ERROR CORRECTION IN A REDUNDANT PROCESSING SYSTEM

Abstract

A processing system encompasses several processing devices and a comparison device. A method for controlling the processing system encompasses: processing of identical information items by the processing devices using associated processing processes; furnishing a characteristic value of each processing process, respectively as a function of the processing that has occurred; and comparing the characteristic values by way of the comparison device and determining a defectively operating processing process on the basis of the comparison. The defectively operating processing process is replaced by a processing process restarted on the same processing device.

Claims

1-9. (canceled)

10. A method for controlling a processing system, including a plurality of processing devices and a comparison device, the method comprising: processing identical information items by the processing devices using associated processing processes; furnishing a characteristic value of each of the processing processes, respectively, as a function of the processing that has occurred; and comparing the characteristic values by the comparison device, and determining a defectively operating processing process based on the comparison; wherein defectively operating processing processes are replaced by a processing process restarted on the same processing device.

11. The method of claim 10, wherein a further processing process is periodically restarted on each of the processing devices, and initialized with the input information items, and wherein the existing processing processes on all of the processing devices are replaced by the further processing processes.

12. The method of claim 10, wherein a further processing process is restarted on each of the processing devices and initialized with the input information items, wherein the processing device on which the defectively operating processing process is running is reset, wherein a processing process is restarted on that processing device and is initialized with input information items, and wherein the existing processing processes on the other processing devices are replaced by the further processing processes.

13. The method of claim 10, wherein the processing device on which the defectively operating processing process is running is reset, wherein a processing process is restarted on that processing device and initialized with input information items, wherein on each of the other processing devices, a further processing process is respectively restarted and initialized with the input information items, and wherein the existing processing processes on the other processing devices are replaced with the further processing processes.

14. The method of claim 10, wherein the processing processes of at least two processing devices are identical.

15. The method of claim 10, wherein at least three processing processes are provided and a processing process is determined to be operating defectively if its characteristic value differs from the characteristic values of the other processing devices and the other characteristic values are in agreement.

16. A non-transitory computer readable medium having a computer program, which is executable by a processor, comprising: a program code arrangement having program code for controlling a processing system, including a plurality of processing devices and a comparison device, by performing the following: processing identical information items by the processing devices using associated processing processes; furnishing a characteristic value of each of the processing processes, respectively, as a function of the processing that has occurred; and comparing the characteristic values by the comparison device, and determining a defectively operating processing process based on the comparison; wherein defectively operating processing processes are replaced by a processing process restarted on the same processing device.

17. A processing system, comprising: a plurality of processing devices, each being configured to process the same input information items respectively using an associated processing process and to furnish a characteristic value as a function of the processing; and a comparison device to compare the characteristic values and to determine a defectively operating processing process based on the comparison; wherein each of the processing devices is configured to replace the processing process executing on it with a restarted processing process if the processing process executing on that processing device has been determined to be operating defectively.

18. The processing system of claim 17, wherein at least two of the processing devices are of identical construction.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0023] FIG. 1 depicts a processing system.

[0024] FIG. 2 is an execution diagram of a first method.

[0025] FIG. 3 is an execution diagram of a second method.

[0026] FIG. 4 is an execution diagram of a third method.

DETAILED DESCRIPTION

[0027] FIG. 1 shows a processing system 100 that is configured for redundant processing of information items. Processing system 100 can in particular be real-time capable and can be configured, for example, for driver-independent control of a motor vehicle, in particular of a passenger car. In the embodiment depicted by way of example, processing system 100 encompasses a first processing device 105, a second processing device 110, a third processing device 115, and a comparison device 120. In the embodiment depicted here, three processing devices 105 to 115 are provided; in other embodiments, only two or more than three can be used. Each processing device may be constituted by a programmable microcomputer. An associated processing process executes on each processing device 105 to 115. A first processing process A1 is associated with first processing device 105, a second processing process A2 with second processing device 110, and a third processing process A3 with third processing device 115. Comparison device 120 may be embodied as a microcontroller, but can also encompass a microcomputer. In the embodiment depicted, a comparison process V executes on comparison device 120.

[0028] Processing system 100 is configured to process input information items 125 that can be furnished, for example with a predetermined frequency of occurrence, by a video camera 130.

[0029] In the present case an input interface 135 is provided through which input information items 125 can be transferred to processing system 100. After the processing of input information items 125 by processing processes A1 to A3 on processing devices 105 to 115, a processing result can be furnished via an output interface 140.

[0030] In order to ensure that a defectively operating processing process A1 to A3 does not compromise the data that are being processed, each processing process A1 to A3 or each processing device 105 to 115 furnishes, in an event-controlled manner or periodically, a characteristic value 145 that refers to the respective processing operation. Comparison device 120 or comparison process V compares characteristic values 145 with one another and/or with predetermined values in order to determine whether an anomaly exists in one of processing processes A1 to A3. If this is the case, then that processing device 105 to 115, on which the processing process A1 to A3 has been determined to be operating defectively, is prompted, by way of a signal of comparison device 120, to restart processing process A1 to A3 or to supersede or replace it with a restarted processing process A1 to A3. Different variants for this purpose are proposed, and will be discussed in further detail below with reference to FIGS. 2 to 4. Comparison device V can be configured to control one of processing processes A1 to A3 in the event of an anomaly, in particular with regard to resolution of a fault state, and/or to determine or modify a processing result of processing processes A1 to A3, in particular on the basis of a majority decision.

[0031] FIGS. 2 to 4 are all depicted in the same manner. A time t is plotted in a horizontal direction; in a vertical direction, processing processes A1 to A3 and comparison process V are depicted one above another as bars. The bars that are depicted are interrupted in order to indicate when the respective process A1 to A3, V is executing and when not. The depiction is merely exemplary and figurative. A black bar indicates in each case that the underlying processing device 105 to 115 is being restarted. This operation is known in conjunction with computers as booting, and can encompass in particular loading and starting of an operating system on the respective processing device 105 to 115 which controls or enables the execution of processes A1 to A3.

[0032] A hatched bar indicates that a processing process A1 to A3 is being initialized. Initialization requires the delivery of input information items 125 over a certain time period or a certain number of measurement epochs. Filters, parameters, or a model that can be encompassed by processing processes A1 to A3 can be constructed or stabilized on the basis of input information items 125 that are delivered. For example, processing processes A1 to A3 can encompass a Kalman filter that operates substantially recursively and supplies usable results only after a number of input information items 125. A bar depicted in white represents a usual execution of a processing process A1 to A3. If more than one processing process A1 to A3 is running on a processing device 105 to 115, the most recently started processing process is provided with an apostrophe and labeled A1 to A3. If one of processing processes A1 to A3 executing on the same processing device 105 to 115 then terminates, the remaining processing process is then automatically labeled A1 to A3 (without an apostrophe).

[0033] FIG. 2 is an execution diagram of a first method 200 for controlling a processing system 100 according to FIG. 1. Processing and comparison devices 105 to 120 may be restarted (booted) in a first step 205. Processing processes A1 to A3 are then initialized on processing devices 105 to 115 in a step 210. A usual execution of processing processes A1 to A3 then occurs in a step 215. In a step 220, new processing processes A1 to A3 are respectively started on all processing devices 105 to 115, and run concurrently with processing processes A1 to A3.

[0034] In a step 225, the restarted processing processes A1 to A3 are initialized, while at the same time processing processes A1 to A3 run normally and furnish information processed on the basis of input information items 125. Once the new processing processes A1 to A3 have been completely initialized, they then replace processing processes A1 to A3 in a step 230. The restarted processing processes A1 to A3 become processing processes A1 to A3, and method 200 can continue in step 215.

[0035] FIG. 3 shows a second method 300 for controlling processing system 100 of FIG. 1. It is assumed in the depiction that steps 205 and 210 have already been carried out. The depiction begins with step 215, in which processing processes A1 to A3 are carried out normally on the associated processing devices 105 to 115. In a step 240, new processing processes A1 to A3 are started on processing devices 105 to 115 in addition to the existing processing processes A1 to A3, and are initialized in a subsequent step 245. Steps 240 and 245 correspond substantially to steps 220 and 225 of method 200 of FIG. 2. A switchover from processing processes A1 to A3 to the new processing processes A1 to A3 does not then occur, however, but instead the restarted processing process A1 to A3 run in the background or are set aside while, in step 250, normal processing corresponding to step 215 is carried out.

[0036] If a defective embodiment 255 is determined (in the depiction, second processing process A2), the associated processing device 110 is then restarted in a step 260 (cf. step 205). In a step 265, a processing process A2 is then started and initialized on the restarted processing device 110. In a step 270, the respective current processing process A1, A3 on processing devices 105, 115 that were not affected by fault 255 is replaced by processing process A1, A3 that was subsequently started. Processing can then occur again as in step 215.

[0037] FIG. 4 is an execution diagram of a third method 400 for controlling processing system 100 of FIG. 1. Steps 205, 210, and 215 described above are carried out until a fault 255, which here once again, by way of example, affects the second processing process A2 on second processing device 110, is identified. Second processing device 110 that is affected is then restarted in a step 260. In a step 275, new processing processes A1 to A3 are then started on all processing devices 105 to 115. In a step 270, operation can then switch over to the restarted processing processes A1 to A3, and normal execution operation can be resumed in step 215.