precisely by means of the detection unit. In this case, other factors such as, for example, the ambient temperature or the like can be taken into account.

[0023] Preferably, the detection unit is designed to detect a voltage, wherein the detection unit is designed to adjust the predetermined time period as a function of the detected voltage and by means of a reference voltage and a comparator.

[0024] The advantage of this embodiment is that the time period can be adjusted by means of simple components, such as a comparator which can have a reference voltage and the detected voltage of the detection unit. As a result, different voltage states and / or line states can be taken into account for adjusting the predetermined time period.

[0025] Furthermore, it is preferred that the monitoring unit is designed to transmit the activity signal to a plurality of actuators.

[0026] This embodiment has the advantage that only one monitoring unit has to be provided for the component in order to control a plurality of actuators or to generate the activity signal for a plurality of actuators.

[0027] A further aspect of the invention relates to a vehicle having a monitoring unit as described above and below. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0029] Figure 1 and 2 A monitoring unit according to one embodiment is shown; and

[0030] Figure 3 A vehicle according to one specific embodiment is shown. DETAILED DESCRIPTION

[0031] Figure 1 A monitoring unit 10 is shown. The monitoring unit 10 has a logic unit 12 and a switching device 14. The logic unit 12 is designed to generate and / or receive a reset signal. A first data connection 28 indicates the reception of a reset signal. In addition, the switching device 14 is designed to generate an active signal (Lebendsignal) in a predetermined time period when the logic unit 12 receives and / or generates a reset signal. The active signal can be transmitted, for example, from the monitoring unit 10 to the actuator 16. The active signal 30 is transmitted in a predetermined time period. Figure 1 It is shown as a schematic description.

[0032] Figure 2An embodiment of the monitoring unit 10 is shown. This monitoring unit 10 has a logic unit 12. In addition, the monitoring unit 10 includes a switching device 14. In addition, the monitoring unit 10 is connected to at least one actuator 16 by means of a signal line 32. In addition, the monitoring unit 10 can also preferably generate a large number of active signals 30 for a large number 26 of actuators 16. In addition, the switching device 14 can include a time element 18. The time element 18 is designed to generate the active signal 30 in a predetermined time period. In addition, the time element 18 can have a capacitor 20, which limits the duration of the predetermined time period. In addition, the monitoring unit 10 can have a detection unit 22, which is designed to adjust the predetermined time period. The detection unit 22 can here in particular include a comparator 24.

[0033] Figure 3 A vehicle 200 is shown which has a safety-critical device 100 and a monitoring unit as described above and below.

Claims

1. A monitoring unit (10) for a safety-critical device (100), comprising: at least one logic unit (12) which is designed to generate and / or receive a reset signal, The monitoring unit (10) has a switching device (14), wherein the switching device (14) is designed to generate an active signal for a predetermined period of time when the logic unit (12) receives and / or generates the reset signal. 2 . The monitoring unit ( 10 ) according to claim 1 , wherein the activity signal is designed to keep at least one actuator ( 16 ) in its switching state for the predetermined period of time.

3. A monitoring unit (10) according to any one of the preceding claims, wherein the switching device (14) has at least one time element (18), wherein the time element (18) is designed to generate an activity signal within the predetermined time period. 4 . The monitoring unit ( 10 ) according to claim 3 , wherein the monitoring unit ( 10 ) is designed to charge the timing element ( 18 ) in the absence of a reset signal.

5. The monitoring unit (10) according to claim 3, wherein the timing element (18) has a capacitance (20), wherein the capacitance (20) is designed to determine the duration of the predetermined time period.

6. The monitoring unit (10) according to any one of claims 3 to 5, wherein the switching device (14) is configured to generate the active signal during the predetermined time period until the reference value of the time element falls below a predetermined limit value.

7. The monitoring unit (10) according to any one of the preceding claims, wherein the monitoring unit (10) has a detection unit (22), wherein the detection unit (22) is designed to adjust the predetermined time period.

8. The monitoring unit (10) according to claim 7, wherein the detection unit (22) is configured to detect a voltage, wherein the detection unit (22) is configured to adjust the predetermined time period by means of the detected voltage and by means of a reference voltage and a comparator (24).

9. The monitoring unit (10) according to claim 1, wherein the monitoring unit (10) is designed to transmit the activity signal to a plurality (26) of actuators (14).

10. Vehicle (200) having a monitoring unit (10) according to any of the preceding claims.

Images