Control unit for a safety-critical facility

Abstract

The present invention relates to a control unit (10) for a safety-critical device, comprising at least one logic unit (12) which is configured to generate and / or receive a reset signal, wherein the control unit (10) has a switching arrangement (14) wherein the switching arrangement (14) is configured to generate a live signal for a predetermined period when the logic unit (12) receives and / or generates the reset signal.

Description

State of the art

[0001] The present invention relates to a control unit for a safety-critical device and a vehicle.

[0002] Currently, there are a variety of different solutions for resetting control units in vehicles. Due to the increasing number of electrically controllable components in vehicles and the increased demands of autonomous driving, the need for innovative and robust error correction options is continuously growing.

[0003] The constant weight reduction in the vehicle sector to reduce fuel consumption as well as increasing competition are creating cost pressure, so that cheaper and more efficient components for vehicles are in greater demand.

[0004] WO 2016 005 187 A1 describes a control arrangement for safety-relevant actuators with a reset unit and a monitoring unit. The reset unit can reset at least parts of the control arrangement.

[0005] Furthermore, WO 99 04324 A1 compares a ramp of negative and positive edges of a pulse against a level value in order to generate a reset signal of an electronic safety circuit if the level value is exceeded. Disclosure of the invention

[0006] The control unit according to the invention for a safety-critical device with the features of claim 1 has the advantage over the known device that safety functions are not triggered due to the live signal and are not unnecessarily brought into a safe state. This can, in particular, affect a multitude of other components. A further advantage is that no redundant system needs to be used for the duration of a restart of a control unit, which can, in particular, result in additional costs.

[0007] This is achieved according to the invention in that the control unit for a safety-critical device comprises at least one logic unit configured to generate and / or receive a reset signal. Furthermore, the control unit has a switching arrangement, wherein the switching arrangement is configured to generate a live signal for a predetermined period of time when the logic unit receives and / or generates the reset signal.

[0008] In other words, the switching arrangement generates a live signal so that a safety function does not switch to a safe state despite a restart of the control unit or a device associated therewith, since the safety function is informed that this is merely a restart and not a failure or the like. After the predetermined period of time, the safety function switches to the safe state. This makes it possible, in particular, to eliminate the need for a second or redundant unit. Preferably, the logic unit is configured to generate and / or receive a reset signal. The reset signal can, in particular, mean a restart of a control unit and / or a control unit or the like. Further preferably, the switching arrangement forms a live signal for a predetermined period of time, wherein the switching arrangement is, in particular, connected to the safety function or an actuator in a signal-conducting manner.Thus, when the logic unit receives and / or generates the reset signal, the control unit can generate the live signal for the predetermined period of time, wherein the predetermined period of time is, in particular, a duration for a restart. Furthermore, another component can generate the reset signal, so that the logic unit receives the reset signal from another component. In particular, a reset may be necessary due to a software error or electromagnetic radiation. Furthermore, the predetermined period of time can be selected such that a "fault tolerance time" is not exceeded. After the predetermined period of time has elapsed, the live signal extinguishes and the "fault tolerance time" is exceeded, so that the safe state is reached.

[0009] The subclaims show preferred developments of the invention.

[0010] Preferably, the live signal is configured to leave at least one actuator in its switching state for the predetermined period of time.

[0011] An advantage of this embodiment is that components that switch to the safe state upon a reset, such as high-side or low-side drivers, remain in their previous switching state for the predetermined period of time because they receive the live signal. This allows control to continue even after the reset, so that the previous switching state can be maintained despite the reset. The live signal can be routed, in particular, to the actuator via the control unit and / or the switch arrangement.

[0012] Further preferably, the switching arrangement comprises at least one timing element, wherein the timing element is configured to generate the live signal for the predetermined period of time.

[0013] An advantage of this embodiment is that, if, for example, a capacitor or similar energy storage device in the timing element is discharged, the live signal automatically extinguishes when it is discharged and the system can thus switch to the safe state. For example, the timing element is an RC element or any other form of electrical storage device. Furthermore, the timing element is preferably configured such that when no voltage or current is present due to the restart, it begins to discharge. For the duration of the discharge of the timing element, the switching state of the actuator is maintained, so that the system does not switch to the safe state for the predetermined period.

[0014] Preferably, the control unit is configured to charge the timer in the absence of the reset signal.

[0015] An advantage of this embodiment is that the timer is automatically recharged and thus the live signal can be generated for a variety of processes.

[0016] The timer can be charged using the prevailing voltage and current, so that when the reset signal occurs, the timer begins to discharge.

[0017] Further preferably, the timer has a capacity, wherein the capacity is configured to determine a duration of the predetermined period of time.

[0018] An advantage of this embodiment is that the exact duration of the predetermined period can be set by dimensioning the capacitance, such as a capacitor. Based on this duration, the duration of the live signal generation can be determined.

[0019] Preferably, the switching arrangement is configured to generate the live signal in the predetermined period of time until a reference of the timing element falls below a predetermined limit value.

[0020] An advantage of this embodiment is that the detection unit can be used to check whether the live signal level is sufficient to maintain the safe state. If the level falls below the predetermined limit, the live signal is canceled, and in particular, the safe state is canceled. If the detection unit has a constant power supply, a switch or switching arrangement can be provided to determine whether the timer's reference falls below the predetermined limit.

[0021] Preferably, the control unit comprises a detection unit, wherein the detection unit is configured to adapt the predetermined period of time.

[0022] An advantage of this embodiment is that the detection unit allows the predetermined time period to be precisely adjusted. In particular, other factors, such as the ambient temperature or similar, can be taken into account.

[0023] Preferably, the detection unit is configured to detect a voltage, wherein the detection unit is configured to adapt the predetermined period of time based on the detected voltage and by means of a reference voltage and a comparator.

[0024] An advantage of this embodiment is that the time period can be adjusted using a simple component such as a comparator, which can have a reference voltage and a detected voltage from the detection unit. Thus, different voltage and / or circuit states can be taken into account for adjusting the predetermined time period.

[0025] Further preferably, the control unit is configured to transmit the live signal to a plurality of actuators.

[0026] An advantage of this embodiment is that only one control unit needs to be provided for a component in order to control a plurality of actuators or to generate the live signal for a plurality of actuators.

[0027] A further aspect of the invention relates to a vehicle having a control unit as described above and below. Drawings

[0028] Embodiments of the invention are described in detail below with reference to the accompanying drawings. It shows: Fig. 1 and Fig. 2 a control unit according to an embodiment, and Fig. 3 a vehicle according to an embodiment. Embodiments of the invention

[0029] Fig. 1 shows a control unit 10. The control unit 10 has a logic unit 12 and a switching arrangement 14. The logic unit 12 is configured to generate and / or receive a reset signal. A first data connection 28 indicates the receipt of a reset signal. Furthermore, the switching arrangement 14 is configured to generate a live signal for a predetermined period of time when the logic unit 12 receives and / or generates the reset signal. The live signal can, for example, be transmitted from the control unit 10 to an actuator 16. The live signal 30 is in the Fig. 1 is shown as a schematic representation.

[0030] Fig. 2 shows an embodiment of the control unit 10. This control unit 10 has a logic unit 12. The control unit 10 further comprises a switching arrangement 14. In addition, the control unit 10 is connected to at least one actuator 16 by means of a signal line 32. More preferably, the control unit 10 can also generate a plurality of live signals 30 for a plurality 26 of actuators 16. In addition, the switching arrangement 14 can comprise a timing element 18. The timing element 18 is configured to generate the live signal 30 for a predetermined period of time. Furthermore, the timing element 18 can have a capacitor 20 that defines a duration of the predetermined period of time. In addition, the control unit 10 can have a detection unit 22 that is configured to adapt the predetermined period of time. The detection unit 22 can in particular comprise a comparator 24.

[0031] Fig.3 shows a vehicle 200 having a safety-critical device 100 and a control unit as described above and below. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] WO 2016 005 187 A1

[0004] WO 99 04324 A1

[0005]

Claims

[1] Control unit (10) for a safety-critical device (100), comprising: • at least one logic unit (12) which is configured to generate and / or receive a reset signal, • wherein the control unit (10) has a switching arrangement (14), wherein the switching arrangement (14) is configured to generate a live signal for a predetermined period of time when the logic unit (12) receives and / or generates the reset signal. [2] Control unit (10) according to claim 1, wherein the live signal is configured to leave at least one actuator (16) in its switching state for the predetermined period of time. [3] Control unit (10) according to one of the preceding claims, wherein the switching arrangement (14) has at least one timing element (18), wherein the timing element (18) is designed to form the live signal for the predetermined period of time. [4] Control unit (10) according to claim 3, wherein the control unit (10) is arranged to charge the timer (18) in the absence of the reset signal. [5] Control unit (10) according to one of claims 3 and 4, wherein the timer (18) has a capacitance (20), the capacitance (20) being adapted to determine a duration of the predetermined period of time. [6] Control unit (10) according to one of claims 3 to 5, wherein the switching arrangement (14) is arranged to generate the live signal in the predetermined period of time until a reference of the timer falls below a predetermined limit value. [7] Control unit (10) according to one of the preceding claims, wherein the control unit (10) comprises a detection unit (22), wherein the detection unit (22) is configured to adapt the predetermined period of time. [8] Control unit (10) according to claim 7, wherein the detection unit (22) is configured to detect a voltage, wherein the detection unit (22) is configured to adapt the predetermined period of time based on the detected voltage and by means of a reference voltage and a comparator (24). [9] Control unit (10) according to one of the preceding claims, wherein the control unit (10) is arranged to transmit the live signal to a plurality (26) of actuators (14). [10] Vehicle (200) comprising a control unit (10) according to one of the preceding claims.

Images