Back to results
US 9,434,379 B2Granted
Semiconductor circuit and method in a safety concept for use in a motor vehicle
AssigneeConti Temic microelectronic GmbH
InventorsVolker Naegele, Michael Pechtold
Life of this patent
Estimating the term…
Abstract
A semiconductor circuit for an electronic control device for a system in a motor vehicle, wherein the system is not mechanically intrinsically safe, includes a functional computer (FR), at least one monitoring unit (MU) and a monitoring computer that are each physically independent of each other. A full or a restricted function of the semiconductor circuit is ensured by the functional computer (FR) in the event of a failure of the monitoring computer (UR) and vice versa. The semiconductor circuit is monitored according to a monitoring method.
Claims17
A semiconductor circuit for an electronic control device for a system in a motor vehicle, said system not being mechanically intrinsically safe, comprising
- a functional computer (FR) configured for controlling a normal operation of the motor vehicle by executing at least functionalities of a functional layer and of a function monitoring layer of a three-layer monitoring concept,
- at least one monitoring unit (MU) configured for executing at least a functionality of a computer monitoring layer of the three-layer monitoring concept,
- a monitoring computer (UR) on which at least one dialog procedure (FAV) with the functional computer (FR) can be performed,
- a first power supply that is connected to and configured to supply power to the functional computer, and
- a second power supply that is separate from the first power supply, and that is connected to and configured to supply power to the monitoring computer,
- wherein:
- the functional computer (FR), the monitoring unit (MU) and the monitoring computer (UR) are each physically independent of each other,
- a full function or a restricted function of the semiconductor circuit is ensured by the functional computer (FR) if the monitoring computer (UR) fails, and
- the full function or the restricted function of the semiconductor circuit is ensured by the monitoring computer (UR) if the functional computer (FR) fails.
6 more elements
A method of monitoring a semiconductor circuit for an electronic control device for a system of a motor vehicle,
- wherein the semiconductor circuit includes a functional computer configured to control a normal operation of the system of the motor vehicle by executing a functional layer functionality and a function monitoring layer functionality of a three-layer monitoring concept, a monitoring computer that is physically independent of the functional computer, and only a single monitoring unit that is physically independent of the functional computer and the monitoring computer and that is configured to execute a computer monitoring layer functionality of the three-layer monitoring concept, and
- wherein the method comprises the following steps:
- a. initializing a first dialog procedure (FAV) between the monitoring unit (MU) and the functional computer (FR),
- b. initializing a second dialog procedure (FAV) between the functional computer (FR) and the monitoring computer (UR),
- c. if no error occurs in the first dialog procedure but an error occurs in the second dialog procedure, then the functional computer (FR) resets the monitoring computer (UR) according to a predetermined error-dependent sequence and takes over a full function or a restricted function of the semiconductor circuit,
- d. if an error occurs in the first dialog procedure, then the monitoring unit (MU) first activates a monitoring signal according to a predetermined error-dependent sequence and then resets the functional computer (FR),
- e. reading in the monitoring signal and a reset signal of the functional computer (FR) by the monitoring computer (UR), and
- f. taking over the full function or the restricted function of the semiconductor circuit by the monitoring computer (UR).
5 more elements
A method of monitoring a semiconductor circuit for an electronic control device for a system of a motor vehicle,
- wherein the semiconductor circuit includes a functional computer configured to control a normal operation of the system of the motor vehicle by executing a functional layer functionality and a function monitoring layer functionality of a three-layer monitoring concept, a monitoring computer that is physically independent of the functional computer, and first and second monitoring units that are physically independent of the functional computer and the monitoring computer and that are configured to execute a computer monitoring layer functionality of the three-layer monitoring concept, and
- wherein the method comprises the following steps:
- a. initializing a first dialog procedure (FAV) between the first monitoring unit (MU1) and the functional computer (FR),
- b. initializing a second dialog procedure (FAV) between the second monitoring unit (MU2) and the monitoring computer (UR),
- c. initializing a third dialog procedure (FAV) between the functional computer (FR) and the monitoring computer (UR),
- d. if an error occurs in the first dialog procedure, then the first monitoring unit (MU1) first activates a monitoring signal according to a predetermined error-dependent sequence and then resets the functional computer (FR),
- e. reading in the monitoring signal and a reset signal of the functional computer (FR) by the monitoring computer (UR),
- f. taking over a full function or a restricted function of the semiconductor circuit by the monitoring computer (UR),
- g. if an error occurs in the second dialog procedure, then the second monitoring unit (MU2) first activates a monitoring signal according to a predetermined error-dependent sequence and then resets the monitoring computer (UR),
- h. reading in the monitoring signal and a reset signal of the monitoring computer (UR) by the functional computer (FR),
- i. taking over the full function or the restricted function of the semiconductor circuit by the functional computer (FR),
- j. if an error occurs in the third dialog procedure, then the functional computer (FR) resets the monitoring computer (UR) according to a predetermined error-dependent sequence, and
- k. taking over the full function or the restricted function of the semiconductor circuit by the functional computer (FR).
10 more elements
Dependencies are inferred from the claim text.