Method for operating a control unit

• US 10,384,689 B2
• Filed: 06/08/2017
• Issued: 08/20/2019
• Est. Priority Date: 06/20/2016
• Status: Active Grant

• Current Assignee: Robert Bosch GmbH
• Original Assignee: Robert Bosch GmbH
• Inventors: Topp, Jaroslaw, Thoss, Dieter, Mueller, Margit, Hartgen, Thomas
• Primary Examiner(s): Bonzo, Bryce P
• Assistant Examiner(s): Arcos, Jeison C
• Application Number:
  US15/617,610
• Publication Number:
  US 20170361852A1
• Time in Patent Office: 803 Days
• CPC Class Codes: B60W 2050/0006 Digital architecture hierarchy
• CPC Class Codes: B60W 2050/021 Means for detecting failure or malfunction
• CPC Class Codes: B60W 2050/041 Built in Test Equipment [BITE]
• CPC Class Codes: B60W 50/0205 Diagnosing or detecting failures; Failure detection models
• CPC Class Codes: B60W 50/04 Monitoring the functioning of the control system
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/2242 in multi-processor systems, e.g. one processor becoming the test master G06F11/2736 takes precedence
• CPC Class Codes: G06F 11/26 Functional testing
• CPC Class Codes: G06F 11/27 Built-in tests

Abstract

A method for operating a control unit of a motor vehicle. A status inquiry is transmitted by a watchdog unit to a first monitoring unit, which is implemented on a first processor core of a multicore processor. A status response is ascertained by the first monitoring unit as a function of the status inquiry. A fault is ascertained by the watchdog unit as a function of the status response.

Claims

1. A method for operating a control unit of a motor vehicle, comprising:

transmitting a status inquiry by a watchdog unit to a first monitoring unit, which is implemented on a first processor core of a multicore processor;

ascertaining, by the first monitoring unit, a status response as a function of the status inquiry;

ascertaining, by the watchdog unit, a fault as a function of the status response;

ascertaining, by a first self-testing unit, a first test result, the first self-testing unit being implemented on the first processor core;

ascertaining, by a second self-testing unit, a second test result, the second self-testing unit being implemented on a second processor core of the multicore processor; and

ascertaining, by a second monitoring unit, a third test result as a function of the second test result; and

wherein the status response is ascertained by the first monitoring unit as a function of the first test result, and as a function of the third test result.

2. The method as recited in claim 1, further comprising:

ascertaining, by a third self-testing unit, a fourth test result, the third self-testing unit being implemented on a third processor core of the multicore processor;

wherein the third test result is ascertained by the second monitoring unit as a function of the second test result, and as a function of the fourth test result.

3. The method as recited in claim 2, wherein at least one of:

the second test result is compared to a second nominal test result by the second monitoring unit;

the fourth test result is compared to a fourth nominal test result by the second monitoring unit; and

a further fault is ascertained, if at least one of the second test result and fourth test result deviates from at least one of a specific second and third nominal result.

4. The method as recited in claim 3, wherein the further fault is ascertained by the second monitoring unit, when the second or fourth test result is not available after expiration of a period of time.

5. The method as recited in claim 1, wherein the first processor core is operated with the aid of an associated lockstep processor core according to a lockstep method.

6. The method as recited in claim 1, wherein:

the second monitoring unit is implemented on the first processor core;

program execution monitoring is carried out with respect to the implementation of the second monitoring unit; and

the first test result includes a result of the program execution monitoring.

7. The method as recited in claim 1, wherein:

with the aid of a further watchdog unit, which is implemented on the second processor core, a further status inquiry is transmitted to a secondary, first monitoring unit, which is implemented on a secondary, first processor core of a secondary multicore processor;

a further status response is ascertained by the secondary, first monitoring unit as a function of the further status inquiry;

a further fault is ascertained by the further watchdog unit as a function of the further status response;

a secondary, first test result is ascertained by a secondary, first self-testing unit, which is implemented on the secondary, first processor core;

a secondary, second test result is ascertained by a secondary, second self-testing unit, which is implemented on a secondary, second processor core of the secondary multicore processor;

a secondary, third test result is ascertained by a secondary, second monitoring unit as a function of the secondary, second test result; and

the secondary status response is ascertained by the secondary, first monitoring unit as a function of the secondary, first test result, and as a function of the secondary, third test result.

8. The method as recited in claim 7, wherein:

a secondary, fourth test result is ascertained by a secondary, third self-testing unit, which is implemented on a secondary, third processor core of the secondary multicore processor; and

a secondary, third test result is ascertained by a secondary, second monitoring unit as a function of the secondary, second test result, and as a function of the secondary, fourth test result.

9. The method as recited in claim 8, wherein:

the second processor core of the multicore processor is operated with the aid of an associated lockstep processor core according to a lockstep method; and

the secondary, first processor core is operated with the aid of an associated lockstep processor core according to the lockstep method.

10. The method as recited in claim 1, wherein the watchdog unit takes the form of a hardware component.

11. A control unit for a motor vehicle, the control unit designed to:

transmit a status inquiry by a watchdog unit to a first monitoring unit, which is implemented on a first processor core of a multicore processor;

ascertain, by the first monitoring unit, a status response as a function of the status inquiry;

ascertain, by the watchdog unit, a fault as a function of the status response;

wherein;

a first test result is transmitted by a first self-testing unit, which is implementable on the first processor core;

a second test result is transmitted by a second self-testing unit, which is implemented on a second processor core of the multicore processor;

a third test result is ascertained by a second monitoring unit as a function of the second test result; and

the status response is ascertained by the first monitoring unit as a function of the first test result, and as a function of the third test result.

12. The control unit as recited in claim 11, the control unit being designed to:

ascertain, by a third self-testing unit, a fourth test result, the third self-testing unit being implemented on a third processor core of the multicore processor;

wherein the third test result is ascertained by the second monitoring unit as a function of the second test result, and as a function of the fourth test result.