DE102007004794B4 - Controller block with monitoring by a watchdog - Google Patents

Abstract

A controller module is described with monitoring by a watchdog, the controller module comprising an arithmetic unit and an addressable port module, both of which are each connected to a controller-internal address bus and to a controller-internal data bus, at least one arithmetic task being stored within a component of the controller module The result of this is the address of the port module, with the computing unit calculating the computing task cyclically and transferring the result value to the address bus, and the computing unit sending a data value to the data bus that appears as a signal for resetting the watchdog when the port module is correctly addressed at the output of the port module ,

Description

The present invention relates to a controller module in a safety-critical device with monitoring by a watchdog, wherein the controller module includes a computing unit and an addressable port module, both of which are each connected to a controller-internal address bus and a controller-internal data bus.

From the Japanese Patent Abstract JP 02281343 A An arrangement is known in which a computing unit is connected via an address bus and a data bus to a comparison circuit, which compares values on the address and the data bus with reference values, and resets a watchdog timer on successful comparison.

The German patent application DE 103 47 196 A1 describes a device for checking an interface between a controller and one or more peripheral units. The interface has an address bus and a data bus. A monitoring circuit connected to the interface and having a comparison register whose content is comparable to the content of a receiver which contains a first bit pattern formed from the bit patterns of address bus and data bus may generate an alarm signal if the receiver and the comparison register do not match. By a switching mechanism, the content of the comparison register, consisting of second bit patterns, according to a predetermined rule changeable.

In the US 2004 0078 731 A1 For example, a method for operating a processor-controlled system is proposed. To monitor the health of the processor, a processor independent integrated monitoring unit is integrated with the processor in an integrated circuit. The integrated monitoring unit must cyclically reset a watchdog unit, wherein after a request directed by the integrated monitoring unit to the processor, the watchdog unit is reset in accordance with a response given by the processor.

Many day-to-day facilities are now equipped with a microcontroller. In particularly important or safety-critical devices, the correct function of the microcontroller is ensured by special measures, such as by a multiple and thus redundant installation of safety-critical components. This creates a relatively high cost.

In many cases, a so-called watchdog is provided for monitoring a controller module. This is a counter or timer implemented by hardware or software which is reset by a signal within regular timings and which, if the signal fails, triggers a safety function, for example by resetting the controller module or by shutting down more or less large parts of the monitored facility.

A watchdog thus checks whether a reset signal occurs regularly. The reliability with which errors are detected depends in particular on the way in which the resetting signal is obtained. Thus, in an otherwise regular program sequence of a computing unit often can not be detected when the arithmetic unit performs arithmetic operations incorrectly. In order to uncover such errors as well, two computing units operating independently of one another are frequently provided which mutually check their computation results. However, this requires a considerable cost.

The object was to provide a controller module for a safety-critical device, in which arithmetic errors occurring in particular in a computing unit can be detected reliably in a simple and cost-effective manner.

This object is achieved by the features mentioned in claim 1.

The controller module according to the invention thus carries out arithmetic tasks, in particular numerical arithmetic tasks, the results of which are used to check the correct function of the arithmetic unit.

Advantageous embodiments and further developments of the invention are set forth in the dependent claims. In the following an embodiment of the invention will be illustrated with reference to the drawing and explained in more detail. The single FIGURE shows a greatly simplified block diagram of a controller module according to the invention.

The controller module (CB) has at least one processor unit (CPU) and one port module (IO). The port module (IO) can be, for example, a serial or parallel input / output module. The arithmetic unit (CPU) and the port block (IO) communicate with each other via an address bus (AB) and a data bus (DB), whereby the arithmetic unit (CPU) can address the port block (IO) via the address bus (AB). The data bus (DB) can be used for data values from the Processing unit (CPU) to the port block (IO), and vice versa, transferred.

Furthermore, the controller module (CB) has an internal component (SP), implemented, for example, as a memory module (SP) in which at least one arithmetic task (RA) and preferably several arithmetic functions (RA) are stored. The term calculation task (RA) generally stands for an algorithmic sequence which can be executed by the arithmetic unit (CPU) and supplies a numerical result value as the result. The at least one calculation task (RA) is specified in such a way that it supplies the address of the port block (IO) as the result value.

Also provided is a hardware or software watchdog (WD) that includes a resettable counter or timer. The watchdog (WD), which is shown here as an external component, can alternatively also be designed as a component integrated in the controller module (CB).

If the reset of the watchdog (WD) does not take place regularly within a time window or before the expiry of a maximum time, then this generates an output signal, which is supplied to a reset input (RESET) of the controller module (CB) and a restart of the controller module (CB) or the Arithmetic unit (CPU) causes with defined initial conditions. Alternatively, the output signal of the watchdog (WD) can also switch off the device controlled by the controller module (CB).

In particular, the described structure has the purpose of regularly checking the functionality of the controller module (CB) and especially of the arithmetic unit (CPU) and thus ensuring it. It is essential that especially the arithmetic functions, ie the "correct calculation" of the arithmetic unit (CPU), are monitored.

For checking, the arithmetic unit (CPU) processes arithmetic tasks (RA) within the usual program sequence, which are stored, for example, in an internal memory module (SP) and which the arithmetic unit (CPU) retrieves from this memory component (SP). The arithmetic unit (CPU) calculates a numerical result value from this.

However, the arithmetic unit (CPU) can not reliably check this result value for correctness, since it can at least not be ruled out in the case of a faulty result value that the check of the result value would also be faulty.

The solution to this problem is to check the result externally, ie outside of the arithmetic unit (CPU). For this purpose, a calculation of the same computational task by a second, independent arithmetic unit or a retrieval of the stored result, and a comparison of the two result values could be provided. Such a structure would be very expensive.

Instead, the external check is carried out by using the result value to address a port block (IO). The at least one arithmetic task (RA) stored in the memory module (SP) is designed such that it supplies the address of the port module (IO) as the result. The arithmetic unit (CPU) then outputs the result of the calculation to the address bus (AB). If the calculation result is correct, the port block (IO) is addressed. A data value subsequently given by the arithmetic unit (CPU) to the data bus (DB) thus arrives at the port module (IO), which then outputs a signal corresponding to this data value at its output, which effects a reset of the watchdog (WD).

If, however, the calculation unit (CPU) calculates the result value incorrectly, the port block (IO) is not addressed and the port block (IO) accordingly outputs no signal for resetting the watchdog (WD). In this case, the watchdog (WD) generates an output signal for the reset input (RESET) of the controller module (CB).

The security of the check can be further increased, even if the data value which the arithmetic unit (CPU) gives to the data bus (DB) has previously been determined by the arithmetic unit (CPU) as the result of a computational task (RA).

In this regard, it is also advantageous if the arithmetic unit (CPU) does not always solve the same arithmetical task (RA) for determining the address of the port block (IO), but several different arithmetic tasks (RA) successively, preferably in random order. As a result, the arithmetic unit (CPU) is tested to a greater extent, so that smaller and more specific errors of the arithmetic unit (CPU) can be detected with greater security.

reference numeral

FROM

address

CB

controller chip

CPU

computer unit

DB

bus

IO

port module

RA

Calculation (n)

RESET

Reset input

SP

Component (memory module)

WD

Watchdog

Claims (9)

Controller module in a safety-critical device with monitoring by a watchdog, the controller module includes a computing unit and an addressable port module, both of which are each connected to an internal controller address bus and a controller internal data bus, characterized in that within a component (SP) of the controller module (CB) at least one computational task (RA) is stored, which results in the address of the Portbausteins (IO), that the arithmetic unit (CPU) calculates the arithmetic task (RA) cyclically and the result value on the address bus (AB) and that the Arithmetic unit (CPU) is a data value on the data bus (DB), which appears at the output of the port block (IO) with a correctly addressed port block (IO) as a signal for resetting the watchdog (WD). Controller module according to claim 1, characterized in that within a component of the controller module (CB) a plurality of arithmetic tasks (RA) are stored, which calculates the arithmetic unit (CPU) cyclically successively. Controller module according to claim 1, characterized in that within a component (SP) of the controller module (CB) a plurality of arithmetic tasks (RA) are stored, which calculates the arithmetic unit (CPU) in random order one after the other. Controller module according to one of the preceding claims, characterized in that the arithmetic unit (CPU) also determines the data value by calculating a calculation task (RA). Controller module according to claim 1, characterized in that the watchdog (WD) is a controller-internal component or a controllerexterne device. Controller module according to claim 1, characterized in that the controller module (CB) is connected to a plurality of watchdogs. Controller module according to claim 6, characterized in that at least one watchdog is a controller-internal component and at least one watchdog (WD) is a controllerexterne device. Controller module according to claim 1, characterized in that at least one watchdog (WD) can perform a reset of the controller module (CB). Controller module according to claim 1, characterized in that at least one watchdog can perform a shutdown of a controlled by the controller device device.

Images