Device for controlling safety-related process and method for testing functionality thereof

Abstract

The invention relates to a device for controlling a safety-related process and to a method for testing the functionality thereof, said device (100) being redundantly designed and comprising a primary control device (110) and a secondary control device (130), which assumes the function of the primary control device in the event of an error, wherein the control is carried out on the basis of an analysis of the signal of the at least one sensor (120); and a communication bus (140) enabling data exchange between the primary and secondary control devices. The primary control device and the secondary control device each comprise an application-specific integrated circuit (112, 132), and the primary control device and the secondary control device are each provided with a sensor isolation circuit (116, 136). Each of the primary control device and the secondary control device is supplied with power through an independent voltage source, and wherein each of the primary control device and the secondary control device communicates with the other of the primary control device and the secondary control device, respectively, through two mutually independent communication paths.

Description

[0001] Instructions for divisional application:

[0002] This application is a divisional application of the Chinese invention patent application with the application date of April 8, 2018, application number 201810305335.2 and invention name “Device for controlling safety-related processes and method for testing their functionality”. Technical Field

[0003] Autonomous driving (sometimes also called automated driving or automated driving or guided driving) is understood to be the development of vehicles, mobile robots and transport systems that operate largely autonomously. There are several different levels of the concept of automated driving. If a driver who sometimes only monitors the automated driving process is in the vehicle, the automated driving is responsible for a certain level. In Europe, several different transport authorities (in Germany, the Federal Agency for Transport) have worked together and established the following levels of automation.

[0004] •Level 0: “Driver only”, the driver drives, steers, accelerates, brakes, etc. by himself.

[0005] • Level 1: Assistance systems for determining the vehicle situation (among which is also the distance control system - Automatic Cruise Control (ACC)).

[0006] • Level 2: Partial automation. In this case, automatic parking, lane keeping function, general longitudinal guidance, acceleration, braking, etc. are completed by auxiliary systems (including traffic jam assistant).

[0007] • Level 3: High automation. The driver does not have to constantly monitor the system. The vehicle automatically performs functions such as triggering lights, lane changes and lane keeping. The driver can be involved in other things, but is required to take control if necessary within the system's warning time. This automation is technically possible on public roads. Legislators are committed to allowing Level 3 vehicles. The legal framework conditions for this have been completed.

[0008] • Level 4: Fully automated. The system continuously controls the vehicle. The driver can be asked to take control if the system is no longer competent for the driving task.

[0009] • Level 5: No driver required. No human intervention is required except when the destination is determined and the system is turned on.

[0010] Automated driving functions from level 3 onwards relieve the driver of responsibility for vehicle control. Intervening braking and stabilization systems can fail due to individual errors, so a suitable fallback plane is required to keep the vehicle in a dynamically safe state at all times until the driver can intervene again. Braking systems for such vehicles, which provide automated driving from level 3 onwards, are always designed redundantly. The braking system can then consist of two components, namely a primary braking system and a secondary braking system, so that one component can fail without endangering driving stability. Background Art

[0011] For safety reasons, the driving function must ensure the availability of the anti-skid control function, for example in the anti-lock braking system ABS, in addition to the availability of the deceleration function in the speed range above 60 km / h. The anti-skid control function requires sensor data as control values. This also includes the detection of the wheel speed, such as is currently implemented in control devices for driving dynamics control (Electronic Stability Control, ESC). If the ESC electronics (primary brake system) fails, the driving function and the anti-skid control function can no longer provide movement information for the wheels in the secondary brake system, so that the adjustment of the reverse plane can no longer be achieved.

[0012] What is not easy to achieve with electronic interfaces based on standard wheel speed sensors is to connect the sensor to two control devices in order to be able to transmit the necessary information to both control devices. The sensor transmits its signal via a transmission protocol that is used for defined current levels. The VDA protocol is used for this purpose. When two control devices are connected in parallel, the current is divided and the level cannot be recognized in either control device. This is different when the individual wheel speed sensors are connected to a data bus, such as a CAN bus (Controller Area Network), via which the data can be transmitted to a plurality of connected control devices.

[0013] The following known technical solutions are listed:

[0014] a) Use 4 additional wheel speed sensors, thus using a total of 8 wheel speed sensors, that is, one wheel speed sensor for each wheel and control unit.

[0015] b) Use of four redundant wheel speed sensors. Here, the components for the wheel speed sensors contain two sensor elements with separate outputs, one for each connected control unit. Depending on which unit is controlling the braking process, the appropriate sensor element is evaluated. Both sensor elements are always in operation simultaneously.

[0016] A device is known from document DE 102015110965A1, which is designed for reliable braking of an automatically controlled vehicle. The device is installed redundantly. The device comprises a first brake control module, also referred to as a primary module, and a second brake control module, also referred to as a secondary module. In a first embodiment, all wheel speed sensors are connected to the first brake control module. The first brake control module provides the wheel speed data of the wheel speed sensors to the second brake control module via a data connection. In a second embodiment, a plurality of wheel speed sensors are connected to the first brake control module, and only a few wheel speed sensors are connected to the second brake control module.

[0017] A system is known from document DE 102015209565A1, which is also designed for reliable braking of an automatically controlled vehicle. There are also primary braking systems and secondary braking systems. The primary braking system is equipped with a first control device (e.g., an ESP / ABS device). And the control device is also installed redundantly. The control device consists of a first control device and a second control device configured as an ASIC. Voltage can be provided to the wheel speed sensor via the two control devices. The wheel speed data is detected by the second control device and can be transmitted to an external control device via a vehicle bus (e.g., a CAN bus), which controls the secondary braking system. Even if the first control device and the microcontroller of the first control device fail, the wheel speed data can still be transmitted to the external control device.

[0018] A system for controlling and / or monitoring a control device combination having at least two control devices is known from the document EP1219489A2. The first control device has multiple functions, namely, implementing its own inherent control function, monitoring its own inherent control function and monitoring the second control device. If the first control device detects a faulty function of the second control device, the first control device switches off the second control device.

[0019] The known technical solution has several disadvantages. For four additional wheel speed sensors or four redundant wheel speed sensors, twice as many lines must be reserved in the vehicle network as before. The costs for standard sensors increase because twice as many are required. Redundant sensors have the disadvantage of being in small quantities and even higher costs can be expected for this.

[0020] The technical solution according to the above-mentioned publication has the same goal, but it describes a circuit that is used only on one of the two control devices. This brings about various disadvantages:

[0021] In a control unit containing this circuit, twice the number of plug-in contacts for the wheel speed sensors is required (eg 16 instead of 8 plug-in contacts).

[0022] If the supply voltage in the primary control device fails and a switchover to the secondary control device occurs, the voltage losses in the switching logic must be taken into account, since self-conducting MOSFETs (metal oxide semiconductor field effect transistors) must necessarily be used. Summary of the invention

[0023] It was recognized within the scope of the present invention that existing technical solutions do not make efficient use of wheel speed sensors and that the costs for additional wheel speed sensors are therefore too high.

[0024] According to the invention, a special hardware architecture is proposed. This hardware architecture contains standardized hardware interfaces for connecting four standard wheel speed sensors to two control devices. According to the invention, a behavior mode for the operating mode is also proposed for this hardware architecture, which can ensure that even if individual errors occur on one of the two control devices, the data of all sensors can be directly received by the other control device. In this case, the data is transmitted to the other control device via the vehicle bus and is also provided to other receivers. In this way, a fallback plane can be set in the two control devices, which can always contribute to the existence of wheel speed information. In addition, a test mode is proposed, which is used to check the overall functionality of the system. This ensures that the system meets the redundancy requirements of the driving function.

[0025] A standardized hardware interface offers the advantage that the hardware can be implemented identically in all control devices.

[0026] In principle, a conventional circuit including a sensor interface is used in the control device. However, a sensor isolation circuit is also inserted in the control device between the IC and the sensor, which can interrupt the connection between the sensor and the faulty control device so that current does not flow through the interface. As a result, the wheel speed sensor can be connected in parallel to two control devices, because the sensor isolation circuit can ensure that one of the two control devices disconnects the interface and the sensor current is not divided.

[0027] Each control device must control the isolation circuit and be able to communicate the corresponding status via the vehicle bus. A failure of a control device must at least result in the circuit disconnecting the control device from the sensor. This can be achieved, for example, with the aid of an existing monitoring circuit (watchdog circuit). The watchdog function is present in current brake systems anyway and shuts down the control device as soon as it is detected that an actuator or an electronic component can no longer be controlled and thus faces vehicle instability. If the control device has not yet completely failed, the status of the interface can still be communicated via the vehicle bus.

[0028] For this purpose, it is advantageous if the sensor isolation circuit includes an UND circuit (AND gate circuit), which causes the connection of at least one sensor to the corresponding primary or secondary control device in such a way that a signal indicating that the corresponding control device is operating without faults is obtained by the monitoring device and a microcontroller of the corresponding control device indicates that the control device is in a state in which a processing device and / or a conduction device for the signal of the at least one sensor is provided on the corresponding secondary or primary control device.

[0029] The software of the control unit must be designed in such a way that it only activates the interface when it has always ensured that the interfaces of the other control units are closed. This is achieved by an internal state automatic control, which receives the status of the respective other state automatic control via the vehicle bus. The software of the primary brake system must activate the interface as a standard and close it only in the event of a certain error. If an error in the primary brake system leads to the closing of its interface, the software of the secondary brake system must close the interface as a standard and then immediately activate it.

[0030] According to the invention, a test mode is also proposed, which allows the switching performance of the interface to be checked. This ensures that the necessary redundancy of the brake system exists before the automated driving function can be activated by the driver. The test system works as follows:

[0031] The primary control device disconnects at least one sensor by means of a sensor isolation circuit assigned to the primary control device. The secondary control device is informed via the communication bus that the test mode has been entered, wherein the secondary control device subsequently connects at least one sensor to the secondary control device by means of the sensor isolation circuit assigned to the secondary control device, and the sensor data is sent to the primary control device via the communication bus. The primary control device checks the correct reception of the sensor data and informs the primary control device via the communication bus of the end of the test mode if a positive check result is obtained.

[0032] Advantageously, the secondary control device disconnects at least one sensor via a sensor isolation circuit configured in the secondary control device after information about the end of the test mode is input, and the primary control device itself then connects at least one sensor to the primary control device via the sensor isolation circuit assigned to the primary control device due to the lack of transmitted sensor data and advances the transmission of sensor data to the secondary control device as before before starting the test mode.

[0033] Advantageously, a test of the functionality of the device is performed after a request to start an operating mode of a highly automated driving of the motor vehicle is made. The test is then performed before the vehicle is switched to the highly automated driving mode.

[0034] Furthermore, it is advantageous for the test mode that, when the primary control unit recognizes during the test that sensor data cannot be correctly received by the secondary control unit, at least one sensor is switched on to the primary control unit via the sensor isolation circuit associated with the primary control unit, and the transmission of the sensor data to the secondary control unit is accelerated as before before the start of the test mode. It is advantageous here that the primary control unit informs the secondary control unit of the incorrect reception of the sensor data, whereupon the secondary control unit disconnects at least one sensor via the associated sensor isolation circuit.

[0035] Advantageously, when the secondary control device recognizes during a test that sensor data cannot be correctly received by the primary control device, the sensor isolation circuit assigned to the secondary control device takes over the reception of at least one sensor at the secondary control device and promotes the transmission of the sensor data to the primary control device, wherein the secondary control device informs the primary control device of the erroneous reception of the sensor data, and the primary control device then disconnects at least one sensor via the assigned sensor isolation circuit.

[0036] The invention can be applied to all vehicles with automated driving functions (according to VDA) level 3 and above, which operate in a higher speed range. At lower speeds (below about 60 km / h), wheel speed sensor data is not necessary in order to be able to decelerate the vehicle stably. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Preferred exemplary embodiments of the invention are shown in the drawings and are explained in more detail in the following description.

[0038] In the attached picture:

[0039] Figure 1 A vehicle having four wheel speed sensors is shown;

[0040] Figure 2 The hardware architecture of a braking system for highly automated driving is shown, which has a primary control device and a secondary control device; and

[0041] Figure 3 A state flow diagram for a brake system with a test mode is shown. DETAILED DESCRIPTION

[0042] This description explains the principle according to the disclosure of the present invention. It should be understood that those skilled in the art can design a variety of different arrangements, although the arrangement is not described in detail herein, but the arrangement is intended to reflect the principle of the disclosure of the present invention and should be protected within its scope as well.

[0043] Figure 1A car is shown. A passenger car (Pkw) is shown. However, any other vehicle can also be considered as a vehicle. For example, other vehicles are: buses, commercial vehicles, especially trucks (Lkw), agricultural machinery, construction machinery, motorcycles, rail vehicles, etc. The vehicle is marked with the reference numeral 10. The vehicle is equipped with four wheels as a passenger car (Pkw). Current brake systems are usually also equipped with a drive anti-skid system ASR. For this purpose, it is necessary to detect the wheel speeds of all four wheels, which also applies to the anti-lock braking function ABS. Therefore, it is also shown in the figure that a wheel speed sensor 120 is installed on each gear. The wheel speed sensor 120 is connected to a brake control system 100. The brake control system 100 consists of two control devices that work independently of each other. For example, there is an ESC control device for the primary brake system, which controls the primary brake system. It implements an electronic driving stabilization function also known as electronic stability control (ESC). The ESC control device has the function of braking the vehicle 10 in a controlled manner from high speed. For this reason, the functionality of the anti-lock braking system ABS is also present in modern ESC control devices. However, there is also a secondary brake system independent of the primary brake system, so that the vehicle can be braked in a controlled manner. For this purpose, for example, intelligent brake boosters have been developed, which are also called electronic brake boosters (eBKV). Their control device then forms the control device of the secondary brake system.

[0044] The two control devices do not have to be Figure 1 As shown, the two control devices are installed at the same position, and can also be installed at different positions of the automobile 10. The two control devices are interconnected at least via a vehicle bus. As an example of a vehicle bus for interconnecting control devices in a vehicle, a controller area network is also called CAN. This bus system is standardized and please refer to the corresponding specifications of ISO11898 for more details. Since different CAN bus variants can be used for a variety of control device types, a CAN drive bus is mentioned here, which is used to interconnect control devices of the drive system, such as motor control devices, automatic control devices, transmission control devices, and ESC control devices. A high-speed solution of the CAN bus that complies with the ISO11898-2 specification is usually used for this purpose.

[0045] Figure 2The hardware architecture of a brake control system 100 according to the invention is now shown. The invention comprises a standardized hardware interface for connecting four standard wheel speed sensors to two control devices, and a behavior module which ensures that even after individual errors occur at one of the two control devices, the data of all sensors can be directly received and made available to the other control device and other receivers via a data bus. In this way, a fallback plane can be set up in both control devices, which can always ensure the presence of wheel speed information.

[0046] The control device of the primary braking system is marked with reference numeral 110. As described above, this is an ESP / ABS control device. The control device of the secondary braking system is marked with reference numeral 130. This is a control device of an electronic brake booster. The four wheel speed sensors are marked with reference numeral 120. The signal line of the wheel speed sensor 120 is marked with reference numeral 122. The two control devices 110 and 130 are connected to each other via a vehicle data bus (referred to as vehicle bus for short) 140, through which data can be exchanged. Other control devices, such as a motor control device and a transmission control device (not shown in the drawings), can be connected to the vehicle bus 140. Figure 2 The architecture of the control device is also shown in FIG. 1 . Typically, the control devices 110 and 130 each include an application-specific integrated circuit (ASIC) 112 and 132, which is responsible for the current / voltage supply of the wheel speed sensor 120 and is used to detect and process the signals of the wheel speed sensor 120. The control devices 110 and 130 are also equipped with microcontrollers 114 and 134, respectively. Each microcontroller 114 and 134 assumes the respective control function of the control device. In addition, a monitoring circuit 118 and 138 is also provided in each control device. Such a monitoring circuit is known as a "watchdog" circuit. The correct program flow in the control device is monitored thereby. Connection devices 111 and 131 are provided between the application-specific integrated circuits 112 and 132 and the microcontrollers 114 and 134, so that, for example, measured sensor data can be transmitted.

[0047] As described above, the wheel speed sensor 120 is connected to the two control devices 110, 130. In principle, conventional circuits related to the sensor interface are used in the control devices. However, circuit units 113, 133 in sensor isolation circuits 116, 136 are also inserted in the control devices 110, 130 between the corresponding ASIC 112, 132 and the wheel speed sensor 120, and the sensor isolation circuit can interrupt the connection between the wheel speed sensor 120 and the corresponding control device 110, 130, so that current cannot flow through the interface. As a result, the wheel speed sensor 120 can be connected in parallel to the two control devices 110, 130, because it can be ensured that one of the two control devices 110, 130 is disconnected and the sensor current is not shunted.

[0048] Each control device 110, 130 must be able to control the circuit unit 113, 133 in the sensor isolation circuit 116, 136 and communicate the corresponding status via the vehicle bus 140. A failure of the control device must at least cause the sensor isolation circuit 116, 136 to disconnect the connection of the control device 110, 130 to the wheel speed sensor 120. This is achieved by the above-mentioned watchdog circuit. The watchdog circuit is mainly composed of a counter, which is reset at a defined position in the program flow. If this reset does not occur due to an error, for example, because the program enters an infinite loop, a counter overflow occurs and the watchdog circuit paralyzes the controller. And once it is recognized that the actuator or electronic device can no longer be controlled and the vehicle is thus facing instability, the watchdog function shuts down the control device in the current braking system. If the control device is not completely faulty, the status of the interface can also be communicated via the vehicle bus 140. An alternative working method when using a watchdog circuit is that the control device is reset when an error occurs in order to test whether the error can be overcome thereby.

[0049] The software of control device 110, 130 is designed so that it only activates the sensor interface when it has always ensured that the sensor interface of the other control device 130, 110 is closed. This is achieved by an internal state automatic control, which receives the state of the corresponding other state automatic control via vehicle bus 140. The software of control device 110 of the primary brake system activates its sensor interface as a standard and closes the sensor interface only when a certain error occurs. If an error in the primary brake system leads to the closing of the sensor interface of the primary brake system, the software of control device 130 of the secondary brake system closes its sensor interface as a standard and immediately activates it.

[0050] In view of the security requirements, the following points must be observed for the system environment:

[0051] • Redundant power supply

[0052] Each control device 110 , 130 is supplied with power by an independent voltage source.

[0053] • Redundant communications

[0054] Each control device 110 , 130 can communicate with another control device 130 , 110 and other defined control devices in the vehicle via two mutually independent communication paths.

[0055] • Error-tolerant driving function

[0056] The failure of the wheel speed sensor 120 does not lead to a failure of the driving function. The three wheel speed sensors 120 can also achieve reliable control of the vehicle.

[0057] Furthermore, the present invention proposes a test mode that allows the performance of control units 110 , 130 for switching sensor interfaces to be checked, thereby ensuring that the necessary redundancy of the brake system is present before the automated driving function is activated by the driver.

[0058] Figure 3 A state flow chart for a brake system with a test mode is shown. After the vehicle is started via step 205, the software first changes to the state 210 of "normal operation\HAF". Highly automated driving HAF does not occur here. The control device 110 of the primary brake system PBS establishes a connection with the wheel speed sensor 120 via the circuit unit 113 in the sensor isolation circuit 116. The sensor signal is sent from the primary brake system via the CAN bus 140. The control device 130 of the secondary brake system SBS disconnects the connection between the wheel speed sensor 120 and the control device 130 of the secondary brake system via the circuit unit 133 in the sensor isolation circuit 136. The control device 130 of the secondary brake system receives the sensor signal via the CAN bus 140.

[0059] The system remains in this state 210 until the driver requests a highly automated driving function via a corresponding user interface. For this purpose, a HAF request is issued to the control device 110 of the primary brake system via the main function. The system then changes to the state 220 "Initial (Test)", in which the test mode is initialized. The test system operates as follows: The control device 110 of the primary brake system closes its sensor interface and informs the control device 130 of the secondary brake system of the entry of the test mode via the vehicle bus 140. In the state of the test mode, the control device 110 of the primary brake system does not send the data of the wheel speed sensor 120 to the control device 130 of the SBS. The control device 130 of the secondary brake system receives the signal about the entry of the test mode and establishes a connection with the speed sensor 120 via the circuit unit 133 of the sensor isolation circuit 136. In addition, the analyzed data of the wheel speed sensor 120 are sent to the control device 110 of the primary control device via the vehicle bus 140. The control device 110 receives the data of the wheel speed sensor 120 via the CAN bus 140. The entry of the test mode is fed back to the control device 110 of the primary control device via the vehicle bus 140. The control device 110 of the primary braking system checks the received data and, when a positive result is obtained, transmits a signal that the test mode has ended to the control device 130 of the SBS. In an alternative embodiment, the design may be such that the transition to the initial (test) state 220 is completed before the driver issues a HAF request, so as to shorten the reaction time relative to the driver. Moreover, repeated and periodic checks are also feasible. However, the present invention can also be used for "fully automatic driving" above VDA level 5, which does not require driver participation.

[0060] The control device 130 of the secondary brake system receives the signal, changes to the state 240 "normal operation (HAF)", and disconnects the connection with the wheel speed sensor 120. The control device 110 of the primary brake system no longer obtains the sensor signal through the vehicle bus 140, and then establishes the connection with the wheel speed sensor 120 in the state 240 "normal operation (HAF)". In addition, the data of the wheel speed sensor 120 is sent to the control device 130 of the primary control device through the vehicle bus 140. When the data of the wheel speed sensor 120 is correctly received, the primary brake system completes the initialization and also changes to the state 240 "normal (HAF)". In this state, the automated driving function is ready. The control device 130 of the secondary brake system now receives the sensor signal through the vehicle bus 140 and is also initialized. The HAF preparation is fed back to the vehicle main function, and the vehicle main function makes a request to start the HAF operation. Then, the automated driving function is started as the driver wishes. When no error occurs, this state is maintained until the end of the driving cycle in step 245.

[0061] In state 220 "Initial (test)", the data received by the control device 130 of the secondary brake system is continuously checked. When the data cannot be received correctly, a transition to state 230 "Error: PBS ok" is achieved. This error situation is intercepted by the transition to the reliable state of the primary brake system. In this case, the control device 110 of the primary brake system is connected to the wheel speed sensor 120, and the data of the wheel speed sensor is sent to the control device 130 of the secondary brake system via the vehicle bus 140. The control device 130 of the secondary brake system tests the input of the data of the wheel speed sensor. If the data can no longer be received correctly, there is a serious error that cannot be corrected. The test ends with the corresponding result in step 235. The automated driving function cannot be started.

[0062] In state 240 "Normal (HAF)", the data received by the control device 110 of the primary brake system is continuously checked. When the data cannot be received correctly, a transition to state 250 "Error: PBS ok" is achieved. This error situation is intercepted by a transition to a reliable state of the secondary brake system. In this case, the control device 130 of the secondary brake system is connected to the wheel speed sensor 120, and the data of the wheel speed sensor is sent to the control device 110 of the primary brake system via the vehicle bus 140. The control device 110 of the primary brake system tests the input of the data of the wheel speed sensor 120. If the data can no longer be received correctly, there is a serious error that cannot be corrected. The test ends in step 255 with the corresponding result. The automated driving function cannot be started.

[0063] All examples and limited expressions mentioned herein should not be understood as being limited to the specifically described examples. For the examples, those skilled in the art should note that the block diagrams described herein show the design diagrams of exemplary circuit devices. In a similar manner, it should be noted that the flow charts, state transition diagrams, pseudocodes and similar various variants shown are used to describe processes, which are primarily stored in a computer-readable manner and can thus be implemented by a computer or processor.

[0064] It should be understood that the proposed method and the associated device can be implemented in different ways of hardware, software, firmware, special processors or combinations thereof. The special processor may include an application specific integrated circuit (ASIC), a reduced instruction set computer (RISC) and / or a field programmable gate array (FPGA). Preferably, the proposed method and device are implemented as a combination of hardware and software. The software is preferably installed in a program storage device as an application program. It is generally related to a machine based on a computer platform, and the computer platform has hardware, such as one or more central processing units (CPUs), random access memories (RAMs) and one or more input / output (I / O) interfaces. An operating system is also generally installed on the computer platform. The various processes and functions described herein may be part of an application program or a part implemented by an operating system.

[0065] The disclosure of the present invention is not limited to the embodiments described. There is still room for various adjustments and optimizations, and those skilled in the art will also regard the adjustments and optimizations as belonging to the disclosure based on their professional knowledge.

[0066] List of Reference Numerals

[0067] 100 Braking equipment

[0068] 110 Primary control equipment

[0069] 111 Data bus for secondary control devices

[0070] 112 ASICs for primary control devices

[0071] 113 Circuit Unit

[0072] 114 Microcontroller

[0073] 115 Control Line

[0074] 116 Sensor isolation circuit for primary control equipment

[0075] 118 Monitoring Circuit

[0076] 120 Wheel speed sensor

[0077] 122 Sensor signal line

[0078] 130 Secondary control equipment

[0079] 131 Data bus for primary control equipment

[0080] 132 ASIC for secondary control equipment

[0081] 133 Circuit Unit

[0082] 134 Microcontroller

[0083] 135 Control Line

[0084] 136 Sensor isolation circuit for secondary control equipment

[0085] 138 Monitoring Circuit

[0086] 140 Communication bus

[0087] 200 State Diagram

[0088] 210 Normal operation status without HAF preparation

[0089] 220 Test mode status

[0090] 230 Safe operating state of primary control equipment

[0091] 240 Normal operation status with HAF preparation

[0092] 250 Safe operating state via secondary control equipment

Claims

1. A device for controlling a safety-related process, wherein: The device (100) is redundantly constructed and has: a primary control device (110) and a secondary control device (130), wherein the secondary control device (130) assumes the functions of the primary control device (110) in the event of an error, wherein the control of the safety-related process is performed based on an evaluation of a signal of at least one sensor (120); and a communication bus (140), wherein the communication bus connects the primary control device (110) and the secondary control device (130), and the communication bus (140) enables data exchange between the primary control device and the secondary control device, The invention is characterized in that the at least one sensor (120) can be connected to the primary control device (110) and the secondary control device (130), and the primary control device (110) and the secondary control device (130) respectively include a dedicated integrated circuit (112, 132), which is responsible for the current / voltage supply of the at least one sensor (120) and is used for detecting and processing the signal of the at least one sensor (120). The primary control device (110) and the secondary control device (130) are respectively provided with a sensor isolation circuit, namely a sensor isolation circuit (116) assigned to the primary control device and a sensor isolation circuit (136) assigned to the secondary control device (130), which, when activated, separates the primary control device or the secondary control device from the at least one sensor (120) and thereby does not shunt the sensor current. wherein the sensor interface of one of the primary control device and the secondary control device is always activated when the sensor interface of the other of the primary control device and the secondary control device is closed, wherein each of the primary control device (110) and the secondary control device (130) is supplied with power via an independent voltage source, and Each of the primary control device (110) and the secondary control device (130) communicates with the other of the primary control device (110) and the secondary control device (130) through two independent communication paths.

2. The device according to claim 1, characterized in that Each of the sensor isolation circuits (116, 136) includes an UND circuit, which causes the at least one sensor (120) to be connected to the corresponding primary control device or the secondary control device in such a way that a signal indicating that the corresponding control device is operating without fault is obtained by the monitoring device (118, 138) and a microcontroller (114, 134) of the corresponding control device indicates that the control device is in a state in which a processing device and / or a conduction device for the signal of the at least one sensor (120) is provided on the corresponding secondary control device or the primary control device.

3. The device according to claim 1, characterized in that A monitoring device (118) is provided for monitoring the function of the primary control device (110).

4. The device according to claim 1, characterized in that A monitoring device (138) is provided for monitoring the function of the secondary control device (130).

5. The device according to claim 3 or 4, characterized in that The monitoring device (118, 138) is a program execution monitoring device.

6. The device according to claim 5, characterized in that The monitoring device (118, 138) is a "watchdog" device.

7. The device according to claim 1, characterized in that The safety-relevant process is a braking process of a motor vehicle, and the device is installed in the motor vehicle.

8. The device according to claim 7, characterized in that The primary control device (110) is a control device for a primary brake system of the motor vehicle.

9. The device according to claim 7, characterized in that The secondary control device (130) is a control device for a secondary brake system of the motor vehicle.

10. The device according to claim 7, characterized in that The at least one sensor (120) is a wheel speed sensor.

11. The device according to claim 1, characterized in that Each of the primary control device (110) and the secondary control device (130) communicates with other specific control devices in the vehicle via the two mutually independent communication paths.

12. A method for testing a device (100) for controlling a safety-related process according to any one of the preceding claims, characterized in that The primary control device (110) disconnects at least one sensor (120) by means of a sensor isolation circuit (116) assigned to the primary control device. The primary control device informs the secondary control device (130) via a communication bus (140) that the test mode has been entered. The secondary control device (130) then connects the at least one sensor (120) to the secondary control device (130) by means of a sensor isolation circuit (136) assigned to the secondary control device. The secondary control device sends the sensor data to the primary control device (110) via the communication bus (140), and The primary control device (110) checks the correct reception of the sensor data and, if a positive check result is obtained, transmits a signal to the primary control device (110) via a communication bus (140) to indicate the end of the test mode.

13. The method according to claim 12, characterized in that After inputting information about the end of the test mode, the secondary control device (130) disconnects the at least one sensor (120) via a sensor isolation circuit (136) configured in the secondary control device, and then the primary control device (110) itself connects the at least one sensor to the primary control device (110) via a sensor isolation circuit (116) assigned to the primary control device due to the lack of sensor data to be transmitted, and promotes the transmission of sensor data to the secondary control device (130) before starting the test mode as before.

14. The method according to claim 12, characterized in that After a request to start an operating mode of a highly automated driving of the motor vehicle, a test of the functionality of the device (100) is carried out.

15. The method according to claim 12, characterized in that When the secondary control device (130) recognizes during the test that the sensor data cannot be correctly received by the primary control device, the at least one sensor (120) is connected to the primary control device (110) via a sensor isolation circuit (116) assigned to the primary control device, and the transmission of the sensor data to the secondary control device is promoted before the start of the test mode as before. The primary control device (110) informs a secondary control device (130) of erroneous reception of sensor data, whereupon the secondary control device (130) disconnects the at least one sensor (120) via a sensor isolation circuit (136) assigned to the secondary control device.

16. The method according to claim 12, characterized in that When the secondary control device (130) recognizes during the test that the sensor data cannot be correctly received by the primary control device (110), the at least one sensor (120) is connected to the secondary control device (130) via a sensor isolation circuit (136) assigned to the secondary control device, and the sensor data is transmitted to the primary control device (110). The secondary control device (130) informs the primary control device (110) of erroneous reception of sensor data, whereupon the primary control device (110) disconnects the at least one sensor (120) via a sensor isolation circuit (116) assigned to the primary control device.

17. A car, characterized in that: The motor vehicle has a device for controlling a safety-relevant process according to any one of the preceding claims 1 to 11 .

Images