Energy supply method for operating a processing device

Abstract

Energy supply method for operating a processing device (100) for controlling and / or regulating a data stream and / or an energy supply stream for powering on-board electronics of a user object, comprising the steps: - Providing a first power supply controller unit (30) which receives power supply data and aggregates it into individual data packets in order to then supply it to a safety controller (32), - Providing a second power supply controller unit (31) that operates independently of the first power supply controller unit (30) and which receives power supply data and aggregates it into individual data packets for transmission to the safety controller (32), characterized in that the first power supply controller unit (30) and the second power supply controller unit (31) operate at least partially redundantly with respect to each other, so that in the event of a malfunction of one of the two power supply controller units (31, 32) and / or the safety controller (32), at least one of the power supply controller units (30, 31) and the safety controller unit (32) ensures the continued error-free operation of the entire processing device (100), wherein the safety controller (32) decides, based on standard operating parameters, whether data and / or which data from the two power supply controller units (30, 31) should be transmitted to the safety controller (32).31) be forwarded to the on-board electronics of a device, in particular a vehicle.

Description

[0001] The present invention relates to a power supply method for operating a processing device for controlling and / or regulating a data stream and / or a power supply stream for supplying power to on-board electronics of a user object, as well as to a corresponding power supply device according to the preambles of patent claims 1 and 7.

[0002] Processing devices and, in particular, power supply methods for operating a processing device for controlling and regulating a data stream and / or a power supply stream for powering on-board electronics of a device are known from the prior art. These methods operate, in particular, in a fail-safe mode. If a malfunction is detected by a corresponding processing device, the corresponding faulty component is typically shut down or continues to operate at reduced power. Such a faulty component then enters a sleep state and, in particular, a fail-safe state (also known as fail-safe mode).

[0003] Such a fail-safe mode can have the disadvantage that continued operation of the device is either not possible at all or at least only possible to a limited extent.

[0004] If the processing device is installed in a vehicle and controls and / or regulates on-board electronics or is an element of the on-board electronics of a vehicle, the on-board electronics and / or a component of the on-board electronics and / or a component of the processing device, for example, begins to enter a fail-safe mode. Continued unrestricted operation, in particular continued operation in a standard operating mode, is therefore no longer possible for safety reasons. However, this leads to the vehicle in question being drivable, at best, only to a limited extent or even not at all.

[0005] In order to avoid such a fail-safe mode of a corresponding processing device and at the same time to offer a device and a corresponding energy supply method which are also available in the event of a malfunction of one of the components of the processing device or one of the components of a device connected to the processing device being detected, the present invention is based on an energy supply method and a corresponding energy supply device which makes use of a fail-operational mode in order to enable at least largely undisturbed continued operation.

[0006] The aim is therefore, among other things, to be able to maintain a normal operating mode, at least partially, even in the event of a malfunction of one of the aforementioned components. In particular, the present application addresses the possibility of providing redundant operation.

[0007] US 2005 / 0 156 468 A1 shows a power supply method for operating a processing device for controlling and / or regulating a data stream and / or a power supply stream for supplying power to on-board electronics of a user object.

[0008] DE 10 2005 005 995 A1 relates to a method and a device for monitoring signal processing units for sensors.

[0009] US 2014 / 0 175 874 A1 describes a method for the redundancy of controller units for sensor data processing.

[0010] The object of the present invention is therefore to provide a fail-operational system, in particular a fail-operational processing device, and a corresponding energy supply method in a particularly simple and cost-effective manner in order to enable continued operation, at least in part, even in the event of a malfunction of one of the components of the processing device.

[0011] This problem is solved by the subject matter of claim 1 and by the subject matter of claim 7.

[0012] The energy supply method proposed here for operating a processing device for controlling and / or regulating a data stream (for controlling the on-board electronics) and / or an energy supply stream for supplying energy to on-board electronics of at least one object of use, the method proposed here therefore comprises a first step, after which a first energy supply controller unit is provided, which receives energy supply data and combines it into individual data packets in order to then feed these to a security controller.

[0013] The energy supply controller is, for example, configured and intended to generate and / or be a part of an energy supply management system, preferably only configured and intended to generate and / or be a part of an energy supply management system.

[0014] In a second step, a second power supply controller unit is provided, which can be operated or is operated independently of the first power supply controller unit and which receives power supply data and summarizes it into individual data packets in order to feed them to a security controller.

[0015] Preferably, the first power supply controller unit and the second power supply controller unit are supplied with different data, but in any case not with identical data. The safety controller can, in particular, be a controller that monitors the functionality of the power supply controller units and compares whether these power supply controller units are operating in a standard operating mode or are leaving such a mode.

[0016] For the purposes of the invention, "regulated operating mode of the first and / or second power supply controller unit" means operation of this unit based on within a range of regulated operating parameters. Therefore, the regulated operating mode can be a respective normal operating mode of the controller units.

[0017] The standard operating parameters can therefore be specified, for example, by an instruction manual and / or a manufacturer's operating recommendation. If one of the power supply units deviates from such a standard operating mode in its operating parameters, the corresponding power supply controller unit is then in fail mode.

[0018] The above-mentioned considerations can also apply to sensor devices connected to the power supply controller units. For example, at least one sensor device is uniquely, preferably uniquely, assigned to each power supply controller unit. In this respect, the present invention can also provide a first sensor device, wherein this first sensor device is intended for data acquisition of at least one foreign object, preferably an ambient temperature or the like, wherein this first sensor device can then also be part of the processing device. The same can also apply to a second sensor device.

[0019] The safety controller can therefore also or alternatively monitor the first and / or the second sensor device for their functionality and their operation in a normal operating mode.

[0020] It is conceivable that the second power supply controller unit is only operated when the first power supply controller unit and / or the safety controller is in a fail-operational mode and therefore exits a regular operating mode. In this case, the second power supply controller unit is a second power supply controller unit that operates exclusively redundantly, preferably completely redundantly to the first power supply controller unit.

[0021] According to the invention, the first energy supply controller unit and the second energy supply controller unit operate at least partially redundantly to one another, so that in the event of a malfunction of one of the two energy supply controller units and / or the safety controller, at least one of the units ensures error-free continued operation of the entire processing device, in particular wherein the energy supply controller units are forwarded to on-board electronics of a usage object, in particular a vehicle.

[0022] The safety controller described above can therefore be a comparison unit that, for example, compares the data from the first power supply controller unit, which is intended to be forwarded to the on-board electronics system, with the data from the second power supply controller unit, which is intended to be forwarded to the on-board electronics system. If the individual data therefore differ from one another, the safety controller can also determine which of the power supply controller units are not operating within a standard operating mode, so that only those data are forwarded to the on-board electronics that represent a standard operating mode and / or are within a standard operating mode when viewed from a parameter page.

[0023] Alternatively or additionally, the safety controller can also be configured and provided to compare the individual data forwarded from the energy supply controller units to the safety controller with control operating parameters (= standard operating parameters) stored in the safety controller and / or another processing unit.

[0024] Diagnostic data can serve as additional input for the safety controller. For example, if a diagnostic device detects that sensors in one of the two sensor devices are defective, the output values ​​of the controller unit assigned to this defective sensor device are used (which may, under certain circumstances, provide faulty sensor data, but may be supplemented or corrected with diagnostic data), even if the output values ​​from other controller units are closer to the target values. All conceivable sensors can be considered, including, but are not limited to, radar, lidar, temperature, motion, optical, and pressure sensors. Different sensor types can also be combined.

[0025] Therefore, if the data generated by the first energy supply controller unit and / or the second energy supply controller unit deviate from the standard operating parameters, it can be decided that either the data of only a first energy supply controller unit and / or the data of only the second energy supply controller unit or no data at all are forwarded to the on-board electronics of a vehicle.

[0026] In the case of a fully redundant system, it is therefore conceivable that the safety controller compares the data generated by the first controller unit with the corresponding standard operating parameters and, in the event of a deviation of the data, in particular beyond a certain fault tolerance, the safety controller puts the second energy supply controller unit into operation and, in particular, puts the first energy supply controller unit and / or the first sensor device out of operation.

[0027] In other words, the processing unit proposed here can, for example, consist of two redundant, different threads for calculating and / or forwarding data or a data stream to the on-board electronics. Both paths can be capable of operating independently of each other. Each of the two paths can have its own sensor configuration for a so-called full 360° view.

[0028] It is conceivable that each sensor configuration of individual sensor units and / or each configuration of the power supply controller units is designed such that individual unit failures can be handled, in particular even at least partially remedied, by the respective claimed safety controller. The present invention is also suitable, among other things, for exchanging sensor data or data from the power supply controller units between individual paths, for example, for diagnostic purposes. Both controller units can therefore communicate with each other, in particular even without the aforementioned safety controller.

[0029] In order to improve the quality of environmental detection in the presence of special environmental conditions, it is also possible to exchange data between the various sensor units and / or controller units and, in particular, to redirect data streams via the individual controller units and / or sensor units, as already explained above.

[0030] In a control mode, i.e. in normal operation, the above-mentioned safety controller can therefore be the final instance that decides whether the result of the first or the second path (i.e. the result of the first or second controller unit) is forwarded to the on-board electronics of a vehicle, for example to a vehicle communication system.

[0031] Additionally, both paths have the ability to send data individually. In the event of a safety controller failure, it is conceivable that the two paths, especially the two controller units, monitor each other and thus mutually decide which of the controller units forwards the respective data to the on-board electronics. This design can therefore be created in a so-called master-slave solution. One of the two controller units can therefore represent a master controller unit, and a second controller unit can represent the corresponding slave controller unit.

[0032] According to at least one embodiment, the energy supply method according to the invention for operating a processing device for controlling and / or regulating a data stream and / or an energy supply stream for supplying energy to on-board electronics of the object of use comprises the steps of firstly providing a first energy supply controller unit which receives energy supply data and combines it into individual data packets in order to then feed these to a security controller.

[0033] In a second step, a second power supply controller unit is provided, which operates independently of the first power supply controller unit and receives power supply data and combines it into individual data packets, which are then fed to the security controller.

[0034] According to the invention, the first controller unit and the second controller unit operate at least partially redundantly to one another, so that in the event of a malfunction of one of the two energy supply controller units and / or the safety controller, at least one of the units (including, for example, the safety controller) ensures error-free continued operation of the entire processing device, in particular wherein the safety controller decides on the basis of standard operating parameters whether data and / or which data of the two energy supply controller units are forwarded to on-board electronics of a usage object, in particular a vehicle.

[0035] In other words, a scalable, secure, redundant and protected system (for example 2x SoC (the two power supply controller units) + safety uC (= safety controller)) for autonomous driving with high availability is provided in one housing.

[0036] The supply concept proposed here monitors independent paths and can continue to operate in fault mode.

[0037] A main monitoring device can operate as a “safety uC” (= safety controller) which is capable of making a safety decision under fault operating conditions.

[0038] Each supply path (one path each via a power supply controller unit) and each processor (SoC's / uC) can therefore, for example, monitor each other and is able to make a safety decision under fault operating conditions.

[0039] The security implementation can be done on a circuit board (for example in the form of a SoC implementation) and not by multiple control units

[0040] In at least one embodiment, each processing part (including each power supply controller unit) and each power supply together with the safety UC (= safety controller) are independent and do not affect each other if a failure occurs on the supply side.

[0041] In case of failure, one SoC can take over the functionality of the other due to the increased availability of power and the configuration of the vehicle sensors.

[0042] The power supply of the processing device is defined in such a way that it ensures high availability of the sensors in fault mode, which leads to high performance even in fault mode (e.g. you can drive at a standstill at 100 km / h).

[0043] The power supply concept, which can be represented by the processing device described here, can be extended to increase the safe functionality for a higher level of autonomous driving.

[0044] According to at least one embodiment, at least one of the two power supply controller units is designed as a system-on-a-chip (SoC). A system-on-a-chip (SoC) is the integration of all or a large portion of the functions of a programmable electronic system on a chip (die), i.e., an integrated circuit (IC) on a semiconductor substrate, also known as monolithic integration. When silicon is used as the substrate material, it is also referred to as a system-on-silicon (SoS). A system is understood to be a combination of different elements (logic circuits, clocking, autonomous start-up, micro-technical sensors, etc.) that together provide a specific functionality, for example, an acceleration sensor including evaluation electronics.

[0045] Digital, analog, and mixed-signal functional units are integrated, for example. The main advantages are cost savings, lower energy consumption and power dissipation, and comprehensive miniaturization.

[0046] For example, the two controller units are implemented in separate SoCs. However, it is conceivable, and preferred, that the two controller units are integrated into a single SoC. The two controller units can therefore share the same substrate as the carrier material.

[0047] The safety controller can be designed separately from the controller units. In this case, it is conceivable that the safety controller is not designed according to an SoC concept and is therefore positioned separately as a separate component next to the controller units.

[0048] Alternatively, the security controller could also be implemented as an SoC. In this context, it would even be conceivable for the security controller to be integrated with one or both of the controller units on a common substrate.

[0049] According to at least one embodiment, those data, and preferably only those data, from the power supply controller unit that are within the standard operating mode are forwarded to the on-board electronics. As already mentioned above, this advantageously ensures that the on-board electronics are not supplied with "incorrect" or "faulty" data.

[0050] According to at least one embodiment, if both data of both energy supply controller units are within the control operating mode (and thus, for example, both sensor devices possibly connected to the energy supply controller units are operated at least simultaneously), those data of the energy supply controller unit are forwarded which, in terms of measurement and / or data technology, are closer to a target operating value or a target operating range with regard to individual operating parameters.

[0051] Such a comparison can be performed by the safety controller described above. As shown above, such a comparison can be performed by an absolute and / or relative comparison of the individual data sets provided by the controller unit.

[0052] For example, the two controller devices and / or the two sensor devices mentioned above and / or other units are operated simultaneously such that the first power supply controller unit is operated based on an optical sensor and the second power supply controller unit is operated based on a thermal sensor. In this case, the first sensor unit can be an optical sensor and the second sensor unit can be a thermal sensor.

[0053] The individual data can also be summarized by the power supply controller units. However, summary processing can also be performed by the safety controller. It is therefore conceivable that the data streams and / or the data generated by the sensor devices differ from one another, especially if both sensors are operated simultaneously. However, it is also conceivable that both sensor devices are operated in a fully redundant mode. This means that only one of the sensor devices is active at a time. The same can also apply to the two power supply controller units.

[0054] Therefore, if the first power supply controller unit is operated without errors or within a predetermined tolerance range, i.e. if the first power supply controller unit operates in the normal operating mode, the second power supply controller unit can be operated in a standby mode, which corresponds to or entails a corresponding power reduction of the second power supply controller unit and / or the second sensor device.

[0055] According to at least one embodiment, in the event of a safety controller failure, one of the two power supply controller units assumes the role of the safety controller, with the corresponding safety controller unit then controlling its own data. In such a case, one of the two controller units can therefore become the safety controller. For example, master-slave operation as indicated above is possible. Data integration of the switch module can then also be dispensed with.

[0056] According to at least one embodiment, one of the two power supply controller units controls and / or regulates the other power supply controller unit in case of a malfunction of the safety controller, so that the power supply controller unit and / or the corresponding safety controller is bypassed.

[0057] In particular, such an embodiment is based on the idea that the safety controller unit must operate in a standard operating mode. In the event of a deviation from this standard operating mode, the safety controller is then shut down or at least transferred to standby mode.

[0058] Furthermore, the present invention comprises a power supply device, in particular a processing device, for controlling and / or regulating a data stream and / or a power supply stream for supplying power to on-board electronics of a user object. This power supply device comprises a first power supply controller unit, which receives power supply data and combines it into individual data packets to then feed them to a security controller. Furthermore, the power supply device comprises a second power supply controller unit, which can be operated independently of the first power supply controller unit and which receives power supply data from the second power supply controller unit and combines it into individual data packets to then feed them to the security controller.

[0059] In addition, the first energy supply controller unit and the second energy supply controller unit are configured and provided to operate at least partially redundantly to one another, so that in the event of a malfunction of one of the two energy supply controller units and / or the safety controller, at least one of the units ensures error-free continued operation of the entire processing device, in particular wherein the safety controller decides on the basis of standard operating parameters whether data and / or which data of the two energy supply controller units are forwarded to on-board electronics of a usage object, in particular the vehicle.

[0060] The energy supply device described here comprises the same advantages and advantageous configurations as the method described above and in particular the processing device described above.

[0061] The invention described here is explained in more detail below with reference to a figure.

[0062] Fig. 1 shows an embodiment of a method described here as well as an embodiment of a device described here, in particular a processing device described here based on the inventive concept described above.

[0063] From the Fig. 1 therefore shows a power supply device 3 for controlling and / or regulating a data stream. The power supply device can be part of a processing device 100. A first power supply controller unit 30 can be seen, which receives power supply data and combines it into individual data packets, which are then fed to a security controller (32).

[0064] In addition, a second power supply controller unit 31 is shown, which can be operated independently of the first power supply controller unit 30.

[0065] One of the essential features of the invention is that the first energy supply controller unit 30 and a second energy supply controller unit 31 operate at least partially redundantly to one another, so that in the event of a malfunction of one of the two energy supply controller units and / or the safety controller 32, at least one of the units 30, 31, 32 ensures error-free continued operation of the entire device, in particular wherein the safety controller 32 decides on the basis of standard operating parameters whether data and / or which data of the two energy supply controller units 30, 31 are forwarded to on-board electronics of a usage object, in particular the vehicle.

[0066] One of the two controller units 30, 31 can therefore assume the role of the other controller unit 30, 31, in particular with regard to the processing of data arriving from two sensor devices uniquely assigned to these controller units 30, 31.

[0067] In this respect, in the present case, a fail-operational system is proposed by the at least partially redundant cooperation between the two energy supply controller units 30, 31 in order to avoid a fail-safe system, in particular a fail-safe state during the operation of the energy supply device 3, in particular during the operation of the processing device 100 described above. List of reference symbols 3 Energy supply facility 30 first power supply controller unit 32 security controllers 100 processing facilities 31 second power supply controller unit

Claims

[1] Energy supply method for operating a processing device (100) for controlling and / or regulating a data stream and / or an energy supply stream for supplying energy to on-board electronics of a user object, comprising the steps: - Providing a first power supply controller unit (30) which receives power supply data and combines it into individual data packets in order to then feed them to a security controller (32), - providing a second power supply controller unit (31) which is operated independently of the first power supply controller unit (30), which receives power supply data and combines it into individual data packets in order to supply them to the security controller (32), characterized byin that the first energy supply controller unit (30) and the second energy supply controller unit (31) operate at least partially redundantly to one another, so that in the event of a malfunction of one of the two energy supply controller units (31, 32) and / or of the safety controller (32), at least one of the energy supply controller units (30, 31) and the safety controller unit (32) ensures error-free continued operation of the entire processing device (100), wherein the safety controller (32) decides on the basis of standard operating parameters whether data and / or which data of the two energy supply controller units (30, 31) are forwarded to on-board electronics of a usage object, in particular a vehicle. [2] A method for operating a processing device (100) according to claim 1, characterized bythat at least one of the two power supply controller units (30, 31) is designed as a system-on-a-chip (SoC). [3] Method for operating a processing device (100) according to claim 1 or 2, characterized by that those data of the energy supply controller units (30, 31) which lie entirely within a control operating mode are forwarded to the on-board electronics. [4] A method for operating a processing device (100) according to claim 2, characterized by that if both data of both energy supply controller units (30, 31) are within the control operating mode, those data of the energy supply controller unit (30, 31) are forwarded which are closer to a setpoint operating value in terms of measurement and / or data technology. [5] Method for operating a processing device (100) according to one of the preceding claims, characterized bythat in the event of a failure of the safety controller (32), one of the two power supply controller units (30, 31) takes over the role of the safety controller (32), and therefore the power supply controller unit (30, 31) then acting as the safety controller controls its own data. [6] A method for operating a processing device (100) according to claim 6, characterized by that one of the two energy supply controller units (30, 31) controls and / or regulates the other energy supply controller unit (30, 31) in the event of a malfunction of the safety controller (32), so that one of the two energy supply controller units (30, 31) and the safety controller (32) are thereby bypassed. [7] Energy supply device (3), in particular a processing device (100), for controlling and / or regulating a data stream and / or an energy supply stream for supplying energy to on-board electronics of a usage object, comprising, - a first power supply controller unit (30) which receives power supply data and combines it into individual data packets in order to then feed them to a security controller (32), - a second power supply controller unit (31) operable independently of the first power supply controller unit (30), which receives power supply data and combines it into individual data packets in order to supply them to the security controller (32), characterized byin that the first energy supply controller unit (30) and the second energy supply controller unit (31) operate at least partially redundantly to one another, so that in the event of a malfunction of one of the two energy supply controller units (30, 31) and / or of the safety controller (32), at least one of the energy supply controller units (30, 31) and the safety controller unit (32) ensures error-free continued operation of the entire processing device (100), wherein the safety controller (32) decides, based on standard operating parameters, whether data and / or which data of the two energy supply controller units (30, 31) are forwarded to on-board electronics of a usage object, in particular a vehicle.

Images