Method for handling faults in a central control device, and control device
The invention relates to a method for handling faults in a central control device, wherein the control device comprises a distributed computer system ( 100 ), to which distributed computer system ( 100 ) sensors ( 112, 113, 122, 123 ) are connected or can be connected, wherein the distributed computer system ( 100 ), particularly all the components of the computer system, is distributed to a first fault containment unit FCU1 ( 101 ) and a second fault containment unit FCU2 ( 102 ), wherein FCU1 ( 101 ) and FCU2 ( 102 ) are each supplied with power via a separate, independent power supply, and wherein FCU1 ( 101 ) and FCU2 ( 102 ) interchange data solely via galvanically separated lines, and wherein some of the sensors are connected at least to FCU1 ( 101 ) and the remainder of the sensors are connected at least to FCU2 ( 102 ), and wherein FCU1 ( 101 ) and FCU2 ( 102 ) are connected to a redundantly designed communication system ( 131, 132 ) having one or more actuators, so that, if FCU1 fails, FCU2 will maintain a limited functionality using the sensors assigned to FCU2, and if FCU2 fails, FCU1 will maintain a limited functionality using the sensors assigned to FCU1.
1. A method for handling faults in a central control device, wherein the central control device comprises a distributed computer system ( 100 ), to which sensors ( 112 , 113 , 122 , 123 ) are operably connectable,
wherein the distributed computer system ( 100 ) is distributed to a first fault containment unit FCU1 ( 101 ) and a second fault containment unit FCU2 ( 102 ),
wherein FCU1 ( 101 ) and FCU2 ( 102 ) each consist of a first subsystem SS1 ( 110 , 120 ) and a second subsystem SS2 ( 111 , 121 ), wherein the first subsystems SS1 ( 110 , 120 ) process sensor data from the sensors and the second subsystems SS2 ( 111 , 121 ) monitor functioning of the respective first subsystem SS1 ( 110 , 120 ),
wherein FCU1 ( 101 ) and FCU2 ( 102 ) are each supplied with power via a separate, independent power supply,
wherein FCU1 ( 101 ) and FCU2 ( 102 ) interchange data solely via galvanically separated lines,
wherein some of the sensors are connected at least to FCU1 ( 101 ) and the remainder of the sensors are connected at least to FCU2 ( 102 ),
wherein FCU1 ( 101 ) and FCU2 ( 102 ) are connected to a communication system ( 131 , 132 ) having one or more actuators, and
wherein FCU1 and FCU2, or one or more components of FCU1 and one or more components of FCU2, have access to a globally synchronized time.
2. The method of claim 1 , wherein the communication system ( 131 , 132 ) is redundant.
3. The method of claim 1 , wherein the second subsystems SS2 ( 111 , 121 ) periodically execute a challenge response protocol to verify the functioning of the respective first subsystem SS1 ( 110 , 120 ).
4. The method of claim 1 , wherein the second subsystems SS2 ( 111 , 121 ) monitor the supply of power to FCU1 ( 101 ) or FCU2 ( 102 ).
5. The method of claim 1 , wherein the second subsystems SS2 ( 111 , 121 ) periodically verify the data structures within FCU1 ( 101 ) or FCU2 ( 102 ).
6. The method of claim 1 , wherein the second subsystem ( 111 , 121 ) periodically transmits an “I am alive” message to the other FCU1 ( 101 ) or FCU2 ( 102 ).
7. The method of claim 6 , wherein the time of the arrival on schedule of the periodic “I am alive” message is monitored by the other FCU1 ( 101 ) or FCU2 ( 102 ) by means of a timeout.
8. The method of claim 7 , wherein the time at which the “I am alive” message is transmitted and the time of the timeout monitoring of the “I am alive” message in the receiving FCU1 ( 101 ) or FCU2 ( 102 ) are synchronized over the global time.
9. The method of claim 1 , wherein when a failure of FCU1 ( 101 ) or FCU2 ( 102 ) is detected by the expiration of the timeout of the “I am alive” message, the surviving FCU1 ( 101 ) or FCU2 ( 102 ) implements a limited functionality using the sensors assigned to it.
10. The method of claim 1 , wherein each functioning FCU1 ( 101 ) or FCU2 ( 102 ) periodically transmits the relevant part of its internal state to the other FCU1 ( 101 ) or FCU2 ( 102 ).
11. The method of claim 1 , wherein, after a failure of the first subsystem SS1 ( 110 , 120 ) of FCU1 ( 101 ) or FCU2 ( 102 ), the second subsystem SS2 ( 111 , 121 ) initiates a reset of the first subsystem SS1 ( 110 , 120 ), which prompts the failed FCU1 ( 101 ) or FCU2 ( 102 ) to carry out a reintegration using the internal state of the other FCU1 ( 101 ) or FCU2 ( 102 ).
12. The method of claim 1 , wherein a monitoring and simulation component monitors data from the sensors and simulates functioning of the sensors in real time.
13. A control device, wherein the control device comprises a distributed computer system ( 100 ), to which distributed computer system ( 100 ) sensors ( 112 , 113 , 122 , 123 ) are operably connectable,
wherein the distributed computer system ( 100 ) is distributed to a first fault containment unit FCU1 ( 101 ) and a second fault containment unit FCU2 ( 102 ),
wherein FCU1 ( 101 ) and FCU2 ( 102 ) each consist of a first subsystem SS1 ( 110 , 120 ) and a second subsystem SS2 ( 111 , 121 ), wherein the first subsystems SS1 ( 110 , 120 ) process sensor data from the sensors and the second subsystems SS2 ( 111 , 121 ) monitor functioning of the respective first subsystem SS1 ( 110 , 120 ),
wherein FCU1 ( 101 ) and FCU2 ( 102 ) are each supplied with power via a separate, independent power supply,
wherein FCU1 ( 101 ) and FCU2 ( 102 ) interchange data solely via galvanically separated lines,
wherein some of the sensors are connected at least to FCU1 ( 101 ) and the remainder of the sensors are connected at least to FCU2 ( 102 ),
wherein FCU1 ( 101 ) and FCU2 ( 102 ) are connected to a communication system ( 131 , 132 ) having one or more actuators, and
wherein FCU1 and FCU2, or one or more components of FCU1 and one or more components of FCU2, have access to a globally synchronized time.
14. The control device of claim 13 , wherein the communication system ( 131 , 132 ) is redundant.
15. The control device of claim 13 , wherein the second subsystems SS2 ( 111 , 121 ) periodically execute a challenge response protocol to verify the functioning of the respective first subsystem SS1 ( 110 , 120 ).
16. The control device of claim 13 , wherein the second subsystems SS2 ( 111 , 121 ) monitor the supply of power to FCU1 ( 101 ) or FCU2 ( 102 ).
17. The control device of claim 13 , wherein the second subsystems SS2 ( 111 , 121 ) periodically verify the data structures within FCU1 ( 101 ) or FCU2 ( 102 ).
18. The control device of claim 13 , wherein the second subsystem ( 111 , 121 ) periodically transmits an “I am alive” message to the other FCU1 ( 101 ) or FCU2 ( 102 ).
19. The control device of claim 18 , wherein the time of the arrival on schedule of the periodic “I am alive” message is monitored by the other FCU1 ( 101 ) or FCU2 ( 102 ) by means of a timeout.
20. The control device of claim 19 , wherein the time at which the “I am alive” message is transmitted and the time of the timeout monitoring of the “I am alive” message in the receiving FCU1 ( 101 ) or FCU2 ( 102 ) are synchronized over the global time.
21. The control device of claim 13 , wherein, when the failure of FCU1 ( 101 ) or FCU2 ( 102 ) ( 101 , 102 ) is detected by the expiration of the timeout of the “I am alive” message, the surviving FCU1 ( 101 ) or FCU2 ( 102 ) ( 102 , 101 ) implements a limited functionality using the sensors assigned to it.
22. The control device of claim 13 , wherein each functioning FCU1 ( 101 ) or FCU2 ( 102 ) ( 101 , 102 ) periodically transmits the relevant part of its internal state to the other FCU1 ( 101 ) or FCU2 ( 102 ).
23. The control device of claim 13 , wherein, after the failure of the first subsystem SS1 ( 110 , 120 ) of FCU1 ( 101 ) or FCU2 ( 102 ) ( 101 , 102 ), the second subsystem SS2 ( 111 , 121 ) initiates a reset of the first subsystem SS1 ( 110 , 120 ), prompting the failed FCU1 ( 101 ) or FCU2 ( 102 ) ( 101 , 102 ) to carry out a reintegration using the internal state of the other FCU1 ( 101 ) or FCU2 ( 102 ).
24. The control device of claim 13 , wherein a monitoring and simulation component monitors data from the sensors and simulates functioning of the sensors in real time.
25. The control device of claim 13 , wherein FCU1 and FCU2 are arranged on a single circuit board ( 100 ).
26. The control device of claim 13 , wherein a sensor of the sensors assigned to FCU1 ( 101 ) or FCU2 ( 102 ) is connectable directly to said FCU1 ( 101 ) or FCU2 ( 102 ).
27. The control device of claim 13 , wherein a sensor of the sensors assigned to FCU1 ( 101 ) or FCU2 ( 102 ) is operably connectable to a message distribution unit, which message distribution unit is operably connectable both to the FCU1 ( 101 ) or FCU2 ( 102 ) assigned to the sensor and to the other FCU1 ( 101 ) or FCU2 ( 102 ).
28. The control device of claim 13 , wherein FCU1 and FCU2 are operably connectable to the sensors, which comprise a variety of sensors.
29. The control device of claim 27 , wherein a monitoring and simulation component is operably connectable to the message distribution units.
30. The control device of claim 13 , wherein the control device is provided for controlling braking and/or steering and/or acceleration in a motor vehicle.
31. The control device of claim 13 , wherein FCU1 ( 101 ) or FCU2 ( 102 ) contain a variety of software.
32. The control device of claim 13 , wherein FCU1 ( 101 ) or FCU2 ( 102 ) are connected to a global clock.
33. The control device of claim 32 , wherein FCU1 ( 101 ) or FCU2 ( 102 ) are connected to a fault-tolerant global clock.
34. The control device of claim 13 , wherein FCU1 ( 101 ) or FCU2 ( 102 ) are connected by means of an Ethernet communication system.
35. The control device of claim 13 , wherein FCU1 and FCU2 are arranged on a circuit board in such a way that there is no galvanic connection between FCU1 ( 101 ) or FCU2 ( 102 ).
36. The control device of claim 35 , wherein a housing of the circuit board has two isolated chambers, one of FCU1 ( 101 ) or FCU2 ( 102 ) being arranged in each chamber.
37. A system comprising at least one control device of claim 13 , wherein a number of the sensors are connected to the control device.
38. A motor vehicle comprising at least one control device of claim 13 , wherein a number of the sensors are connected to the control device.