GB2213966A

GB2213966A - Device for monitoring electronic equipment

Info

Publication number: GB2213966A
Application number: GB8900587A
Authority: GB
Inventors: Rudolf Kroll
Original assignee: Hella KGaA Huek and Co
Current assignee: Hella GmbH and Co KGaA
Priority date: 1988-01-14
Filing date: 1989-01-11
Publication date: 1989-08-23
Anticipated expiration: 2009-01-11
Also published as: DE3800829C1; GB2213966B; GB8900587D0; SE8804587L; SE8804587D0; SE466072B

Description

k 1 DEVICE FOR MONITORING ELECTRONIC EQUIPMENT )2131166 The invention

relates to a device for monitoring electronic equipment, particularly microcomputers, having an output which, in the event of a faultfree program run, delivers periodic monitoring signals, and having an input at which the program run can be started again by applying a restart signal.

A device of this kind is known from the UK Patent Specification with the number GB 2120428. A microcomputer to be monitored comprises a monitoring-signal output at which periodic monitoring signals appear in the event of a fault-free program run. The monitoring-signal output of the microcomputer is connected to respective set inputs of first and second retriggerable monostable trigger stages.

The time constants of the trigger stages are each determined by an RC network, the time constant of the first trigger stage being shorter than the time constant of the second trigger stage. An output of the first trigger stage is connected to the restart input of the microcomputer.

In the event of a fault-free program run, the first monostable trigger stage is triggered by the periodic monitoring signals each time before the expiration of the time constant. If the monitoring signals remain absent over a preset period of time which is longer than the time predetermined by the time constant, a restart signal appears at the output of the first trigger stage and starts 2 the program run of the microcomputer afresh. If a faultfree program runs follows, the restart signal is reset. If the absence of the monitoring signals exceeds the time constant of the second trigger stage, however, a disturbance signal is generated which actuates a warning device or a switching-off device in order to indicate or avoid an operating state endangering safety.

In another example, the effect is achieved, by an oscillator, a further time-dependent circuit and two NOR gates in the connection between the output of the first monostable trigger stage and the restart input of the microcomputer, so that on the one hand a restart signal is generated periodically if the monitoring signals from the microcomputer are absent and on the other hand a reset signal is generated if the supply voltage has not yet reached a preset value after switching-on has been effected.

In this case, it proves a disadvantage that a large number of discrete and integrated components are necessary for the generation of periodic restart signals in the event of absence of the monitoring signals, as a result of which, simple and inexpensive manufacture is impossible. This also applies to the generation of the restart signal on switching on and particularly with the combination, that is to say when using the oscillator and the time- dependent circuit.

In addition, it proves a disadvantage that, after the expiration of the time constant of the second W 3 monostable trigger stage, no restart signal is generated by means of which safety during operation could be increased since thereby a defined starting of the program run could be achieved.

A further device for monitoring microcomputers (Huse, Horst, "Watch-dog"-Schaltungen erkennen pP Systemstbrungen in: ELEKTRONIK 1980, No. 4, pages 92-94) has two retriggerable monostable trigger stages which have different time constants. In the event of a fault-free program run, the first trigger stage is reset by the monitoring signals of a microcomputer each time before the expiration of the time constant, so that no restart signal is generated. If no resetting of the first monostable trigger stage is effected, a renewed start of the system is carried out. On the expiration of the time constant of the first trigger stage, the second trigger stage is started.

If, after the restart signal, the program of the microcomputer does not run fault-free, then after the expiration of the time constant of the second trigger stage, a signal is generated which initiates a stoppage of the system. In this case, it proves a disadvantage that the two-stage resetting is effected by the program run of the microcomputer, since, in the event of a faulty program run, the safety during operation can be reduced.

In addition, it proves a disadvantage that in the event of a continuous absence of the monitoring signals from the microcomputer, restart signals are not generated periodically, and after the expiration of the time constant 4 of the second trigger stage no further restart signal is generated by means of which a possible defined fresh start of the program run might be achieved.

A device is also known from DEPS 2842392 wherein a first monostable trigger stage, the outputs of which are connected to a NAND gate, is integrated in the microprocessor. An RC network is provided in the connection from the non-inverting output to the NAND gate. In the absence of a monitoring signal from the microprocessor, a restart signal is generated at the output of the NAND gate, which signal is supplied to the microprocessor via a restart input and starts the program run of the microprocessor afresh.

In order to actuate an emergency running switching function of the microprocessor, the inverting output of the first monostable trigger stage is connected to the clock input of a JK flip-flop and to the set input of a second monostable trigger stage. The standing time (time constant) of the second monostable trigger stage is longer than that of the first. As a result of the absence of a further monitoring signal within the standing time of the second monostable trigger stage, the JK flip-flop is set and an emergency running switching function is activated via an OR gate.

If, after the absence of a first monitoring signal, no further monitoring signals appear, the noninverting outputs of the first and of the second monostable trigger stages are connected to an AND gate, the output of 1 which is connected to an input of an OR gate to initiate an emergency running switching function.

This last-described device has the disadvantage, in particular, that in the event of the failure of the monitoring signals to appear over a longer period of time than is preset by the standing time of the first trigger stage, only one restart signal is connected through to the microprocessor so that in the absence of further monitoring signals, the program is not started afresh. If the microprocessor nevertheless resumes operation, the program run can start again anywhere in the run so that there is no defined initial state for the program run and errors can thus frequently be caused.

A further disadvantage is the integration of the first trigger stage in the microprocessor, since, as a result of this, the device can frequently only be adapted with difficulty or not at all to another given electronic circuit.

Another disadvantage results from the fact that although activation of the emergency running switching function is avoided when the electronic equipment is brought into operation, nevertheless, no restart signal is connected through to the microprocessor in order to set this in a defined initial state after the necessary supply voltage has been reached.

Finally, simple and inexpensive manufacture of the device is scarcely possible since a large number of integrated semiconductor components are necessary.

6 According to the present invention, there is provided a device for monitoring electronic equipment, such as a microcomputer, the device being arranged to be connected to an output of the electronic equipment which, in the event of a fault-free program run, delivers periodic monitoring signals, and to apply to an input at the electronic equipment a restart signal for starting the program run again, the device comprising first and second monostable trigger stages which can be retriggered by the monitoring signals and the time constant of each of which is determined by an RC network, the time constant of the first monostable trigger stage being smaller than the time constant of the second monostable trigger stage, said monitoring-signal output connection of the microcomputer being to respective set inputs of the first and second monostable trigger stages and an output of the first monostable trigger stage providing said connection to the restart input of the microcomputer, an output of the second monostable trigger stage being connected to a further set input of the first monostable trigger stage and the first monostable trigger stage comprising a further RC network which determines the duration of the restart signal.

It is an advantage that the first trigger stage comprises an RC network which determines the duration of the restart signal because assurance is thus provided, in a simple and inexpensive manner without the use of a large number of discrete and integrated components, that, with an appropriate selection of the time constant, a restart 7 signal of adequate duration is delivered to the microcomputer so as to be able to execute a defined program start and, in addition, in the absence of the monitoring signals over a prolonged period of time, restart signals are generated periodically in order to start the program run afresh repeatedly.

It is a particular advantage that an output of the second trigger stage is connected to a further set input of the first trigger stage because thus, in the absence of the monitoring signals from the microcomputer over a period of time which is longer than the time constant of the second trigger stage, this delivers a set signal to the first trigger stage to produce a restart signal each time and connects it through to the input of the microcomputer in order to start the program run afresh in a defined manner each time, as a result of which the reliability in the operation of the microcomputer is increased.

Preferably, a supply-voltage control is provided, the output of which is connected to the further set input of the first trigger stage in order to generate a restart signal when the device is brought into operation and in the event of fluctuations appearing in the supply voltage, as a result of which, assurance is provided on these occasions that, if the supply voltage drops below a preset value, a set signal is delivered by the supply voltage control to the first trigger stage which then generates a restart signal and connects it through to the microcomputer in 8 order to start the program run in a defined state of operation and so avoid errors.

The output of the second trigger stage may be connected to an external output which may be connected in particular to an output shift register, for example, in order to activate an emergency running switching function after the expiration of the time constant of the second trigger stage, or to carry out switching-off operations by means of relays in order to avoid dangerous operating states.

One embodiment of the present invention is illustrated by way of example in the accompanying drawing and is described in more detail below, the single figure of the drawing being in the form of a block diagram of a device for monitoring the program run of a microcomputer.

In the drawing, a microcomputer MR is supplied with current from a voltage source B, which may be formed by a battery of a motor vehicle, via a supply-voltage control VR at one output A7 at which, a voltage of + 5V for example appears. The microcomputer MR is electrically connected, via its monitoring-signal output Al, to the device for monitoring the microcomputer.

In the event of a fault-free program run, the microcomputer MR delivers, at its output Al, periodic.

monitoring signals which are applied to a first electrode of a capacitor C3 of the device. The second electrode of the capacitor C3 is connected, via a so-called pull-up resistor R3, to the supply voltage. The second electrode 2 9 of the third capacitor C3 is also connected, via a series resistor RV, to a set input El of a first monostable trigger stage MK1 and to a set input E2 of a second monostable trigger stage MK2.

Disposed between the output Al of the microcomputer MR and the first electrode of the capacitor C3 is an integrated transistor gate T3, the output A10 of which is not only connected to the supply voltage via a pull-up resistor R8 but is also connected to the first electrode of the capacitor C3. An output A3 of the first trigger stage MK1 and the device is electrically connected to a restart input E4 of the microcomputer MR.

The first trigger stage MK1 has an RC network which determines its time constant and which is formed by a resistor R4 and a capacitor C4. The first electrode of the fourth capacitor C4 is connected to earth or to the negative operating voltage, and also to the terminal K1 of the first stage MK1. The second electrode of the capacitor C4 is connected to the terminal K2 of the first stage MK1, and to a fourth resistor R4 and, via this, to the supply voltage.

A second RC network of the first monostable trigger stage MK1 determines the duration of the restart signal. This second RC network consists of a resistor R1 and a capacitor Cl. The first electrode of the capacitor Cl is connected to earth or the negative battery voltage. The second electrode of the capacitor Cl is connected to the further set input E3 of the first trigger stage MK1, and connected, via the first resistor R1, output A8 of the first stage MK1.

The time constant of the second monostable trigger stage MK2 is determined by an RC network which consists of a resistor R5 and a capacitor C5. The first electrode of the capacitor C5 is connected to earth or the negative battery voltage, and to the terminal K3 of the second trigger stage MK2. The second electrode of the capacitor C5 is connected to the terminal K4 of the second trigger stage MK2, and to the supply voltage via a resistor R5.

The output A2 of the second trigger stage MR2 is connected, via a capacitor C2, to a first integrated inverting transistor gate T1. The output A9 of this first is gate T1 is connected to a terminal K5. The terminal KS is connected to the supply voltage via a pull-up resistor R6, and to the output A4 of the supply voltage control VR.

In addition, the terminal K5 is connected to the reset input E5 of the first trigger stage MK1 and to the reset input E6 of the second trigger stage MK2. Furthermore, the terminal K5 is connected to the cathode of the diode D1. The anode of the diode D1 is electrically connected to the further set input E3 of the first trigger stage MK1 via a low-resistance resistor R7, and via the resistor R7 and the resistor Rl, to the further output A8 of the first stage MK1. In addition, the anode of the diode D1 is connected, via the resistor R7, to the second electrode of the capacitor Cl. With this arrangement, the to the further 4 11 resistor R7 serves for the rapid discharge of the capacitor Cl.

Furthermore, the output A2 of the second trigger stage MK2 is electrically connected, via a second integrated transistor gate T2, to the external output A5 to which an output shift register AR may be connected, for example in order to activate an emergency running switching function. The external output A5 is electrically connected, via a pull-up resistor R2, to the supply voltage or to the positive battery voltage.

The operation of the device is explained in more detail below with reference to an example.

During a fault-free program run of the microcomputer MR, it delivers to the monitoring device, at its monitoring-signal output Al, rectangular pulses of positive potential, that is to say with the binary level 1, at predetermined, uniform intervals of time. The rectangular pulses of the microcomputer are converted, by the integrated transistor gate T3, into rectangular pulses of negative potential, that is to say with the binary level 0, and are converted into voltage breaks by means of the capacitor C3, the second electrode of which is connected, via the pull-up resistor R3, to the supply voltage. These voltage breaks occurring at the second electrode of the third capacitor C3 are advantageously supplied, via the series resistor RV, which serves as current-limiting series resistor, advantageously to the two set inputs El, of the first and second monostable trigger stages MK1,M2.

E2 12 If the interval of time for the appearance of the rectangular monitoring signals from the microcomputer MR is about 40 ms for example, with fault- free program execution, it has proved advantageous to adjust the time constant of the first monostable trigger stage MK1, via the RC network R4,C4, to about 60 ms. Thus assurance is provided that with a fault-free program run, the first stage MK1 is retriggered before the expiration of the time constant and so no restart signal is connected through to the microcomputer. If a monitoring signal of the microcomputer MR fails to appear, a maximum reaction time of about 100 ms results.

The output A3 of the first monostable trigger stage MK1 and the device is at positive potential, that is to say at the binary level 1, so long as the time constant has not expired. If a monitoring signal from the microcomputer MR fails to appear, the time constant expires and the output A3 of the first stage MK1 is set to the binary level 0 which starts the program run afresh via the restart input E4 of the microcomputer. The duration of this restart signal is advantageously preset by the second RC network of the first stage MK1, which network is composed of the resistor Rl and the capacitor Cl. At the same time as the output A3 is set to the binary level 0, the output A8 is set from the binary level 0 to the binary level 1. The capacitor Cl is charged up to a threshold value of the voltage which, at the further set input E3 of the first trigger stage MK1, causes the output A3 to be 7 13 reset to the binary level 1 and the output A8 to be reset to the binary level 0. Thus the duration of the restart signal is ended.

Depending on the microcomputer used, it has been found that it is an advantage to fix the duration of the restart signal, that is to say the time constant of the second RC network Rl,Cl of the first trigger stage MK1 at about 2 to 3 ms as a result of which assurance is provided that the program run is started afresh.

In the waiting mode of the microcomputer MR, that is to say when this is not set in operation, after the expiration of the time constant which is preset by the RC network R4,C4, a restart signal with the preset restart duration is connected through each time to the microcomputer, in accordance with the cycle described above. If the time constant of the RC network R4,C4 is about 60 ms and if the microcomputer delivers monitoring signals at its output Al about every 40 ms, triggering of the device is effected in the waiting mode after a maximum of about 100 ms.

If, during the operation of the microcomputer MR, the monitoring signals fail to appear for so long that the time constant of the second trigger stage MK2 expires, which is determined by the RC network R5,C5 and has been selected here so that it has the value of about 100 ms, which has proved most favourable, the output A2 of the second stage is set from the binary level 0, which is present during the course of the time constant, to the 14 bInary level 1.

This set signal is fed, via the capacitor C2, which serves for the decoupling and forms a brief set signal from the static set signal, to the integrated inverting transistor gate T1, the output A9 of which is connected to earth and so a negative potential, that is to say the binary level 0, is applied to this output A9. Thus, the terminal K5, which is connected to the supply voltage via the pull-up resistor R6, is set to the binary level 0. BY the presence of this binary level 0, assurance is provided, via the reset inputs E5,E6 of the first and second trigger stages W1,MK2, that on the one hand the output A2 of the second stage MK2 is reset to the binary level 0 as soon as a monitoring signal from the microcomputer MR appears at the set input E2 and on the other hand, the further output A8 of the first stage MK1 is set to the binary level 1. As a result of the fact that the output A3 assumes the binary level 0 at the same time, a restart signal is connected through to the microcomputer.

As a result of the binary level 0 appearing briefly at terminal K5, the capacitor Cl is advantageously simultaneously rapidly discharged via the diode D1 and the low-resistance resistor R7. Since, as described above, the terminal K5 is only briefly set to the binary level 0.and then re-assumes the binary level 1, the diode D1 becomes blocking and the capacitor Cl is charged up to a threshold value of the voltage which, at the further set input E3 of the first trigger stage, causes the outputs A3,A8 to be 1 1 reversed, that is to say, the output A3 is set to the binary level 1 and the output A8 is set to the binary level 0. As a result, the restart signal is terminated. Thus, if the monitoring signals from the microcomputer fail to appear for longer than is prescribed by the time constant of the second trigger stage MK2, a further restart signal of preset duration is advantageously obtained at the output A3 of the device, which signal starts the program run of the microcomputer afresh and ensures that the program does not start in an undefined state.

During the operation of the electronic equipment or, rather, of the monitoring device and particularly when it is brought into operation, it has proved favourable for a supply-voltage control VR to be provided, at the output A4 of which a set signal with the binary level 0 appears briefly if the supply voltage drops below a preset value. In this case, an RC network of the supply-voltage control VR determines the duration of the set signal which is applied to terminal K5 and thus starts the operating sequence described above. This means that a restart signal is generated at the output A3 of the device, the duration of which signal is determined by the time constant of the RC network Rl,Cl and of the RC network of the supplyvoltage control VR. In this case, the necessary switchingon conditions described above are established via the reset inputs E5,E6 of the first and second trigger stages M1,MK2. It has proved favourable if a set signal is generated by the supply-voltage control VR if the supply 16 voltage drops below the desired value by about 0.5 V or has not yet reached this value.

As a result of this generation of a restart signal for the microcomputer MR when it is brought into operation, the advantage is achieved that the program starts in a defined preset initial stage and so errors, which might lead to dangerous operating states, particularly in motor vehicles, are avoided.

In order to increase the safety further during the operation of the electronic equipment, it is advantageously provided that on expiration of the time constant of the second trigger stage MK2 not only is a further restart signal generated but also a signal is generated at an external output A5 of the device.

As described, after expiration of the time constant of the second trigger stage MK2, the output A2 is set from the binary level 0 to the binary level 1. This signal is passed to the second integrated inverting transistor gate T2. Thus the output A6 of the transistor gate T2 is set from the binary level 1 to the binary level 0. This level then also appears at the external output A5 which is connected, via the pull-up resistor R2, to the supply voltage or the positive battery voltage.

This signal, that is to say the level 0 produced at the external output A5, can be advantageously used, for example in order to control the output shift register AR and so to activate an emergency running switching function for example or to carry out switching-off operations 1 1 17 through relays.

It can be seen from the foregoing description that the monitoring device can be constructed in a simple and inexpensive manner and has the ability, in the event of a faulty program run of electronic equipment, to generate periodically restart signals and, moreover, in order to increase the reliability during the operation of electronic equipment, to generate additional restart signals.

1 18

Claims

1. A device for monitoring electronic equipment, such as a microcomputer, the device being arranged to be connected to an output of the electronic equipment which, in the event of a fault-free program run, delivers periodic monitoring signals, and to apply to an input at the electronic equipment a restart signal for starting the program run again, the device comprising first and second monostable trigger stages which can be retriggered by the monitoring signals and the time constant of each of which is determined by an RC network, the time constant of the first monostable trigger stage. being smaller than the time constant of the second monostable trigger stage, said monitoring-signal output connection of the microcomputer being to respective set inputs of the first and second monostable trigger stages and an output of the first monostable trigger stage providing said connection to the restart input of the microcomputer, an output of the second monostable trigger stage being connected to a further set input of the first monostable trigger stage and the first monostable trigger stage comprising a further RC network which determines the duration of the restart signal.,

2. A device according to claim 1, wherein a supplyvoltage control is provided, with an output from said control connected to said further set input of the first z TI 19 monostable trigger stage to generate a restart signal when the device or the electronic equipment is put into operation.

3. A device according to claim 2, wherein a second capacitor is provided between the output of the second monostable trigger stage and respectively, the output of the supply-voltage control and the set input of the first monostable trigger stage.

4. A device according to claim 3, wherein a transistor gate, is provided between the second capacitor and the diode.

5. A device according to claim 4, wherein the transistor gate is an integrated inverting transistor gate.

6. A device according to any one of claims 2 to 5, wherein a diode, the anode of which points, in particular, in the direction of the further set input, is connected between said further set input and the respective outputs of the supply-voltage control and the second monostable trigger stage.

7. A device according to any one of claims 2 to 6, wherein the output of the second monostable trigger stage and the output of the supply-voltage control are each connected to respective reset inputs of the first and 1 second monostable trigger stages.

8. A device according to any one of the preceding claims, wherein the output of the second monostable trigger stage is connected to an external output.

9. A device according to claim 8, wherein an output shift register is connected to the external output.

10. A device according to claim 8 or claim 9, wherein a transistor gate is provided between the output of the second monostable trigger stage and the external output.

11. A device according to claim 10, wherein the transistor gate is an integrated inverting transistor gate.

12. A device according to any one of the preceding claims, adapted for use in control and regulating equipment particularly for motor vehicles.

13. A device for monitoring electronic equipment, constructed and arranged for use and operation substantially as described herein with reference to the accompanying drawing.

Published 1988 at The Patent Office. State House. 66'71 High Holborn. London WCIR 4TF Further copies may be obtained from The Patent Office. Sales Branch, St Mary Cray. Orpington, Kent. BRS 3RD Printed by Multiplex tecliniques ltd, St Mary Cray. Kent Con 1'87 -11