Method and arrangement for suppressing incorrect messages in monitoring systems

[0001] This is a U.S. national stage of application No. PCT/EP2004/050980, filed on 1 Jun. 2004. Priority is claimed on the following application(s): Country: Germany, Application No.: 103 29 512.7, Filed: 30 Jun. 2003.

[0002] The invention relates to a method and an arrangement for suppressing incorrect messages in monitoring systems for electronic devices, in particular for sensor circuits for motor vehicles.

[0003] For safety reasons, monitoring systems are frequently used for electronic devices in which an incorrect output variable which is caused by a fault in the device can bring about hazards. It is therefore necessary to avoid faults in sensor circuits for motor vehicles resulting in hazardous driving situations, for example if a rotational speed sensor signals a high rotational rate while the vehicle is maintaining its course. However, other hazards and at least operational faults may occur as a result of incorrect messages. Incorrect messages may be caused, for example, by brief disruptions, in particular voltage peaks, which are interpreted by monitoring systems as faults without them leading to falsification of the output variable of the device.

[0004] An object of the present invention is to largely prevent incorrect messages so that as far as possible only genuine faults lead to an alarm, which is then indicated or can be fed to a superordinate system to ignore the output variable, and to ensure that an alarm is triggered quickly when there are a plurality of input variables.

[0005] This object is achieved according to the invention in that fault messages are derived using a program running on a processor if one of the input variables to be monitored exceeds respective limiting values which are predefined for it, in that a respective counter is incremented by the fault messages, in that the counter reading is checked to determine whether at least one fault message is present, and in that, if this is the case, a further check is carried out in advance for the relevant input variable, in that the fault messages each increment a counter, and in that an alarm is not triggered until a predefined counter reading is reached.

[0006] The size of the increments and, if appropriate, of the decrements and the predefined counter reading may be preselectable, and the triggering of an alarm can be adapted individually to the type of respective fault message. This particular embodiment is preferably implemented by the preselectable variables being read out from a nonvolatile memory when the device is switched on.

[0007] In devices which are to be monitored it is generally expedient to monitor a plurality of variables, referred to below as input variables with respect to the method according to the invention. For this purpose, in the method according to the invention there is provision for fault messages which each increment a counter to be derived from a plurality of input variables to be monitored, and for the size of the increments and, if appropriate, of the decrements, the predefined counter reading and limiting values of the variable to be respectively monitored to be preselectable for each of the input variables to be monitored.

[0008] In the case of devices which are relevant to safety it is frequently necessary to react very quickly to a fault message. The checking of the fault messages with the method according to the invention can, however, take longer than necessary, in particular when there are a plurality of input variables to be monitored, due to the finite running time of the program in the processor. This applies in particular if a plurality of incrementations are necessary up to the point where the predefined counter reading is reached, in order to avoid incorrect messages.

[0009] In one development of the method according to the invention the triggering of an alarm is speeded up significantly in that fault messages are derived using a program running on a processor if one of the input variables to be monitored exceeds respective limiting values which are predefined for it, in that the respective counter is incremented by the fault messages, in that the counter reading is checked to determine whether at least one fault message is present, and in that, if this is the case, a further check is carried out in advance for the relevant input variable. This is achieved in that the monitoring of a variable which has already had attention drawn to it by a fault message is carried out in a prioritized fashion in terms of time. If a plurality of such fault messages are present, the further checking will preferably be carried out in such a way that when fault messages are present for a plurality of input variables the advance further checking of these input variables is carried out according to a previously defined priority list.

[0010] The invention also comprises an arrangement for suppressing fault messages in monitoring systems for electronic devices, in particular for sensor circuits for motor vehicles, in which it is provided that in a microprocessor it is possible to run a program with which fault messages are derived if one of the input variables to be monitored exceeds respective limiting values which are predefined for it. A respective counter is incremented by the fault messages. The counter reading is checked to determine whether at least one fault message is present, and in that, if this is the case, further checking is carried out in advance for the relevant input variable. An alarm is not triggered until at least one of the counters reaches a respectively predefined counter reading.

[0015] For the sake of simplicity, the arrangement according to FIG. 1 is illustrated only for an input variable which is to be monitored and which is present at an input 1. At first, checking is carried out at range check 2 to determine whether the input variable is in a permissible range between mm and max. If this is not the case, a fault message is passed on to a fault counter 3, also simply referred to below as counter. If a fault message is present, the counter 3 is incremented by one increment I which is predefined as a number of counting steps. If no fault message is present in the respective time period (program run), the counter 3 is decremented by one decrement D which is also predefined as a number of counter steps. If the counter reading reaches a predefined threshold value A, an alarm is triggered in an alarm trigger 4 and output via an output 5. The respective counter reading can be read out via a monitoring output 6.

[0016] When the device is switched on, the predefined values are read out from an EEPROM 7, said values being specifically the maximum permissible value max and the minimum permissible value min of the input signal, the number of counting steps I and D and the threshold value A. In addition, the counter 3 is reset by means of an input 8. The part of FIG. 1 which is outlined by dashed lines is present once for each input variable and is preferably implemented by a program for a processor, with the predefined variables being stored individually for each input variable in the EEPROM 7 and being loaded into the working memory of the processor when the device is switched on. The outputs 5, 6 which are assigned to the alarm triggers for the various input variables can be combined in a suitable way.

[0017] Threshold values may be used to suppress the alarm in a selective way when specific input variables to be monitored exceed allowable values. The threshold value may be set to “0” for these input variables. This specification of a threshold value is interpreted as a command with which the correspondingly configured alarm triggers are blocked. The fault counter for checking these input variables thus has no effect on the triggering of the alarm.

[0018] FIG. 2a shows an exemplary profile of the output variable of the range check 2 in line a. As an example it will be assumed that after a fault-free time a fault message 11 occurs and then in turn a time period without faults and then two fault messages 12, 13 in succession.

[0019] Line b of FIG. 2b shows the profile of a reading of error counter 3 for the case in which in each case a fault message 11, 12, 13 increments the counter by an increment I of one counting step, and in which the absence of a faults message decrements the counter 3 by D=0. With this setting, no fault messages are therefore “forgotten” again so that the absolute number of fault messages remains stored in the error counter 3 until the next reset (switching on of the device or switching off). If the threshold value is therefore set to 3 in the case illustrated in FIG. 2b, an alarm is triggered on the basis of the fault message 13 because the counter reaches the value of 3 after the fault message 13 occurs.

[0020] FIG. 2c relates in turn to the occurrence of fault messages 11, 12, 13 according to FIG. 2a, but I is set to 3 and D to 1. As a result of fault messages 11, 12, 13 occurring in close succession, the counter reading quickly rises, and when fault messages are absent it drops more slowly. As a result, accumulations of fault messages lead to an alarm if the threshold value A is set higher than I.

[0021] The program illustrated in part in FIG. 3 runs through a loop during which all the input variables from 1 to n are checked. In the program steps 21, 22, the first two input variables are checked, the respective counter is incremented or decremented and the counter reading is compared with the associated threshold value A. There is then an interrogation to determine whether one of the input variables has incremented the counter 3 as a result of the limiting values max and min (FIG. 1) being respectively exceeded or undershot, which is considered to be a warning. If this is not the case, after the branching point 23 the program continues with checking further input variables. However, if at least one warning is present, the relevant input variables in the program part 24 are checked again. This takes place according to a previously defined priority sequence.

[0022] If it is detected during one of the checks 21, 22, 24 that the alarm threshold A has been reached, an alarm is triggered, which is not illustrated in particular in FIG. 3 for the sake of clarity. The last two input variables (n-1) and n are checked at 25 and 26, after which in turn branching takes place as a function of whether these input variables have lead to a warning. If this is the case, the relevant input variables are checked again at 28. The program is then repeated starting at 21.

[0023] The described checking of two input variables including the immediate further checking at 24 takes approximately 5 ms when a program is carried out in practice. If a maximum reaction time for a fault message of 25 ms is allowed, ten input variables can be checked. The order of the checks can also be changed depending on the particular requirements. For example, three or more input variables can thus be checked before the system continues to immediate further checking of those input variables for which a warning is active. In other cases it is also possible to provide that after each input variable has been checked it is decided whether said input variable is to be checked once more immediately afterward.