CN217008192U

CN217008192U - Circuit arrangement for preventing faulty data transmission via a bus interface

Info

Publication number: CN217008192U
Application number: CN202090000456.7U
Authority: CN
Inventors: A·万德利希; A·菲施
Original assignee: Vitesco Technologies GmbH
Current assignee: Vitesco Technologies GmbH
Priority date: 2019-03-26
Filing date: 2020-03-25
Publication date: 2022-07-19
Anticipated expiration: 2030-03-25
Also published as: DE102019204176B4; DE102019204176A1; WO2020193642A1

Abstract

The utility model relates to a circuit arrangement for preventing faulty data transmission via a BUS interface (BUS), comprising a Microcontroller (MC), a BUS interface module (BT) connected to the Microcontroller (MC), AND a Monitoring Unit (MU) which monitors the Microcontroller (MC), wherein both the Microcontroller (MC) AND the Monitoring Unit (MU) have disconnection outputs which are each connected to an input of a logical AND circuit (AND), AND wherein a switching unit (SE; SR) which connects the BUS interface module (BT) to a supply voltage potential (VDDx) is connected to the output of the AND circuit (AND) in order to be able to disconnect the BUS interface module (BT) from the supply voltage in the event of a fault.

Description

Circuit arrangement for preventing faulty data transmission via a bus interface

Technical Field

The utility model relates to a circuit arrangement for preventing faulty data transmission via a bus interface, having a microcontroller, a bus interface module connected to the microcontroller, and a monitoring unit for monitoring the microcontroller.

Bus interfaces, such as CAN, Flexray, Ethernet or LIN, which are used in vehicles to control safety-relevant actuators via control devices, are mostly included in safety disconnection schemes. The aim here is to block bus communication in the event of a fault.

In a first possible scenario, an Enable Pin (Enable-Pin) present at the bus interface module or bus transceiver is used for disconnection, which is also referred to as a mode control Pin. By means of which the transmission direction can be blocked or the transceiver can be completely deactivated.

In another possible case, a disconnection within the microcontroller of the transmission path is used. In this case, the function is triggered internally by software or externally by pins at the microcontroller.

However, the above-described solution is likely not to meet the required FIT-ratio for ASIL D safety objectives because Common Cause failures (Common Cause Fehler) of voltage supply schemes such as microcontrollers, logic circuits, and bus transceivers cannot be eliminated.

Background

DE 102011016706 a1 discloses a circuit arrangement for a control unit for carrying out a Fail-quiet or Fail-Safe function (Fail-silence-bzw. Fail-Safe-function), which has a microcontroller which comprises a hardware-implemented monitoring device which detects errors in individual modules of the microcontroller and has at least one output in order to inform external components about detected errors by means of a signal voltage, and which has a bus driver for communication of the control unit with a bus network, wherein the signal voltage applied to the output of the monitoring device is used to control the bus driver when an error is detected by the monitoring device, so that the bus communication of the control unit is not interrupted.

The bus driver may comprise a bus monitor interface with an input and the output of the monitoring device is connected to the input of the bus monitor interface, wherein a high level of the signal voltage is applied at the output of the monitoring device in the normal case and a low level of the signal voltage is applied in the fault case, and the bus driver interrupts the bus communication if a low level is present at the input of the bus monitor interface.

This solution and the solutions described above cannot be used for all bus transceivers in the automotive field, since the enable pins are not present on all bus interface modules or bus transceivers.

The disconnection within the microcontroller is not guaranteed outside the specified voltage range and is not present on some manufacturers' microcontrollers.

Disclosure of Invention

It is therefore an object of the present invention to provide a circuit arrangement for preventing faulty data transmission via a bus interface, which circuit arrangement is independent of the specific properties of the microcontroller and of the bus transceiver.

This object is achieved by a circuit arrangement according to the utility model.

The circuit arrangement according to the utility model for preventing faulty data transmission via a bus interface is therefore formed by a microcontroller, a bus interface module connected to the microcontroller and a monitoring unit which monitors the microcontroller, wherein both the microcontroller and the monitoring unit have disconnection outputs which are each connected to one input of a logical and circuit, and wherein a switching unit which connects the bus interface module to a supply voltage potential is connected to the output of the logical and circuit in order to be able to disconnect the bus interface module from the supply voltage in the event of a fault.

Irrespective of the specific properties of the microcontroller or the enable input of the bus transceiver or of the bus interface module, data transmission can therefore be prevented in the event of a fault in an advantageous and simple manner, since the voltage supply of the bus interface module is interrupted and it can therefore no longer be operated.

The switching unit can be a switching element which is connected between a supply voltage potential, preferably a positive supply voltage potential, of the supply voltage supplied to the bus interface module and its respective supply voltage input. In this case the bus interface module is simply separated from the supply voltage.

In an alternative embodiment of the circuit arrangement according to the utility model, the switching unit is a voltage regulator, from which the bus interface module is supplied with a supply voltage. A defined level at the output of the logic and circuit causes the voltage regulator to be deactivated, so that likewise no supply voltage is present anymore at the bus interface module and the bus interface module likewise becomes inactive.

In an advantageous embodiment of the circuit arrangement according to the utility model, the voltage regulator and the monitoring unit and possibly also the circuit are also integrated in the electronic module. This is a so-called power-application-specific integrated circuit (ASIC) with integrated watchdog circuitry (watchdog-switching).

Drawings

The utility model is explained in more detail below by means of embodiments with the aid of the drawings.

Fig. 1 shows a first embodiment of a circuit arrangement according to the utility model; and

fig. 2 shows a second embodiment of the circuit arrangement according to the utility model.

Detailed Description

In a first variant of the circuit arrangement according to the utility model, as shown in fig. 1, the microcontroller MC also has two data ports, one of which is connected to the data transmission channel TxD and the other to the data reception channel RxD of the data. The data transmission channel and the data reception channel are connected to respective inputs or outputs of a bus interface module BT, which is also commonly referred to as a bus driver or a bus transceiver. The BUS interface module BT then gives signals of a determined level corresponding to the BUS specification to the respective channel BUS or has a receiving circuit capable of receiving and converting these signals. All possible buses, such as a CAN bus, a Flexray bus, an Ethernet bus or a LIN bus, which are currently common, CAN be considered as a bus.

The bus interface module BT is coupled to a voltage supply source VDDx in a manner according to the utility model via a switching unit, which in the embodiment of fig. 1 is constructed by a switching element, which is constructed for example by a MOS-FET.

The microcontroller MC is monitored in a known manner by a monitoring unit MU, usually called Watchdog (Watchdog), for correct functioning, and which, like the microcontroller MC, has a disconnection output DIS.

The microcontroller MC AND the disconnection output DIS of the monitoring unit MU are each connected to an input of a logical AND circuit AND, which may be designed, for example, as a simple AND circuit (UND-gate).

The monitoring unit MU and the logic and circuit may be designed as separate or as an integrated module.

The output of the AND logic circuit AND is connected to the control input of the switching element SE, in order to be able to open the switching element in the event of a fault, so that the bus interface module BT is no longer connected to the positive potential VDDx of the voltage supply source AND is therefore no longer supplied. As a result, the BUS interface module can no longer transmit signals via the BUS, so that, for example, actuators, such as injection valves, cannot be actuated with errors.

In a second variant of the circuit arrangement according to the utility model, as shown in fig. 2, identical components are provided with the same reference numerals and are also connected to one another in the same manner. These components are therefore not described again, for which reference is made to the description of the variant of fig. 1.

The bus interface module BT is coupled to a voltage supply source which is designed as a voltage regulator SR and likewise provides the bus interface module BT with a positive voltage supply potential VDDx and a negative voltage supply potential GND. The bus interface module is coupled in the manner according to the utility model here to a voltage regulator SR, which is constructed in an integrated circuit IC, which is generally referred to as a Power-Supply-ASIC.

The integrated circuit IC is connected for communication and for monitoring via one or more channels Comm/MO. The integrated circuit furthermore has a port which is connected to the disconnection port DIS of the microcontroller MC AND, within the integrated circuit IC, to an input of the AND logic circuit AND. The integrated circuit is supplied in the embodiment presented by the vehicle battery at a voltage Vbatt.

The monitoring unit MU is likewise constructed in this exemplary embodiment in the integrated circuit IC, AND so is the logical AND circuit AND. In this case, the open output of the monitoring unit MU is advantageously connected directly on the semiconductor chip to the logical AND circuit AND. The output of the AND logic circuit AND is connected in the same way directly on the semiconductor chip to the voltage regulator SR, so that the voltage regulator can be deactivated in the event of a fault.

The circuit arrangement according to the utility model makes it possible to implement a flexible disconnection concept which can be used for a variety of different transceivers and can also be used independently of the microprocessor manufacturer. All safety-relevant control tasks implemented via the bus interface can be reliably performed in this case.

Claims

1. Circuit arrangement for preventing faulty data transmission via a BUS interface (BUS), having a Microcontroller (MC), a BUS interface module (BT) connected to the Microcontroller (MC), and a Monitoring Unit (MU) which monitors the Microcontroller (MC),

wherein both the Microcontroller (MC) AND the Monitoring Unit (MU) have disconnection outputs which are each connected to an input of a logical AND circuit (AND),

AND wherein a switching unit (SE; SR) connecting the bus interface module (BT) to a supply voltage potential (VDDx) is connected to an output of the AND circuit (AND) in order to be able to disconnect the bus interface module (BT) from the supply voltage in the event of a fault.

2. The circuit arrangement according to claim 1, wherein the switching unit (SE) is a switching element.

3. The circuit arrangement according to claim 1, wherein the switching unit (SE) is a voltage regulator (SR).

4. The circuit arrangement according to one of claims 1 to 3, wherein the voltage regulator (SR) and the Monitoring Unit (MU) are constructed integrally in one module (IC).

5. The circuit arrangement according to claim 4, wherein said AND-circuit (AND) is also integrally constructed in said module (IC).