Control device in a system and method for monitoring a controller

• US 6,604,006 B2
• Filed: 12/11/2000
• Issued: 08/05/2003
• Est. Priority Date: 06/10/1998
• Status: Expired due to Fees

• Current Assignee: Infineon Technologies AG
• Original Assignee: Siemens AG
• Inventors: Zeilinger, Reinhold
• Primary Examiner(s): Follansbee, John
• Assistant Examiner(s): GAIN, EDWARD F
• Application Number:
  US09/734,464
• Publication Number:
  US 20010050543A1
• Time in Patent Office: 967 Days
• Field of Search: 700/82, 700/79, 700/21, 700/22, 700/4, 700/245, 700/292, 700/293, 701/76, 701/107
• US Class Current: 700/79
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 19/058 Safety, monitoring

Abstract

A control device is provided for a machine, system or appliance, particularly a fuel cell system, having a first control unit and a second control unit which interchanges signals with the first control unit and monitors the first control unit. A comparison module compares states of the control units. A method for monitoring a controller includes monitoring the first control unit with the second control unit by comparing the states of the control units.

Claims

1. A method for monitoring a controller, comprising:

processing input signals from peripheral elements identically in first and second control units;

determining output signals in parallel for the peripheral elements, in the first and second control units;

comparing states of the first control unit and states of the second control unit;

sending a trigger signal to a disconnection component only upon identity between the states;

sending the trigger signal from the second control unit to the first control unit if the identity between the states has been established in the second control unit;

maintaining sequence functions of the controller only if the disconnection component is triggered regularly.

2. A method for monitoring a controller, comprising:

processing input Bignals from peripheral elements identically in first and second control units;

determining output signals in parallel for the peripheral elements, in the first and second control units;

comparing states of the first control unit and states of the second control unit;

sending a trigger signal to a disconnection component only upon identity between the states;

sending the trigger signal from the second control unit to the first control unit if the identity between the states has been established in the second control unit; and

maintaining sequence functions of the controller only if the disconnection component is triggered regularly.

3. The method according to claim 2, which further comprises causing the first control unit and the second control unit to each determine their own state changes and transmit their own state for state comparison in the other control unit.

4. The method according to claim 2, which further comprises sending identical signals from the peripheral elements to the control units.

5. The method according to claim 4, which further comprises sending output signals to the peripheral elements only with the first control unit.

6. The method according to claim 4, which further comprises transmitting the signals through a fieldbus.

7. The method according to claim 6, which further comprises initially sending the trigger signal to a bus module and forwarding the trigger signal from the bus module to the disconnection component.

8. The method according to claim 7, which further comprises monitoring the bus module with one of the control units by triggering the disconnection component only if an output signal from the bus module is present.

9. The method according to claim 4, which further comprises transmitting the signals through a CAN bus.

10. The method according to claim 2, which further comprises providing another disconnection component and sending the trigger signal to both of the disconnection components.

11. The method according to claim 10, which further comprises providing two bus modules, initially sending the trigger signal to the two bus modules, forwarding the trigger signal from one of the bus modules to one of the disconnection components, and forwarding the trigger signal from another of the bus modules to another of the disconnection components.

12. The method according to claim 2, which further comprises monitoring a voltage of a power supply for the system with one of the control units.