Method for monitoring insert units in a rack

Abstract

The invention relates to a method for monitoring plug-in units (90) in a rack, in which a plurality of plug-in units (90) and an energy supply plug-in unit are provided in the rack, in each plug-in unit (90) a microcontroller (100), an energy supply module and a monitoring arrangement are arranged, in which the energy supply plug-in unit is used for monitoring the plug-in units in the rack, the energy supply plug-in unit communicates with any plug-in unit, in particular data exchange is carried out between the energy supply plug-in unit and the corresponding monitoring arrangement in the plug-in unit.

Description

Technical Field

[0001] The invention relates to a method for monitoring plug-in units in a rack, in particular in a motor vehicle, and to a monitoring arrangement for carrying out the method. Background Art

[0002] The current automotive electrical / electronic (E / E) architecture has reached its scalability limit. The E / E Regional Architecture is a concept that reflects technological change and addresses the growing complexity and computing demands of automotive E / E systems to meet the expectations of a new generation of automotive consumers and enable new industry trends.

[0003] The transition from the current flat automotive E / E architecture to an integrated regional architecture involves several intermediate steps, such as central gateways, domain controllers, and distributed regional architectures.

[0004] All of these intermediate steps introduce new device classes, communication topologies, and implementations, such as high-performance, multi-function modular computers, high-speed backbone networks, and modular software as a service (SaaS). These steps aim to:

[0005] Reduce hardware

[0006] Reduce wiring

[0007] Increased functionality

[0008] Considering the physical size of a vehicle in a regional architecture, its equipment can be divided into three categories:

[0009] Edge devices, such as sensors and actuators, as well as traditional control units corresponding to other architectures.

[0010] Regional gateways, acting as local connectivity hubs, consolidate multiple low-speed interfaces (mostly legacy) and transmit data to the backbone network (Haupttrasse) via a single high-speed connection (e.g., Ethernet). Regional gateways can also perform edge processing and offload or prepare data for processing by vehicle servers, reducing workload and bandwidth.

[0011] The task of a vehicle server is to reduce the number of physical control units (ECUs) in a vehicle, for example by consolidating hardware components. A vehicle server doesn't necessarily have to be a single physical device, but can be implemented by connecting several high-performance control units, grouping system-on-chips (SoCs) on the same printed circuit board (PCB), or using a backbone network (rack architecture) with expansion cards.

[0012] In terms of operational safety and data security, goals such as secure boot, resource isolation, network protection, and secure storage should be considered, especially for hardware integration topologies that choose backbone networks with expansion cards. Since some logic and technology resources are shared between multiple physical instances, managed safety functions and safety-critical functions, i.e., functions with a high ASIL (Automotive Safety Integrity Level) classification, need to be used.

[0013] EP 1 128 536 B1 discloses an arrangement for switching a control unit on and off in a motor vehicle, wherein the control unit is arranged in a dual-voltage vehicle electrical system. The arrangement comprises a logic unit having an input for supplying a voltage monitoring signal.

[0014] The rack concept allows several control units to be combined into one physical housing. These control units are distributed at various locations in the vehicle.

[0015] The key concept within the rack is to separate fixed ratios of compute, storage, and networking into different pools that can be interconnected or combined into logical systems, cards, enclosures, or nodes when needed to optimize specific applications.

[0016] Currently, whenever a control unit has ASIL functionality requirements, suppliers must add ASIL-D-capable diagnostic and isolation path components. This also applies to the chassis and its enclosure or plug-in units, which contradicts the idea of ​​having a central high-performance ASIL-D node that can take on all or part of the ASIL-D functionality, thereby significantly reducing the number of microcontrollers on board, simplifying hardware design, and reducing material and development costs.

[0017] One such function is rack energy supply, which is highly integrated and has high requirements with regard to fault tolerance and availability. Summary of the Invention

[0018] Against this background, a method according to the invention and an arrangement according to the invention are proposed. Detailed description of the embodiments follows from the following description.

[0019] The proposed method is used for monitoring plug-in units in a rack, wherein a plurality of plug-in units and one energy supply plug-in unit are provided in the rack, and a microcontroller, an energy supply module, and a monitoring arrangement are arranged in each plug-in unit, wherein the energy supply plug-in unit is used to monitor the plug-in units in the rack, wherein communication takes place between the energy supply plug-in unit and any plug-in units, wherein in particular data is exchanged between the energy supply plug-in unit and the corresponding monitoring arrangement in the plug-in unit, wherein the monitoring unit in the energy supply plug-in unit communicates with the monitoring arrangement in the monitored plug-in unit.

[0020] The monitoring arrangement described is located in a plug-in unit. When this plug-in unit is monitored, it is referred to as the monitored plug-in unit. The plug-in unit is located in a rack, which typically also houses other plug-in units and a power supply plug-in unit. The power supply plug-in unit monitors the plug-in units in the rack. To this end, the power supply plug-in unit communicates with any plug-in units by exchanging data with the corresponding monitoring arrangement in the plug-in unit.

[0021] In the current design, each plug-in unit or housing houses a highly integrated node (safety domain) that is capable of detecting safety-critical events and responding accordingly. Regarding hardware transitions and permanent faults, the highly integrated node should be able to monitor basic hardware functions such as voltage, current, temperature, clock, etc.

[0022] In the current design, a specific plug-in unit, the energy supply plug-in unit, is responsible for generating and / or distributing energy to other plug-ins, i.e., distributing the supplied energy. This has the advantage that the startup and shutdown sequence can be controlled by starting a single node to achieve energy balance.

[0023] It has now been recognized that the main disadvantage is that the power supply management integrated circuits (PMICs) are also present inside the plug-in units, which generate and / or distribute the power locally. These PMICs also monitor the local microcontroller as an external safety agent. Therefore, the status of the local power can only be communicated to the power supply plug-in unit after the microcontroller is up and running and has communicated with the other plug-in units via a data bus or discrete signals, see Figure 2 .

[0024] This paper proposes a concept for improving and expanding the voltage monitoring capabilities of energy supply plug-in units to monitor other plug-in units in the same rack. The concept uses a regular monitoring arrangement with four to seven inputs in a so-called "overturned design." The term "overturned" is used here to emphasize that the voltage monitored by the component is the voltage generated by the monitored plug-in unit after activation. However, instead of monitoring the microcontroller on the monitored plug-in unit, the monitoring arrangement is implemented via highly integrated node monitoring on the energy supply plug-in unit. As a result, the energy supply plug-in unit frees up its request watchdog and safety response functions via an interface connection.

[0025] In this concept, three application types are provided: Type A, B and C. The concept can also be used based on similar devices, such as 6-channel ASIL-D voltage monitoring with analog-to-digital converter (ADC) and watchdog in accordance with automotive standards. In this context, see Figure 3 .

[0026] Further advantages and embodiments of the invention are apparent from the description and the drawings.

[0027] It will be understood that the features mentioned above and those yet to be explained below can be used not only in the respectively specified combination but also in other combinations or alone, without departing from the scope of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 The transition steps from a flat architecture to an E / E zone architecture are shown in a simplified diagram.

[0029] Figure 2 The integration of a typical highly integrated node is shown in simplified diagram form.

[0030] Figure 3 The interface-connected plug-in units within a rack architecture are shown in block diagram form.

[0031] Figure 4 An embodiment of the proposed arrangement for monitoring a voltage is shown in the form of a block diagram. DETAILED DESCRIPTION

[0032] The present invention is schematically shown based on embodiments in the drawings and will be described in detail below with reference to the drawings.

[0033] Figure 1 The steps of transitioning from a flat architecture to an E / E regional architecture are shown in a simplified diagram: a flat E / E architecture 10 is shown on the left, a central gateway 12 is shown in the middle, and an E / E regional architecture 14 is shown on the right.

[0034] In the flat E / E architecture 10 , there are provided a first control unit 20 having a safety domain 22 , a second control unit 24 having a safety domain 26 , and an nth control unit 28 , which is designed as an nth safety control unit 30 .

[0035] Central gateway 12 includes a first node 40 with a security domain 42, a second node 44 with a security domain 46, an nth node 48 with a security domain 50, and a supply node or energy node 52 with a security domain 54. A backbone network 56 is also shown.

[0036] In the E / E area architecture 14, there are provided a first control unit 60, an nth control unit 62, and a security server 64. In the security server 64, a first security domain 66 and a second security domain 68 are provided.

[0037] Units 30, 54 and 68 are designed as monitoring units. Units 22, 26, 42, 46, 50 and 66 are designed as monitored units.

[0038] Figure 2 A typical highly integrated node chassis plug-in unit 90 is shown in simplified form. The figure shows a monitored microcontroller 100, a supervisory unit (supervisor) 102, and a voltage regulator 104. Furthermore, a transceiver 106 with a physical layer and a closed path is shown, representing the interface to a bus 108.

[0039] The transmitted variables or signals include a control signal 110 , an activation signal 112 for shutting down a path, a signal 114 for a generated or regulated voltage, a signal 116 for a monitored voltage, a reset signal 118 , a query signal or response signal 120 for a watchdog interface, and an error signal 122 .

[0040] Furthermore, a power management circuit (PMIC: Power Management IC) 124 is shown. This is an integrated circuit with the aid of which the energy of the entire system can be managed.

[0041] Figure 3 The plug-in units connected by interfaces within a rack architecture are shown in block diagram form, wherein the rack as a whole is designated by reference numeral 200. The figure shows a first plug-in unit 190, a second plug-in unit 192 and a third plug-in unit 194. In addition, a plug-in unit 196 is provided, which is configured as an energy supply plug-in unit 230 and is connected according to the Figure 2 The arrangement 90 in FIG. 1 is constructed for monitoring further plug-in units 190 , 192 , 194 .

[0042] The figure also shows a first monitoring arrangement 202 of type A, a second monitoring arrangement 204 of type B, and a third monitoring arrangement 206 of type C in the plug-in units 190, 192, 194. The first monitoring arrangement 202 is assigned to a first local energy supply module 210, the second monitoring arrangement 204 is assigned to a second local energy supply module 212, and the third monitoring arrangement 206 is assigned to a third local energy supply module 214.

[0043] A monitored microcontroller 232, a monitoring unit 234, and a regulator 236 are provided in the power supply plug-in unit 230 on the fourth plug-in unit 196. Furthermore, a transceiver 238 with a physical layer and a switching path is shown, which represents the interface to the bus 240.

[0044] The energy supply input is denoted by reference numeral 250. The supply with external energy is denoted by reference numeral 252. The line for reset or interrupt is denoted by reference numeral 254. The line for configuration and query / response is denoted by reference numeral 256. The line for activation and deactivation is denoted by reference numeral 258. Reference numerals 270 and 272 also denote transceivers.

[0045] Type A design: externally supplied plug-in unit 190, released by the energy supply plug-in unit

[0046] exist Figure 3 In the example, the type A plug-in unit 190 is permanently supplied with an external battery voltage (VINext). After the energy supply plug-in unit 230 is started and operational, the energy supply module 210 or the energy supply module on the plug-in unit 190 is activated by a release signal (Freegabe-Signal). The monitoring arrangement 202 is supplied with voltage and released locally. The highly integrated node 232 on the energy supply plug-in unit 230 is activated via I 2 C. Continue with voltage monitoring configuration. After configuration, activity tests or periodic tests can be initiated, enabling the highly integrated nodes on the energy supply plug-in unit 230 to query the monitoring arrangement 202 .

[0047] If the monitoring arrangement 202 detects UV / OV, an interrupt is generated and the highly integrated node 232 on the energy supply plug-in unit 230 proceeds with a safety response, for example deactivating one or more energy supply modules 210 on the plug-in unit 190 .

[0048] Type B design: plug-in unit 192 supplied and released in a controlled manner by energy supply plug-in unit 230 .

[0049] exist Figure 3In the embodiment, the type B plug-in unit 192 is supplied by a battery voltage rail (Batteriespannungsrail) (VIN) 250, which is controlled by a highly integrated node on the energy supply plug-in unit 230 after the energy supply plug-in unit is started and running. One or more energy supply modules 212 provided on the plug-in unit 192 are automatically activated after voltage is applied. The monitoring arrangement 204 is then locally supplied with voltage. By means of a release signal, the monitoring arrangement 204 is remotely released via a highly integrated node 232 on the energy supply plug-in unit 230. The highly integrated node on the energy supply plug-in unit 230 will be activated via I 2 C. Continue with voltage monitoring configuration. After configuration, an active test or a periodic test can be initiated, enabling the highly integrated nodes on the energy supply plug-in unit 230 to query the monitoring arrangement 204 .

[0050] If the monitoring arrangement 204 detects UV / OV, an interrupt will be generated and the highly integrated node on the energy supply plug-in unit 230 will proceed with a safety response, such as cutting off the energy supply supply to the plug-in unit 192 .

[0051] Type C design: plug-in unit 194 supplied in a controlled manner by the energy supply plug-in unit 230

[0052] exist Figure 3 In the embodiment, after the energy supply plug-in unit is started and running, the type C plug-in unit 194 is supplied with the battery voltage rail (VIN) in a manner controlled by the highly integrated node on the energy supply plug-in unit 230. The energy supply module 214 or the energy supply module provided on the plug-in unit 194 is automatically activated after the voltage is applied. The monitoring arrangement 206 is then locally supplied with voltage and also locally released. The highly integrated node on the energy supply plug-in unit 230 will be connected to the battery voltage rail (VIN) through I 2 C. Continue with voltage monitoring configuration. After configuration, an active test or a periodic test can be initiated, enabling the highly integrated nodes on the energy supply plug-in unit 230 to query the monitoring arrangement 206 .

[0053] If the monitoring arrangement 206 detects UV / OV, an interrupt will be generated and the highly integrated node on the energy supply plug-in unit 230 will proceed with a safety response, such as cutting off the energy supply supply to the plug-in unit 194 .

[0054] Monitoring arrangement 202, 204, or 206 represents a fully ASIL-compliant SoC energy system monitor. When used with controller 232 of monitoring arrangement 202, 204, or 206, it can meet ASIL-D reliability requirements. It supports up to seven voltage monitoring inputs. Each input has programmable OV / UV thresholds (OV: overvoltage; UV: undervoltage). Controller 232 is assigned to the three monitoring arrangements 202, 204, and 206.

[0055] The monitoring arrangement 202, 204 or 206 includes a programmable flexible energy sequence recorder (FPSR). The energy sequence recorder stores the start-up time stamp and the shutdown time stamp separately and supports the on / off energy supply sequence and the sleep / standby energy supply sequence (Ruhe / Standby-Leistungssequenzen). It also includes a programmable flexible energy sequence recorder (FPSR). 2 Programmable request / acknowledge watchdog accessible via the C interface, with configurable reset output (Rücksetz-bzw.RESET-Ausgang).

[0056] The monitoring arrangement 202 , 204 , or 206 improves reliability while significantly reducing system size and component count compared to separate integrated circuits (ICs) or discrete components.

[0057] Figure 4 An embodiment of a monitoring arrangement is shown in the form of a block diagram, designated overall by reference numeral 400. The diagram shows a voltage monitoring device 402, a recording unit 404 for flexible energy sequencing, a unit for control and diagnosis 406, a watchdog with a window 408 and an I 2 C-interface 410.

[0058] The figure also shows a first connection 420 for the energy supply voltage VDD and a second connection 422 for ground. In addition, a third output 424 for a reset signal (Reset) is provided.

[0059] The arrangement 400 detects undervoltage and overvoltage conditions (reference number 430) and triggers an error response if necessary, for example by a reset (reference number 424). 2 The C interface 410 allows programmable thresholds and delays for undervoltage and overvoltage conditions via signals SDA 432 (SD: Serial Data) and SCL 434 (SCL: Serial Clock). A logging unit 404 is used to separately store startup and shutdown timestamps. Furthermore, the monitoring arrangement 400 supports both on / off power supply sequences and sleep / standby power sequences (reference numeral 436). Finally, the arrangement provides a windowed challenge / response watchdog 408 for external monitoring of the SoC (System on Chip).

Claims

1. A method for monitoring a plug-in unit (90, 190, 192, 194, 196) in a rack (200), wherein: A plurality of plug-in units (90, 190, 192, 194, 196) and an energy supply plug-in unit (230) are arranged in the rack (200), and a microcontroller (100, 232), an energy supply module (210, 212, 214) and a monitoring arrangement (202, 204, 206, 400) are arranged in each of the plug-in units (90, 190, 192, 194, 196), The energy supply plug-in unit is used to monitor the plug-in units in the rack, wherein the energy supply plug-in unit communicates with any plug-in units, wherein in particular data is exchanged between the energy supply plug-in unit and corresponding monitoring arrangements in the plug-in units.

2. The method according to claim 1, wherein The voltage in the monitored plug-in unit (90, 190, 192, 194, 196) is monitored.

3. The method according to claim 1 or 2, wherein: The monitored plug-in units (90, 190, 192, 194, 196) are permanently supplied with energy via an external energy supply, the monitoring being carried out by means of tests.

4. The method according to claim 1 or 2, wherein: The monitored plug-in units (90, 190, 192, 194, 196) are supplied with energy via an energy source controlled by the energy supply plug-in unit (230), the monitoring being carried out by means of a test.

5. The method according to claim 1 or 2, wherein: The monitored plug-in units (90, 190, 192, 194, 196) are supplied via a battery voltage rail controlled by the energy supply plug-in unit (230), the monitoring being carried out by means of a test.

6. The method according to any one of claims 3 to 5, wherein The monitoring is performed by periodic testing.

7. The method according to any one of claims 3 to 5, wherein The monitoring is achieved through activity measurement.

8. The method according to any one of claims 1 to 7, wherein Communication between the energy supply plug-in unit (230) and the monitoring arrangement (202, 204, 206, 400) of the monitored plug-in unit (90, 190, 192, 194, 196) is via I 2 C interface implementation.

9. A monitoring arrangement for monitoring a plug-in unit (90, 190, 192, 194, 196) in a rack (200), wherein: The monitoring arrangement (202, 204, 206, 400) is arranged in an insert unit (90, 190, 192, 194, 196) and is configured to carry out a method according to any one of claims 1 to 8.

10. The monitoring arrangement according to claim 9, which is configured to monitor a voltage.

Images