# US 9,434,379 B2 · Semiconductor circuit and method in a safety concept for use in a motor vehicle

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,434,379 B2
- Document ID: US9434379B2
- Status: Granted
- Kind: B2
- Application number: 14/000,071
- Filed: 2012-02-16
- Published: 2014-02-20
- Granted: 2016-09-06
- Earliest claimed: 2011-02-18
- Assignees: Conti Temic microelectronic GmbH
- Applicants: Volker Naegele; Michael Pechtold
- Inventors: Volker Naegele; Michael Pechtold
- Web page: https://patentgrep.com/patent/US9434379B2

## CPC

- B60W 30/00: Purposes of road vehicle drive control systems not related to the control of a particular sub-unit, e.g. of systems using conjoint control of vehicle sub-units
- B60K 26/04: of means connecting initiating means or elements to propulsion unit
- G06F 11/0739: {in a data processing system embedded in automotive or aircraft systems}
- G06F 11/0757: {by exceeding a time limit, i.e. time-out, e.g. watchdogs}
- G06F 11/076: {by exceeding a count or rate limit, e.g. word- or bit count limit}
- G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)}
- G06F 11/2028: {eliminating a faulty processor or activating a spare}
- B60K 2026/046: {with electrical transmission means}
- G06F 11/0796: {Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element}
- G06F 11/2041: {with more than one idle spare processing component}
- B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60K: ARRANGEMENT OR MOUNTING OF PROPULSION UNITS OR OF TRANSMISSIONS IN VEHICLES; ARRANGEMENT OR MOUNTING OF PLURAL DIVERSE PRIME-MOVERS IN VEHICLES; AUXILIARY DRIVES FOR VEHICLES; INSTRUMENTATION OR DASHBOARDS FOR VEHICLES; ARRANGEMENTS IN CONNECTION WITH COOLING, AIR INTAKE, GAS EXHAUST OR FUEL SUPPLY OF PROPULSION UNITS IN VEHICLES
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A semiconductor circuit for an electronic control device for a system in a motor vehicle, wherein the system is not mechanically intrinsically safe, includes a functional computer (FR), at least one monitoring unit (MU) and a monitoring computer that are each physically independent of each other. A full or a restricted function of the semiconductor circuit is ensured by the functional computer (FR) in the event of a failure of the monitoring computer (UR) and vice versa. The semiconductor circuit is monitored according to a monitoring method.

## Claims

### Claim 1

A semiconductor circuit for an electronic control device for a system in a motor vehicle, said system not being mechanically intrinsically safe, comprising
a functional computer (FR) configured for controlling a normal operation of the motor vehicle by executing at least functionalities of a functional layer and of a function monitoring layer of a three-layer monitoring concept,
at least one monitoring unit (MU) configured for executing at least a functionality of a computer monitoring layer of the three-layer monitoring concept,
a monitoring computer (UR) on which at least one dialog procedure (FAV) with the functional computer (FR) can be performed,
a first power supply that is connected to and configured to supply power to the functional computer, and
a second power supply that is separate from the first power supply, and that is connected to and configured to supply power to the monitoring computer,
wherein:
the functional computer (FR), the monitoring unit (MU) and the monitoring computer (UR) are each physically independent of each other,
a full function or a restricted function of the semiconductor circuit is ensured by the functional computer (FR) if the monitoring computer (UR) fails, and
the full function or the restricted function of the semiconductor circuit is ensured by the monitoring computer (UR) if the functional computer (FR) fails.

### Claim 2 (depends on 1)

The semiconductor circuit according to claim 1, characterized in that the second power supply (SV2) has a watchdog (WD) configured for additionally monitoring the monitoring computer (UR).

### Claim 3 (depends on 1)

The semiconductor circuit according to claim 1, characterized in that the power supplies (SV1, SV2) each have a watchdog (WD) configured for monitoring the computers (FR, UR).

### Claim 4

A method of monitoring a semiconductor circuit for an electronic control device for a system of a motor vehicle,
wherein the semiconductor circuit includes a functional computer configured to control a normal operation of the system of the motor vehicle by executing a functional layer functionality and a function monitoring layer functionality of a three-layer monitoring concept, a monitoring computer that is physically independent of the functional computer, and only a single monitoring unit that is physically independent of the functional computer and the monitoring computer and that is configured to execute a computer monitoring layer functionality of the three-layer monitoring concept, and
wherein the method comprises the following steps:
a. initializing a first dialog procedure (FAV) between the monitoring unit (MU) and the functional computer (FR),
b. initializing a second dialog procedure (FAV) between the functional computer (FR) and the monitoring computer (UR),
c. if no error occurs in the first dialog procedure but an error occurs in the second dialog procedure, then the functional computer (FR) resets the monitoring computer (UR) according to a predetermined error-dependent sequence and takes over a full function or a restricted function of the semiconductor circuit,
d. if an error occurs in the first dialog procedure, then the monitoring unit (MU) first activates a monitoring signal according to a predetermined error-dependent sequence and then resets the functional computer (FR),
e. reading in the monitoring signal and a reset signal of the functional computer (FR) by the monitoring computer (UR), and
f. taking over the full function or the restricted function of the semiconductor circuit by the monitoring computer (UR).

### Claim 5

A method of monitoring a semiconductor circuit for an electronic control device for a system of a motor vehicle,
wherein the semiconductor circuit includes a functional computer configured to control a normal operation of the system of the motor vehicle by executing a functional layer functionality and a function monitoring layer functionality of a three-layer monitoring concept, a monitoring computer that is physically independent of the functional computer, and first and second monitoring units that are physically independent of the functional computer and the monitoring computer and that are configured to execute a computer monitoring layer functionality of the three-layer monitoring concept, and
wherein the method comprises the following steps:
a. initializing a first dialog procedure (FAV) between the first monitoring unit (MU1) and the functional computer (FR),
b. initializing a second dialog procedure (FAV) between the second monitoring unit (MU2) and the monitoring computer (UR),
c. initializing a third dialog procedure (FAV) between the functional computer (FR) and the monitoring computer (UR),
d. if an error occurs in the first dialog procedure, then the first monitoring unit (MU1) first activates a monitoring signal according to a predetermined error-dependent sequence and then resets the functional computer (FR),
e. reading in the monitoring signal and a reset signal of the functional computer (FR) by the monitoring computer (UR),
f. taking over a full function or a restricted function of the semiconductor circuit by the monitoring computer (UR),
g. if an error occurs in the second dialog procedure, then the second monitoring unit (MU2) first activates a monitoring signal according to a predetermined error-dependent sequence and then resets the monitoring computer (UR),
h. reading in the monitoring signal and a reset signal of the monitoring computer (UR) by the functional computer (FR),
i. taking over the full function or the restricted function of the semiconductor circuit by the functional computer (FR),
j. if an error occurs in the third dialog procedure, then the functional computer (FR) resets the monitoring computer (UR) according to a predetermined error-dependent sequence, and
k. taking over the full function or the restricted function of the semiconductor circuit by the functional computer (FR).

### Claim 6 (depends on 5)

The method according to claim 5, characterized in that the predetermined error-dependent sequence according to which the monitoring signal is first activated and the functional computer or the monitoring computer (FR, UR) is then reset comprises the following steps:
a. the interrogating unit (MU, FR, UR), being the monitoring unit, the functional computer or the monitoring computer that initiated the respective dialog procedure, first activates the monitoring signal after m wrong responses, said monitoring signal switching critical actuator output stages to a currentless state,
b. after further n wrong responses occurring in the respective dialog procedure (FAV) between the interrogating unit (MU, FR, UR) and the responding unit (FR, UR), being the functional computer or the monitoring computer that responds to the respective dialog procedure, the interrogating unit (MU, FR, UR) resets the responding unit (FR, UR).

### Claim 7 (depends on 5)

The method according to claim 5, characterized in that during a run-up phase of the computers (FR, UR), suitable timing and logic or software ensure that a respective safety function is triggered in the event of an error.

### Claim 8 (depends on 5)

The method according to claim 5, characterized in that a controlled shut-down of the semiconductor circuit is accomplished by passing through, in a shut-down phase of the computers (FR, UR), a controlled deactivation sequence of monitoring until a power supply (SV1, SV2) of the semiconductor circuit is switched off.

### Claim 9 (depends on 8)

The method according to claim 8, characterized in that all active ones of the dialog procedures are continued until the functional computer (FR) is at a point of disabling self-holding functions of all power supplies (SV1, SV2) of the semiconductor circuit.

### Claim 10 (depends on 5)

The method according to claim 5, characterized in that a watchdog (WD) integrated in a power supply (SV2) of the monitoring computer (UR) monitors the monitoring computer (UR) in operational phases in which the monitoring computer is not yet monitored by the functional computer.

### Claim 11 (depends on 5)

The method according to claim 5, characterized in that a watchdog (WD) integrated in power supplies (SV1, SV2) of the computers (FR, UR) additionally monitors the computers (FR, UR) in operational phases in which the computers are not or not yet monitored by the monitoring units (MU1, MU2).

### Claim 12 (depends on 4)

The method according to claim 4, characterized in that the predetermined error-dependent sequence according to which the monitoring signal is first activated and the functional computer or the monitoring computer (FR, UR) is then reset comprises the following steps:
a. the interrogating unit (MU, FR, UR), being the monitoring unit, the functional computer or the monitoring computer that initiated the respective dialog procedure, first activates the monitoring signal after m wrong responses, said monitoring signal switching critical actuator output stages to a currentless state,
b. after further n wrong responses occurring in the respective dialog procedure (FAV) between the interrogating unit (MU, FR, UR) and the responding unit (FR, UR), being the functional computer or the monitoring computer that responds to the respective dialog procedure, the interrogating unit (MU, FR, UR) resets the responding unit (FR, UR).

### Claim 13 (depends on 4)

The method according to claim 4, characterized in that during a run-up phase of the computers (FR, UR), suitable timing and logic or software ensure that a respective safety function is triggered in the event of an error.

### Claim 14 (depends on 4)

The method according to claim 4, characterized in that a controlled shut-down of the semiconductor circuit is accomplished by passing through, in a shut-down phase of the computers (FR, UR), a controlled deactivation sequence of monitoring until a power supply (SV1, SV2) of the semiconductor circuit is switched off.

### Claim 15 (depends on 14)

The method according to claim 14, characterized in that all active ones of the dialog procedures are continued until the functional computer (FR) is at a point of disabling self-holding functions of all power supplies (SV1, SV2) of the semiconductor circuit.

### Claim 16 (depends on 4)

The method according to claim 4, characterized in that a watchdog (WD) integrated in a power supply (SV2) of the monitoring computer (UR) monitors the monitoring computer (UR) in operational phases in which the monitoring computer is not yet monitored by the functional computer.

### Claim 17 (depends on 4)

The method according to claim 4, characterized in that a watchdog (WD) integrated in power supplies (SV1, SV2) of the computers (FR, UR) additionally monitors the computers (FR, UR) in operational phases in which the computers are not or not yet monitored by the monitoring unit (MU1, MU2).