Method and device for monitoring control units

• US 20020194551A1
• Filed: 03/20/2002
• Published: 12/19/2002
• Est. Priority Date: 03/21/2001
• Status: Active Grant

• Current Assignee: Robert Bosch GmbH
• Original Assignee: Robert Bosch GmbH
• Inventors: Keller, Stefan, Mueller, Margit, Kaiser, Lilian
• Granted Patent: US 6,918,064 B2
• Time in Patent Office: Days
• US Class Current: 714/48
• CPC Class Codes: F02D 41/2493 Resetting of data to a predefined set of values
• CPC Class Codes: F02D 41/266 the computer being backed-up or assisted by another circuit, e.g. analogue
• CPC Class Codes: G05B 19/0421 Multiprocessor system
• CPC Class Codes: G05B 2219/24195 Compare data in channels at timed intervals, for equality

Abstract

A method and a device for monitoring data and the transmission of data between at least one first control unit and one second control unit are provided. The at least two control units have a first program level, to which are allocated programs which calculate the control function, as well as a second program level including programs that monitor the functional reliability of the programs of the first program level. The first control unit is connected to at least one component which may be used to acquire data, for example, controlled variables. The data acquired by the component or further data determined with this data may be transmitted from the first control unit to the second control unit over a single connection in a secure manner, and the data and the data transmission are secured separately in the first and second program levels such that errors in the data and the data transmission may be detected.

Claims

1. A method of monitoring at least one of data and transmission of data between a first control unit and a second control unit, the two control units having a first program level, to which are allocated programs which calculate a control function, as well as a second program level including programs that monitor functional reliability of the programs of the first program level, the first control unit being connected to at least one component which is used to acquire data, comprising the steps of:

transmitting at least one of the data acquired by the component and data derived from the data acquired by the component, from the first control unit to the second control unit over a single connection in a secure manner; and

separating, in a secure manner, the at least one of the data and the data transmission in the first and second program levels such that errors in the at least one of the data and the data transmission are detected.

2. The method according to claim 1, wherein the single connection is a CAN bus.

3. The method according to claim 2, further comprising the step of:

implementing security in the first program level by analysis of status information of a corresponding CAN message containing data that is on the CAN bus.

4. The method according to claim 1, further comprising the step of:

implementing security in the second program level of the first control unit by adding security information to respective data and by using a message counter.

5. The method according to claim 1, further comprising the step of:

providing an error response, by which a more secure state is set in the second controller, when an error in the at least one of the data and the data transmission is detected.

6. The method according to claim 5, wherein the error is an interruption in the data transmission.

7. A device for monitoring at least one of data and transmission of data, comprising:

first and second control units, the control units including a first program level, to which are allocated programs which calculate a control function, as well as a second program level including programs that monitor functional reliability of the programs of the first program level;

a component for acquiring data, which component is connected to the first control unit, wherein at least one of the data acquired by the component and data derived from the data acquired by the component are transmitted from the first control unit to the second control unit over a single connection in a secure manner; and

an arrangement which implements separate security for the at least one of the data and the data transmission in the first and second program levels such that errors in the at least one of the data and the data transmission are detected.