Computer architecture and functional architecture for increasing the fail-safety of auxiliary power steering

Patent metadata

Field	Value
Publication number	US-10800449-B2
Application number	US-201816100859-A
Country	US
Kind code	B2
Filing date	Aug 10, 2018
Priority date	Feb 10, 2016
Publication date	Oct 13, 2020
Grant date	Oct 13, 2020

Abstract

The invention relates to a computer architecture and functional architecture for the operation of electric power steering, to an electronic control unit, and to power steering, having a first group of modules with a high probability of failure and a second group of modules with a low probability of failure. In this case, the modules of the first group have a higher probability of failure than the modules of the second group. The first group of modules is maintained redundantly in this case and, as a result, divided into main modules and into the redundant implementation of what are known as secondary modules. The main modules are arranged on a main control path and the secondary modules are respectively arranged on a secondary control path. Each of these control paths ultimately produces a control signal, i.e., a main control signal and a secondary control signal. A multiplexer is used to decide which of these two control signals is forwarded to modules from the second group. This second group of modules is implemented only once and not present in redundant form.

First claim

What is claimed is:

1. A computer architecture and functional architecture for operation of an electric power steering, comprising:
a first group of modules designated as having a first probability of failure;
a second group of modules designated as having a second probability of failure; and
a multiplexer,
wherein the first group of modules have a higher probability of failure than the second group of modules,
wherein the first group of modules is maintained redundantly and, as a result, main modules and secondary modules of the first group of modules are provided in redundant implementation, the main modules being arranged on a main control path and the secondary modules being arranged on a secondary control path, and the main modules generating a main control signal and the secondary modules generating a secondary control signal,
wherein the second group of modules is implemented only once, the second group of modules each generating a first signal that is combined into the main control signal, and the second group of modules each generating a second signal that is combined into the secondary control signal, and
wherein the multiplexer forwards one of the main control signal and the secondary control signal to a driver.

2. The computer architecture and functional architecture according to claim 1 , wherein the first group of modules comprises at least one of the following modules:
a current monitor; or
a computing unit, and

wherein the second group of modules comprises at least one of the following modules:
a driver;
a power stage; or
a phase cut-off.

3. The computer architecture and functional architecture according to claim 1 , wherein a main module of the main control modules sets a main error signal in an event of an error of a main module and wherein a secondary module of the secondary control modules sets a secondary error signal in an event of a secondary module error.

4. The computer architecture and functional architecture according to claim 1 , wherein the only communication between the main control path and the secondary control path or between the secondary control path and the main control path includes:
transmission of main error signals from the main modules to the secondary modules; and
transmission of secondary error signals from the secondary modules to the main modules.

5. The computer architecture and functional architecture according to claim 1 , wherein a main module sets a secondary error signal in an event of an error of a secondary module, and wherein a secondary module sets a main error signal in an event of an error of a main module.

6. The computer architecture and functional architecture according to claim 2 , wherein the first group of modules comprise a current monitor and a computing unit, in particular a main current monitor, a main computing unit, and parallel thereto, a redundant secondary current monitor and a redundant secondary computing unit, wherein the main current monitor sets a second main error signal when it detects an error of the main current monitor or the main computing unit, wherein the main computing unit sets a first main error signal when it detects an error of the main computing unit, wherein the secondary current monitor sets a second secondary error signal when it detects an error of the secondary current monitor or the secondary computing unit, and wherein the secondary computing unit sets a first secondary error signal when it detects an error of the secondary computing unit.

7. The computer architecture and functional architecture according to claim 3 , wherein the multiplexer forwards the secondary control signal of the secondary control path when the main error signal is set by the main control module, and when the main error signal is not set, the multiplexer forwards the main control signal of the main control path.

8. The computer architecture and functional architecture according to claim 1 , wherein an emergency operating mode is activated when a main error signal is set by the main control modules and at a same time a secondary error signal is set by the secondary modules.

9. An electronic control unit or combined motor/electronic control unit, comprising a computer architecture and functional architecture according to claim 1 .

10. The electronic control unit or combined motor/electronic control unit according to claim 9 , wherein external interfaces are not present redundantly.

11. A power steering comprising an electronic control unit or a combined motor/electronic control unit according to claim 9 .

12. The computer architecture and functional architecture according to claim 1 , wherein redundancy for the first group of modules is hardware redundancy for each module of the first group of modules.

13. An electronic control unit, comprising:
at least one main control unit outputting a main control signal;
at least one auxiliary control unit providing hot-redundancy for the at least one main control unit by parallel computation with the at least one main control unit, and outputting an auxiliary control signal;
at least one system control unit transmitting a first control signal to the at least one main control unit and transmitting a second control signal to the at least one auxiliary control unit;
a multiplexer receiving the main control signal and the auxiliary control signal, the multiplexer transmitting the main control signal, when a first error logic value is not set, to a driver, the multiplexer transmitting the auxiliary control signal, when the first error logic value is set, to the driver,
wherein the first control signal is encoded in the main control signal, and the second control signal is encoded in the auxiliary control signal, and
wherein the at least one main control unit and the auxiliary control unit exchange error signals indicating failure of the at least one main control unit and/or the at least one auxiliary control unit.

14. The electronic control unit of claim 13 , further comprising:
a first main control unit and a second main control unit of the at least one main control unit;
a first auxiliary control unit and a second auxiliary control unit of the at least one auxiliary control unit, the first auxiliary control unit providing parallel computation for the first main control unit, and the second auxiliary control unit providing parallel computation for the second main control unit;
a first system control unit and a second system control unit of the at least one system control unit, the first system control unit transmitting the first control signal to the first main control unit and transmitting the second control signal to the first auxiliary control unit, the second system control unit transmitting a third control signal to the second main control unit and transmitting a fourth control signal to the second auxiliary control unit,
wherein the first main control unit is connected to the second main control unit,
wherein the first auxiliary control unit is connected to the second auxiliary control unit,
wherein the first main control unit is connected to the multiplexer via a first signal path and the first auxiliary control unit is connected to the multiplexer via a second signal path, and
wherein the first main control unit is connected to the first auxiliary control unit via a first error signal path and a second error signal path.

15. The electronic control unit of claim 13 , wherein the at least one main control unit, the at least one auxiliary control unit, the at least one system control unit, and the driver are implemented in hardware on the electronic control unit.

Assignees

• Hella Gmbh & Co Kgaa

Inventors

• Bernon-Enjalbert Valerie
• Dietsch Jerome
• Galtie Frank

Classifications

• B62D5/0493

  detecting processor errors, e.g. plausibility of steering direction · CPC title

• B62D5/0484 Primary

  for reaction to failures, e.g. limp home · CPC title