DE102018207542A1 - Method and device for the control of a safety-relevant process, as well as vehicle - Google Patents

Abstract

The invention relies on a special hardware architecture for controlling a security-relevant process. In this case, at least two microcontrollers (256, 356) are used, each of the at least two microcontrollers (256, 356) being designed to control the security-relevant process. It is therefore a redundant system. The two microcontrollers (256, 356) are each equipped with at least two arithmetic cores (252, 254, 352, 354) in which the same algorithm is calculated. The method according to the invention for controlling the security-relevant process is characterized in that at least certain calculation results of the calculation cores (252, 254, 352, 354) are compared, the calculation results being exchanged among the computing cores (252, 254, 352, 354) for checking purposes , Upon detection of a deviation, a majority decision is made over at least three of the distributed arbitrator modules (261, 262, 361, 362). This then causes the control of the safety-relevant process by the microcontroller of the control line, in which the arithmetic core (252, 254, 352, 354) is located, whose arithmetic result of the computational results in at least two other arithmetic cores (252, 254, 352, 354 ), if the deviation is confirmed in at least two of the distributed decision modules (261, 262, 361, 362). Thus, the third instance is realized by distributing the decision modules via the calculation cores, which all check the calculation results, and majority formation and it can be saved another microcontroller.

Description

In today's vehicles mostly electromechanical steering systems ( ) used. If faults occur in the electronics of these steering systems during operation, the steering assistance is switched off or reduced. The driver then steers the vehicle with increased effort.

In the near future autonomous driving systems will be used in the vehicles, which will make it impossible for the driver to be permanently occupied with the driving task and to carry out ancillary activities (reading, sleeping, writing messages ...) while the driving system is active. The driver is therefore no longer available to the steering system as a fallback in the event of a fault. Accordingly, the steering system used in conjunction with an autonomous driving system must still be able to guide the vehicle and set a movement on the rack even after a fault.

• • Level 0: „Driver only“, der Fahrer fährt selbst, lenkt, gibt Gas, bremst etc.
• • Level 1: Bestimmte Assistenzsysteme helfen bei der Fahrzeugbedienung (u.a. ein Abstandsregelsystem - Automatic Cruise Control ACC).
• • Level 2: Teilautomatisierung. U.a. automatisches Einparken, Spurhaltefunktion, allgemeine Längsführung, Beschleunigen, Abbremsen etc. werden von den Assistenzsystemen übernommen (u.a. Stauassistent).
• • Level 3: Hochautomatisierung. Der Fahrer muss das System nicht dauernd überwachen. Das Fahrzeug führt selbstständig Funktionen wie das Auslösen des Blinkers, Spurwechsel und Spurhalten durch. Der Fahrer kann sich anderen Dingen zuwenden, wird aber bei Bedarf innerhalb einer Vorwarnzeit vom System aufgefordert, die Führung zu übernehmen. Diese Form der Autonomie ist auf Autobahnen technisch machbar. Der Gesetzgeber arbeitet darauf hin, Level 3-Fahrzeuge zuzulassen. Die gesetzlichen Rahmenbedingungen wurden dafür bereits geschaffen.
• • Level 4: Vollautomatisierung. Die Führung des Fahrzeugs wird dauerhaft vom System übernommen. Werden die Fahraufgaben vom System nicht mehr bewältigt, kann der Fahrer aufgefordert werden, die Führung zu übernehmen.
• • Level 5: Kein Fahrer erforderlich. Außer dem Festlegen des Ziels und dem Starten des Systems ist kein menschliches Eingreifen erforderlich.

Autonomous driving (sometimes also called automatic driving, automated driving or piloted driving) is the movement of vehicles, mobile robots and driverless transport systems to understand the largely autonomous behavior. There are different gradations of the term autonomous driving. Autonomous driving is also spoken at certain stages even if there is still a driver in the vehicle who, if necessary, only takes over the monitoring of the automatic driving process. In Europe, the various ministries of transport (in Germany the Federal Highway Research Institute was involved) worked together and defined the following levels of autonomy.

• • Level 0: Driver only, the driver drives, steers, accelerates, brakes, etc.
• • Level 1: Certain assistance systems help with vehicle operation (including a cruise control system - Automatic Cruise Control ACC).
• • Level 2: partial automation. Automatic parking, lane keeping, general longitudinal guidance, acceleration, deceleration etc. are taken over by the assistance systems (eg traffic jam assistant).
• • Level 3: high automation. The driver does not have to constantly monitor the system. The vehicle autonomously performs functions such as triggering the turn signal, lane change and lane keeping. The driver can turn to other things, but is prompted by the system if necessary within a warning time to take the lead. This form of autonomy is technically feasible on motorways. Legislators are working to allow Level 3 vehicles. The legal framework has already been created for this purpose.
• • Level 4: full automation. The guidance of the vehicle is permanently taken over by the system. If the system no longer copes with the driving tasks, the driver can be asked to take the lead.
• • Level 5: No driver required. There is no human intervention beyond setting the goal and starting the system.

Automated driving functions from level 3 relieve the driver of responsibility for controlling the vehicle. An involved steering system, which may fail due to a single fault, therefore, needs a suitable fallback to keep the vehicle always in a dynamic driving condition until the driver can intervene again, or even at higher Autonomiestufe to the vehicle without the driver's support Standstill comes. The safety-related systems such as brake systems, vehicle dynamics systems, steering systems etc. for this type of vehicles that provide automated driving from stage 3 offer are always designed to be redundant. They then consist of control cables, both of which can execute the control process so that a component can fail without endangering the driving stability.

Known is the dual redundant design of the steering system electronics. In this case, the input signals are already made available twice in the power steering control unit. The logic part is also duplicated, where a parallel, independent signal processing takes place. This also applies to the power unit, which is also dual and which drives one or more suitable electric motors (e.g., 6-phase or 12-phase motor). If an error occurs in one of the two subsystems, the other subsystem is fundamentally capable of providing at least a reduced steering assistance for generating a rack movement.

One challenge with this structure is that a detected error must also be identified as such with quantifiable security. To meet the safety requirements and to To avoid unjustified power cuts and shutdowns, it is necessary that the fault be confirmed by a separate instance.

However, the other control thread is not alone in this case, since in the case of a decision to the contrary, the probability that this test has given a wrong result is the same as the probability that the error detected by the other control branch was recognized as being defective.

Thus, a third instance is necessary, which in this case determines whether the error is confirmed or not confirmed as such (2 of 3 decision). One possible solution is the use of a third independent microprocessor (aerospace state-of-the-art). However, since this solution involves additional hardware overhead with additional space requirements and increased costs, it has some disadvantages.

From the EP 2 450 261 A2 a device for driving an electric motor for a power steering system is known. In it, a host receives the signals from sensors, recycles them and outputs control signals. In addition, a monitoring computer is provided, which also receives the signals from the sensors and is able to step in the event of a failure or defect of the main computer in its place.

From the DE 10 2016 203 090 A1 a control unit with at least two microcontrollers is known, wherein the at least two microcontrollers communicate with each other via at least one Ethernet connection and are set up to exchange data thereon. In particular, this can ensure that the individual microcontrollers can communicate with one another even in the event of a fault, for example if one of the microcontrollers has a defect or if one of the Ethernet connections fails due to a line break, for example. In one example, the controller has four microcontrollers each having two processor cores connected in a ring.

From the DE 10 2016 205 109 A1 For example, a microprocessor having at least two processor cores is known, wherein a first processor core is configured to perform the functions hardware-implemented by specially configured hardware, and a second processor core is configured to perform the functions software-implemented by executing software. The first processor core is configured to monitor and / or secure a function performed by the second processor core. The monitoring is based on the use of redundant hardware.

In the context of the invention, it has been recognized that the security requirement that an error must be confirmed by a separate instance is not easy to implement without additional hardware complexity.

The object of the invention is to find a solution for implementing a further independent entity without having to use an additional processor.

This object is achieved by a method for controlling a safety-relevant process according to claim 1, a device for controlling a safety-relevant process according to claim 7 and a motor vehicle according to claim 11

The dependent claims contain advantageous developments and improvements of the invention according to the following description of these measures.

The invention is based on a special hardware architecture. At least two microcontrollers are used for controlling a safety-related process, wherein each of the at least two microcontrollers is designed to control the safety-relevant process. It is therefore a redundant system. The two microcontrollers are each equipped with at least two arithmetic cores, in which the same algorithm is calculated. The method according to the invention for controlling the security-relevant process is characterized in that at least certain calculation results of the calculation cores are checked in decision modules distributed over the computing cores, the calculation results being exchanged among the computing cores for verification and compared with one another. Upon detection of a deviation, a majority decision is made over at least three of the distributed arbitrator modules. This then causes the control of the safety-relevant process is prevented by the microcontroller of the control line, in which the arithmetic core is located, whose calculation result differs from the computational results in at least two other cores, if the deviation is confirmed in at least two of the distributed decision modules. Thus, the third instance is realized by distributing the decision modules via the calculation cores, which all check the calculation results, and majority formation and it can be saved another microcontroller.

The decision modules are realized as "virtual" or "logical" decision makers, so are not physically present in a block, but are executed distributed as software modules in the cores of the two existing microcontroller.

The suppression of the control of the safety-relevant process can be advantageously carried out by switching off or partial shutdown of the control of the safety-relevant operation of the microcontroller itself, in which the arithmetic core is located, was found in the calculation result, the deviation. This corresponds to an easy-to-implement variant. In another embodiment, the embodiment may also be such that a computing core in the other microcontroller performs the shutdown.

It is particularly advantageous for the implementation when the control process is divided into functional groups and a review of a calculation result is provided for each functional group, for each function group a similar decision module is provided and the result of the review by a decision module is passed on to the next function group , This modular structure of the control software greatly simplifies the development process. In addition to the necessary function, the blocks, which are always executed identically, are implemented to compare the results and to make decisions. Especially in the software, it is possible to use a once developed, tested and released structure multiple times, which significantly reduces development costs. The exact number of functional groups can be advantageously determined based on the security requirements regarding the error coverage.

The proposal can be used especially for the application of controlling a steering operation in a vehicle. A useful division into functional groups consists in the division into the functional groups: processing of the input signals, calculation of the tie rod position or the target engine torque for adjusting the steering angle, detection of the actual output by the microcontroller control signal or detection of the actual output from a converter control signal.

In the steering system, the control operation is that certain phases of a multi-phase electric motor for the steering operation are driven by each of the at least two microcontrollers to effect a rack movement in accordance with the steering command. In the event of a fault, control of the steering operation is prevented by disconnecting the connection between the microcontroller in which the arithmetic core identified as defective is located, and the associated phases of the multiphase electric motor. For this purpose, a phase separator can be used.

For a corresponding device for controlling a safety-relevant process, the corresponding measures are advantageous. The device is constructed redundantly with at least two microcontrollers, and each of the at least two microcontrollers is designed for the control of the safety-relevant process. It is advantageous according to the proposal, if the two micro-controllers each have at least two computing cores on which the same control functions are calculated. Each calculation kernel has a comparator in which the calculation results exchanged under the calculation kernels are compared. Furthermore, each calculation kernel has a decision module in which a majority decision is formed with the verification results of at least three of the calculation kernels. By majority decision is confirmed that an error occurs in one of the cores, and there is a suppression of the control of the security-relevant operation by the microcontroller of the control line, in which the arithmetic core is located, in which the error was detected.

For the data exchange at least one communication bus is provided, which connects the at least two microcontrollers with each other. This can be advantageously designed in the form of an Ethernet communication bus, FlexRay communication bus or CAN (-FD) communication bus. CAN-FD stands for Controller Area Network-Flexible Data Rate.

A further advantageous measure is that at least one of the computation cores of the microcontroller is equipped with lockstep core, which is thus able to detect its own random arithmetic errors. The result of this core can therefore be considered reliable.

The device can be advantageously used to control a steering operation in a vehicle.

The invention can be used in all vehicles with an automated driving function from stage 3 (according to VDA).

An embodiment of the invention is illustrated in the drawings and will be explained in more detail with reference to FIGS.

• 1 das typische Cockpit eines Fahrzeuges;
• 2 eine Gesamtansicht eines typischen Lenksystems für ein Fahrzeug;
• 3 ein Blockschaltbild der Kfz-Elektronik des Fahrzeuges;
• 4 ein Blockschaltbild des Lenkhilfe-Steuergerätes;
• 5 ein erstes Blockschaltbild der beiden Microcontroller in dem Lenkhilfe-Steuergerät;
• 6 ein zweites Blockschaltbild der beiden Microcontroller in dem Lenkhilfe-Steuergerät mit einer Ansicht der logischen Entscheiderstufe;
• 7 ein drittes Blockschaltbild der beiden Microcontroller in dem Lenkhilfe-Steuergerät mit einer Abfolge einer Fehlerüberprüfung; und
• 8 ein Prinzipbild für die Aufteilung der Steuerungsfunktion in Funktionsgruppen.

Show it:

• 1 the typical cockpit of a vehicle;
• 2 an overall view of a typical steering system for a vehicle;
• 3 a block diagram of the vehicle electronics of the vehicle;
• 4 a block diagram of the power steering control unit;
• 5 a first block diagram of the two microcontroller in the power steering control unit;
• 6 a second block diagram of the two microcontroller in the power steering control unit with a view of the logical decision stage;
• 7 a third block diagram of the two microcontroller in the power steering controller with a sequence of error checking; and
• 8th a schematic diagram for the distribution of the control function in function groups.

The present description illustrates the principles of the disclosure of the invention. It will thus be understood that those skilled in the art will be able to devise various arrangements which, while not explicitly described herein, are intended to embody principles of the invention and to be equally limited in scope.

1 shows the typical cockpit of a vehicle 10 , Shown is a passenger car car , As a vehicle 10 However, any other vehicles would also be considered. Examples of other vehicles are: buses, commercial vehicles, especially trucks truck , Agricultural machinery, construction machinery, rail vehicles, etc. The use of the invention would be generally in land vehicles, rail vehicles, watercraft and aircraft possible.

The essential for the invention component in the vehicle 10 is the steering system from which in the cockpit the steering wheel 12 with parts of the steering column can be seen. Next is in 1 a display unit of an infotainment system with reference number highlighted. It is a touch-sensitive screen 20 which is installed in the center console.

The touch-sensitive screen 20 serves in particular for the operation of functions of the vehicle 10 , For example, a radio, a navigation system, a playback of stored music pieces and / or an air conditioning system, other electronic devices or other comfort functions or applications of the vehicle 10 to be controlled. In summary, there is often talk of an "infotainment system". An infotainment system referred to in motor vehicles, specifically car , the merger of car radio, navigation system, handsfree, driver assistance systems and other functions in a central control unit. The term infotainment is a boxword word composed of the words information and entertainment (entertainment). To operate the infotainment system is mainly the touch-sensitive screen 20 ("Touch screen"), this screen 20 in particular, by a driver of the vehicle 10 but also by a passenger of the vehicle 10 well viewed and can be served. Below the screen 20 In addition, mechanical controls, such as buttons, knobs, or combinations thereof, such as rotary switches, in an input unit 50 be arranged. Typically, a steering wheel control of parts of the infotainment system is possible. For this, the vehicles are equipped with a so-called multifunction steering wheel operation. This unit is not shown separately but is considered part of the input unit 50 considered.

Back to the steering system of the vehicle 10 , An overall view of the steering system shows 2 , The essential components are the steering wheel 12 , the steering column 14 , the torque sensor 15 , the electric motor 16 , the rack 18 and the power steering controller 186 ,

3 schematically shows a block diagram of the automotive electronics and, by way of example, some subsystems or applications of the infotainment system. The infotainment system includes: the touch-sensitive display unit 20 , a computing device 40 , an input unit 50 and a memory 60 , The display unit 20 includes both a display area for displaying variable graphical information and a user interface (touch-sensitive layer) arranged above the display area for inputting commands by a user.

The display unit 20 is via a data line 70 with the computing device 40 connected. The data line can be designed according to the LVDS standard, corresponding to Low Voltage Differential Signaling. Via the data line 70 receives the display unit 20 Control data for controlling the display area of the touchscreen 20 from the computing device 40 , Via the data line 70 also control data of the entered commands from the touch screen 20 to the computing device 40 transfer. With the reference number 50 is the input unit called. They include the already mentioned control elements such as buttons, rotary knobs, sliders or rotary control, with the help of which the operator can make inputs via the menu. Input is generally understood as selecting a selected menu item, as well as changing a parameter, turning a function on and off, and so on.

The storage device 60 is via a data line 80 with the computing device 40 connected. In the store 60 is a pictogram directory and / or symbol directory deposited with the pictograms and / or symbols for possible displays of additional information.

The other parts of the infotainment system camera 150 , Radio 140 , Navigation device 130 , Phone 120 and instrument cluster 110 are over the data bus 100 connected to the device for operating the infotainment system. As a data bus 100 the high-speed version of the CAN bus according to ISO standard 11898-2 is considered. Alternatively, for example, the use of a based on Ethernet technology bus system such as IEEE 802.03cg in question. Bus systems in which the data is transmitted via optical fibers can also be used. Examples are the MOST bus (Media Oriented System Transport) or the D2B Bus (Domestic Digital Bus). For inbound and outbound wireless communication is the vehicle 10 with a communication module 160 fitted. This module is often referred to as an on-board unit. It can be designed for mobile communication, eg according to LTE standard, according to Long Term Evolution. It can also be designed for WLAN communication, according to wireless LAN, whether for communication with in-vehicle devices or for vehicle-to-vehicle communication, etc.

The communication bus 100 of the infotainment system is with a gateway 30 connected. Connected to it are the other parts of the car electronics. First, the communication bus 104 of the drive train, which is typically implemented in the form of the CAN bus. As examples, the control units of the powertrain engine control unit 172 , ESP control unit 174 and gearbox control unit 176 called and shown. Next the communication bus 102 for driver assistance systems, which may be designed in the form of the FlexRay bus. Three driver assistance systems are shown: a driver assistance system 182 for automatic distance control ACC according to Adaptive Cruise Control, a driver assistance system DCC for adaptive chassis control 184 , according to Dynamic Chassis Control and a power steering system 186 , Furthermore, there is still a communication bus 106 to the gateway 30 connected. This connects the gateway 30 with an on-board diagnostic interface 190 , The task of the gateway 30 This is the format conversions for the different communication systems 100 . 102 . 104 . 106 to do so that data can be exchanged with each other.

The following is more specific to the power steering controller 186 received.

It is, as already mentioned, constructed redundantly for security reasons. The steering operation is controlled by two parallel strands. The parts are input 220 . 320 , Logic part 250 . 350 and power section 270 . 370 each double. Also shown is the polyphase electric motor 410 that of the power steering controller 186 is controlled. In this case, the electric motor is driven to full steering assistance from both strands. If an error occurs in one of the two strings, the control is prevented by this strand for safety's sake. As a result, the driver does not get full steering assistance more, but the steering function remains so far by the control of the other strand ensures that the vehicle 10 can still safely be directed to the roadside or in an emergency stop or on a parking lot. The system is designed so that the driver does not have to intervene. The steering system can still perform the steering automatically. After this emergency stop it is possible to continue driving with manual control of the steering.

A realization could also be designed so that both control strands can individually provide the full steering assistance.

Thus, it would also be possible for the vehicle after a fault occurred in a strand even with the remaining functional strand automatically stops the drive to "ignition off". For safety reasons, however, a repeated switching on of the automatic driving function would then be blocked.

In the entrance electrical parts 228 and 328 there is one filter unit each 228 and 328 in which, for example, the chokes and filters are arranged to compensate for disturbances in the supply voltage. The supply voltage is at the power connection 222 on. The contact 226 used for connection with the torque sensor 15 of the steering system. This one is on the steering column 14 attached and read directly. In the future, such a sensor could be omitted. It already under the keyword Steerby-Wire steering systems are developed, which manage without mechanical steering column. Then comes the information in the power steering control unit 186 which forces act on the steering. With the torque sensor 15 Typically, the required data of angle of rotation, direction of rotation and torque are electronically recorded. This is important to be able to determine what force the electric motor 410 must apply in order to support the steering operation. It should be noted that the steering process must be controlled very sensitively. Further information plays an important role, eg the speed of the vehicle. This input signal from the torque sensor is sent internally to both microcontrollers 250 and 350 forwarded. Furthermore, every microcontroller 250 . 350 separately to the communication bus 102 connected. The power steering control unit 186 therefore has two connections for the vehicle bus. In this way, the steering function is guaranteed even if there is a defect in one of the bus connections or the leads. The logic parts 250 and 350 of the power steering control unit 186 essentially each contain one of the two microcontrollers 256 and 356 , The microcontroller 256 includes the two cores 252 and 254 , The microcontroller 356 includes the two cores 352 and 354 , The computing cores of a microcontroller are interconnected so that they can exchange data, in particular calculation results. For this purpose, a parallel bus is typically used accordingly. Between all four cores 252 . 254 . 352 . 354 the microcontroller 256 . 356 Data can also be exchanged with each other. This is also necessary with the security concept presented here, so that the data on the basis of which the decision is to be made exist in the same way on all four cores. In one embodiment of the invention, the communication bus 259 between the two microcontrollers 256 . 356 as an Ethernet bus. In another embodiment, it can also be designed as a FlexRay or CAN-FD communication bus. In 4 It is shown that each processor core has two Ethernet ports, through which it is connected to the two cores of the other microcontroller. A special feature is that the cores 252 and 352 with so-called lockstep calculation cores 253 and 353 are equipped. These correspond to parallel computers that process the exact same program. The parallel connection is not the performance increase, but the control. A comparison of the results of the individual calculation cores takes place, which takes place in individual, timely and non-interruptible steps. The redundancy achieved in this way allows hardware-side failures to be detected in one of the processor cores and to react to them, as is the case with a dual-core in lockstep mode.

Also the power unit of the power steering control unit 186 is built in parallel. The control signal for controlling the electric motor 410 is from the respective microcontroller 256 . 356 in the form of PWM signals, corresponding to "pulse width modulation" output. These are in the power section 270 and 370 in corresponding converter circuits 272 . 274 and 372 . 374 implemented. In 4 the electric motor is shown as a 12-phase motor. Depending on which phases are controlled, so more or less force is transmitted to the rack. When all phases are driven, the greatest force is applied. In order to be able to control this sensitively, are per microcontroller 256 . 356 two converter circuits 272 . 274 respectively. 372 . 374 intended. These are so-called Gate Drive Units GDU, which convert the PWM signal into corresponding signals for controlling an amplifier (Power MOSFET). Before the drive signals to the electric motor 410 pass, they still pass a phase separation circuit 276 . 278 respectively. 376 . 378 , In each case a shutdown of the control of the electric motor via the phase separation circuits 410 done in the appropriate path. According to the drawn connections between microcontrollers and phase separation circuits, a shutdown of the control can be done only by the microcontroller of the respective control line.

In the following figures, the same reference numerals denote the same components as in FIG 4 , The 5 illustrates the process of mutual data exchange among the cores in a step of verifying the computational results after a so-called data event. The control process consists of different phases. Including the detection and processing of the input signals, the calculation of the target engine torque by the steering functions and the formation of the control signals by the engine controller. After each step, the processing or calculation results can be checked. Further reviews could be done with intermediate results. After each intermediate result or at the end of one of the mentioned stages, a data event will be generated in each calculation kernel 251 . 351 . 255 . 355 triggered. The occurrence of a data event then triggers the exchange of the predetermined processing or computational results among the cores. There is a comparison of the results. If there are deviations, there must be an error in one of the cores. How to decide in which strand the error is present is the subject of the following considerations. Also in 5 is shown to be a mutual program flow control 264 between each two cores takes place. This can be realized with appropriately designed watchdog circuits.

6 shows the use of a logical decision maker 260 who, so to speak, serves as a third instance for the purpose of deciding on which microcontroller 256 . 356 the error has occurred. The logical decision maker is not an additional hardware component. It is rather a decision maker, which is realized with software. Part of the software for the decision maker will be installed on each core of the computer. The corresponding parts are in the 6 with the reference numerals 261 . 262 . 361 . 362 designated.

In 7 the expiration of the review is shown. After the occurrence of the data event, the calculation results are interchanged. When comparing the calculation results is in the calculator 252 found a deviation, s. the step ED , In the logical decision maker 260 next to it are the results of the comparisons in the cores 352 and 254 considered. The logical decision maker 260 forms a majority decision. This happens as follows. In each arithmetic kernel is compared, which computational result deviates, s. the steps EC1 and EC2 , The following tables illustrate the process: Comparison in μCA RK1 μCA RK2 μCB RK1 deviation in percent μCA RK1 μCA RK1 μCA RK1

Here it was found in the comparisons in all cores that the result is in the calculation kernel 252 from the results in the cores 352 and 254 differs. This will be done by the decision makers 261 . 262 . 361 recognized. So there is a clear majority for the calculation kernel 252 has a defect, and the decision maker 262 then takes care of the step EH for controlling the electric motor 410 through the microcontroller 256 is prevented. This is done with the phase separation circuits 276 . 278 ,

In the further case considered, the results of the comparisons are as follows: Comparison in μCA RK1 μCA RK2 μCB RK1 deviation in percent none μCA RK1 μCA RK1

Here was in the comparison in calculation kernel 252 no deviation was found, however, in the comparisons in the cores 262 and 361 was found to be a deviation in the calculation result of the calculation kernel 252 is present. In the decision modules ( 261 . 262 . 361 ) is again a majority decision with that of the other decision modules ( 261 . 262 . 361 ). This is a 2: 1 majority and it will turn the microcontroller 256 from the electric motor 410 separated.

Other constellations are possible, but they need not be considered in detail here. Because there are always three decider modules involved, there is always unanimity if everything is ok or a 2/3 majority if one of the cores is affected by a defect. If no deviation is detected, everything is fine and there is no shutdown. The comparison results in three calculation cores are always used to check the plausibility of a detected deviation. Because the decision modules ( 261 . 262 . 361 . 362 ) via the computing cores ( 252 . 254 . 352 . 354 ) in which the comparison results are analyzed, a functioning decision module of a microcontroller is always active in order to shut off the strand where the deviation occurs.

In the following, a particularly advantageous modular design of the control software is presented. In this case, the comparison process and the decision module is taken into account. The modular structure is in 8th shown. The tax procedure is divided into functional groups. The function groups may correspond to the above-mentioned phases of the control process, ie the detection and processing of the input signals, the calculation of the target engine torque by the steering functions and the formation of the drive signals by the engine controller. Two functional groups FG1 and FG2 are shown as an example. The data event will check the function FG1 causes. The mentioned comparison of the calculation results takes place in the comparator FG1V instead of. To do this, the computational results from the other two cores need to be compared to the comparator FG1V be transmitted. The comparison results are in the decision module FG1E evaluated. Therein the described majority decision is formed. At the same time the decision module gets FG1 E also the feedback from the other two decision modules in the form, whether they have recognized an error or not. So they then receive confirmation for their own majority decision. Thus, a further majority decision is formed therein, namely on whether the error was also determined by at least one further decision module. This safeguards the function of the decision module. In addition, the results of the other decision modules are sent to the decision module FG1E returned. If no deviation has been detected and no error detection is reported by the other decision modules, the output of the decision module becomes FG1 E is set to zero, which means that the test did not detect a malfunction. Otherwise, the output will be set to one, indicating that a malfunction has been detected. Forwarding the information to the following function group FG2 ensures that the error is also output there. At the end of the control process, therefore, the error still appears and the decision module of the last functional group of the control process will finally cause the control of the faulty strand to be switched off.

• - Positive Logik: eine logische 1 bedeutet alles ist in Ordnung, dann besteht der Vergleicher aus logischen UND Gattern
• - Negative Logik: eine logische 0 bedeutet alles ist in Ordnung, dann besteht der Vergleicher aus logischen ODER Gattern. Beide Varianten haben Vor- und Nachteile und es wird nach Bedarf entschieden, welche Logik für das jeweilige Projekt geeignet ist.

In order to implement the decision-making structure in this way, the software and electronics are divided into function groups, on each of which, in addition to the necessary function, the blocks of identical design are implemented for comparison of results and for decision-making. The result of the decision makers can follow positive or negative logic. Where:

• - Positive logic: a logical 1 means everything is fine, then the comparator consists of logical AND gates
• - Negative logic: a logical 0 means everything is fine, then the comparator consists of logical OR gates. Both variants have advantages and disadvantages and it is decided as needed which logic is suitable for the respective project.

Especially in the software, it is possible to use a once developed, tested and released structure multiple times, which significantly reduces development costs.

All examples mentioned herein as well as conditional formulations are to be understood without limitation to such specifically mentioned examples. For example, it will be appreciated by those skilled in the art that the block diagram presented here represents a conceptual view of exemplary circuitry. Similarly, it will be appreciated that an illustrated flowchart, state transition diagram, pseudocode, and the like are various variants for representing processes that may be stored substantially in computer-readable media and thus executed by a computer or processor.

It should be understood that the proposed method and apparatus may be implemented in various forms of hardware, software, firmware, special purpose processors, or a combination thereof. Special purpose processors may include Application Specific Integrated Circuits (ASICs), Reduced Instruction Set Computer (RISC), and / or Field Programmable Gate Arrays (FPGAs). Preferably, the proposed method and apparatus is implemented as a combination of hardware and software. The software is preferably installed as an application program on a program storage device. Typically, it is a machine platform based on a computer platform that includes hardware, such as one or more central processing units (CPU), random access memory (RAM), and one or more input / output (I / O) interface (s). The computer platform also typically installs an operating system. The various processes and functions described herein may be part of the application program or part that is executed via the operating system.

The disclosure is not limited to the embodiments described herein. There is room for various adjustments and modifications that would be considered by those skilled in the art, as well as to the disclosure.

LIST OF REFERENCE NUMBERS

10

vehicle

20

touch-sensitive display unit

30

gateway

40

computer unit

50

input unit

60

storage unit

70

Data line to the display unit

80

Data line to the storage unit

90

Data line to the input unit

100

1st data bus

102

2nd data bus

104

3rd data bus

106

4. Data bus

110

instrument cluster

120

phone

130

navigation device

140

radio

150

camera

160

communication module

172

Engine control unit

174

ESP control unit

176

Transmission controller

182

Distance control ECU

184

Suspension control unit

186

Steering control device

190

On-board diagnostic connector

220

Electrical input

222

power connection

224

DME

226

Communication bus

228

filter stage

250

logic part

251

Data validation event

252

solver 1

253

Lockstep unit

254

solver 2

256

microcontroller 1

257

Operating system calculation kernel 1

258

Operating system calculation kernel 2

259

communication bus

260

Logical decision maker level

261

decision module E1

262

decision module E2

264

Program flow control 1

270

power unit

272

GDU converter 1

274

GDU converter 2

276

phase separator 1

278

phase separator 2

320

Electrical input

322

power connection

326

Communication bus

328

filter stage

350

logic part

352

solver 1

353

Lockstep unit

354

solver 2

356

microcontroller 2

361

decision module E3

362

decision module E4

364

Program flow control 2

370

power unit

372

GDU converter 1

374

GDU converter 2

376

phase separator 1

378

phase separator 2

410

Polyphase electric motor

ED

Error detection event

EC1

Error check in decision module E2

EC2

Error check in decision module E3

EH

error handling

FG1

1st function group

FG2

2nd function group

FG1V

Comparator function group 1

FG2V

Comparator function group 2

FG1F

function 1

FG2F

function 2

FG1E

Decision module Function group 1

FG2E

Decision module Function group 2

FG1M

Majority images Function group 1

FG2M

Majority images Function group 2

FG1W

Result forwarding function group 1

FG2W

Result forwarding function group 2

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• EP 2450261 A2 [0009]
• DE 102016203090 A1 [0010]
• DE 102016205109 A1 [0011]

Claims (11)

Method for controlling a safety-related process, wherein at least two microcontrollers (256, 356) are used for the control, wherein each of the at least two microcontrollers (256, 356) is designed for controlling the safety-relevant process, wherein the two microcontrollers (256, 356) each comprise at least two calculation cores (252, 254, 352, 354) in which the same algorithm is calculated, characterized in that at least certain processing results, called calculation results below, of the calculation cores (252, 254, 352, 354) in the calculation cores distributed decision modules (261, 262, 361, 362) are checked, for verification, the calculation results among the cores (252, 254, 352, 354) are exchanged and compared with each other, and upon detection of a deviation, a majority decision on at least three the distributed decision module (261, 262, 361, 362) is formed, the type s the control of the security-relevant operation by the microcontroller (256) of the control line, in which the arithmetic core is located whose computation result differs from the computational results in at least two other compute cores, is suppressed if the deviation in at least two of the distributed decider modules (261, 262 , 361, 362). Method according to Claim 1 wherein a decider module (261, 262, 361, 362) is software installed on each of the processor cores (252, 254, 352, 354). Method according to Claim 1 or 2 , wherein the suppression of the control of the safety-relevant process by switching off or partial shutdown of the control of the safety-relevant operation by the microcontroller (256) in which the arithmetic core (252) is located, the calculation result deviates, is carried out itself. Method according to one of the preceding claims, wherein the control process is divided into function groups (FG1, FG2), and a check of a calculation result is provided for each function group (FG1, FG2), wherein for each function group (FG1, FG2) a similar decision module (FG1E , FG2E) is provided and wherein the result of the review by a decision module (FG1E, FG2E) is passed on to the next function group (FG1, FG2). Method according to Claim 4 wherein the safety-relevant operation is a steering operation for a vehicle (10) and at least one or more of the following functional groups (FG1, FG2) are formed: processing of the input signals, calculation of the tie rod position or the target engine torque for adjusting the steering angle, detection of the actual from the microcontroller (256) output control signal or detection of the actual output from a converter unit (272, 274, 372, 374) control signal. Method according to Claim 5 wherein certain phases of a multi-phase electric motor (410) for the steering operation of each of the at least two micro-controllers (256, 356) are controlled and the control of the steering operation by disconnecting the connection between the microcontroller (256), in which the detected as faulty arithmetic core is located, and the associated phases of the polyphase electric motor (410) is prevented. Device for the control of a safety-related process, wherein the device is constructed redundantly with at least two microcontrollers (256, 356), so that each of the at least two micro-controllers (256, 356) is designed for the control of the safety-relevant process, wherein the two micro-controllers (256 , 356) in each case have at least two calculation cores (252, 254, 352, 354), characterized in that each calculation core (252, 254, 352, 354) has a comparator (FG1V, FG2V), in which the one of the calculation cores (252 , 254, 352, 354), wherein each calculation kernel (252, 254, 352, 354) further comprises a decision module (261, 262, 361, 362) for forming a majority decision with the verification results of at least three of the calculation kernels ( 252, 254, 352, 354) and that a suppression of the control of the safety-relevant operation by the microcontroller (256) of the control line, in which the Rechenke is located where the deviation was detected and confirmed by majority decision takes place. Device after Claim 7 in which at least one communication bus (259) is provided which connects the at least two microcontrollers (256, 356) for data exchange, Device after Claim 7 or 8th wherein at least one of the computing cores (252, 254, 352, 354) of the microcontrollers (256, 356) is equipped with Lockstep core. Device according to one of Claims 7 to 9 wherein the safety-relevant process is a steering operation of a vehicle (10) and the device is installed in a vehicle (10). Vehicle, characterized in that the vehicle (10) is a device according to one of Claims 7 to 10 having.

Images