System and method for controlling and/or monitoring a control-unit group having at least two control units

• US 6,804,564 B2
• Filed: 08/26/2002
• Issued: 10/12/2004
• Est. Priority Date: 12/28/2000
• Status: Active Grant

• Current Assignee: Robert Bosch GmbH
• Original Assignee: Robert Bosch GmbH
• Inventors: Crispin, Norbert, Frank, Andreas, Meier, Thomas, Haas, Wolfgang
• Primary Examiner(s): Patel, Ramesh
• Assistant Examiner(s): BARNES-BULLOCK, CRYSTAL JOY
• Application Number:
  US10/228,407
• Publication Number:
  US 20030105537A1
• Time in Patent Office: 778 Days
• Field of Search: 700/2, 700/3, 700/20, 700/21, 700/79, 700/82, 701/39, 701/43, 701/62, 701/76, 701/92, 701/97, 701/107, 318/563, 123/339.15, 123/359, 123/406.13, 123/690, 123/479, 123/568.16
• US Class Current: 700/79
• CPC Class Codes: B60W 10/04 including control of propulsion units
• CPC Class Codes: B60W 10/06 including control of combustion engines
• CPC Class Codes: B60W 2050/0005 Processor details or data handling, e.g. memory registers or chip architecture
• CPC Class Codes: B60W 2050/0045 using databus protocols
• CPC Class Codes: B60W 2050/021 Means for detecting failure or malfunction
• CPC Class Codes: B60W 2050/0292 Fail-safe or redundant systems, e.g. limp-home or backup systems
• CPC Class Codes: B60W 50/023 Avoiding failures by using redundant parts
• CPC Class Codes: B60W 50/032 Fixing failures by repairing failed parts, e.g. loosening a sticking valve
• CPC Class Codes: F02D 41/221 relating to the failure of actuators or electrically driven elements
• CPC Class Codes: F02D 41/266 the computer being backed-up or assisted by another circuit, e.g. analogue
• CPC Class Codes: F16H 2061/122 Avoiding failures by using redundant parts
• CPC Class Codes: F16H 2061/1268 Electric parts of the controller, e.g. a defect solenoid, wiring or microprocessor
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

A system for controlling and/or monitoring a control-unit group having at least two control units, a first control unit and at least one second control unit, the first control unit being designed for performing its control function and for monitoring this control function, as well as for monitoring the control function of the at least one second control unit.

Claims

1. A system for at least one of controlling and monitoring a control-unit group including a first control unit and at least one second control unit, the system comprising:

means, in the first control unit, for performing a control function of the first control unit, for monitoring the control function of the first control unit, and for monitoring a control function of the at least one second control unit; and

a central emergency-operation signal line for triggering in the event of a malfunction of at least one of the first control unit and the at least one second wherein the first control unit is intrinsically safe and the at least one second control unit is not intrinsically safe control unit.

2. The system according to claim 1, further comprising:

a microcomputer in the first control unit; and

wherein the control function and the monitoring function of the first control unit are performed in a first operating level and the monitoring function for the at least one second control unit is performed in a second operating level, the first and second operating levels being independent of one another at least outside of a fault case.

3. The system according to claim 2, wherein, in a third operating level, a functioning method of the first control unit is checked by monitoring the second operating level that performs the monitoring.

4. The system according to claim 2, wherein the microcomputer is adapted to introduce safety/emergency measures including at least one of (a) switching off an actuator system of the at least one second control unit and (b) switching off the at least one second control unit.

5. The system according to claim 1, further comprising:

sensors functioning as redundant sensors for the at least one second control unit in a normal state, the sensors, in response to a malfunction of the at least one second control unit being detected, being assigned to the first control unit to ensure an emergency-operation function with respect to a normal state control function of the at least one second control unit.

6. A method for at least one of controlling and monitoring a control-unit group including a first control unit and at least one second control unit, the method comprising:

performing by the first control unit a first drive unit control function of the first control unit;

performing by the first control unit a monitoring of the first control function of the first control unit;

performing by the first control unit a monitoring of at least one second drive unit control function of the at least one second control unit; and

triggering a central emergency-operation signal line in the event of a malfunction of at least one of the first control unit and the at least one second control unit wherein the first control unit is intrinsically safe and the at least one second control unit is not intrinsically safe.

7. A method for at least one of controlling and monitoring a control-unit group including a first control unit and at least one second control unit, the method comprising:

performing by the first control unit a first drive unit control function of the first control unit;

performing by the first control unit a monitoring of the first control function of the first control unit;

performing by the first control unit a monitoring of at least one second drive unit control function of the at least one second control unit;

wherein the first control unit is intrinsically safe and the at least one second control unit is not intrinsically safe.

8. A system for at least one of controlling and monitoring a control-unit group including a first control unit and at least one second control unit, the system comprising:

means, in the first control unit, for performing a control function of the first control unit, for monitoring the control function of the first control unit, and for monitoring a control function of the at least one second control unit;

wherein the first control unit is intrinsically safe and the at least one second control unit is not intrinsically safe.