Method and device for dual-channel monitoring of safety-relevant sensor signals

• US 8,798,849 B2
• Filed: 07/15/2009
• Issued: 08/05/2014
• Est. Priority Date: 09/01/2008
• Status: Active Grant

• Current Assignee: Magna Powertrain AG & Company KG (Magna International Incorporated)
• Original Assignee: Magna Powertrain AG & Company KG (Magna International Incorporated)
• Inventors: Eggert, Thomas, Langbauer, Heinz
• Primary Examiner(s): Tarcza, Thomas
• Assistant Examiner(s): PIPALA, EDWARD J
• Application Number:
  US13/058,884
• Publication Number:
  US 20110213535A1
• Time in Patent Office: 1,847 Days
• Field of Search: 701/1, 701/36, 701/51, 701/53, 701/58, 701/60, 701/62, 701/63, 701/65, 701/67, 701/68, 701/69, 701/70, 701/71, 701/72, 701/76, 701/78, 701/81, 701/82, 701/83, 701/84, 701/87, 701/88, 701/89, 701/92, 701/29.1, 701/29.2, 701/29.7, 701/30.3, 340/425.5, 340/438, 340/451, 340/452, 340/453
• US Class Current: 701/30.3
• CPC Class Codes: G05B 2219/24184 Redundant I-O, software comparison of both channels
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

A method and device for dual-channel transmission of safety-relevant sensor signals. In the method, two sensor signals to be monitored are generated parallel to one another by two sensors and the generated sensor signals are transmitted to a common evaluation unit via two separate, input-side transmission channels. Within the evaluation unit, the permissibility of the transmitted sensor signals is checked using prescribed calculation specifications that correspond to one another and an evaluation unit output signal representing permissibility or impermissibility is generated for each sensor signal. The individual processing steps of the two calculation specifications are decoupled by the evaluation unit for the two sensor signals and performed diversified within the evaluation unit. The generated output signals are output via two separate, output-side transmission channels.

Claims

1. A method for dual-channel monitoring of safety-relevant sensor signals, the method comprising:

generating two sensor signals in parallel to one another to be monitored, via two sensors;

transmitting the generated sensor signals to a single, common microprocessor via two separate, input-side transmission channels;

determining one of a permissibility and an impermissibility of the transmitted sensor signals within the microprocessor using two prescribed calculation specifications corresponding to one another; and

then

generating for each transmitted sensor signal, via the microprocessor, an output signal representing one of permissibility and impermissibility,

wherein in determining the permissibility of the transmitted sensor signals, individual processing steps of the calculation specifications are decoupled from one another by the microprocessor for the sensor signals and performed separately within the microprocessor,

wherein each generated output signal is output via two separate, output-side transmission channels.

2. The method of claim 1, wherein one of the calculation specifications is configured to be an inverse of the other calculation specification.

3. The method of claim 1, wherein the calculation specifications comprise individual processing steps each corresponding to one another such that each processing step of one calculation specification is configured as an inverse of a corresponding processing step of the other calculation specification.

4. The method of claim 1, wherein the calculation specifications are configured to be in parallel to each other.

5. The method of claim 1, wherein the calculation specifications correspond to one another and comprise individual processing steps such that each individual, corresponding processing step of the calculation specifications is performed in parallel.

6. The method of claim 1, wherein determining one of the permissibility and the impermissibility of the transmitted sensor signals using the calculation specifications comprises ascertaining whether the transmitted sensor signals one of exceed and fall short of a prescribed reference value.

7. The method of claim 1, further comprising, after generating the output signal from the microprocessor:

generating a control signal if at least one output signal represents an impermissible signal.

8. The method of claim 7, wherein the control signal comprises a switch-off signal.

9. A monitoring device configured for dual-channel monitoring of safety-relevant sensor signals, the monitoring device comprising:

a pair of sensors each configured to generate in parallel sensor signals to be monitored;

a pair of input-side transmission channels configured to separately transmit the sensor signals;

a microprocessor configured to receive the transmitted sensor signals from the input-side transmission channels and then process the transmitted sensor signals using individual processing steps to thereby determine one of a permissibility and an impermissibility of the transmitted sensor signals; and

a pair of output-side transmission channels each operatively connected to the microprocessor and configured to generate an output signal representing one of permissibility and impermissibility.

10. The monitoring device of claim 9, wherein the input-side transmission channels are operatively connected to separate inputs of the microprocessor.

11. The monitoring device of claim 9, wherein the output-side transmission channels are operatively connected to separate outputs of the microprocessor.

12. The monitoring device of claim 9, wherein the output-side transmission channels are operatively connected to one another via a component representing a logical OR-connective.

13. A method for dual-channel monitoring hydraulic pressure acting on a friction-clutch of a torque-vectoring-system safety-relevant sensor signals, the method comprising:

measuring the hydraulic pressure and then and converting the measured hydraulic pressure into sensor signals;

transmitting the sensor signals to a single, common microprocessor via two separate, input-side transmission channels;

determining one of a permissibility and an impermissibility of the transmitted sensor signals within the microprocessor using two prescribed calculation specifications which correspond to one another such by ascertaining whether the transmitted sensor signals one of exceed and fall short of a prescribed reference value; and

then

generating for each transmitted sensor signals via the microprocessor an output signal representing one of permissibility and impermissibility based on whether the transmitted sensor signals one of exceed and fall short of a prescribed reference value.

14. The method of claim 13, wherein:

one of the calculation specifications is configured to be an inverse of the other calculation specification;

in determining the permissibility of the transmitted sensor signals, individual processing steps of the calculation specifications are decoupled from one another by the microprocessor for the sensor signals and performed separately within the evaluation unit; and

each generated output signal is output via two separate, output-side transmission channels.

15. The method of claim 13, wherein the calculation specifications comprise individual processing steps each corresponding to one another such that each processing step of one calculation specification is configured as an inverse of a corresponding processing step of the other calculation specification.

16. The method of claim 13, wherein determining one of the permissibility and the impermissibility of the transmitted sensor signals using the calculation specifications comprises ascertaining whether the transmitted sensor signals one of exceed and fall short of a prescribed reference value.

17. The method of claim 13, further comprising, after generating the output signal from the microprocessor:

generating a warning signal if at least one output signal represents an impermissible signal,

wherein the warning signal comprises a switch-off signal.

18. A torque-vectoring-system with a friction clutch configured to transmit a drive torque to a half-shaft of a motor vehicle, the torque-vectoring-system comprising:

a monitoring device configured for dual-channel monitoring of hydraulic pressure acting on the friction-clutch, the monitoring device comprising;

a pair of sensors each configured to measure the hydraulic pressure and then convert the measured hydraulic pressure into sensor signals;

a pair of input-side transmission channels configured to separately transmit the sensor signals;

an evaluation unit configured to receive the transmitted sensor signals from the input-side transmission channels and then process the transmitted sensor signals using individual processing steps to thereby determine one of a permissibility and an impermissibility of the transmitted sensor signals by ascertaining whether the transmitted sensor signals one of exceed and fall short of a prescribed reference value; and

a pair of output-side transmission channels each operatively connected to the evaluation unit and configured to generate an output signal representing one of permissibility and impermissibility based upon whether the transmitted sensor signals one of exceed and fall short of a prescribed reference value,

wherein a warning signal is generated by the monitoring device if at least one output signal represents an impermissible signal.

19. The torque-vectoring-system of claim 18, wherein:

the input-side transmission channels are operatively connected to separate inputs of the evaluation unit;

the output-side transmission channels are operatively connected to separate outputs of the evaluation unit; and

the evaluation unit comprises a microprocessor.