Method of processing data for an automated vehicle

• US 10,503,166 B2
• Filed: 09/29/2017
• Issued: 12/10/2019
• Est. Priority Date: 10/17/2016
• Status: Active Grant

• Current Assignee: Robert Bosch GmbH
• Original Assignee: Robert Bosch GmbH
• Inventors: Baumgaertner, Rainer
• Primary Examiner(s): Merlino, David P.
• Application Number:
  US15/719,943
• Publication Number:
  US 20180107212A1
• Time in Patent Office: 802 Days
• Field of Search: 701 2, 701 292, 701 36, 701469, 702182, 702183, 700 80, 700295, 710305, 709222, 370216, 370362, 340 343, 340438, 340627, 455466, 327 1, 1 1
• CPC Class Codes: B60W 2050/0292 Fail-safe or redundant systems, e.g. limp-home or backup systems
• CPC Class Codes: B60W 30/00 Purposes of road vehicle drive control systems not related to the control of a particular sub-unit, e.g. of systems using conjoint control of vehicle sub-units
• CPC Class Codes: B60W 50/04 Monitoring the functioning of the control system
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/24182 Redundancy
• CPC Class Codes: G05B 2219/2637 Vehicle, car, auto, wheelchair
• CPC Class Codes: G05D 1/0055 with safety arrangements
• CPC Class Codes: G05D 1/0077 using redundant signals or controls
• CPC Class Codes: G05D 1/0088 characterized by the autonomous decision making process, e.g. artificial intelligence, predefined behaviours using knowledge based models G06N5/00
• CPC Class Codes: G07C 5/085 using electronic data carriers

Abstract

A method for processing data for an automated vehicle, including operating at least two processing units, the at least two processing units being monitored by a monitoring device having at least two self-monitoring monitoring units. Defined monitoring of the processing units is carried out with the aid of the at least two monitoring units. A master functionality of the monitoring units is assumed by a defined monitoring unit. In the event of a fault of the monitoring unit carrying out the master functionality, the master functionality is taken over by a downstream monitoring unit.

Claims

1. A method for processing data for an automated vehicle, comprising:

operating at least two processing units, the at least two processing units being monitored by a monitoring device having at least two self-monitoring monitoring units;

carrying out defined monitoring of the at least two processing units with the aid of the at least two self-monitoring monitoring units, a master functionality of the at least two self-monitoring monitoring units being assumed only by a first one of the at least two self-monitoring monitoring units and not by any others of the at least two self-monitoring monitoring units, wherein each of the at least two self-monitoring monitoring units monitors all of the at least two processing units, the monitoring by each of the at least two self-monitoring monitoring units including receiving result data from each of the at least two processing units and comparing the received result data to one another to determine whether the received result data are identical to each other; and

in the event of a fault of the first one of the at least two self-monitoring monitoring units carrying out the master functionality, the master functionality is taken over by a second one of the at least two self-monitoring monitoring units which is downstream of the first one of the at least two self-monitoring monitoring monitoring units so that only the second one of the at least two self-monitoring monitoring units assumes the master functionality and none of the others of the at least two self-monitoring monitoring units assumes the master functionality;

wherein the master functionality includes triggering the at least two processing units to synchronize them.

2. The method as recited in claim 1, wherein monitoring of the processing units is carried out by the at least two self-monitoring monitoring units in parallel to one another.

3. The method as recited in claim 1, wherein downstream ones of the at least two self-monitoring monitoring units signal to a monitoring unit of the at least two self-monitoring monitoring units carrying out the master functionality whether they are fault-free.

4. The method as recited in claim 1, wherein in the event of a deviation between a result data from one of the at least two processing units and result data from others of the at least two processing units, a processing unit of the at least two processing units supplying the deviating result data is deactivated.

5. The method as recited in claim 1, wherein each of the at least two self-monitoring monitoring units has a multiplexer, and a data channel of the each of the at least two self-monitoring monitoring devices is developed with the aid of the respective multiplexer.

6. The method as recited in claim 1, wherein the second one of the at least two self-monitoring monitoring units synchronizes to the triggering for as long as the first one of the at least two self-monitoring monitoring units is fault free and the master functionality is assumed by the first one of the at least two self-monitoring monitoring units.

7. A device for processing data for an automated vehicle, comprising:

at least two processing units;

at least two monitoring units with the aid of which the at least two processing units are monitored;

wherein a master functionality is assumed only by a first one of the at least two monitoring units and not by any others of the at least two monitoring units, wherein each of the at least two monitoring units monitors all of the at last two processing units, the monitoring by each of the at least two monitoring units including receiving result data from each of the at least two processing units and comparing the received result data to one another to determine whether the received result data are identical to each other, and in the event that the first one of the at least two monitoring unit assuming the master functionality is faulty, the master functionality is taken over by a second one of the at least two monitoring units which is downstream of the first one of the monitoring units so that only the second one of the at least two monitoring units assumes the master functionality and none of the others of the at least two monitoring units assumes the master functionality;

wherein the master functionality includes triggering the at least two processing units to synchronize them.

8. The device as recited in claim 7, wherein interface buses are separately developed between the at least two processing units and the at least two monitoring units.

9. The device as recited in claim 7, wherein interface buses between the at least two processing units and the at least two monitoring units are integrated in a single bus.

10. The device as recited in claim 7, wherein the second one of the at least two monitoring units synchronizes to the triggering for as long as the first one of the at least two monitoring units is fault free and the master functionality is assumed by the first one of the at least two monitoring units.

11. A non-transitory computer-readable data carrier on which program code is stored, the program code for processing data for an automated vehicle, the program code, when executed on an electronic monitoring device, causing the electronic monitoring device to perform:

operating at least two processing units, the at least two processing units being monitored by a monitoring device having at least two self-monitoring monitoring units;

carrying out defined monitoring of the at least two processing units with the aid of the at least two self-monitoring monitoring units, a master functionality of the at least two self-monitoring monitoring units being assumed only by a first one of the at least two self-monitoring monitoring units and not by any others of the at least two self-monitoring monitoring units, wherein each of the at least two self-monitoring monitoring units monitors all of the at least two processing units, the monitoring by each of the at least two self-monitoring monitoring units including receiving result data from each of the at least two processing units and comparing the received result data to one another to determine whether the received result data are identical to each other; and

in the event of a fault of the first one of the at least two self-monitoring monitoring units carrying out the master functionality, the master functionality is taken over by a second one of the at least two self-monitoring monitoring units which is downstream of the first one of the at least two self-monitoring monitoring units so that only the second one of the at least two self-monitoring monitoring units assumes the master functionality and none of the others of the at least two self-monitoring monitoring units assumes the master functionality;

wherein the master functionality includes triggering the at least two processing units to synchronize them.

12. The non-transitory computer-readable data carrier as recited in claim 11, wherein the second one of the at least two self-monitoring monitoring units synchronizes to the triggering for as long as the first one of the at least two self-monitoring monitoring units is fault free and the master functionality is assumed by the first one of the at least two self-monitoring monitoring units.