Control integrated circuits for computing units and computing units for automobiles

Abstract

A control integrated circuit (3) for the arithmetic unit (2) of an automobile (1) includes a watchdog unit (12) which is connectable to a first data processing device (4, 5, 18) to receive a first watchdog refresh signal and is connectable to a second data processing device (4, 5, 18) to receive a second watchdog refresh signal. The watchdog unit (12) is configured to determine, based on the watchdog refresh signal, whether a local failure exists in the first or second data processing device (4, 5, 18) and whether a global failure exists. The watchdog unit (12) is configured to activate safety measures for the first or second data processing device (4, 5, 18) in the case of each local failure and to activate a global safety measure in the case of a global failure.

Description

Technical Field

[0004]

[0001] The present invention relates to a control integrated circuit for an arithmetic unit of an automobile, and an arithmetic unit for an automobile including such a control integrated circuit.

Background Art

[0002] An arithmetic unit of an automobile, such as an electronic control unit (ECU), particularly a zone control unit (ZCU) or a domain control unit (DCU), may be equipped with one or more data processing devices such as a microcontroller, an Ethernet switch, and a low-power backup processor. From the perspective of faults or malfunctions, it is desirable to monitor each of these data processing devices and initiate appropriate safety measures if such are detected.

[0003] Providing individual monitoring systems for each data processing device can lead to unnecessary redundancy, which may increase costs, required space, and power consumption. Furthermore, individual monitoring systems may not be able to synchronize or monitor all related data processing devices as a whole.

[0004] An object of the present invention is to overcome at least partially the above-mentioned drawbacks.

[0005] This object is achieved by the respective subject matters of the independent claims. Further implementation forms and preferred embodiments are the subject matters of the dependent claims.

[0006] The present invention is based on the idea of providing a single control integrated circuit (IC) including a multi-channel watchdog unit for monitoring at least two data processing devices of an arithmetic unit for an automobile.

Summary of the Invention

[0007] According to an aspect of the present invention, a control IC for an automobile computing unit is provided. The control IC includes a multi-channel watchdog unit, which is connectable to or connected to a first data processing device of the computing unit and configured to receive a first watchdog refresh signal from the first data processing device. The multi-channel watchdog unit is connectable to or connected to a second data processing device of the computing unit and configured to receive a second watchdog refresh signal from the second data processing device. The multi-channel watchdog unit is configured to determine, based on the first watchdog refresh signal and the second watchdog refresh signal, whether a localized failure exists in the first data processing device, whether a localized failure exists in the second data processing device, and whether an overall failure affecting the first and second data processing devices exists. The multi-channel watchdog unit is configured to activate safety measures for the first data processing device if a localized failure occurs in the first data processing device, to activate safety measures for the second data processing device if a localized failure occurs in the second data processing device, and to activate global safety measures for both the first and second data processing devices if a global failure occurs.

[0008] An arithmetic unit can be understood, in particular, as a data processing device that includes processing circuits. Therefore, an arithmetic unit can, in particular, process data and perform arithmetic operations. This processing may include operations for performing index access on data structures, such as lookup tables (LUTs).

[0009] In particular, the arithmetic unit may include one or more computers, one or more microcontrollers, and / or one or more integrated circuits, such as one or more application-specific integrated circuits (ASICs), one or more field-programmable gate arrays (FPGAs), and / or one or more system-on-a-chip (SoCs). The arithmetic unit may also include one or more processors, such as one or more microprocessors, one or more central processing units (CPUs), one or more graphics processing units (GPUs), and / or one or more signal processors, in particular one or more digital signal processors (DSPs). The arithmetic unit may also include a physical or virtual cluster of computers, or other such units.

[0010] In various embodiments, the arithmetic unit includes one or more hardware and / or software interfaces, and / or one or more memory units.

[0011] The memory unit may be implemented as volatile data memory, such as dynamic random access memory (DRAM) or static random access memory (SRAM), or as non-volatile data memory, such as read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory or flash EEPROM, ferroelectric random access memory (FRAM), magnetoresistive random access memory (MRAM), or phase-change random access memory (PCRAM).

[0012] The data processing device may be, for example, a microcontroller unit or system-on-a-chip (SOC), an Ethernet switch, a processor, a hardware accelerator, or data processing peripherals.

[0013] The first data processing device may be external to the control IC or may be part of the control IC. In the latter case, the first data processing device is connected to the multi-channel watchdog unit; in the former case, the first data processing device is connected to or can be connected to the multi-channel watchdog unit via the corresponding terminal or pin of the control IC. The second data processing device may be external to the control IC or may be part of the control IC. In the latter case, the second data processing device is connected to the multi-channel watchdog unit; in the former case, the second data processing device is connected to or can be connected to the multi-channel watchdog unit via the corresponding terminal or pin of the control IC.

[0014] A multi-channel watchdog unit is so named because it receives at least a first watchdog refresh signal and a second watchdog refresh signal, and activates corresponding safety measures accordingly.

[0015] A multi-channel watchdog unit may be operated according to functions such as a timeout watchdog, a window watchdog, or a more complex implementation. A multi-channel watchdog unit is, in particular, a hardware unit and is also referred to as a hardware watchdog.

[0016] Safety measures for the first data processing device may include, for example, resetting, disconnecting, or restarting the first data processing device. Safety measures for the second data processing device may include, for example, resetting, disconnecting, or restarting the second data processing device. Overall safety measures may include, for example, resetting, disconnecting, or restarting both the first and second data processing devices.

[0017] However, depending on the actual implementation, these safety measures may also include further actions affecting additional components of the control IC or arithmetic unit, such as the transfer of responsibility or tasks, or the starting or stopping of specific components or backup systems.

[0018] In particular, local failures of the first and second data processing devices, respectively, may be due to failures or malfunctions related to the software of each data processing device.

[0019] To activate corresponding safety measures, the multi-channel watchdog unit can send one or more respective commands or signals to the control unit of the control IC, which can, for example, initiate or impose the respective safety measures in response to one or more respective commands or signals.

[0020] The control IC according to the present invention allows two or more data processing devices to be monitored simultaneously by a single IC. In particular, a multi-channel watchdog system makes it possible to provide watchdog functionality to a first data processing device and a second data processing device, which may be, for example, the main microcontroller of an arithmetic unit, an Ethernet switch, or a low-power processing core, and may be incorporated into the control IC in some implementations. The multi-channel watchdog unit may make it possible to synchronize watchdog functionality between the first and second data processing devices, and in some implementations, one or more further data processing devices. In the event of a localized failure, the multi-channel watchdog unit may individually activate an individual reset for each data processing device, and in the event of a global failure, it may activate a reset or another global safety measure for all data processing devices.

[0021] In some implementations of the control IC, the multi-channel watchdog unit is connectable to or connected to a third data processing device of the arithmetic unit. The third data processing device may be external to the control IC, or in some implementations, it may be integrated into the control IC.

[0022] The third data processing device may be external to the control IC or part of the control IC. In the latter case, the third data processing device is connected to the multi-channel watchdog unit; in the former case, the third data processing device is connected to or can be connected to the multi-channel watchdog unit via the corresponding terminal or pin of the control IC.

[0023] In some implementations, the multi-channel watchdog unit is configured to receive a third watchdog refresh signal from a third data processing device and, based on the first, second, and third watchdog refresh signals, determine whether a localized failure exists in the first data processing device, the second data processing device, the third data processing device, and whether an overall failure affecting the first, second, and third data processing devices exists. The multi-channel watchdog unit is configured to activate safety measures for the third data processing device if a localized failure exists in the third data processing device.

[0024] Furthermore, the overall safety measures may be for the first, second, and third data processing devices. The concepts described with respect to the third data processing device can similarly be extended to apply to three or more data processing devices in the computing unit.

[0025] In some implementations, the multi-channel watchdog unit is configured to determine the temporal reception sequence of a first watchdog refresh signal, a second watchdog refresh signal, and, in some implementations, a third watchdog refresh signal. Based on the temporal reception sequence, the multi-channel watchdog unit is configured to determine whether a local failure of the first data processing device, a local failure of the second data processing device, and / or a global failure exists. In some implementations, the watchdog unit is configured to determine whether a local failure of the third data processing device exists, based on the temporal reception sequence.

[0026] In particular, multi-channel watchdog signals can distinguish between overall failures and various localized failures depending on the temporal reception sequence. In this way, more differentiated safety measures can be activated.

[0027] In some implementations, the control IC includes a multi-channel safety monitoring unit. The multi-channel safety monitoring unit is connectable to or connected to the first data processing device to receive a first error signal from the first data processing device, and is connectable to or connected to the second data processing device to receive a second error signal from the second data processing device. The multi-channel safety monitoring unit is configured to determine, based on the first and second error signals, whether there is a further local failure in the first data processing device, whether there is a local failure in the second data processing device, and whether there is a further global failure affecting the first and second data processing devices. The multi-channel safety monitoring unit is configured to activate at least one further safety measure for the control IC and / or arithmetic unit in response to the presence of a further local failure in the first data processing device, a further local failure in the second data processing device, and a further global failure, respectively.

[0028] If the first data processing device is part of the control IC, the first data processing device is connected to the multi-channel safety monitoring unit; otherwise, the first data processing device is or can be connected to the multi-channel safety monitoring unit via the corresponding terminal or pin of the control IC. The same applies to the second data processing device.

[0029] For example, the first data processing device and the second data processing device can send an error signal to the multi-channel safety monitoring unit when a respective failure of each data processing device is detected. In other words, the error signal indicates the presence of the corresponding failure. Therefore, the multi-channel safety monitoring unit can monitor different types of failures compared to the multi-channel watchdog unit.

[0030] Further safety measures for the control IC and / or the arithmetic unit may include, for example, resetting, disconnecting or restarting each data processing device. Alternatively or additionally, further safety measures may include appropriately starting, stopping or resetting further components of the control IC and / or the arithmetic unit.

[0031] In this way, it can be achieved that more failures are monitored by a single control IC.

[0032] According to some embodiments, the arithmetic unit or the control IC includes a third data processing device, and instead of being connected to the first data processing device and the second data processing device, the multi-channel safety monitoring unit is or can be connected to the first data processing device and the third data processing device.

[0033] The corresponding descriptions above for the second data processing device are similarly carried over to the third data processing device. Furthermore, the concepts described for the first, second, or third data processing device can be similarly extended and applied to three or more data processing devices in the arithmetic unit.

[0034] In a further implementation, the multi-channel safety monitoring unit is connectable to or connected to a first data processing device, a second data processing device, and a third data processing device in order to receive error signals from each of the data processing devices. The multi-channel safety monitoring unit can, for example, further determine whether there is a further local failure in the third data processing device and, if so, activate at least one additional safety measure as appropriate.

[0035] If the third data processing device is part of a control IC, the third data processing device is connected to the multi-channel safety monitoring unit; otherwise, the third data processing device is connected to or can be connected to the multi-channel safety monitoring unit via the corresponding terminal or pin of the control IC.

[0036] To activate corresponding additional safety measures, the multi-channel safety monitoring unit can send one or more respective commands or signals to the control unit, which can, for example, initiate or impose each of the respective additional safety measures in response to one or more respective commands or signals.

[0037] In some implementations, the control IC includes a wake-up system. The wake-up system is connected to at least one wake-up terminal of the control IC and is configured to receive at least one wake-up signal at at least one wake-up terminal. The wake-up system is configured to wake up a first data processing device and / or a second data processing device, and / or a third data processing device, if applicable, in response to at least one wake-up signal.

[0038] At least one wake-up terminal may be connected to at least one wake-up source, which is located outside the control IC, for example, also outside the arithmetic unit, and corresponds to, for example, further components of an automobile. At least one wake-up source may provide at least one wake-up signal at at least one wake-up terminal.

[0039] In this way, wake-up commands from different wake-up sources, which may be directed to different data processing devices, can be managed by a single control IC.

[0040] In some implementations, at least one wake-up signal includes two or more wake-up signals, and the wake-up system is configured to identify each wake-up source based on each of the two or more wake-up signals. The wake-up system is configured to prioritize the two or more wake-up signals according to a predefined priority, in particular a predefined priority of the identified wake-up sources, and to activate the wake-up of a first data processing device and / or a second data processing device in accordance with the prioritized wake-up signals.

[0041] For example, a time sequence can be determined to wake up a first data processing device and / or a second data processing device, and / or further components of, for example, a control IC or arithmetic unit, in response to a prioritized wake-up signal.

[0042] The concepts described with respect to the first, second, or third data processing device can be similarly extended and applied to three or more data processing devices in the arithmetic unit.

[0043] In some implementations, the control IC includes a power management unit, which is connected to the power supply terminals of the control IC and is configured to control, in particular, supervise and / or monitor, the power supply to a first data processing device, a second data processing device, and, if applicable, a third data processing device.

[0044] In particular, the power management unit receives power from an external power supply unit at its power terminals and controls the power supply to the first and second data processing devices, and, if applicable, the third data processing device, based on the received power. As a result, the power management unit can ensure that each data processing device receives power at the appropriate voltage and current levels.

[0045] The control IC may include, for example, one or more power rails, and a power management unit may control the power supply to the first data processing device, the second data processing device, and, if applicable, the third data processing device via one or more power rails.

[0046] In some implementations, the power management unit monitors power failures in different data processing devices and, for example, activates their respective safety measures in the event of a power failure. In some implementations, the power management unit also monitors the temperature and / or voltage and / or current of each data processing device and responds accordingly.

[0047] The concepts described with respect to the first, second, or third data processing device can be similarly extended and applied to three or more data processing devices in the arithmetic unit.

[0048] In some implementations, the control IC includes a second data processing device as an internal processing device, or a third data processing device as an internal data processing device.

[0049] The internal data processing device may be, for example, a low-power processing core or a low-power microcontroller. The internal data processing device can be used, for example, to handle low-power functions and maintain the power output required for safety-critical power outputs. For example, in the event of a general or local failure, or further general or local failure, as described above, the internal data processing device can be started directly, for example, by a control unit, to start up as quickly as possible and address the necessary activities.

[0050] In some implementations, the control IC includes a control unit configured to activate an internal data processing device in response to the activation of at least one additional safety measure by a multi-channel safety monitoring unit.

[0051] In other words, at least one additional security measure consists of or includes activating an internal data processing device.

[0052] Alternatively or additionally, the control unit may be configured to activate the internal data processing devices in response to the activation of safety measures for a first data processing device by a multi-channel watchdog unit, and / or in response to the activation of safety measures for a second data processing device by a multi-channel watchdog unit, and / or in response to the activation of overall safety measures by a multi-channel watchdog unit.

[0053] In some implementations, the control IC includes a debug interface for debugging the internal data processing device. The debug interface is accessible from outside the control IC.

[0054] In particular, the debug unit may be connected to the internal data processing unit via a debug interface in order to perform debugging. The debug interface may be, for example, a so-called JTAG interface. In other words, the debug interface may be standardized according to the industry standard IEEE 1149.1, which is commonly referred to as JTAG.

[0055] According to some implementations, the internal data processing device includes at least one data interface connected to the data terminals of the control IC.

[0056] Data terminals may be connected to external devices to establish communication channels with internal data processing devices.

[0057] A further aspect of the present invention provides a computing unit for an automobile. The computing unit includes a control IC according to the present invention. Unless already included in the control IC, the computing unit further includes a first data processing device and a second data processing device.

[0058] In some implementations of the computing unit, the first data processing device is implemented as a microcontroller (also referred to as a microcontroller unit (MCU)).

[0059] In other implementations, the first data processing device is implemented as a system-on-a-chip or as an advanced computing unit, such as a graphics processing unit (GPU).

[0060] In some implementations, the second data processing device is implemented as an Ethernet switch.

[0061] According to several implementations of the arithmetic unit, the arithmetic unit is implemented as a microcontroller and includes a first data processing device located outside the control IC, and a second data processing device implemented as an Ethernet switch and located outside the control IC, while the control IC includes a third data processing device as an internal data processing device.

[0062] In some implementations, the arithmetic unit is implemented as an electronic control unit (ECU), a zone control unit (ZCU), or a domain control unit (DCU).

[0063] Where the present disclosure refers to a control IC or arithmetic unit component being adapted, configured, or designed to perform or realize a particular function, achieve a particular effect, or serve a particular purpose, this can be understood as meaning that the component is useful or suitable in principle or theoretically for this function, effect, or purpose, but is concretely and practically possible to perform or realize the function, achieve the effect, or serve the purpose through the corresponding adaptation, programming, physical design, etc.

[0064] Further features of the present invention are evident from the claims, the figures, and the description of the figures. The features and combinations of features described herein, as well as the features and combinations of features described later in the description of the figures, may be included in the present invention not only in the individual combinations specified but also in other combinations. In particular, embodiments and combinations of features that do not include all of the features of the originally conceived claims may also be included in the present invention. Furthermore, embodiments and combinations of features that exceed or deviate from the range of combinations of features described in the enumeration of claims may also be included in the present invention.

[0065] The present invention will be described in detail below with reference to specific exemplary implementations and their respective schematic diagrams. In the drawings, identical or functionally identical elements may be denoted by the same reference numeral. Descriptions of identical or functionally identical elements are not necessarily repeated with respect to different figures. [Brief explanation of the drawing]

[0066] In the diagram, [Figure 1] Figure 1 schematically shows an automobile with an exemplary implementation of the arithmetic unit according to the present invention; [Figure 2] Figure 2 shows a schematic block diagram of an exemplary implementation of the control IC according to the present invention.

[0067] Figure 1 schematically shows an automobile 1 with an exemplary implementation of the arithmetic unit 2 according to the present invention.

[0068] The computing system 2 may be implemented as, for example, a ZCU, and may be adapted to control, for example, one or more sensors 7 and / or further components 6 of the automobile 1.

[0069] The arithmetic system 2 includes an exemplary implementation of the control IC 3 according to the present invention. The arithmetic system 2 includes a first data processing device 4 (e.g., a main microcontroller) and a second data processing device 5 (e.g., an Ethernet switch). The first data processing device 4 and / or the control IC 3 can output, for example, data and / or control signals via an output module 8 of the arithmetic unit 2, which includes one or more switching devices such as MOSFETs, particularly so-called smart MOSFETs.

[0070] The control IC 3 may include, for example, a data terminal, which is connected to one or more network transceivers 9 of the arithmetic unit 2, such as CAN transceivers, LIN transceivers, and / or Ethernet transceivers, to receive data from one or more communication systems of the vehicle 1, such as a communication bus. The control IC 3 may also include, for example, a wake-up terminal, which is connected to one or more wake-up switches 10 of the arithmetic unit 2 to receive wake-up signals from one or more wake-up sources of the vehicle 1. The control IC 3 may also include, for example, a power supply terminal, which is connected to a battery line filter 11 of the arithmetic unit 2 to receive power from a power source of the vehicle 1.

[0071] The control IC 3 includes a multi-channel watchdog unit 12 (see Figure 2), which is connected to the first data processing device 4 to receive a first watchdog refresh signal from the first data processing device 4. The multi-channel watchdog unit 12 is connected to the second data processing device 5 to receive a second watchdog refresh signal from the second data processing device 5. The multi-channel watchdog unit 12 is configured to determine, based on the first and second watchdog refresh signals, whether a localized failure exists in the first data processing device 4, whether a localized failure exists in the second data processing device 5, and whether an overall failure exists affecting both the first and second data processing devices 4 and 5. The multi-channel watchdog unit 12 is configured to activate safety measures for the first data processing device 4 if a localized failure occurs in the first data processing device 4, to activate safety measures for the second data processing device 5 if a localized failure occurs in the second data processing device 5, and to activate global safety measures for both the first data processing device 4 and the second data processing device 5 if a global failure occurs.

[0072] Figure 2 schematically shows a block diagram of a further exemplary implementation of the arithmetic unit 2 according to the present invention, based on the arithmetic unit 2 of Figure 1.

[0073] In this implementation, the control IC 3 can be used as an extended power management IC with capabilities that can overcome some of the limitations of the prior art. For example, the control IC 3 can support power management and power supply for at least the first data processing device 4 and the second data processing device 5. For example, the control IC 3 can provide watchdog support and safety status monitoring for at least the first data processing device 4 and the second data processing device 5. For example, the control IC 3 can provide battery failure monitoring or power failure monitoring. For example, the control IC 3 can monitor different wake-up sources, prioritize them, and provide information about the wake-up sources. For example, the control IC 3 can power an external network transceiver 9 to enable monitoring of an independent wake-up source. The control IC 3 can function as the main power supply system for the complete computing unit 2, and / or can handle wake-up management, fault monitoring, and / or safety monitoring.

[0074] The control IC3 may include an integrated third data processing device 18, which may be, for example, a high-speed limp home wake-up function and a low-power limp home system capable of responding to processing.

[0075] The control IC 3 may include a power management unit 15 that can function as the main power distribution source within the control IC 3. The power management unit 15 can supply power to the power rails 16a and 16b of the control IC 3 and distribute power to further interfaces. The power management unit 15 can monitor the power consumption of each, and monitor temperature, voltage, and current to detect excessively high temperature, voltage, and / or current conditions in particular the first data processing device 4 and / or the second data processing device 5 and / or the third data processing device 18.

[0076] For example, the control unit 17 of the control IC3 may be connected to the first data processing device 4 and may be configured via a serial peripheral interface (SPI) to configure each of the functions of the control IC3, such as the power management unit 15 of the control IC3, the multi-channel watchdog unit 12, the wake-up system 14, the third data processing device 18, and / or the multi-channel safety monitoring unit 13 of the control IC3.

[0077] The wake-up system 14 can accept wake-up signals from different sources, prioritize them, and store information about the wake-up sources. The wake-up system 14 can, for example, wake up the first data processing device 4 and / or the second data processing device 5 and / or the third data processing device 18.

[0078] The multi-channel watchdog unit 12 makes it possible to provide watchdog functionality to several devices, including the first data processing device 4 and / or the second data processing device 5 and / or the third data processing device 18. The multi-channel watchdog unit 12 can synchronize watchdog functionality between different devices, and in the event of a local failure, it can individually activate reset signals to any of the data processing devices 4, 5, and 18, or in the event of a global failure, it can collectively activate the reset of all data processing devices 4, 5, and 18.

[0079] The multi-channel safety monitoring unit 13 can monitor the safety signals or error signals for several devices, including the first data processing device 4 and / or the second data processing device 5 and / or the third data processing device 18. The multi-channel safety monitoring unit 13 can synchronize safety monitoring functions between different devices, and in the event of a local failure, it can activate a safety condition individually for any of the data processing devices 4, 5, and 18, and / or in the event of a global failure, it can activate the safety conditions of all data processing devices 4, 5, and 18 together.

[0080] The third data processing device 18 may be a low-power core device, such as a low-power microcontroller. The third data processing device 18 may include an analog-to-digital converter (ADC) 22, a DIN interface 21, an output interface 27, a timer 24, a LIN transceiver 23, a CAN transceiver 20, a random access memory (RAM) 26, and / or a read-only memory (ROM) 25. The control IC 3 may include, for example, one or more ports 19 connected to the DIN interface 21, the ADC 22, the timer 24, and / or the output interface 27.

[0081] The control IC 3 may include a debug interface 28, such as a JTAG interface, which can be used to program a third data processing device 18 containing firmware (specific firmware that can be run for, for example, fast boot scenarios and / or limp-home scenarios). For example, the third data processing device 18 can monitor the CAN transceiver 20 and the LIN transceiver 23. In the event of a global or localized failure, the third data processing device 18 can be started directly by, for example, the control unit 17, to start up as quickly as possible by addressing the necessary limp-home activities.

[0082] The control IC 3 is powered, for example, directly from the KL30 line. The control IC 3 may power the data processing devices 4, 5, and 18 based on their individual configurations, or put them into low-power mode. The control IC 3 can also power the network transceivers 9 and monitor their wake-up sources.

[0083] Control IC3 eliminates the need for several additional components, such as individual power management ICs, which would otherwise need to be configured individually by their own watchdog and safety monitoring mechanisms. Control IC3 can synchronize the overall watchdog concept with the overall safety concept.

Claims

1. A control integrated circuit (3) for the computing unit (2) of an automobile (1), wherein the control integrated circuit (3) includes a multi-channel watchdog unit (12), and this multi-channel watchdog unit (12) is - Connectable to the first data processing devices (4, 5, 18) of the arithmetic unit (2) to receive a first watchdog refresh signal from the first data processing devices (4, 5, 18), and connectable to the second data processing devices (4, 5, 18) of the arithmetic unit (2) to receive a second watchdog refresh signal from the second data processing devices (4, 5, 18); - Based on the first watchdog refresh signal and the second watchdog refresh signal, the system is configured to determine whether a localized failure exists in the first data processing device (4, 5, 18), whether a localized failure exists in the second data processing device (4, 5, 18), and whether a general failure exists affecting both the first data processing device (4, 5, 18) and the second data processing device (4, 5, 18); - The system is configured to activate safety measures for the first data processing device (4, 5, 18) if a localized failure of the first data processing device (4, 5, 18) occurs, to activate safety measures for the second data processing device (4, 5, 18) if a localized failure of the second data processing device (4, 5, 18) occurs, and to activate overall safety measures for the first data processing device (4, 5, 18) and the second data processing device (4, 5, 18) if a global failure occurs, and includes a wake-up system (14), the wake-up system (14) is configured to activate safety measures for the first data processing device (4, 5, 18) if a localized failure of the first data processing device (4, 5, 18) occurs, to activate safety measures for the second data processing device (4, 5, 18) if a global failure occurs, and includes a wake-up system (14), the wake-up system (14) is configured to activate overall - Connected to at least one wake-up terminal of the control integrated circuit (3), and configured to receive at least one wake-up signal at the at least one wake-up terminal; - A control integrated circuit (3) configured to wake up the first data processing device (4, 5, 18) and / or the second data processing device (4, 5, 18) in response to at least one wake-up signal.

2. The control integrated circuit (3) according to claim 1, wherein the multi-channel watchdog unit (12) is configured to determine the temporal reception sequence of the first watchdog refresh signal and the second watchdog refresh signal, and to determine, according to the temporal reception sequence, whether or not there is a local failure in the first data processing device (4, 5, 18), a local failure in the second data processing device (4, 5, 18), and / or a global failure.

3. A control integrated circuit (3) according to any one of claims 1 to 2, comprising a multi-channel safety monitoring unit (13), wherein the multi-channel safety monitoring unit (13) - Connectable to the first data processing device (4, 5, 18) in order to receive a first error signal from the first data processing device (4, 5, 18), and connectable to the second data processing device (4, 5, 18) in order to receive a second error signal from the second data processing device (4, 5, 18); - Based on the first and second error signals, the system is configured to determine whether there are further local failures in the first data processing device (4, 5, 18), whether there are further local failures in the second data processing device (4, 5, 18), and whether there are further global failures affecting both the first and second data processing devices (4, 5, 18); - A control integrated circuit (3) configured to activate at least one additional safety measure for the control integrated circuit (3) and / or the arithmetic unit (2) in response to the presence of the further local failure of the first data processing device (4, 5, 18), the further local failure of the second data processing device (4, 5, 18), and the further global failure, respectively.

4. The at least one wake-up signal includes two or more wake-up signals, and the wake-up system (14) - Based on each of the two or more wake-up signals, identify the respective wake-up source; - Prioritize the wake-up signals according to the predefined priority order of the identified wake-up sources; - The control integrated circuit (3) according to claim 1, configured to activate the wake-up of the first data processing device (4, 5, 18) and / or the second data processing device (4, 5, 18) in response to the prioritized wake-up signals.

5. The control integrated circuit (3) according to any one of claims 1 to 4, comprising a power management unit (15) connected to the power supply terminal of the control integrated circuit (3) and configured to control the power supply to the first data processing device (4, 5, 18) and the second data processing device (4, 5, 18).

6. The control integrated circuit (3) according to any one of claims 1 to 5, wherein the control integrated circuit (3) includes the second data processing device (4, 5, 18) as an internal data processing device (18), or includes the third data processing device (4, 5, 18) as an internal data processing device (18).

7. The control integrated circuit (3) according to claim 6, comprising a control unit (17) configured to activate the internal data processing device (18) in response to the activation of the safety measures of the first data processing device (4, 5, 18) by the multi-channel watchdog unit (12), and / or in response to the activation of the overall safety measures by the multi-channel watchdog unit (12).

8. The control integrated circuit (3) according to claims 6 and 3, comprising a control unit (17) configured to activate the internal data processing device (18) in response to the activation of the at least one further safety measure by the multi-channel safety monitoring unit (13).

9. The control integrated circuit (3) according to any one of claims 6 to 8, comprising a debug interface (28) for debugging the internal data processing device (18), the debug interface (28) being accessible from outside the control integrated circuit (3).

10. The control integrated circuit (3) according to any one of claims 6 to 9, wherein the internal data processing device (18) includes at least one data interface (20, 23) connected to the data terminal of the control integrated circuit (3).

11. A computing unit (2) for an automobile (1), comprising a control integrated circuit (3) according to any one of claims 1 to 10, the first data processing device (4, 5, 18), and the second data processing device (4, 5, 18).

12. - The first data processing device (4, 5, 18) is implemented as a microcontroller, a system-on-a-chip, or a graphics processing unit; and / or - The arithmetic unit (2) according to claim 11, wherein the second data processing device (4, 5, 18) is implemented as an Ethernet switch.

13. The arithmetic unit (2) according to any one of claims 11 to 12, wherein the arithmetic unit (2) is implemented as an electronic control unit, a zone control unit, or a domain control unit.

Images