# US 10,503,166 B2 · Method of processing data for an automated vehicle > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,166 B2 - Document ID: US10503166B2 - Status: Granted - Kind: B2 - Application number: 15/719,943 - Filed: 2017-09-29 - Published: 2018-04-19 - Granted: 2019-12-10 - Earliest claimed: 2016-10-17 - Assignees: Robert Bosch GmbH - Applicants: Robert Bosch GmbH - Inventors: Rainer Baumgaertner - Web page: https://patentgrep.com/patent/US10503166B2 ## CPC - G05D 1/0055: {with safety arrangements} - B60W 30/00: Purposes of road vehicle drive control systems not related to the control of a particular sub-unit, e.g. of systems using conjoint control of vehicle sub-units - B60W 50/04: Monitoring the functioning of the control system - G05B 19/0428: {Safety, monitoring (G05B19/0423 takes precedence)} - G05D 1/00: Control of position, course, altitude or attitude of land, water, air or space vehicles, e.g. using automatic pilots (drive control systems specially adapted for autonomous road vehicles B60W60/00) - G05D 1/0077: {using redundant signals or controls} - G07C 5/085: {using electronic data carriers} - B60W 2050/0292: {Fail-safe or redundant systems, e.g. limp-home or backup systems} - G05B 2219/24182: Redundancy - G05B 2219/2637: Vehicle, car, auto, wheelchair - G05D: SYSTEMS FOR CONTROLLING OR REGULATING NON-ELECTRIC VARIABLES - B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE ## Abstract A method for processing data for an automated vehicle, including operating at least two processing units, the at least two processing units being monitored by a monitoring device having at least two self-monitoring monitoring units. Defined monitoring of the processing units is carried out with the aid of the at least two monitoring units. A master functionality of the monitoring units is assumed by a defined monitoring unit. In the event of a fault of the monitoring unit carrying out the master functionality, the master functionality is taken over by a downstream monitoring unit. ## Claims ### Claim 1 A method for processing data for an automated vehicle, comprising: operating at least two processing units, the at least two processing units being monitored by a monitoring device having at least two self-monitoring monitoring units; carrying out defined monitoring of the at least two processing units with the aid of the at least two self-monitoring monitoring units, a master functionality of the at least two self-monitoring monitoring units being assumed only by a first one of the at least two self-monitoring monitoring units and not by any others of the at least two self-monitoring monitoring units, wherein each of the at least two self-monitoring monitoring units monitors all of the at least two processing units, the monitoring by each of the at least two self-monitoring monitoring units including receiving result data from each of the at least two processing units and comparing the received result data to one another to determine whether the received result data are identical to each other; and in the event of a fault of the first one of the at least two self-monitoring monitoring units carrying out the master functionality, the master functionality is taken over by a second one of the at least two self-monitoring monitoring units which is downstream of the first one of the at least two self-monitoring monitoring monitoring units so that only the second one of the at least two self-monitoring monitoring units assumes the master functionality and none of the others of the at least two self-monitoring monitoring units assumes the master functionality; wherein the master functionality includes triggering the at least two processing units to synchronize them. ### Claim 2 (depends on 1) The method as recited in claim 1, wherein monitoring of the processing units is carried out by the at least two self-monitoring monitoring units in parallel to one another. ### Claim 3 (depends on 1) The method as recited in claim 1, wherein downstream ones of the at least two self-monitoring monitoring units signal to a monitoring unit of the at least two self-monitoring monitoring units carrying out the master functionality whether they are fault-free. ### Claim 4 (depends on 1) The method as recited in claim 1, wherein in the event of a deviation between a result data from one of the at least two processing units and result data from others of the at least two processing units, a processing unit of the at least two processing units supplying the deviating result data is deactivated. ### Claim 5 (depends on 1) The method as recited in claim 1, wherein each of the at least two self-monitoring monitoring units has a multiplexer, and a data channel of the each of the at least two self-monitoring monitoring devices is developed with the aid of the respective multiplexer. ### Claim 6 (depends on 1) The method as recited in claim 1, wherein the second one of the at least two self-monitoring monitoring units synchronizes to the triggering for as long as the first one of the at least two self-monitoring monitoring units is fault free and the master functionality is assumed by the first one of the at least two self-monitoring monitoring units. ### Claim 7 A device for processing data for an automated vehicle, comprising: at least two processing units; at least two monitoring units with the aid of which the at least two processing units are monitored; wherein a master functionality is assumed only by a first one of the at least two monitoring units and not by any others of the at least two monitoring units, wherein each of the at least two monitoring units monitors all of the at last two processing units, the monitoring by each of the at least two monitoring units including receiving result data from each of the at least two processing units and comparing the received result data to one another to determine whether the received result data are identical to each other, and in the event that the first one of the at least two monitoring unit assuming the master functionality is faulty, the master functionality is taken over by a second one of the at least two monitoring units which is downstream of the first one of the monitoring units so that only the second one of the at least two monitoring units assumes the master functionality and none of the others of the at least two monitoring units assumes the master functionality; wherein the master functionality includes triggering the at least two processing units to synchronize them. ### Claim 8 (depends on 7) The device as recited in claim 7, wherein interface buses are separately developed between the at least two processing units and the at least two monitoring units. ### Claim 9 (depends on 7) The device as recited in claim 7, wherein interface buses between the at least two processing units and the at least two monitoring units are integrated in a single bus. ### Claim 10 (depends on 7) The device as recited in claim 7, wherein the second one of the at least two monitoring units synchronizes to the triggering for as long as the first one of the at least two monitoring units is fault free and the master functionality is assumed by the first one of the at least two monitoring units. ### Claim 11 A non-transitory computer-readable data carrier on which program code is stored, the program code for processing data for an automated vehicle, the program code, when executed on an electronic monitoring device, causing the electronic monitoring device to perform: operating at least two processing units, the at least two processing units being monitored by a monitoring device having at least two self-monitoring monitoring units; carrying out defined monitoring of the at least two processing units with the aid of the at least two self-monitoring monitoring units, a master functionality of the at least two self-monitoring monitoring units being assumed only by a first one of the at least two self-monitoring monitoring units and not by any others of the at least two self-monitoring monitoring units, wherein each of the at least two self-monitoring monitoring units monitors all of the at least two processing units, the monitoring by each of the at least two self-monitoring monitoring units including receiving result data from each of the at least two processing units and comparing the received result data to one another to determine whether the received result data are identical to each other; and in the event of a fault of the first one of the at least two self-monitoring monitoring units carrying out the master functionality, the master functionality is taken over by a second one of the at least two self-monitoring monitoring units which is downstream of the first one of the at least two self-monitoring monitoring units so that only the second one of the at least two self-monitoring monitoring units assumes the master functionality and none of the others of the at least two self-monitoring monitoring units assumes the master functionality; wherein the master functionality includes triggering the at least two processing units to synchronize them. ### Claim 12 (depends on 11) The non-transitory computer-readable data carrier as recited in claim 11, wherein the second one of the at least two self-monitoring monitoring units synchronizes to the triggering for as long as the first one of the at least two self-monitoring monitoring units is fault free and the master functionality is assumed by the first one of the at least two self-monitoring monitoring units.