Method for mutual monitoring of components of a distributed computer system

• US 7,269,762 B2
• Filed: 05/28/2003
• Issued: 09/11/2007
• Est. Priority Date: 05/29/2002
• Status: Expired due to Fees

• Current Assignee: Robert Bosch GmbH
• Original Assignee: Robert Bosch GmbH
• Inventors: Weiberle, Reinhard, Kesch, Bernd, Heckmann, Hans, Blessing, Peter
• Primary Examiner(s): Beausoliel; Robert W.
• Assistant Examiner(s): Mehrmanesh; Elmira
• Application Number:
  US10/446,296
• Publication Number:
  US 20040034810A1
• Time in Patent Office: 1,567 Days
• Field of Search: 714/47, 702/148, 701/29, 701/46
• US Class Current: 714/47.1
• CPC Class Codes: B60T 2270/413 Plausibility monitoring, cross check, redundancy
• CPC Class Codes: B60T 8/885 using electrical circuitry
• CPC Class Codes: G05B 2219/24033 Failure, fault detection and isolation
• CPC Class Codes: G05B 2219/31356 Automatic fault detection and isolation
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3013 where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems testing or monitoring of control systems or parts thereof G05B23/02
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: Y02P 90/02 Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Abstract

A method of mutual monitoring of components of a distributed computer system for a safety-relevant application in a motor vehicle in particular. The components are interconnected by at least one communication system. To make the mutual monitoring of components as simple and comprehensible as possible and to save on additional hardware components for monitoring, in a plurality of components of the computer system an internal monitoring function which detects faults in the monitored component and a mutual monitoring function which performs a mutual check on results determined by the components and makes a majority selection from the results are implemented, and both the result of the internal monitoring function and the results of the mutual monitoring functions are taken into account in a decision as to whether there is a fault in a component.

Claims

1. A method for mutual monitoring of components of a distributed computer system for a safety-relevant application in a motor vehicle, the components being interconnected by at least one communication system, comprising:

performing, in each of a plurality of components of the computer system, an internal monitoring function which detects faults the component, and a mutual monitoring function, which performs a mutual check on results which have been determined by the plurality of components and makes a majority selection from the results of the mutual monitoring; and

determining whether there is a fault in a monitored component as a function of both a result of the internal monitoring function and the results of the mutual monitoring functions.

2. The method as recited in claim 1, wherein the internal monitoring function detects the fault in the component by checking basic operations of a set of commands of a computing element of the component.

3. The method as recited in claim 2, wherein the computing element is a microprocessor.

4. The method as recited in claim 1, further comprising:

receiving, by the components, signals from external units;

processing, by the components, the received signals; and

monitoring the external units as part of the internal monitoring function.

5. The method as recited in claim 1, wherein the mutual monitoring function of the components check the results of the mutual monitoring determined by the components on a basis of model calculations.

6. The method as recited in claim 5, wherein the results of the mutual monitoring are determined in the components by calculations based on selected process data, each being made available to the components by the monitored component.

7. The method as recited in claim 6, wherein the selected process data is made available by the monitored component to the other components in alternation.

8. The method as recited in claim 6, wherein the selected process data is made available by the component to the components via the communication system.

9. The method as recited in claim 1, wherein the results are determined in the components by calculation of responses to a predefinable question as part of a question-response communication, the question being made available in each case by one of the components to others of the components.

10. The method as recited in claim 9, wherein the question is made available by one particular one of the components to others of the components in alternation.

11. The method as recited in claim 9, wherein the question is in each case made available by one particular one of the components to others of the components via the communication system.

12. A storage medium storing a computer program for implementation of a mutual monitoring of components of a distributed computer system for a safety-relevant application in a motor vehicle, the computer program being capable of running on a computing element, when executed by the computing element, causing the computing element to perform a method comprising:

performing an internal monitoring function which detects faults the component, and a mutual monitoring function, which performs a mutual check on results which have been determined by other components of the distributed computer system and makes a majority selection from the results of the mutual monitoring; and

determining whether there is a fault in a monitored component as a function of both a result of the internal monitoring function and the results of the mutual monitoring functions.

13. The storage medium as recited in claim 12, wherein the computer program is stored in a memory element, the memory element including one of a read-only memory, a random-access memory or a flash memory.

14. A control unit for a component of a distributed computer system having a plurality of components for a safety-relevant application in a motor vehicle, the control unit compnsing:

an internal monitoring function arrangement configured to perform an internal monitoring function which detects faults in the component, and

a mutual monitoring function arrangement which performs a mutual check on results determined by the plurality of components and makes a majority selection from the results;

wherein the control unit takes into account a result of the internal monitoring function and the results of the mutual monitoring functions in the case of a decision regarding whether there is a fault in the component.

15. The control unit as recited in claim 14, wherein the internal monitoring function arrangement is configured to detect faults in the component by checking basic operations of a set commands of a computing element of the component.

16. A distributed computer system apparatus comprising:

a plurality of components for a safety-relevant application in a motor vehicle, each of the plurality of components including an internal monitoring function which detects faults in the component and a mutual monitoring function which performs a mutual check on results determined by the plurality components and makes a majority selection from the results;

at least one communication system apparatus by which the components are interconnected; and

means for making a decision as to whether there is a fault in a component taking into account both a result of the internal monitoring function and the results of the mutual monitoring functions.

17. The computer system apparatus as recited in claim 16, wherein the internal monitoring function detects a fault in the component by checking basic operations of a set of commands of a computing element of the component.