Monitoring computer in a control device

• US 9,068,527 B2
• Filed: 12/20/2010
• Issued: 06/30/2015
• Est. Priority Date: 12/18/2009
• Status: Active Grant

• Current Assignee: Vitesco Technologies GmbH (Continental AG)
• Original Assignee: Conti Temic Microelectronic GmbH (Continental AG)
• Inventors: Jacobi, Malte, Bhm, Edwin
• Primary Examiner(s): TRUONG, LOAN
• Application Number:
  US13/515,327
• Publication Number:
  US 20120272104A1
• Time in Patent Office: 1,653 Days
• Field of Search: 714/47.1, 701/1
• US Class Current: 1/1
• CPC Class Codes: F02D 2041/1411 using a finite or infinite state machine, automaton or state graph for controlling or modelling
• CPC Class Codes: F02D 41/22 Safety or indicating devices for abnormal conditions in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809
• CPC Class Codes: F02D 41/2403 using essentially up/down counters
• CPC Class Codes: F02D 41/266 the computer being backed-up or assisted by another circuit, e.g. analogue
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/076 by exceeding a count or rate limit, e.g. word- or bit count limit
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40

Abstract

A monitoring computer for monitoring a processor, on which processor a computing element is executed. The computing element essentially includes three program modules by which the performance of the motor vehicle is influenced. The processor includes a functional computer and a monitoring computer that is physically independent of the functional computer, wherein the monitoring computer includes two monitoring units that are independent of each other.

Claims

1. A monitoring computer for monitoring a processor, on which processor a computing element is executed,

wherein the processor essentially comprises a functional computer apart from the monitoring computer,

wherein the computing element comprises a functional module, a safety module and a monitoring module, all modules can be executed on the functional computer and the monitoring computer communicates with at least the monitoring module on the functional computer by a dialog method via an interface,

wherein the functional computer and the monitoring computer are physically independent of each other and the monitoring computer comprises a first monitoring unit and a second monitoring unit that are independent of each other,

wherein for monitoring the proper processing of the program instructions of the functional computer, one check each can be performed in the functional computer by each monitoring unit by a corresponding monitoring element, and wherein a first check can be performed in the safety module of the computing element by the first monitoring unit via the corresponding monitoring element in the corresponding test path and a second check can be performed in the monitoring module of the computing element by the second monitoring unit via the corresponding monitoring element in the corresponding test path.

2. The monitoring computer according to claim 1, wherein a memory check and a program flow check can be performed in the safety module by the first monitoring unit as a first check.

3. The monitoring computer according to claim 1, wherein an instruction set test can be performed in the monitoring module by the second monitoring unit as a second check.

4. The monitoring computer according to claim 1, wherein an error counter can be operated in the event of an error occurring in the check and a system reaction can be triggered by the monitoring computer independently of the functional computer when freely programmable error reaction thresholds are exceeded.

5. The monitoring computer according to claim 4, wherein error counting is asymmetrical.

6. The monitoring computer according to claim 1, wherein a response time, a response time window, a disable threshold and a reset threshold can be fixed in the computing element apart from other parameters when the corresponding monitoring unit is configured when the processor is initialized, wherein it is possible that the parameters are not the same for each monitoring unit, said fixing being performed by a state machine, respectively.

7. The monitoring computer according to claim 6, wherein the response time is freely configurable in the range between 1 ms and 255 ms.

8. The monitoring computer according to claim 6, wherein the response time window is in the range between 1 ms and 255 ms, wherein the ratio that the response time bears to the response time window is freely scalable.

9. The monitoring computer according to claim 1, wherein the outputs of the monitoring computer are complementary outputs.

10. The monitoring computer according to claim 1, wherein a switch-off path check is a separate state in the state machine.

11. The monitoring computer according to claim 1, wherein a continuous CRC test can be performed in the background.

12. The monitoring computer according to claim 1, wherein random number generation for the dialog method is performed by a linear feedback shift register.

13. A processor with a functional computer and a monitoring computer,

wherein a computing element for controlling at least one function of a motor vehicle dependently on at least one input quantity is executed on the processor and the monitoring computer communicates with the functional computer by a dialog method via an interface,

wherein the computing element comprises a functional module, a safety module and a monitoring module,

wherein the functional computer and the monitoring computer are physically independent of each other and the monitoring computer comprises a first monitoring unit and a second monitoring unit that are independent of each other,

wherein for monitoring the proper processing of the program instructions of the functional computer, one check each can be performed in the functional computer by each monitoring unit by a corresponding monitoring element, and

wherein a first check can be performed in the safety module of the computing element by the first monitoring unit via the corresponding monitoring element in the corresponding test path and a second check can be performed in the monitoring module of the computing element by the second monitoring unit via the corresponding monitoring element in the corresponding test path.

14. A method for monitoring a processor according to claim 13, wherein the functional computer and the monitoring computer are physically independent of each other and the monitoring computer comprises two monitoring units that are independent of each other, wherein for monitoring the proper processing of the program instructions of the functional computer, one check each is performed in the functional computer by each monitoring unit by a corresponding monitoring element.