A method for operating an electronic control unit, a computer program product,a non-transitory computer-readable storage medium, an electronic control

Abstract

Operation of an electronic control unit 16 of a motor vehicle 10, comprising the steps of: receiving a power signal 26 of a voltage regulator 22 for the electronic control unit 16 by a safe reset moni

Description

[0001] The present invention relates to the field of automobiles. More specifically, the present invention relates to a method for operating an electronic control unit of a motor vehicle. Furthermore, the present invention relates to a computer program product, a non-transitory computer-readable storage medium, an electronic control unit, a system, as well as a motor vehicle. BACKGROUND INFORMATION

[0002] An ECU (electronic control unit) package relies on an external reset to initiate the boot process. A separate micro controller unit (MCU) residing within the vehicle provides this external reset. If the MCU malfunctions, the ECU is vulnerable to transient resets resulting in drive time failure. SUMMARY OF THE INVENTION

[0003] It is an object of the present invention to provide a method, a corresponding computer program product, a corresponding non-transitory computer-readable storage medium, a corresponding electronic control unit, a corresponding system, as well as a corresponding motor vehicle, by which a safer operation of the motor vehicle can be realized.

[0004] This object is solved by a method, a corresponding computer program product, a corresponding non-transitory computer-readable storage medium, as well as a corresponding electronic control unit, a corresponding system, as well as a corresponding motor vehicle according to the independent claims. Advantageous embodiments are presented by the dependent claims.

[0005] One aspect of the invention relates to a method for operating an electronic control unit (ECU) of a motor vehicle. A power signal of a voltage regulator from the electronic control unit is received by a safe reset monitor device of the electronic control unit. A reset signal of a micro controller unit (MCU) outside the electronic control unit is received by a boot control logic of the electronic control logic and the reset signal is additionally received by the safe reset monitor device. A number of received reset signals is counted by the safe reset monitor. If the counted number exceeds a predetermined threshold, a failure signal by the safe reset monitor is generated and transmitted to the boot control logic.

[0006] In particular, when a motor vehicle is not operational, for example parked or turned off, the electronic control unit within the motor vehicle requires an external reset to start the operation. This process begins by providing a stable source of power to the electronic control unit via the voltage regulators (VR). The voltage regulators can be internal or external to the electronic control unit system depending on the electronic control unit configuration. The voltage regulators, when ready to provide steady power to the electronic control unit, assert a PowerGood signal indicating stable power supply to the electronic control unit. When the external micro controller unit observes the PowerGood signal asserted, it provides a reset to the electronic control unit triggering the boot process. The external micro controller unit can be a non ASIL-D (highest automotive safety and integrity level) compliant component and introduce a possibility of malfunction. In such a scenario, the electronic control unit may receive spurious reset resulting in functional and safety failures.

[0007] By the present invention a safety mechanism to avoid the unpredicted operation in face of the transient reset due to the micro controller unit malfunction is provided. The present solution has a minimal integration overhead with the electronic control unit and does not require any specially designed components.

[0008] In particular, the boot control logic (BCL) is an electronic control unit specific state stable responsible for performing the boot process. In a typical use case, the boot control logic may receive the external reset and initiates the boot process. On successful completion of the boot process, the boot control logic will hand-off the control to the electronic control unit application process, for example an artificial intelligence inference engine, a particle diffusion application core or furthermore, and maybe either power-gated or clock-gated to conserve power. A transient reset from the external micro controller unit can restart the boot control logic and force the electronic control unit to go through an unexpected boot process again. This can be extremely dangerous when the motor vehicle is in motion and compromises driver safety. The apparatus provided presents the safety mechanism when faced with such transient resets.

[0009] According to an embodiment, the counter of the safe reset monitor device is set to zero when receiving the power signal.

[0010] In another embodiment depending on the failure signal, an operation mode of the electronic control unit is adapted.

[0011] In another embodiment, the electronic control unit provides an applicationprocessing module for performing an operation, wherein after receiving the power signal the application-processing module is booted.

[0012] In particular, the present invention is a computer-implemented method. Therefore, another aspect of the invention relates to a computer program product comprising program code means for performing a method according to the preceding aspect.

[0013] A still further aspect of the invention relates to a non-transitory computer-readable storage medium comprising at least the computer program product according to the preceding aspect.

[0014] Furthermore, the present invention relates to an electronic control unit for a motor vehicle, comprising at least one voltage regulator, one safe reset monitor device, and one boot control logic, wherein the electronic control unit is configured for performing a method according to the preceding aspect. In particular, the method is performed by the electronic control unit.

[0015] Furthermore, the present invention relates to a system for a motor vehicle, comprising at least a micro controller unit and an electronic control unit according to the preceding aspect.

[0016] Furthermore, the present invention relates to a motor vehicle comprising at least a system according to the preceding aspect.

[0017] Advantageous embodiments of the method are to be regarded as advantageous embodiments of the computer program product, the non-transitory computer-readable storage medium, the electronic control unit, the system, as well as the motor vehicle. The electronic control unit, the system, as well as the motor vehicle therefore comprise means for performing the method.

[0018] An electronic computing unit may in particular be understood as a data processing device, which comprises processing circuitry. The computing unit can therefore in particular process data to perform computing operations. This may also include operations to perform indexed accesses to a data structure, for example a look-up table, LUT.

[0019] In particular, the computing unit may include one or more computers, one or more microcontrollers, and / or one or more integrated circuits, for example, one or more application-specific integrated circuits, ASIC, one or more field-programmable gate arrays, FPGA, and / or one or more systems-on-a-chip, SoC. The computing unit may also include one or more processors, for example one or more microprocessors, one or more central processing units, CPU, one or more graphics processing units, GPU, and / or one or more signal processors, in particular one or more digital signal processors, DSP. The computing unit may also include a physical or a virtual cluster of computers or other of said units.

[0020] In various embodiments, the computing unit includes one or more hardware and / or software interfaces and / or one or more memory units.

[0021] A memory unit may be implemented as a volatile data memory, for example a dynamic random access memory, DRAM, or a static random access memory, SRAM, or as a non-volatile data memory, for example a read-only memory, ROM, a programmable read-only memory, PROM, an erasable programmable read-only memory, EPROM, an electrically erasable programmable read-only memory, EEPROM, a flash memory or flash EEPROM, a ferroelectric random access memory, FRAM, a magnetoresistive random access memory, MRAM, or a phase-change random access memory, PCRAM.

[0022] Further advantages, features, and details of the invention derive from the following description of preferred embodiments as well as from the drawings. The features and feature combinations previously mentioned in the description as well as the features and feature combinations mentioned in the following description of the figures and / or shown in the figures alone can be employed not only in the respectively indicated combination but also in any other combination or taken alone without leaving the scope of the invention. BRIEF DESCRIPTION OF THE DRAWING

[0023] The novel features and characteristic of the disclosure are set forth in the appended claims. The accompanying drawings, which are incorporated in and constitute a part of this disclosure, illustrate exemplary embodiments and together with the description, serve to explain the disclosed principles. The same numbers are used throughout the figures to reference like features and components. Some embodiments of system and / or methods in accordance with embodiments of the present subject matter are now described below, by way of example only, and with reference to the accompanying figures.

[0024] The drawings show in:

[0025] Fig. 1 a schematic block diagram according to an embodiment of a system comprising an embodiment of an electronic control unit; and

[0026] Fig. 2 a schematic block diagram according to an embodiment of a safe reset monitor device of an electronic control unit.

[0027] In the figures same elements or elements having the same function are equipped with the same reference signs. DETAILED DESCRIPTION

[0028] In the present document, the word "exemplary" is used herein to mean "serving as an example, instance, or illustration". Any embodiment or implementation of the present subject matter described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments.

[0029] While the disclosure is susceptible to various modifications and alternative forms, specific embodiments thereof have been shown by way of example in the drawing and will be described in detail below. It should be understood, however, that it is not intended to limit the disclosure to the particular forms disclosed, but on the contrary, the disclosure is to cover all modifications, equivalents, and alternatives falling within the scope of the disclosure.

[0030] The terms “comprises”, “comprising”, or any other variations thereof, are intended to cover a non-exclusive inclusion so that a setup, device or method that comprises a list of components or steps does not include only those components or steps but may include other components or steps not expressly listed or inherent to such setup or device or method. In other words, one or more elements in a system or apparatus preceded by “comprises” or “comprise” does not or do not, without more constraints, preclude the existence of other elements or additional elements in the system or method.

[0031] In the following detailed description of the embodiment of the disclosure, reference is made to the accompanying drawing that forms part hereof, and in which is shown by way of illustration a specific embodiment in which the disclosure may be practiced. This embodiment is described in sufficient detail to enable those skilled in the art to practice the disclosure, and it is to be understood that other embodiments may be utilized and that changes may be made without departing from the scope of the present disclosure. The following description is, therefore, not to be taken in a limiting sense.

[0032] Fig. 1 shows a schematic block diagram according to an embodiment of a motor vehicle 10 comprising an embodiment of a system 12. The system 12 comprises at least one micro controller unit 14 and one electronic control unit 16. According to the shown embodiment the electronic control unit 16 comprises at least one safe reset monitor device 18, and one boot control logic 20. Furthermore, the electronic control unit 16 in the shown embodiment comprises at least one voltage regulator 22 as well as one application processing module 24.

[0033] According to the shown embodiment a method for operating the electronic control unit 16 is provided. A power signal 26 of the voltage regulator 22 for the electronic control unit 16 is received by the safe reset monitor device 18. A reset signal 28 of the micro controller unit 14 outside the electronic control unit 16 is received by the boot control logic 20 and the reset signal 28 is also received by the safe reset monitor device 18. A number of received reset signals 28 is counted by the safe reset monitor device 18 and if the counted number exceeds a predetermined threshold 30 (Fig. 2) a failure signal 32 is generated by the safe reset monitor device 18 and the failure signal 32 is transmitted to the boot control logic 20.

[0034] In particular, the counter of the safe reset monitor device 18 is set to zero when receiving the power signal 26. Depending on the failure signal 32, an operation mode of the electronic control unit 16 may be adapted. Furthermore, the electronic control unit 16 provides an application processing module 24 for performing an operation, wherein after receiving the power signal 26 the application processing module 24 is booted.

[0035] In particular, Fig. 1 shows that, when the motor vehicle 10 is not operational, for example parked or turned off, the electronic control unit 16 within the motor vehicle 10 requires an external reset to start the operation. This process begins by providing a stable source of power to the electronic control unit 16 via the voltage regulators 22. The voltage regulators 22 can be internal or external to the electronic control unit 16 depending on the electronic control unit configuration. The voltage regulators, when ready to provide steady power to the electronic control unit 16, assert a PowerGood signal, in particular the power signal 26, indicating stable power supply to the electronic control unit 16. When the external micro controller unit 14 observes the PowerGood signal asserted, it provides a reset to the electronic control unit 16 triggering the boot process. The external micro controller unit 14 may be a non ASIL-D compliant component and introduce a possibility of malfunction. In such a scenario, the electronic control unit 16 can receive spurious reset resulting in function and safety failures.

[0036] According to the shown embodiment, the boot control logic 20 is an electronic control unit specific state machine responsible for performing the boot process. In a typically use case, the boot control logic 20 may receive the external reset signal 28 and initiate the boot process. On successful completion of boot process, the boot control logic 20 may hand-off the control to the electronic control unit application process module 24, for example an artificial intelligence inference engine, a particle diffusion application, or furthermore, and may be either power-gated or clock-gated to conserve power. A transient reset from the external micro controller unit 14 may restart the boot control logic 20 to force the electronic control unit 16 to go through an unexpected boot process again. This can be extremely dangerous when the motor vehicle 10 is in motion and compromise driver safety. The apparatus shown in Fig. 1 above presents a safety mechanism when faced with such transient resets.

[0037] Fig. 2 shows a schematic block diagram according to an embodiment of the safe reset monitor device 18.

[0038] In particular, the safe reset monitor device 18 comprises a counter reset logic 34, an up-counter 36 as well as a comparator 38. In particular, the comparator 38 comprises the threshold 30, which may also be provided as an upper limit. Furthermore, the safe reset monitor device 18 may obtain the power signal 26 as well as a system clock 40, which may be always on.

[0039] Therefore, the new component called the safe reset monitor device 18 is introduced within the electronic control unit 16. The safe reset monitor device 18 is a hardware component consisting of a counter reset logic 34, the up-counter 36, and the comparator 38, which is a control logic to prevent any transient reset to propagate the electronic control unit 16. The safe reset monitor device 18 and the micro controller unit 14 both monitor the PowerGood signal from the voltage regulator 22. The safe reset monitor device 18 uses the power signal 26 to reset its internal counter to zero. Every time the safe reset monitor device 18 counter observes a reset signal from the micro controller unit 14 it increments by one. The safe reset monitor device 18 control logic has a predetermined upper limit, in particular the threshold, for this counter based on architecture specification of the electronic control unit 16. When the counter reaches the upper limit, it may assert the failure signal 32 to the boot control logic 20 indicating the presence of an unexpected reset to the electronic control unit 16. The electronic control unit 16 can now take an architectural predefined action to degrade the safe and limited mode of operation. Reference Signs 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 motor vehicle system micro controller unit electronic control unit safe reset monitor device boot control logic voltage regulators application processing module power signal reset signal threshold failure signal counter reset logic up-counter comparator system clock

Claims

1. A method for operating an electronic control unit (16) of a motor vehicle (10), comprising the steps of:- receiving a power signal (26) of a voltage regulator (22) for the electronic control unit (16) by a safe reset monitor device (18) of the electronic control unit (16);- receiving a reset signal (28) of a micro controller unit (14) outside the electronic control unit (16) by a boot control logic (20) of the electronic control unit (16) and receiving the reset signal (28) by the safe reset monitor device (18);- counting a number of received reset signals (28) by the safe reset monitor device (18); and- if the counted number exceeds a predetermined threshold (30), generating a failure signal (32) by the safe reset monitor device (18) and transmitting the failure signal (32) to the boot control logic (20).

2. The method according to claim 1, characterized in thatthe counter of the safe reset monitor device (18) is set to zero when receiving the power signal (26).

3. The method according to claim 1 or 2, characterized in thatdepending on the failure signal (32) an operation mode of the electronic control unit (16) is adapted.

4. The method according to any one of claims 1 to 3, characterized in thatthe electronic control unit (16) provides an application processing module (24) for performing an operation, wherein after receiving the power signal (26) the application processing module (24) is booted.

5. A computer program product comprising program code means for performing a method according to any one of claims 1 to 4.

6. A non-transitory computer-readable storage medium comprising at least the computer program product according to claim 5.

7. An electronic control unit (16) for a motor vehicle (10), comprising at least one safe reset monitor device (18) and one boot control logic (20), wherein the electronic control unit (16) is configured for performing a method according to any one of claims 1 to 4.

8. A system (12) for a motor vehicle (10), comprising at least a micro controller unit (14) and an electronic control unit (16) according to claim 7.

9. A motor vehicle (10) comprising at least the system (12) according to claim 8.

Images