Microprocessor system for safety-critical control systems

• US 6,823,251 B1
• Filed: 12/22/1999
• Issued: 11/23/2004
• Est. Priority Date: 04/18/1997
• Status: Expired due to Fees

• Current Assignee: Continental Teves AG & Co. OHG (Continental AG)
• Original Assignee: Continental Teves AG & Co. OHG (Continental AG)
• Inventors: Giers, Bernhard
• Primary Examiner(s): LOUIS JACQUES, JACQUES H
• Application Number:
  US09/403,115
• Time in Patent Office: 1,798 Days
• Field of Search: 701/76, 701/70, 701/71, 701/92, 701/36, 701/29, 701/31, 701/33, 701/34, 303/122, 303/122.02, 303/176, 303/147, 303/149, 303/169, 714/30, 714/33, 714/12, 714/14, 714/10, 714/797, 714/820, 714/11, 714/24, 714/3, 700/2, 700/4, 700/81, 700/82, 700/7, 709/249, 709/234, 709/250, 709/213, 326/11, 326/38, 326/48, 710/26, 710/240
• US Class Current: 701/76
• CPC Class Codes: B60G 17/0185 for failure detection
• CPC Class Codes: B60G 2600/08 Failure or malfunction detecting means
• CPC Class Codes: B60G 2800/802 Diagnostics
• CPC Class Codes: B60G 2800/91 Suspension Control
• CPC Class Codes: B60G 2800/92 ABS - Brake Control
• CPC Class Codes: B60G 2800/93 Skid or slide control [ASR]
• CPC Class Codes: B60T 2270/402 Back-up
• CPC Class Codes: B60T 2270/406 Test-mode; Self-diagnosis
• CPC Class Codes: B60T 2270/413 Plausibility monitoring, cross check, redundancy
• CPC Class Codes: B60T 8/885 using electrical circuitry
• CPC Class Codes: B60W 2050/0045 using databus protocols
• CPC Class Codes: B60W 50/0205 Diagnosing or detecting failures; Failure detection models
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

A microprocessor system for safety-critical control operations includes at least three central units which are preferably located jointly on one chip and execute the same program. Further, there is provision of read-only memories and random-access memories with additional memory locations for test data, input and output units and comparators which check the output signals of the central units for correlation. The central units are interconnected by way of bus systems and bypasses which enable the central units to jointly read and process the existing data, including the test data and commands, according to the same program. The central units are extended by redundant periphery units into two complete control signal circuits and are interconnected in such a manner that, upon failure, the faulty central unit is identified by a majority decision and an emergency operation function is maintained.

Claims

1. Microprocessor system for safety-critical control operations, comprising:

a plurality of central processing units which are connected, by way of separate bus systems, to read-only memories and random-access memories that also have memory locations for test data, wherein said plurality of central processing units are further connected to input and output units and to comparators which check the output data or output signals of the central processing units for correlation, wherein the central processing units execute the same program and communicate with each other by way of the bus systems, and wherein the bus systems are interconnected by bypasses which enable the central processing units to jointly read and process the existing data, including the test data and commands,

redundant periphery units into at least two complete control signal circuits and are interconnected in such a manner that, upon failure of a central processing unit or associated components, the faulty central unit can be identified by a majority decision in an identification stage and an emergency operation function is maintained, wherein in the emergency operation function, redundant data processing and comparison of the data processing results for correlation is maintained and non-correlation or the occurrence of differences between the data processing results or intermediate results is signaled, and wherein a delivery of output signals or control signals by the inclusion of or as a function of the faulty system or the faulty central unit is prevented.

2. Microprocessor system as claimed in claim 1, wherein each central processing unit includes a bus system, and also includes other read only and random access memory having double the memory capacity, for the redundance data, compared to the memory capacity required for a non-redundant system, further by way of the bypasses there is a connection between all central processing units and the memory locations in the write and read directions and to all input and output units.

3. Microprocessor system as claimed in claim 2, wherein the three central processing units, along with the read only and random access memories, the input and output units and the periphery units, form two complete and one incomplete data processing systems in total.

4. Microprocessor system as claimed in claim 3, wherein, at least one of said three data processing systems further includes redundance information memories.

5. Microprocessor system as claimed in claim 1, wherein the data processing results or output signals of two central units are sent to comparators for comparing.

6. Microprocessor system as claimed in claim 5, wherein the central processing units with the bus systems, the read only and random access memories, the bypasses, the input and output units, comparators and an identification stage are integrated onto one chip.

7. Microprocessor system as claimed in claim 1, wherein said system is incorporated into two or more automotive vehicle control systems consisting essentially of the group of brake-by-wire, ABS, TCS, ASMS.

8. Microprocessor system as claimed in claim 7, wherein said system is limited to maintaining the operation of selected safety functions.

9. A microprocessor system for safety-critical control operations, comprising:

a first data processing system;

a second data processing system;

a third data processing system;

a first bypass interconnecting the first and second data processing systems by a first bus and a second bus, respectively;

a second bypass interconnecting the second and third data processing systems by a third bus and the second bus, respectively;

a first comparator connected to the first and second buses;

a second comparator connected to the second and third buses;

a third comparator connected to the first and third buses; and

an identification stage connected the first, second and third comparators,

wherein an output signal from the third data processing system is checked for correlation with an output signal from only the first and second data processing systems by the identification stage to detect a fault in one of the first, second and third data processing systems and to determine a location of the fault in one of the first, second and third data processing systems.

10. The microprocessor system for safety-critical control operations according to claim 9, wherein the first data processing system includes a first read-only memory, a first random-access memory, a first processing unit and a first input/output unit, wherein the second data processing system includes a second read-only memory, a second random-access memory, and a second processing unit, and wherein the third data processing system includes a third read-only memory, a third random-access memory, a third processing unit and a third input/output unit.

11. The microprocessor system for safety-critical control operations according to claim 10, wherein the second read-only and random-access memories store data that is redundant with respect data stored in the first and third read-only memories and the first and third random-access memories, thereby eliminating the need for a second input/output unit.

12. The microprocessor system for safety-critical control operations according to claim 10, wherein the first bypass enables the first processing unit to read data stored in the second read-only and random-access memories and permit data flow from the first processing unit and the second read-only and random-access memories to the second processing unit.

13. The microprocessor system for safety-critical control operations according to claim 10, wherein the second bypass enables the third processing unit to read data stored in the second read-only and random-access memories and permit data flow from the third processing unit and the second read-only and random-access memories to the second processing unit.

14. The microprocessor system for safety-critical control operations according to claim 9, further comprising a first peripheral connected to the first data processing system.

15. The microprocessor system for safety-critical control operations according to claim 14, further comprising a second peripheral connected to the third data processing system.

16. The microprocessor system as claimed in claim 9, wherein the system is incorporated into two or more automotive vehicle control systems consisting essentially of the group of brake-by-wire, ABS, TCS, ASMS.