WO2008092846A1

WO2008092846A1 - Controller chip with monitoring via watchdog

Info

Publication number: WO2008092846A1
Application number: PCT/EP2008/051016
Authority: WO
Inventors: Stefan Steinke
Original assignee: Leopold Kostal Gmbh & Co. Kg
Priority date: 2007-01-31
Filing date: 2008-01-29
Publication date: 2008-08-07
Also published as: DE102007004794B4; DE102007004794A1

Abstract

The invention describes a controller chip with monitoring via watchdog, wherein the controller chip comprises a computation unit and an addressable port chip, both of which are respectively connected to a controller-internal address bus and to a controller-internal data bus, wherein a component of the controller chip stores at least one computation task which provides the address of the port chip as a result value, wherein the computation unit calculates the computation task cyclically and places the result value on the address bus, and wherein the computation unit places a data value on the data bus which, when the port chip is addressed correctly, appears at the output of the port chip as a signal for resetting the watchdog.

Description

Controller block with monitoring by a watchdog

The present invention relates to a controller module with monitoring by a watchdog, wherein the controller module includes a computing unit and an addressable port module, both of which are each connected to a controller-internal address bus and to a controller-internal data bus.

Japanese Patent Abstract JP 02281343 A discloses an arrangement in which an arithmetic unit is connected via an address bus and a data bus to a comparison circuit which compares values on the address and data bus with reference values and, if successful, a watchdog timer resets.

Many day-to-day facilities are today with one

Microcontroller provided. In the case of particularly important or safety-critical devices, the correct functioning of the microcontroller is ensured by special measures, such as the multiple and thus redundant installation of safety-critical components. This creates a relatively high cost.

In many cases, a so-called watchdog is provided for monitoring a controller module. This is a counter or timer implemented by hardware or software which is reset by a signal within regular timings and which, if the signal fails, triggers a safety function, for example by resetting the controller module or by shutting down more or less large parts of the monitored facility. A watchdog thus checks whether a reset signal occurs regularly. The reliability with which errors are detected depends in particular on the way in which the resetting signal is obtained. Thus, in an otherwise regular program sequence of a computing unit often can not be detected when the arithmetic unit performs arithmetic operations incorrectly. In order to uncover such errors as well, two computing units operating independently of one another are frequently provided which mutually check their computation results. However, this requires a considerable cost.

It was an object to provide a controller module in which arithmetic errors occurring in particular in a computing unit can be detected reliably in a simple and cost-effective manner.

This object is achieved in that at least one computational task is stored within a component of the controller module, which results in the address of the Portbausteins that the arithmetic unit calculates the arithmetic task cyclically and the result value on the address bus and that the arithmetic unit a data value to the Data bus, which appears at the output of the port block with a correctly addressed port block as a signal for resetting the watchdog.

The controller module according to the invention thus carries out arithmetic tasks, in particular numerical arithmetic tasks, the results of which are used to check the correct function of the arithmetic unit.

Advantageous embodiments and further developments of the invention are set forth in the dependent claims. In the following an embodiment of the invention will be illustrated with reference to the drawing and explained in more detail. The single figure shows a simplified block diagram of a controller module according to the invention.

The controller module (CB) has at least one computing unit (CPU) and one port module (10). The port module (10) can be, for example, a serial or parallel input / output module. The arithmetic unit (CPU) and the port module (10) are connected to one another via an address bus (AB) and a data bus (DB), wherein the arithmetic unit (CPU) can address the port module (10) via the address bus (AB). Data values can be transferred from the processing unit (CPU) to the port block (IO) and vice versa via the data bus (DB).

Furthermore, the controller module (CB) has an internal component (SP), implemented, for example, as a memory module (SP) in which at least one arithmetic task (RA) and preferably several arithmetic functions (RA) are stored. The term calculation task (RA) generally stands for an algorithmic sequence which can be executed by the arithmetic unit (CPU) and supplies a numerical result value as the result. The at least one calculation task (RA) is specified in such a way that it supplies the address of the port block (IO) as the result value.

Also provided is a hardware or software watchdog (WD) that includes a resettable counter or timer. The watchdog (WD), which is shown here as an external component, can alternatively also be designed as a component integrated in the controller module (CB).

If the reset of the watchdog (WD) does not occur regularly within a time window or before the expiration of a maximum time, then it generates one Output signal, which is supplied here to a reset input (RESET) of the controller module (CB) and causes a restart of the controller module (CB) or the arithmetic unit (CPU) with defined initial conditions. Alternatively, the output signal of the watchdog (WD) can also switch off the device controlled by the controller module (CB).

In particular, the described structure has the purpose of regularly checking the functionality of the controller module (CB) and especially of the arithmetic unit (CPU) and thus ensuring it. It is essential that especially the arithmetic functions, ie the "correct calculation" of the arithmetic unit (CPU), are monitored.

For checking, the arithmetic unit (CPU) processes arithmetic tasks (RA) within the usual program sequence, which are stored, for example, in an internal memory module (SP) and which the arithmetic unit (CPU) retrieves from this memory component (SP). The arithmetic unit (CPU) calculates a numerical result value from this.

However, the arithmetic unit (CPU) can not reliably check this result value for correctness, since it can at least not be ruled out in the case of a faulty result value that the check of the result value would also be faulty.

The solution to this problem is to check the result externally, ie outside of the arithmetic unit (CPU). For this purpose, a calculation of the same computational task by a second, independent arithmetic unit or a retrieval of the stored result, and a comparison of the two result values could be provided. Such a structure would be very expensive. Instead, the external check is performed by using the result value to address a port block (10). The at least one arithmetic task (RA) stored in the memory module (SP) is formed in such a way that it supplies the address of the port module (10) as the result value. The arithmetic unit (CPU) then outputs the result of the calculation to the address bus (AB). If the calculation result is correct, the port block (10) is addressed. A data value subsequently given by the arithmetic unit (CPU) to the data bus (DB) thus arrives at the port module (10), which then outputs a signal corresponding to this data value at its output, which causes a reset of the watchdog (WD).

If, however, the calculation unit (CPU) calculates the result value incorrectly, the port block (IO) is not addressed and the port block (IO) accordingly outputs no signal for resetting the watchdog (WD). In this case, the watchdog (WD) generates an output signal for the reset input (RESET) of the controller module (CB).

The security of the check can be further increased, even if the data value which the arithmetic unit (CPU) gives to the data bus (DB) has previously been determined by the arithmetic unit (CPU) as the result of a computational task (RA).

In this regard, it is also advantageous if the arithmetic unit (CPU) does not always solve the same arithmetical task (RA) for determining the address of the port block (IO), but several different arithmetic tasks (RA) successively, preferably in random order. As a result, the arithmetic unit (CPU) is tested to a greater extent, so that smaller and more specific errors of the arithmetic unit (CPU) can be detected with greater security. reference numeral

AB address bus

CB controller module

CPU processing unit

DB data bus

IO port block

RA calculation task (s)

RESET Reset input

SP component (memory module)

WD watchdog

Claims

claims

1. controller module with monitoring by a watchdog,

wherein the controller module includes a computing unit and an addressable port module, both of which are each connected to a controller-internal address bus and to a controller-internal data bus,

characterized,

that within a component (SP) of the controller module (CB) at least one arithmetic task (RA) is stored, which results in the address of the port component (IO),

that the arithmetic unit (CPU) calculates the arithmetic task (RA) cyclically and outputs the result value to the address bus (AB) and

in that the arithmetic unit (CPU) outputs a data value to the data bus (DB) which, with a correctly addressed port block (IO), appears at the output of the port block (IO) as a signal for resetting the watchdog (WD).

2. Controller module according to claim 1, characterized in that within a component of the controller module (CB) more

Arithmetic tasks (RA) are stored, which calculates the arithmetic unit (CPU) cyclically one after the other.

3. Controller module according to claim 1, characterized in that within a component (SP) of the controller module (CB) more Arithmetic tasks (RA) are stored, which calculates the processing unit (CPU) in random order one after the other.

4. Controller module according to one of the preceding claims, characterized in that the arithmetic unit (CPU) also determines the data value by calculating a calculation task (RA).

5. Controller module according to claim 1, characterized in that the watchdog (WD) is a controller-internal component or a controllerexterne device.

6. Controller module according to claim 1, characterized in that the controller module (CB) is connected to a plurality of watchdogs.

7. controller module according to claim 6, characterized in that at least one watchdog is a controller-internal component and at least one watchdog (WD) is a controllerexterne device.

8. Controller module according to claim 1, characterized in that at least one watchdog (WD) can perform a reset of the controller module (CB).

9. controller module according to claim 1, characterized in that at least one watchdog can perform a shutdown of a controlled by the controller device device.