Method for securing the acquisition of an analog signal by an analog-to-digital converter of an on-board computer for an automotive vehicle

Abstract

Method (P) for securing the acquisition of analog signals (S), implemented by an on-board computer (C) for a motor vehicle, the computer being configured to store (Es) in memory a predetermined time-varying analog reference signal (SrefA) and a digital reference signal (SrefN) obtained by analog-to-digital conversion of the analog reference signal, and when a divergence alarm (Ed) is triggered: / a / bring the analog reference signal (SrefA) to the input of each of two respective analog-to-digital converters (ADCa, ADCb), / b / compare (Ec) the digital reference signal (SrefN) with each of two respective converted digital signals obtained as the output response of the analog-to-digital converters, / c / if only one of the comparisons is satisfactory, select (Es) the corresponding digital signal, and send this signal to the input of each of two calculation modules,and trigger (Ef) a failure alarm if none of the comparisons are satisfactory. Figure for the abbreviation: Figure 2,

Description

Title of the invention: Method for securing the acquisition of an analog signal by an analog-to-digital converter of an embedded computer for an automotive vehicle Scope of the invention

[0001] The present invention relates to a method for securing the acquisition of an analog signal by an on-board computer for a motor vehicle. It also relates to such an on-board computer and a motor vehicle equipped with such a computer. Previous art

[0002] An on-board computer for a motor vehicle usually has several analog-to-digital converters, at least one of which is dedicated to operational safety.

[0003] An analog-to-digital converter dedicated to operational safety includes internal diagnostic logic to identify different types of failure.

[0004] The different types of failure are, for example, multiplexer failures, end-of-conversation timeout expirations, detections of divergences between converters, failures of a signal converted from the supply signal.

[0005] The different types of failure are used only to establish a diagnosis and secure the system by resetting or stopping the vehicle in the event of a failure of the analog-to-digital converter.

[0006] In the event of failure of the analog-to-digital converter, and independently of any symptom, after a certain number of resets, usually 8, the system is locked and the vehicle cannot start or, worse, the vehicle is stopped on the road, because it is not possible to perform analog acquisition.

[0007] One object of the invention is to overcome the disadvantages of methods according to the prior art, and in particular to avoid immobilization of the vehicle on the road even if a permanent failure appears. Description of the invention

[0008] To this end, according to a first aspect of the invention, a method for securing the acquisition of analog signals is proposed, implemented by an on-board computer for a motor vehicle, the computer comprising two analog-to-digital converters, and at least two calculation modules each associated with one of the respective analog-to-digital converters, each of the converters analog-to-digital converter being configured to convert an analog input signal into a so-called converted digital signal, and to send the converted digital signal as input to at least one corresponding computing module, each computing module being configured to receive as input a digital signal from the corresponding analog-to-digital converter, and to, in response, generate a control signal for a device on board the vehicle and / or implement an integrity check of such a control signal, the method comprising the following steps: • compare the converted digital signals obtained at the output of each respective analog-to-digital converter, • trigger a divergence alarm in case of divergence between said converted digital signals.

[0009] The computer is further configured to: • store in memory a predetermined time-varying analog reference signal and a digital reference signal obtained by analog-to-digital conversion of said predetermined analog reference signal, and • when a divergence alarm is triggered: - / a / bring the analog reference signal to the input of each respective of the two analog-to-digital converters, - / b / compare said digital reference signal with each respective of the two converted digital signals obtained in response, at the output of the analog-to-digital converters, - / c / if only one of the comparisons is satisfactory, select the corresponding digital signal, and send this signal as input to each of the computing modules, a comparison being considered satisfactory when the difference between the reference digital signal and the converted digital signal is less than a predetermined threshold, and trigger a failure alarm if none of the comparisons are satisfactory.

[0010] According to one embodiment, steps / a / to / c / are further implemented when a response time of at least one converter is greater than a predetermined threshold, the converter conversion time.

[0011] Preferably, the analog reference signal is a periodic ramp-type signal.

[0012] Advantageously, prior to the storage step, the process further comprises a generation of the predetermined time-varying analog reference signal.

[0013] The analog ramp-type signal can be obtained by generating a signal pe- periodic square wave and filtering of said periodic square wave signal.

[0014] According to a second aspect of the invention, a computer for securing the acquisition of analog signals, embedded for a motor vehicle, is proposed, comprising two analog-to-digital converters, and at least two calculation modules each associated with one of the respective analog-to-digital converters, each of the analog-to-digital converters being configured to convert an analog input signal into a so-called converted digital signal, and to send the converted digital signal as input to at least one corresponding calculation module, each of the calculation modules being configured to receive as input a digital signal from the corresponding analog-to-digital converter, and to, in response, generate a control signal (ca, cb) of a device embedded on the vehicle and / or implement an integrity check of such a control signal.

[0015] The computer is further configured to: • compare the converted digital signals obtained at the output of each respective analog-to-digital converter, • trigger a divergence alarm in case of divergence between said converted digital signals, • store in memory a predetermined time-varying analog reference signal and a digital reference signal obtained by analog-to-digital conversion of said predetermined analog reference signal, and • when a divergence alarm is triggered: - / a / bring the analog reference signal to the input of each respective of the two analog-to-digital converters, - / b / compare said digital reference signal with each respective of the two converted digital signals obtained in response, at the output of the analog-to-digital converters, - / c / if only one of the comparisons is satisfactory, select the corresponding digital signal, and send this signal as input to each of the computing modules, a comparison being considered satisfactory when the difference between the reference digital signal and the converted digital signal is less than a predetermined threshold, and trigger a failure alarm if none of the comparisons are satisfactory.

[0016] According to a third aspect of the invention, a calculator is proposed according to the second aspect of the invention, or one or more of its improvements. Brief description of the figures

[0017] Other features and advantages of the invention will become apparent upon reading the detailed description that follows, for an understanding of which reference should be made to the accompanying drawings, in which: • [Fig. 1] illustrates a computer architecture according to the prior art, • [Fig.2] illustrates a computer architecture according to one embodiment of the invention, and • [Fig.3] illustrates a method of securing the acquisition of analog signals according to an embodiment of the invention. Detailed description of the invention

[0018] The embodiments described below are not in any way limiting; variants of the invention may, in particular, be considered comprising only a selection of the features described, hereinafter isolated from the other features described, if this selection of features is sufficient to confer a technical advantage or to differentiate the invention from the prior art. This selection comprises at least one feature, preferably functional without structural details, or with only a portion of the structural details if this portion alone is sufficient to confer a technical advantage or to differentiate the invention from the prior art.

[0019] Fig. 1 illustrates a prior art computing architecture Aa.

[0020] The computing architecture Aa includes two analog-to-digital converters ADCa, ADCb (for the English Analog to Digital Converter).

[0021] Each of the ADCa, respectively ADCb, converters is configured to convert an analog input signal sEa, respectively sEb, into a so-called converted digital output signal sSa, respectively sSb, and to send the converted digital signal into the input of a corresponding computing module, Ucl, respectively Uc2.

[0022] The analog input signal sEa, respectively sEb, is addressed by a multiplexer M arranged to receive as input a plurality of analog signals S.

[0023] The device da, respectively db, comprises an application layer L1 / L2a, respectively L1 / L2b, comprising in particular a layer SL1 / SL2a, respectively SL1 / SL2b, of level 1 and 2 reliability in charge of monitoring the application layer L1L2a, respectively L1L2b.

[0024] The architecture Aa further includes an application layer L3a, respectively L3b, comprising in particular a level 3 dependability layer SL3a, respectively SL3b responsible for monitoring the hardware layer L3a, respectively L3b.

[0025] The SL3 level 3 dependability layer includes monitoring processes d1, d2, d3, and d4 configured to trigger an alarm in the event of an anomaly.

[0026] The subprocess dl performs a comparison of two digital signals converted by analog-to-digital converters, and triggers a so-called divergence alarm Ed in the event of a divergence between the converted digital signals. A divergence between converted digital signals can be detected when the difference between the converted digital signals exceeds a predetermined threshold.

[0027] Subprocess d2 monitors end-of-conversion timeout expirations and triggers an EO timeout alarm when necessary. This alarm is triggered when the converter response time exceeds a predetermined threshold, the converter response time being the same as the converter conversion time.

[0028] The sub-process d3 performs a comparison between a predetermined value representing a supply voltage and the value obtained by conversion by the analog-to-digital converters from a supply current of the converters and triggers a so-called power supply alarm.

[0029] In case of an anomaly, the vehicle is stopped.

[0030] A computer architecture C, also called a microcontroller, for securing the acquisition of a plurality of analog signals S at the same time as a vehicle according to the invention comprising such a computer and a method P for securing the acquisition of such signals S, is now described.

[0031] The calculator C is configured to: • compare the converted digital signals obtained at the output of each respective of the analog-to-digital converters ADCa, ADCb, • trigger a divergence alarm in case of divergence between said converted digital signals.

[0032] The computer C is further configured to (Es) generate a reference analog signal, and store in memory a reference digital signal SrefN obtained by analog-to-digital conversion of said predetermined reference analog signal SrefA, for example by means of a reference analog-to-digital converter.

[0033] The analog reference signal can be generated from a periodic ramp signal. The analog ramp signal can be obtained by generating a periodic square wave signal and filtering said periodic square wave signal.

[0034] When a divergence alarm Ed is triggered, the computer C is configured: • / a / to bring the SrefA reference analog signal to the input of each respective of the two analog-to-digital converters ADCla, ADC2b, • / b / compare (Ec) the reference digital signal SrefN with each of the

[0035]

[0036]

[0037] two converted digital signals obtained in response, at the output of the analog-to-digital converters. • / c / if only one of the comparisons is satisfactory, calculator C is configured to select (Es) the corresponding digital signal, and send this signal as input to each of the computing modules, a comparison being considered satisfactory when the difference between the reference digital signal SrefN and the converted digital signal is less than a predetermined threshold, and trigger (Ef) a failure alarm if none of the comparisons are satisfactory. Thus, when a divergence alarm Ed is triggered and when only one of the two digital signals converted by each of the analog-to-digital converters from said reference signal SrefA corresponds to the digital reference signal SrefN, a still functional analog-to-digital converter is selected and this signal is sent, by means of a selector, to the input of each of the computing modules, which makes it possible to avoid immobilizing the vehicle. According to one possibility, steps / a / to / c / are also implemented when a time overrun alarm Eo is triggered. Of course, the invention is not limited to the examples just described, and many modifications can be made to these examples without departing from the scope of the invention. Furthermore, the various features, forms, variants, and embodiments of the invention can be combined in various ways, provided they are not incompatible or mutually exclusive.

Claims

1. Claims Method (P) for securing the acquisition of analog signals (S), implemented by an on-board computer (C) for a motor vehicle, said computer comprising two analog-to-digital converters (ADCa, ADCb), and at least two calculation modules each associated with a respective one of the analog-to-digital converters (ADC1, ADC2) each of the analog-to-digital converters (ADCa, ADCb) being configured to convert an analog input signal (sEa, sEb) into a so-called converted digital signal (sSa, sSb), and to send the converted digital signal to the input of the at least one corresponding calculation module (Uca, Ucb); each of the calculation modules being configured to receive as input a digital signal from the corresponding analog-digital converter (ADC1, ADC2), and to, in response, generate a control signal (ca, cb) for a device (da, db) on board the vehicle and / or implement an integrity check of such a control signal; the process comprising the following steps: compare the converted digital signals obtained at the output of each respective analog-digital converter, trigger a divergence alarm (Ed) in the event of divergence between said converted digital signals, said calculator is further configured to storing (Es) in memory a predetermined analog reference signal (SrefA) varying over time as well as a digital reference signal (SrefN) obtained by analog-digital conversion of said predetermined analog reference signal, and when a divergence alarm (Ed) is triggered: / a / bring the reference analog signal (SrefA) to the input of each respective of the two analog-to-digital converters (ADCa, ADCb), / b / compare (Ec) said reference digital signal (SrefN) with each respective one of the two converted digital signals obtained in response, at the output of the analog-digital converters, / c / if only one of the comparisons is satisfactory, select (Es) the corresponding converted digital signal, and send this signal to the input of each of the calculation modules, a comparison being considered satisfactory when the difference between the reference digital signal (SrefN) and the converted digital signal is less than a predetermined threshold, and trigger (Ef) a failure alarm if none of the comparisons is satisfactory.

2. Method according to the preceding claim, in which steps / a / to / c / are further implemented when a response time of at least one converter is greater than a predetermined threshold, the response time of the converter corresponding to the conversion time of the converter.

3. Method according to one of the two preceding claims, in which the reference analog signal is a periodic ramp-type signal.

4. Method according to any one of the preceding claims, further comprising, prior to the storage step (Es), a generation of the predetermined time-varying analog reference signal (SrefA).

5. A method according to claim 4, when dependent on claim 3, wherein said ramp-type periodic signal is obtained by generating a periodic square wave signal and filtering said periodic square wave signal.

6. Computer (C) for securing the acquisition of analog signals (S), on board a motor vehicle, comprising two analog-digital converters (ADCa, ADCb), and at least two calculation modules each associated with a respective one of the analog-digital converters (ADC1, ADC2); each of the analog-digital converters (ADCa, ADCb) being configured to convert an analog input signal (sEa, sEb) into a so-called converted digital signal (sSa, sSb), and to send the converted digital signal to the input of the at least one corresponding calculation module (Uca, Ucb); each of the calculation modules being configured to receive as input a digital signal from the corresponding analog-digital converter (ADC1, ADC2), and to, in response, generate a control signal (ca, cb) for a device (da, db) on board the vehicle and / or implement an integrity check of such a control signal;the calculator being further configured to:;

7. comparing the converted digital signals obtained at the output of each respective analog-to-digital converter, triggering a divergence alarm (Ed) in the event of divergence between said converted digital signals, storing (Es) in memory a predetermined analog reference signal (SrefA) varying over time as well as a reference analog signal (SrefA) obtained by analog-to-digital conversion of said predetermined analog reference signal, and when a divergence alarm (Ed) is triggered: / a / bring the reference analog signal (SrefA) to the input of each respective of the two analog-to-digital converters (ADCa, ADCb), / b / compare (Ec) said reference digital signal (SrefN) with each respective one of the two converted digital signals obtained in response, at the output of the analog-digital converters, / c / if only one of the comparisons is satisfactory, select (Es) the corresponding digital signal, and send this signal to the input of each of the calculation modules, a comparison being considered satisfactory when the difference between the reference digital signal (SrefN) and the converted digital signal is less than a predetermined threshold, and trigger (Ef) a failure alarm if none of the comparisons is satisfactory. Vehicle equipped with a computer (C) according to the preceding claim.

Images