Decision unit for faulty motion sensors

Abstract

This application describes a monitoring and decision hardware unit compatible with redundancy-based sensor architectures targeted at fault-operated sensor designs. The invention disclosed herein describes a monitoring and decision unit based on a "decision block" that can be embedded in a redundant sensor architecture and allows monitoring of each isolated subsystem. Furthermore, each isolated subsystem can provide all the required information of the sensor and indicate the operational status of each independent subsystem. This unit is developed to be incorporated into fault-operated sensor designs that include monitoring and circuitry independence and facilitates data sharing via galvanically isolated communication.

Description

[Technical field]

[0001] This application describes a monitoring and decision hardware unit compatible with a redundancy-based sensor architecture targeted at fault-behavior sensor designs. [Background technology]

[0002] The current advancements and evolution in the automotive industry leading to the development of electric and hybrid electric vehicles (EVs and HEVs) will drive the development of autonomous driving systems and drive-by-wire applications.

[0003] This trend is driving a stringent set of requirements in terms of signal availability and safety levels in the field of automotive sensors. The typical "fail-safe" sensor behavior, which goes into a "safe state" in case of a failure (usually ceasing operation), becomes an inefficient solution when implemented in these applications. Summary of the Invention [Problem to be solved by the invention]

[0004] The present invention describes a monitoring and decision unit comprising two independent subsystems, subsystem A and subsystem B, and two galvanic isolators installed between the two independent subsystems, wherein the two independent subsystems are configured to receive input signals from an external source via two sensing elements and provide sensor information and status based on the input signals.

[0005] In the proposed embodiment of the present invention, each of the two independent subsystems comprises a watchdog timer, a microcontroller, a logic gate, and a transceiver. In yet another proposed embodiment of the present invention, each of the two independent subsystems is configured to share data via a communication channel and a separate feedback channel.

[0006] In yet another proposed embodiment of the present invention, the data shared over the communication channel and the separated feedback channel are adapted and protected by galvanic isolators, and the sensor information and status are detected by each of the two independent subsystems.

[0007] In yet another proposed embodiment of the present invention, the monitoring and decision unit comprises a latch circuit for each of the two independent subsystems. In yet another proposed embodiment of the present invention, the sensor information and status comprises a normal status and a fault operating status.

[0008] In yet another proposed embodiment of the present invention, a watchdog timer is configured to monitor the microcontroller for fault handling. In yet another proposed embodiment of the present invention, the microcontroller is configured to acquire data from the sensing element and change the sensor information and status to a faulty operating status, leaving only one of the independent subsystems and latch circuits active and maintaining the faulty operating status until the next reboot of the unit.

[0009] In yet another proposed embodiment of the present invention, the microcontroller comprises a microcontroller enable, an enable pin, and a watchdog input pin output signal. In yet another proposed embodiment of the present invention, the microcontroller is configured to run an initialization routine that performs a sanity check before the microcontroller enable outputs sensor information and status and a watchdog timer via the enable pin.

[0010] In yet another proposed embodiment of the present invention, the microcontroller is configured to periodically acquire and process the signal from the sensing element and in case of a watchdog timer time-out event indicating a fault in data processing, triggers a reset event which is detected by the remaining independent subsystems via the galvanic isolator.

[0011] In yet another proposed embodiment of the present invention, the watchdog timer is adapted to monitor the microcontroller via a refresh frame on the watchdog input pin while providing a valid watchdog output signal to the reset line and the logic gate.

[0012] In yet another proposed embodiment of the invention, the logic gate output depends on its input signal and is adapted to control the transceiver's "standby" signal and, consequently, the state of the separated feedback channel. [Means for solving the problem]

[0013] This application describes a monitoring and decision hardware unit designed to target faulty motion sensors. The developed unit comprises two independent galvanically isolated subsystems capable of measuring external sources via two sensing elements adapted to provide system operation status, for fault detection, based on data processing conditions and other mechanisms.

[0014] Now, this next generation application requires sensors to maintain the required functionality even in the event of a fault, leading to a new standard for fault-operated sensors. The invention disclosed herein describes a monitoring and decision unit based on a "decision block" that can be embedded in a redundant sensor architecture and allows monitoring of each isolated subsystem. Furthermore, each isolated subsystem can provide information about its individual operation and functional status to other independent subsystems. This unit has been developed to be incorporated into fault operation sensor designs that include monitoring and circuitry independence, and facilitates data sharing via galvanically isolated communication.

[0015] One of the strategies to realize a fault-safe solution is based on increasing the redundancy of the system, where independent sources must provide equal information. In addition, fault monitors are required to evaluate the reliability of each independent source. Sensors must maintain their full functionality even in the event of a fault.

[0016] The proposed decision unit allows each independent measurement or sensing source to assess its own data integrity, preventing the flow of invalid information and providing an indication to other independent subsystems of its operational status.

[0017] Based on that information, the remaining active independent subsystems can reconfigure themselves to ensure expected signal availability and safety levels and provide indications to the higher level system regarding the status of their "fault operation" modes.

[0018] One of the main advantages of this galvanically isolated architecture is the prevention of failures due to common causes related to power supply failures, such as under-voltage, over-voltage, short circuits, etc. In addition, the unit allows the extension of sensor redundancy to an external independent power supply unit and / or an independent communication bus.

[0019] The developed unit has a simple hardware deployment design compared to other existing solutions with complex redundant architectures that use multiple microcontrollers in voting systems.

[0020] For a better understanding of the present application, drawings illustrating preferred embodiments are attached hereto, which are not intended to limit the techniques disclosed herein. [Brief description of the drawings]

[0021] [Figure 1] 1 illustrates the operational concept of a monitoring system based on two similar subsystems, Subsystem A (11) and Subsystem B (12). In the illustrated example, both Subsystem A (11) and Subsystem B (12) exhibit correct operational status. [Diagram 2] 2 illustrates the operational concept of a monitoring system based on two similar subsystems, Subsystem A (11) and Subsystem B (12). In the example shown, Subsystem A (11) represents a fault status and Subsystem B (12) represents an operational status that receives a "feedback" of this fault indication. [Diagram 3] 3 illustrates the operational concept of a monitoring system based on two similar subsystems, Subsystem A (11) and Subsystem B (12). In the example shown, Subsystem A (11) represents a faulty status and Subsystem B (12) represents an operational status, but is flagged as a faulty operational warning. [Figure 4] FIG. 4 shows a diagram of the proposed monitoring and decision unit. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] Some embodiments will now be described in more detail with reference to the drawings, which are not intended to limit the scope of the present application. The monitoring system (1) shown in Figures 1, 2 and 3 comprises two subsystems, Subsystem A (11) and Subsystem B (12). Each subsystem (11, 12) of the monitoring and decision unit (1) is responsible for ensuring the monitoring of its own components, detecting its own faults, communicating its own operating status and listening to the status of other branches.

[0023] As shown in Figure 2, the faulty subsystem A (11) is responsible for blocking the output interface to prevent erroneous information flow from its own side. The remaining working subsystem B (12) is able to recognize the fault status of subsystem A (11) and changes its operation status to the fault operation (FO) mode. This allows subsystem B (12) to reconfigure itself to ensure full system functionality to provide the necessary information to the upper system, but flag the information of the faulty degraded status as discussed in Figure 3.

[0024] Based on this behavior, the monitoring and decision unit (1) comprises two subsystems, Subsystem A (11) and Subsystem B (12), relying on the analysis of Fig. 4. Each of the subsystems (11, 12) receives external input data / signals from an external source (2) via sensing elements, in particular, Subsystem A (11) receives input data via Sensing Element A (21) and Subsystem B (12) receives input data via Sensing Element B (22). Both of these sensing elements (21, 22) are responsible for interpreting the signal changes from the external source (2), which may include magnetic changes, optical changes, inductive changes, etc.

[0025] Subsystem A (11) comprises a watchdog timer A (111), a microcontroller A (112), a logic gate A (113), and a transceiver A (115). In addition, subsystem A (11) may include a latch circuit A (114) between logic gate A (113) and transceiver A (115). Microcontroller A (112) is adapted to read / acquire data input from sensing element A (21) and provide output signals and commands to microcontroller B (122) via communication channel A (1121), to watchdog timer A (111) via enable A (1122) and watchdog input A (1123), and to logic gate A (113) via microcontroller enable A (1125). Watchdog timer A (111) is then adapted to provide output signals and commands to microcontroller A (112) via RST_A (1126) and to logic gate A (113) via watchdog output A (1124). Logic gate A (113) then provides a logical result, transceiver "standby" signal A (1141), depending on both input signals, watchdog output A (1124) and microcontroller enable A (1125). Transceiver "standby" signal A (1141) is responsible for activating transceiver A (115) to provide sensor information and status (31) of subsystem A (11) and also provide isolated feedback A (1142) to microcontroller B (122) of subsystem B (12).

[0026] In a mirrored manner, subsystem B (12) comprises watchdog B (121), microcontroller B (122), logic gate B (123), and transceiver B (125). In addition, subsystem B (12) may include a latch circuit B (124) between logic gate B (123) and transceiver B (125). Microcontroller B (122) is adapted to read / acquire data input from sensing element B (22) and provide output signals and commands to microcontroller A (112) via communication channel B (1221), to watchdog timer B (121) via enable B (1222) and watchdog input B (1223), and to logic gate B (123) via microcontroller enable B (1225). Watchdog timer B (121) is then adapted to provide output signals and commands to microcontroller B (122) via RST_B (1226) and to logic gate B (123) via watchdog output B (1224). Logic gate B (123) then provides a logical result, transceiver "standby" signal B (1241), depending on both input signals, watchdog output B (1224) and microcontroller enable B (1225). Transceiver "standby" signal B (1241) is responsible for activating transceiver B (125) to provide sensor information and status (32) of subsystem B (12) and also provide isolated feedback B (1242) to microcontroller A (112) of subsystem A (11).

[0027] The unit (1) also comprises a pair of galvanic isolators (23, 24) which allow communication whilst maintaining electrical isolation between both mirrored subsystems A and B (11, 12).

[0028] Both microcontrollers A and B (112, 122) implement safety monitors and functions for fault detection that reflect their state in digital signals, Microcontroller Enable (1125, 1225), which comprise information related to system (1) initialization, sensing element (21, 22) acquisition status, data processing availability, and internal safety functions.

[0029] Each watchdog timer (111, 121) monitors its associated microcontroller (112, 122) expecting to receive a refresh frame via its input pin WDI (1123, 1223) while maintaining a valid watchdog output (1124, 1224). The microcontroller (112, 122) may have an internal watchdog timer, but a separate component (111, 121) is required to prevent failures during data processing of the microcontroller. Logic gates (113, 123) combine both the microcontroller enable (1125, 1225) and watchdog output (1124, 1224) signals and control the enable status of the transceiver (115, 125) via a "standby" signal (1141, 1241) that interfaces the higher level system with the subsystem information flow as well as sensor information and status (31, 32).

[0030] The microcontroller (112, 122) enables the watchdog timer (111, 121) during the initialization phase. Once enabled, it needs to refresh the WDI (1123, 1223) to maintain a valid status on the WDO (1124, 1224) line and prevent a timeout event. A watchdog (111, 121) timeout condition is indicated when the WDO (1124, 1224) signal is asserted, which means that the microcontroller (112, 122) is no longer operational. However, after a valid initialization and assuming normal operation, the microcontroller (112, 122) performs periodic operations of reading / acquiring data from the sensing elements (21, 22) and processing and transmitting the data.

[0031] Thus, the transceivers (115, 125) and the flow of messages provided to the data bus are only enabled if both the input variables provided by the WDO (1124, 1224) and the microcontroller enable (1125, 1225) signals indicate the correct functional status. Otherwise, the invalid combination will deactivate the transceiver "standby" signal (1141, 1241) and prevent data transmission. The correlation of the status of the decision unit (1) based on these input variables and the operating mode is shown in Table 1.

[0032] [Table 1]

[0033] As shown, the faulty operating mode is asserted by the subsystems (11, 12) whenever there is a malfunction indication provided by the microcontroller (112, 122) or the watchdog (111, 121).

[0034] Furthermore, using a galvanic isolator (23), e.g. an optocoupler, a capacitive or inductive digital isolator, an isolated feedback channel (1142, 1242) is used, whose operating status is detected by another independent subsystem, so that this last system continues to operate and maintains the functionality of the system (1) and then provides a fault event indication to the higher-level system.

[0035] In the proposed monitoring and decision unit (1), two possible embodiments / configurations should be considered: latched and unlatched decisions. In a latched decision configuration, the latch circuit blocks (114, 124) are reset (1143, 1243) to a valid state at system startup. This can be done by the microcontroller (112, 122) after a valid initialization routine has been executed, or via a hardware delay circuit during power-up of the system (1). If the microcontroller (112, 122) detects a fault or if the watchdog timer (111, 121) times out, the system (1) goes into a faulty operating mode, resulting in only one of the independent circuit configurations / subsystems (11 or 12) being active. The latch circuits (114, 124) maintain this faulty status, and the faulty subsystem (11 or 12) remains disconnected until the next power cycle or reboot of the system (1). If found valid after initialization, the faulty subsystem (11 or 12) can only operate again after a new power reboot.

[0036] In the unlatched decision configuration, when the system (1) is turned on, the microcontroller (112, 122) initialization routine must perform a sanity check before the microcontroller enable (1125, 1225) indicates a valid status and enables the watchdog timer (111, 121) via the enable pin (1122, 1222). If a fault event occurs and causes the watchdog timer (111, 121) to time out, the system (1) will enter a faulty operating mode, resulting in only one of the independent circuitry / subsystems (11 or 12) being active. The watchdog (111, 121) can then perform the sanity check routine again after resetting the microcontroller (112, 122). The other independent subsystem (11 or 12) can detect this reset event via the isolator (23) and therefore reconfigure to maintain full functionality of the system (1), until it receives a normal recovery indication from the previously faulty subsystem (11 or 12). Provides an indication of a "failure operating mode" condition.

[0037] In addition to this sensor information and status (31, 32), additional communication channels (1121, 1221), also based on the galvanic isolation principle, are added for "keep alive" indication, data exchange and synchronization between the subsystems (11, 12). [Explanation of symbols]

[0038] 1. Monitoring and Decision Unit 2. External Sources 11 Side A / Subsystem A 12 Side B / Subsystem B 21 Sensing element A 22 Sensing element B 23 Galvanic isolators for "standby" state 24 Galvanic Isolators for Microcontroller "Keep Alive" 31 Upper system interface / sensor information and status 32 Upper system interface / sensor information and status 111 Watchdog timer A (WD_A) 112 uC A / Microcontroller A 113 Logic Gate ANDA 114 Latch circuit A 115 Transceiver A 121 Watchdog Timer B (WD_B) 122 uCB / Microcontroller B 123 Logic Gate ANDB 124 Latch circuit B 125 Transceiver B 1121 Keep-alive / Communication Channel A 1122 Activation A (EN_A) 1123 Watchdog Input A (WDI_A) 1124 Watchdog Output A (WDO_A) 1125 Microcontroller Enable A 1126 Reset A (RST_A) 1141 Transceiver "Standby" Signal A 1142 Separated Feedback Channel A 1143 Latch circuit A reset 1221 Keep-alive / Communication Channel B 1222 Activation B (EN_B) 1223 Watchdog Input B (WDI_B) 1224 Watchdog Output B (WDO_B) 1225 Microcontroller Enable B 1226 Reset B (RST_B) 1241 Transceiver "Standby" Signal B 1242 Separated Feedback Channel B 1243 Latch circuit B reset

Claims

1. Two independent subsystems (11, 12), a subsystem A (11) and a subsystem B (12), a monitoring and decision unit (1) comprising two galvanic isolators (23, 24) installed between the two independent subsystems (11, 12), The two independent subsystems (11, 12) are configured to receive input signals from an external source (2) via two sensing elements (21, 22) and provide sensor information and status (31, 32) based on the input signals. A monitoring and decision unit (1).

2. 2. The monitoring and decision unit (1) of claim 1, wherein each of the two independent subsystems (11, 12) comprises a watchdog timer (111, 121), a microcontroller (112, 122), a logic gate (113, 123), and a transceiver (115, 125).

3. The monitoring and decision unit (1) of claim 1 or 2, wherein each of the two independent subsystems (11, 12) is configured to share data via a communication channel (1121, 1221) and a separate feedback channel (1142, 1242).

4. The monitoring and decision unit (1) of any one of claims 1 to 3, wherein the data shared via the communication channel (1121, 1221) and the separated feedback channel (1142, 1242) are adapted and protected by galvanic isolators (23, 24), and the sensor information and status (31, 32) are detected by each of the two independent subsystems (11, 12).

5. A monitoring and decision unit (1) according to any one of claims 1 to 4, comprising a latch circuit (114, 124) for each of said two independent subsystems (11, 12).

6. The monitoring and decision unit (1) according to any one of claims 1 to 5, wherein said sensor information and status (31, 32) comprises a normal status and a faulty operating status.

7. The monitoring and decision unit (1) according to any one of claims 1 to 6, wherein the watchdog timer (111, 121) is configured to monitor the microcontroller (112, 122) for fault handling.

8. The monitoring and decision unit (1) of any one of claims 1 to 7, wherein the microcontroller (112, 122) is configured to acquire data from the sensing elements (21, 22) and change the sensor information and status (31, 32) to a faulty operation status, and keep only one of the independent subsystems (11, 12) and the latch circuit (114, 124) active and maintain the faulty operation status until the next restart of the monitoring and decision unit (1).

9. The monitoring and decision unit (1) according to any one of the preceding claims, wherein the microcontroller (112, 122) comprises a microcontroller enable (1125, 1225), an enable pin (1122, 1222) and a watchdog input pin (1123, 1223) output signal.

10. The monitoring and decision unit (1) of any one of claims 1 to 9, wherein the microcontroller (112, 122) is configured to execute an initialization routine that performs a health check before the microcontroller enable (1125, 1225) outputs the sensor information and status (31, 32) via the enable pin (1122, 1222) and enables the watchdog timer (111, 121).

11. The monitoring and decision unit (1) according to any one of claims 1 to 10, wherein the microcontroller (112, 122) is configured to periodically acquire and process signals from the sensing elements (21, 22) and, in case of a time-out event of the watchdog timer (111, 121), indicating a fault in data processing, triggers a reset event which is detected by the remaining independent subsystems (11, 12) via the galvanic isolators (23, 24).

12. The monitoring and decision unit (1) of any one of claims 1 to 11, wherein the watchdog timer (111, 121) is adapted to monitor the microcontroller (112, 122) via refresh frames on the watchdog input pin (1123, 1223) while providing a valid watchdog output signal (1124, 1224) to a reset line (1126, 1226) and to the logic gate (113, 123).

13. The monitoring and decision unit (1) of any one of claims 1 to 12, wherein the logic gates (113, 123) are adapted to control the state of a "standby" signal (1141, 1241) of the transceivers (115, 125) and, consequently, of the separated feedback channel (1142, 1242).

Images