DE102009045000A1 - Method and data output monitoring unit for ensuring data output from error-free data of a data processing unit to a data bus - Google Patents

Abstract

The invention relates to a data output monitoring unit (170, 195) for ensuring error-free output of data from a data processing unit (100) to a data bus (120), wherein the data output monitoring unit (170, 195) comprises a monitoring unit (170) having an interface (180) for receiving control data from the data processing unit (100). The data monitoring unit (170, 195) further comprises a forwarding unit (195) for controlling a forwarding of data of the data processing unit (100), wherein the forwarding unit (195) is implemented in order to not forward the data of the data processing unit (100) to a plurality of data circuits (110) of the data bus (120) if erroneous operation of the data processing unit (100) has been detected by the monitoring unit (170) on the basis of the control data received from the data processing unit (100).

Description

State of the art

The present invention relates to a method for ensuring data output from error-free data of a data processing unit to a data bus according to claim 1, a data output monitoring unit according to claim 6, a controller according to claim 7, and a computer program product according to claim 8.

There are many safety-critical applications in ECUs that use watch-dog mechanisms (ie, monitoring mechanisms). In this case, an independent hardware module is used, which monitors a main microcontroller (also referred to simply as a "controller"). In an incorrect operation of the watch-dog mechanism by the controller is z. For example, if the microcontroller is reset (i.e., a reset is performed) or a safety-critical function controlled by the microcontroller is disabled (for example, in a microcontroller that controls an airbag, tripping is suppressed).

However, as networking of components connected to a single data bus increases (eg, data busses installed in vehicles and providing data to a variety of sensors and controllers), this information, which may be transmitted from a malfunctioning microcontroller to the computer Data bus can be triggered, even critical situations. For example, a data packet that is erroneously output from the malfunctioning airbag trip unit to the data bus at another unit connected to that data bus may result in safety-critical misconduct. For example, a falsely sent data packet may result in a command to shut down the servo pump, the gasoline pump, or as a trigger command for issuing an emergency call, all of these functions being over a common data bus such as the CAN bus be controlled in the vehicle. Likewise, sensor values which are necessary for the correct functioning of the electronic stabilization program (ESP) can be distributed via such a common data bus, so that a disruption of the data communication by a malfunctioning microcontroller can also have serious consequences in the ESP control and thus a Danger to the driving safety of the vehicle. If a malfunctioning unit delivers incorrect values to the data bus, it can have serious consequences and even accidents.

Independent security semiconductors, which are installed and wired, for example, in a separate housing, can realize the said watch-dog mechanisms in order to actively activate a safety-critical function. In the airbag system, such a safety semiconductor even separately determine a fire or triggering decision to trigger the airbag, which must be met in addition to a good and error-free operation of the watchdog mechanism by the microcontroller so that airbag power amplifiers actually activated or . "to be fired. A so-called "Enable" line is used to allow the energization of the airbag output stages via suitable hardware components. Although an evaluation of the data communication on the data bus for error detection would in principle be possible, however, the semantics of the data transmission or the evaluation of the data packets on the data buses is usually too complex to be able to deactivate timely certain critical functions by the hardware components.

The DE 10 2005 048 037 A1 discloses a method for controlling at least one task by means of a control program that monitors a runtime of the at least one task, wherein the control program terminates the at least one task if the runtime of the at least one task exceeds a predetermined time duration. However, this termination of a task requires a period of time in which a data processing unit can still output faulty data packets to the common data bus, so that the connected units can nevertheless still be disturbed.

Disclosure of the invention

Against this background, the present invention provides a method, furthermore a data output monitoring unit, a control unit which uses the method and finally a corresponding computer program product according to the independent patent claims. Advantageous embodiments emerge from the respective subclaims and the following description.

• – Feststellen eines fehlerhaften Betriebs der Datenverarbeitungseinheit durch eine von der Datenverarbeitungseinheit unabhängige Überwachungseinheit; und
• – Sperren einer Ausgabe von Daten der Datenverarbeitungseinheit auf eine Mehrzahl von Datenleitungen eines Datenbusses, wenn die Überwachungseinheit den fehlerhaften Betrieb der Datenverarbeitungseinheit festgestellt hat.

The present invention provides a method for ensuring data output from error-free data of a data processing unit to a data bus, the method comprising the steps of:

• - detecting an erroneous operation of the data processing unit by an independent of the data processing unit monitoring unit; and
• - Disabling an output of data of the data processing unit on a plurality of data lines of a data bus, when the monitoring unit has detected the erroneous operation of the data processing unit.

• – eine Überwachungseinheit mit einer Schnittstelle zum Empfangen von Kontrolldaten von der Datenverarbeitungseinheit;
• – eine Weiterleitungseinheit zur Steuerung einer Weiterleitung von Daten der Datenverarbeitungseinheit, wobei die Weiterleitungseinheit ausgebildet ist, um die Daten der Datenverarbeitungseinheit nicht an eine Mehrzahl von Datenleitungen des Datenbusses weiterzugeben, wenn durch die Überwachungseinheit auf der Basis der von der Datenverarbeitungseinheit empfangenen Kontrolldaten ein fehlerhafter Betrieb der Datenverarbeitungseinheit festgestellt wurde.

Further, the present invention provides a data output monitoring unit for ensuring data output from error-free data of a data processing unit to a data bus, the data output monitoring unit having the following features:

• A monitoring unit having an interface for receiving control data from the data processing unit;
• A forwarding unit for controlling a forwarding of data of the data processing unit, wherein the forwarding unit is designed so as not to forward the data of the data processing unit to a plurality of data lines of the data bus, if the monitoring unit based on the control data received from the data processing unit indicates an erroneous operation of the data processing unit Data processing unit was detected.

The present invention further provides a control device which is designed to carry out, to control or to implement the steps of the method according to the invention. Also by this embodiment of the invention in the form of a control device, the object underlying the invention can be achieved quickly and efficiently.

In the present case, a control device can be understood as meaning an electrical device which processes sensor signals and outputs control signals in dependence thereon. The control unit may have an interface, which may be formed in hardware and / or software. In the case of a hardware-based design, the interfaces can be part of a so-called system ASIC, for example, which contains various functions of the control unit. However, it is also possible that the interfaces are their own integrated circuits or at least partially consist of discrete components. In a software training, the interfaces may be software modules that are present, for example, on a microcontroller in addition to other software modules.

Also of advantage is a computer program product with program code which is stored on a machine-readable carrier such as a semiconductor memory, a hard disk memory or an optical memory and is used to perform and / or control steps of the method according to one of the embodiments described above, when the program a control unit or a data processing system is executed.

The present invention is based on the knowledge that a quick suppression of the output of erroneous data can be achieved by the supervisor unit being able to suppress the output of the (erroneous) data of the data processing unit when it detects an erroneous operation of the data processing unit. In this way, it can be ensured that after the recognition of a "crazy" controller (ie a malfunctioning data processing unit), no further data is output from this controller to the data bus and further units connected to the data bus are disturbed by such erroneous data.

The present invention offers the advantage that a simple further use of already existing monitoring mechanisms makes it possible to significantly improve the security of the data communication on the data bus. Circuit technology or numerically, the present invention can be implemented very easily.

In a further embodiment of the present invention, in which a step of activating a security device of a vehicle by the data processing unit is provided, a step of monitoring the activation of the security means by the monitoring unit may further be provided, wherein in the step of monitoring an activation of the security means is suppressed by the monitoring unit when the monitoring unit has detected a faulty operation of the data processing unit. Such an embodiment of the present invention has the advantage that the monitoring of the activation of the security means already requires special measures to prevent a false triggering of the security means. As a result, already established approaches for monitoring the error-free operation of the data bus can also be used.

Also, the step of locking may be performed using a plurality of driver units configured to each apply a data line of the data bus to data of the data processing unit, wherein in the step of disabling the driver units upon detection of erroneous operation of the data processing unit by a disable signal be switched by the monitoring unit in an inactive mode in which they do not act on the data lines of the data bus with data from the data processing unit. Such an embodiment of the present invention offers the advantage of simply and simultaneously inhibiting the output of data from the data processing unit to the data lines of the data bus. In this way, a data output of the data of the data processing unit is abruptly prevented on preferably all data lines of the data bus. At the same time, such an embodiment of the present invention is technically very easy to implement.

In a further embodiment of the invention, in the step of monitoring, the activation of the security means by the action of a corresponding driver unit by means of the lock signal from the monitoring unit. Such an embodiment of the present invention has the advantage that signals or a signal from the already proven concept of highly secure monitoring of a data processing unit in the field of vehicle technology can be used in a simple manner to suppress data output to a vehicle data bus. In particular, if, for example, a suppression of the control of the security means requires a driver unit, which differs from further the driver units for suppressing the output of the data of the data processing unit, by the common lock signal, a very elegant multiple utilization of the output from the monitoring unit lock signal respectively.

Also, the step of determining may be based on a data processing task performed by the data processing unit by the monitoring unit, wherein the monitoring unit determines erroneous operation of the data processing unit if the data processing task solution provided by the data processing unit does not match a result expected by the monitoring unit , By such an approach, a faulty operation of the data processing unit can be determined without much effort and very quickly without evaluating the communication on the data bus.

The invention will now be described by way of example with reference to the accompanying drawings. Show it:

1 a block diagram of a first embodiment of the present invention; and

2 a flowchart of another embodiment of the present invention as a method.

The same or similar elements may be provided in the following figures by the same or similar reference numerals, wherein a repeated description is omitted. Furthermore, the figures of the drawings, the description and the claims contain numerous features in combination. It is clear to a person skilled in the art that these features are also considered individually or that they can be combined to form further combinations not explicitly described here. Furthermore, the invention in the following description may be explained using different dimensions and dimensions, wherein a mention of these dimensions and dimensions is not to be understood as meaning that the invention is limited to these dimensions and dimensions.

1 shows a block diagram of a first embodiment of the present invention. Here is a microcontroller first 100 represented, which is used as a data processing unit. Alternatively, the microcontroller 100 be another unit such as a digital signal processor, an ASIC or a similar semiconductor device, which is designed for data processing. The microcontroller 100 can sensor signals via connecting cables 105 over one or more data lines 110 a data bus 120 received by a sensor and evaluate these sensor signals accordingly. So can the microcontroller 100 For example, a trip decision for a safety device such as an airbag may occur when the sensor signals originate from one or more acceleration sensors that detect an impact of an object on a subject vehicle. In such a case, the microcontroller 100 a corresponding security function 130 activate or activate, via a first driver unit 140 a trigger signal 150 to the appropriate security agent 160 (eg the airbag).

To now ensure that the security agent 160 only triggered when the microcontroller 100 also works correctly, can a second safety semiconductor 170 be provided, which is the microcontroller 100 supervised. This security semiconductor 170 can one from the microcontroller 100 be completely independent semiconductor device, the only one interface 180 Data from the microcontroller 100 received or can send to this. In this way it can be ensured that despite a faulty operation of the microcontroller 100 the safety semiconductor 170 still works reliably with a high probability. The safety semiconductor 170 , which represents a monitoring unit, can perform a data processing task via the interface 180 to the microcontroller 100 send that to the microcontroller 100 must solve. For example, this may be a simple calculation to determine if the microcontroller 100 This can perform simple, fast and correct calculation and thus works flawlessly. That from the microcontroller 100 certain results or the solution of the monitoring unit 100 set data processing task, can subsequently again via the interface 180 be transmitted to the monitoring unit or the safety semiconductor. The safety semiconductor 170 who knows the solution of the data processing task can be determined by the microcontroller 100 obtained solution ( Conveniently also by checking a time that the microcontroller has used to solve the problem) now determine if the microcontroller 100 still working without errors.

If this is not the case, the release of the safety device can 160 by a lock signal 190 prevents the driver unit 140 switches to an inactive mode, so no trigger signal 150 more to the appropriate security 160 how the airbag can be dispensed.

And now ensure that no data from the microcontroller 100 on the data lines 110 of the data bus 120 arrive when the data processing unit 100 working incorrectly, this lock signal can 190 now also be used to further driver units 195 to switch to an inactive mode. This may result in data output from (possibly corrupted) data from the microcontroller 100 on the lines 110 of the data bus 120 be prevented. In this way, the monitoring unit 170 not only for the verification or plausibility of the triggering decision for the security agent 160 be used; rather, it is possible to obtain a corresponding monitoring signal 190 also for decoupling of the microcontroller 100 from the wires 110 of the data bus 120 deploy. This offers next to a simple circuitry realization possibility also a very fast and reliable way to avoid interference in other units that are connected to the lines 110 of the data bus 120 are connected. The present approach is particularly favorable when the driver units 140 respectively. 195 configured differently, but can be switched on or off by a common "Enable" - or "Disable" signal.

Under a driver unit 195 is understood to be a conventional driver as well as a transceiver, the bidirectional data transmission, ie a data transfer from the data bus 120 to the microcontroller 100 as well as a data transfer from the microcontroller 100 to the data bus 120 allows.

2 shows a flowchart of an embodiment of the present invention as a method 200 for ensuring data output from error-free data of a data processing unit to a data bus. The method has a step of determining 210 erroneous operation of the data processing unit by an independent from the data processing unit monitoring unit and a step of blocking 220 an output of data of the data processing unit on a plurality of data lines of a data bus, when the monitoring unit has detected the erroneous operation of the data processing unit.

So can be summarized that when the controller 100 uncontrolled, the BUS systems are immediately disconnected from the controller to prevent unwanted effects. This corresponds to a prevention of erroneous application of safety-critical information or data on the data bus. The advantage of the approach presented here can now be seen in the fact that now also the output of safety-critical BUS information from the microcontroller 100 to the data bus 120 over the security semiconductor 170 can be turned off. Depending on the application, this switching off of a data transmission from the data processing unit to the data bus can relate to different types of bus (LIN, CAN, Flexray bus, etc.), without the fundamental functionality of the monitoring unit having to be changed as a result.

In the case of a "crazy" controller (ie, a malfunctioning processing unit), indexed by a misoperation of the watchdog mechanism of the security semiconductor 170 , are the corresponding transceivers 195 the BUS connections can be switched off. This should include the watchdog "Active" information from the security semiconductor 170 only with a "Disable" / "Enable" line of the transceiver 195 be coupled. In simple systems (eg the LIN bus) the connection can also be made to a driver component. However, with such a connection, this information of the "Enable" or "Disable" line may still be necessary for a pin on the corresponding driver or transceiver units 195 to lay.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102005048037 A1 [0005]

Claims (8)

Procedure ( 200 ) for ensuring data output of error-free data of a data processing unit ( 100 ) on a data bus ( 120 ), the process ( 200 ) comprises the following steps: - determining ( 210 ) of erroneous operation of the data processing unit ( 100 ) by one of the data processing unit ( 100 ) independent monitoring unit ( 170 ); and - locks ( 220 ) an output of data of the data processing unit ( 100 ) on a plurality of data lines ( 110 ) of a data bus ( 120 ), if the monitoring unit ( 170 ) the erroneous operation of the data processing unit ( 100 ) Has been established. Procedure ( 200 ) according to claim 1, comprising a step of activating a security means ( 160 ) of a vehicle by the data processing unit ( 100 ), characterized in that further comprises a step of monitoring the activation of the security means ( 160 ) by the monitoring unit ( 170 ), wherein in the step of monitoring an activation of the security means ( 160 ) by the monitoring unit ( 170 ) is suppressed when the monitoring unit ( 170 ) erroneous operation of the data processing unit ( 100 ) Has been established. Procedure ( 200 ) according to one of the preceding claims, characterized in that the step of blocking ( 220 ) using a plurality of driver units ( 195 ), which are designed to each have a data line ( 110 ) of the data bus ( 120 ) with data of the data processing unit ( 100 ), wherein in the step of blocking ( 220 ) the driver units ( 195 ) upon detection of erroneous operation of the data processing unit ( 100 ) by a lock signal ( 190 ) from the monitoring unit ( 170 ) are switched into an inactive mode in which they are the data lines ( 110 ) of the data bus ( 120 ) not with data of the data processing unit ( 100 ). Procedure ( 200 ) according to claims 2 and 3, characterized in that in the step of monitoring activation of the security means ( 160 ) by applying a corresponding driver unit ( 140 ) by means of the inhibit signal from the monitoring unit ( 170 ) he follows. Procedure ( 200 ) according to one of the preceding claims, characterized in that the step of determining ( 210 ) on the basis of a data processing task performed by the data processing unit ( 100 ) from the monitoring unit ( 170 ), the monitoring unit ( 170 ) erroneous operation of the data processing unit ( 100 ) when the data processing unit (s) 100 ) solution of the data processing task with one of the monitoring unit ( 170 ) corresponds to the expected result. Data output monitoring unit ( 170 . 195 ) for ensuring data output of error-free data of a data processing unit ( 100 ) on a data bus ( 120 ), wherein the data output monitoring unit ( 170 . 195 ) has the following features: a monitoring unit ( 170 ) with an interface ( 180 ) for receiving control data from the data processing unit ( 100 ); A forwarding unit ( 195 ) for controlling a forwarding of data of the data processing unit ( 100 ), the forwarding unit ( 195 ) is adapted to the data of the data processing unit ( 100 ) not to a plurality of data lines ( 110 ) of the data bus ( 120 ) if, through the monitoring unit ( 170 ) based on the data processing unit ( 100 ) received an incorrect operation of the data processing unit ( 100 ) was detected. Control device that is designed to perform the steps of a method ( 200 ) according to one of claims 1 to 5. Computer program product with program code, which is stored on a machine-readable carrier, for carrying out and / or controlling the steps of the method ( 200 ) according to one of claims 1 to 5, when the program is executed on a control device or a data processing system.

Images