Redundant signal processing of a safety-relevant application
View Patent ↗To effect redundant signal processing of a safety-relevant application, such as for a safety control unit of a motor vehicle, at least two redundant signals are fed from at least one sensor to an electronic circuit assembly as input signals for processing. At least one input signal is converted into a different test signal. In the electronic circuit assembly, the input signals are fed to a first peripheral module of a microcontroller, and the test signal is fed to an additional peripheral module. The sensor information of the input signals and of the test signal are thus redundantly processed independently of each other in a respective peripheral module of the microcontroller.
1. A method for redundant signal processing of a safety-relevant application, the method comprising:
feeding at least two redundant signals from first and second sensors to an electronic circuit as first and second input signals for processing sensor information;
processing the first and second input signals in a first peripheral module of a microcontroller of the electronic circuit to detect an error associated with at least one of the first and second sensors and to determine a braking demand;
converting at least one of the first and second input signals into a test signal, the test signal differing from the first and second input signals but retaining the sensor information; and
feeding the test signal to a second peripheral module of the microcontroller, different from the first peripheral module, for processing the sensor information of the test signal to redundantly determine the braking demand, the processing of the sensor information of the first and second input signals in the first peripheral module of the microcontroller and the processing of the test signal in the second peripheral module of the microcontroller being effected redundantly and independently such that the microcontroller is adapted to detect an error associated with the first peripheral module based on a difference between the braking demand determined by the first peripheral module and the braking demand determined by the second peripheral module,
wherein the first peripheral module is functionally different from the second peripheral module such that, in the absence of the error associated with the first peripheral module, the first peripheral module and the second peripheral module determine a common braking demand based on different inputs thereto.
2. The method as claimed in claim 1 , further comprising, when deviations exist between the sensor information of the first and second input signals and the sensor information of the test signal, transferring control systems affected by the deviations into a safe operating mode.
3. The method according to claim 1 , wherein the safety-relevant application is a safety control unit for a motor vehicle.
4. The method as claimed in claim 1 , wherein processing the first and second input signals in the first peripheral module includes comparing the first and second input signals with each other.
5. An electronic circuit, comprising:
at least one microcontroller having a first peripheral module configured to process at least two redundant signals from first and second sensors, the first peripheral module being adapted to detect an error associated with the first or second sensor and determine a braking demand;
at least one input circuit configured to convert one of the at least two redundant signals into a test signal, the test signal differing from the at least two redundant signals; and
a second peripheral module of the microcontroller, the second peripheral module being configured to process sensor information contained in the test signal to redundantly determine the braking demand, wherein configuration of the first peripheral module and the second peripheral module is such that the processing of the sensor information of the at least two redundant signals in the first peripheral module of the microcontroller and the processing of the test signal in the second peripheral module of the microcontroller are effected redundantly and independently such that the microcontroller is adapted to determine an error associated with the first peripheral module based on a difference between the braking demand determined by the first peripheral module and the braking demand determined by the second peripheral module,
wherein the first peripheral module is functionally different from the second peripheral module such that, in the absence of the error associated with the first peripheral module, the first peripheral module and the second peripheral module determine a common braking demand based on different inputs thereto.
6. The electronic circuit as claimed in claim 5 , wherein the first peripheral module and the second peripheral module comprise software modules that differ from each other and have different software drivers.
7. The electronic circuit as claimed in claim 5 , wherein the at least one input circuit is a low-pass filter for a pulse-width modulated signal, or wherein the at least one input circuit comprises a voltage-controlled oscillator for an analog voltage or current signal.
8. The electronic circuit as claimed in claim 5 , wherein processing the at least two redundant signals in the first peripheral module includes comparing the at least two redundant signals with each other.
9. A motor vehicle brake system, comprising the electronic circuit as claimed in claim 5 .
10. A motor vehicle, comprising the electronic circuit as claimed in claim 5 .
11. A method for redundant signal processing of a safety-relevant application, the method comprising using the electronic circuit as claimed in claim 5 in a motor vehicle.