Microprocessor arrangement for a vehicle-control system

• US 6,173,229 B1
• Filed: 12/03/1999
• Issued: 01/09/2001
• Est. Priority Date: 08/02/1996
• Status: Expired due to Fees

• Current Assignee: Continental Teves AG & Co. OHG (Continental AG)
• Original Assignee: Continental Teves AG & Co. OHG (Continental AG)
• Inventors: Esselbrügge, Herman, Giers, Bernhard, Fennel, Helmut, Zydek, Michael, Kant, Bernhard
• Primary Examiner(s): Nguyen, Tan
• Assistant Examiner(s): Tran, Dalena
• Application Number:
  US09/230,860
• Time in Patent Office: 403 Days
• Field of Search: 701/82, 701/91, 701/92, 701/97, 701/36, 395/181, 395/182.04, 395/182.09, 395/800.32, 395/200.5, 395/800.34, 395/200.78, 364/131, 364/133, 364/134, 714/2, 714/6, 714/11, 709/220, 709/248, 700/2, 700/4, 700/5
• US Class Current: 701/91
• CPC Class Codes: B60T 2270/413 Plausibility monitoring, cross check, redundancy
• CPC Class Codes: G06F 11/1641 where the comparison is not performed by the redundant processing components
• CPC Class Codes: G06F 11/165 with continued operation after detection of the error

Abstract

A microprocessor configuration for a control system of a vehicle comprises a plurality of microprocessor systems (4,5,6) which are interconnected by bus systems (1,2,3) and include an anti-lock and/or traction slip control system and further control systems, which require complex computing operations, as well as an input signal conditioning system (SC). For the purpose of error detection one part of the data processing is performed “symmetrically” redundantly in a plurality of microprocessor systems and another part of the data processing is additionally performed (“asymmetrically” redundantly) in accordance with simplified algorithms.

Two like master microprocessor systems (5,6) are provided which serve the symmetrically redundant data processing. The input signal conditioning and the processing in accordance with simplified algorithms are installed in a third microprocessor system (4). The output and/or intermediate results are compared for redundancy; moreover, the data processing performed in these microprocessor systems is each time compared and checked for plausibility with the results of the simplified data processing.

Claims

1. A microprocessor configuration for a control system of a vehicle comprising a plurality of microprocessor systems which are interconnected by bus systems and include at least one member of the group consisting of an anti-lock control system and a traction slip control system, and at least one additional control system, which requires complex computing operations, as well as an input signal conditioning system, wherein, for the purpose of error detection, the configuration being capable of performing one part of the data processing redundantly in a plurality of microprocessor systems in symmetrical redundancy and, additionally, one part of the data processing in accordance with simplified algorithms in asymmetrical redundancy, wherein the microprocessor configuration includes two like master microprocessor systems which are assigned to the redundant data processing;

wherein a third microprocessor is adapted to perform the input signal conditioning and the processing in accordance with the simplified algorithms; and

wherein the configuration is capable of comparing results of the data processing amongst each other for concurrence and of comparing and checking these results, for plausibility with the respective results of the simplified data processing.

2. A microprocessor configuration as claimed in claim 1, wherein, in comparing and evaluating the redundantly processed data, the configuration is capable of distinguishing between safety-critical and functionally essential data.

3. A microprocessor configuration as claimed in claim 2, wherein the configuration includes a safety device which, in case of discrepancies between the redundantly processed safety-critical data, switches off at least the control systems concerned by non-concurrent data.

4. A microprocessor configuration as claimed in claim 2, which is capable of identifying, in case of discrepancies between the functionally essential data, a defective master microprocessor system by means of individual comparison of the data of the two master microprocessor systems with the results of the simplified data processing in the third microprocessor system, and of continuing control functions, at least restrictedly, by means of the remaining intact master microprocessor system and by means of the third microprocessor system.

5. A microprocessor configuration as claimed in claim 4, which is capable of deactivating, one after the other, the two master microprocessor systems upon the occurrence of discrepancies between the data processing results of the master microprocessor systems and, if, after deactivation of one of the master microprocessor systems, the data processing results are plausible, of continuing control functions, at least restrictedly, on the basis of the remaining valid, intact master microprocessor system and on the basis of monitoring for plausibility.

6. A microprocessor configuration as claimed in claim 5, wherein the control functions being continued are only the functionally essential data processing operations and control functions not the safety-critical ones.

7. A microprocessor configuration as claimed in claim 4, wherein that master microprocessor systems is deemed the intact one whose results are closer to the results established by the simplified data processing.

8. A microprocessor configuration as claimed in claim 1, which is capable, upon the occurrence of discrepancies, of canceling certain control functions or system functions in dependence on the extent or number of non-concurrences per time unit, with differentiating between safety-critical and uncritical, functionally essential control functions and system functions.

9. A microprocessor control system of a vehicle, comprising:

a first microprocessing system interconnected in symmetrical redundancy to a second microprocessing system for redundant data processing, said first and second microprocessing systems each including a first control system utilizing complex computing operations and a second control system utilizing complex computing operations, said first control system being at least one of an anti-lock control system and a traction slip control system;

a third microprocessing control system interconnected to said first and second microprocessing control systems, said third microprocessing control system adapted to perform input signal conditioning and signal processing utilizing simplified algorithms;

wherein

when said microprocessor control system compares results of the data processing between the first, second and third microprocessing systems according to predetermined rules.

10. The microprocessor control system of claim 9, wherein said predetermined rules distinguish between safety-critical and functionally essential data.

11. The microprocessor control system of claim 10, further comprising a safety device that, upon determination of a discrepancy between the safety-critical data, switches off at least the microprocessing system generating non-concurrent data.

12. The microprocessor control system of claim 10, wherein upon determination of a discrepancy between the functionally essential data, individual comparison is made between the first and third microprocessing control systems and the second and third microprocessing control systems to determine which of the first and second microprocessing systems is outputting nominal functionally essential data, and continuing control functions utilizing the nominally performing of the first and second microprocessing systems and the third microprocessing system.

13. The microprocessor control system of claim 12, wherein the nominally performing of the first and second microprocessing systems is outputting data having comparative results closer to the output of the third microprocessing system.

14. The microprocessor control system of claim 10, wherein upon determination of a discrepancy between the data output by the first and second microprocessing control systems, both the first and second microprocessing systems are deactivated one after the other, and wherein, following deactivation of the first and second microprocessing systems, the output data of one of the first and second microprocessing systems is determined by the predetermined rules to be plausible, control functions are continued, at least restrictedly, utilizing that microprocessing system and the third microprocessing system.

15. The microprocessor control system of claim 14, wherein the continued control functions are non-safety-critical control functions.

16. The microprocessor control system of claim 9, said third microprocessing system including a control system simulator.