Circuit configuration for a motor vehicle control system

• US 6,410,993 B1
• Filed: 03/06/2000
• Issued: 06/25/2002
• Est. Priority Date: 04/28/1997
• Status: Expired due to Fees

• Current Assignee: Continental Teves AG & Co. OHG (Continental AG)
• Original Assignee: Continental Teves AG & Co. OHG (Continental AG)
• Inventors: Giers, Bernhard
• Primary Examiner(s): Ballato, Josie
• Assistant Examiner(s): POLK, SHARON A
• Application Number:
  US09/403,876
• Time in Patent Office: 841 Days
• Field of Search: 307/10.1, 701/71, 303/122.05, 303/122.08, 303/20, 303/22.4, 700/79
• US Class Current: 307/10.1
• CPC Class Codes: B60G 17/0185 for failure detection
• CPC Class Codes: B60G 17/0195 characterised by the regulation being combined with other vehicle control systems conjoint control of vehicle sub-units including control of suspension systems B60W10/22
• CPC Class Codes: B60G 2600/08 Failure or malfunction detecting means
• CPC Class Codes: B60G 2800/80 Detection or control after a system or component failure
• CPC Class Codes: B60T 17/221 Procedure or apparatus for checking or keeping in a correct functioning condition of brake systems hydraulic pressure systems in general F15B19/00, F15B21/04; testing structures or apparatus G01M
• CPC Class Codes: B60T 2270/413 Plausibility monitoring, cross check, redundancy
• CPC Class Codes: B60T 8/321 deceleration B60T8/34, B60T8/52, B60T8/54, B60T8/56, B60T8/58, B60T8/72, B60T8/86, B60T8/88 take precedence
• CPC Class Codes: B60T 8/885 using electrical circuitry
• CPC Class Codes: B60T 8/96 on speed responsive control means
• CPC Class Codes: B60W 2050/021 Means for detecting failure or malfunction

Abstract

A circuit arrangement for a safety-critical control system, such as ABS, TCS, ASMS, brake-by-wire, etc., has a dual-circuit or multiple-circuit design, and each circuit includes a complete microprocessor system that processes the input data redundantly and delivers an error identification signal (FAIL) when an error or a discrepancy between the redundantly produced data processing results occurs. Upon error detection, there is a transition to an emergency operation mode where either a circuit is disconnected or the actuator activation of both circuits is assumed by the intact microprocessor system. Each of the two systems is equipped with peripherals of its own, comprised of signal detection, actuator activation, and energy supply.

Claims

1. A circuit arrangement for use with an automotive vehicle control system for controlling safety-critical control operations, said circuit arrangement processing input data from the control system and generating an error identification signal when a discrepancy occurs, said circuit arrangement comprising:

first and second microprocessor systems for redundantly processing input signals and for generating an error identification signal in the event of a discrepancy between the redundantly processed input signals; and

means for transitioning the control system to an emergency operation mode when a discrepancy occurs in one of said first and second microprocessor systems,

wherein said transitioning means comprises a first commutator for transitioning the control system from said first microprocessor system to said second microprocessor system when the discrepancy occurs in said first microprocessor system, and a second commutator for transitioning the control system from said second microprocessor system to said first microprocessor system when the discrepancy occurs in said second microprocessor system.

2. The circuit arrangement according to claim 1, further including first and second input units for providing input data to said first and second microprocessor systems, respectively.

3. The circuit arrangement according to claim 1, wherein said first commutator includes first and second switch positions, the control system being transitioned from said first microprocessor system to said second microprocessor system when said first communtator is positioned in said second switch position, and wherein said second commutator includes first and second switch positions, the control system being transitioned from said second microprocessor system to said first microprocessor system when said second communtator is positioned in said second switch position.

4. A dual circuit arrangement for use with an automotive vehicle control system for controlling safety-critical control operations, comprising:

a first circuit comprising a first input unit for receiving input data, a first microprocessor for receiving and processing the input data from said first input unit, a first commutator for receiving a signal from said first microprocessor, and a first actuation unit for receiving a signal from said first commutator; and

a second circuit comprising a second input unit for receiving input data, a second microprocessor for receiving and redundantly processing the input data from said second input unit, a second commutator for receiving a signal from said second microprocessor, and a second actuation unit for receiving a signal from said second commutator,

wherein one of said first and second circuits generates an error identification signal when a discrepancy occurs in one of said first and second microprocessors,

wherein the first commutator transitions the control system from said first microprocessor to said second microprocessor when the discrepancy occurs in said first microprocessor, and wherein the second commutator transitions the control system from said second microprocessor to said first microprocessor when the discrepancy occurs in said second microprocessor.

5. The circuit arrangement according to claim 4, wherein said first commutator includes first and second switch positions, the control system being transitioned from said first microprocessor to said second microprocessor when said first communtator is positioned in said second switch position, and wherein said second commutator includes first and second switch positions, the control system being transitioned from said second microprocessor to said first microprocessor when said second communtator is positioned in said second switch position.

6. The dual circuit arrangement according to claim 4, wherein the first actuation unit isolates the control system from said first microprocessor when the discrepancy occurs in said first microprocessor, and wherein the second actuation unit isolates the control system from said second microprocessor when the discrepancy occurs in said second microprocessor.

7. A method of controlling safety-critical control operations of an automotive vehicle control system by use of a dual circuit arrangement, the dual circuit arrangement including a first circuit comprising a first input unit for receiving input data, a first microprocessor for receiving the input data from said first input unit, a first commutator for receiving a signal from said first microprocessor, and a first actuation unit for receiving a signal from said first commutator, and a second circuit comprising a second input unit for receiving input data, a second microprocessor for receiving the input data from said second input unit, a second commutator for receiving a signal from said second microprocessor, and a second actuation unit for receiving a signal from said second commutator, the method comprising the steps of:

processing the input data in the first microprocessor;

redundantly processing the input data in a second microprocessor; and

generating an error identification signal when a discrepancy occurs in one of said first and second microprocessor; and

transitioning the control system from said first circuit to said second circuit when the discrepancy occurs in said first microprocessor by switching said first commutator from a first position to a second position; and

transitioning the control system from said second circuit to said first circuit when the discrepancy occurs in said second microprocessor by switching said second commutator from a first position to a second position.

8. The method according to claim 7, wherein said first actuation unit isolates the control system from said first circuit when the discrepancy occurs in said first microprocessor, and wherein said second actuation unit isolates the control system from said second circuit when the discrepancy occurs in said second microprocessor.