Source: {"pile_set_name": "USPTO Backgrounds"}

The present invention relates to a control unit for controlling safety-critical applications, having a microcomputer (MC), a monitoring unit (check unit, CU), and peripheral circuits (input output, IO). Furthermore, the present invention relates to a method for checking a microcomputer (MC) of a control unit for controlling safety-critical applications, the control unit having microcomputer (MC), a monitoring unit (check unit, CU), and peripheral circuits (input output, IO).
In control units that control or regulate applications or functions that are critical with regard to safety, errors of the microcomputer (MC) or of a processor of the microcomputer may be detected by monitoring. Such control units having safety tasks are used, for example, for anti-lock braking systems, for traction control systems, and/or for electronic stability programs. The safety-critical applications controlled by the control unit are connected to the control unit via the peripheral circuits. In the case of single-computer control units, methods having a self-test, plausibility check, and watchdog may be available.
For testing CMOS chips (integrated circuits, IC) at the manufacturer, methods and measuring devices for measuring the quiescent current are used. The background of the so-called quiescent current test is that in a digital CMOS chip in purely static logic, it is believed that almost the entire power loss during the switching operations occurs in its interior. In the rest state, the current flow is restricted to tiny leakage currents as well as to currents through pullup resistors or pulldown resistors at the inputs and through external loads at the output drivers.
It is believed that various production-dependent errors may lead to increased conductivity between the positive and negative supply voltage, and that activating such defective regions (point defects) of the circuit causes the current consumption to increase abruptly. Such defects may be Ad ascertained by a highly exact measurement of the current consumption during the test operation and a comparison to corresponding setpoint values. As already stated, such a quiescent current measurement may be used in the manufacture of CMOS chips to sort out the defective chips after the manufacturing process.
The quiescent current test method, which is believed to be available for use in the manufacturing of computer modules for the control units (as referred to above), to test the computer modules during their normal operation for detecting what may be the most frequent defects in the computer modules, in particular in the microcomputer (MC), e.g. lock-up errors (stuck-at), bridge errors (bridging), and/or interrupt errors (stuck-open).
An available approach for increasing reliability in the case of control units (as referred to above) involves providing two MCs, which reciprocally test one another by parallel computing and/or plausibility checks. However, cost considerations may suggest using only one MC for such control units.
An object of an exemplary method and/or exemplary embodiment of the present invention is to provide a control unit in which the reliability of the error detection is improved, and the detection is expanded to additional types of errors.
In an exemplary embodiment of the present invention, the monitoring unit (CU) has a first apparatus, arrangement or structure for measuring the quiescent current of the microcomputer (MC), at least one handshake line for controlling the measurement of the quiescent current runs between the first apparatus, arrangement or structure of the CU and the MC, the CU has a second apparatus, arrangement or structure for applying a test data input signal to the MC to process the test data input signal and compare the corresponding test data output signal of the MC to the corresponding test data output signal of the CU, and at least one test data signal transmission line runs between the second apparatus, arrangement or structure of the CU and the MC.
In accordance with the exemplary embodiment and/or exemplary method of the present invention, the reliability of the error detection can be increased by using two different test methods that supplement one another. In this manner, it is believed that a significantly greater number of different error types of the computer modules of the MC can be detected.
The control unit according to the exemplary embodiment of the present invention can also have a plurality of MCs and a plurality of CUs. However, the following assumes that the control unit has one MC and one CU. The CU of the control unit according to the exemplary embodiment of the present invention has a first apparatus, arrangement or structure for measuring the quiescent current of the MC.
At least one handshake line for controlling the measurement of the quiescent current runs between the first apparatus, arrangement or structure of the CU and the MC. The handshake line can, for example, be a bidirectional line.
After the control unit is switched on, the quiescent current is measured for a set number (typically 8 to 16) of selected commands within the framework of a test program. For example, 14 selected commands containing an internal machine cycle are processed for microcomputer TMS470.
To supplement the quiescent current measurement, the CU of the control unit according to the exemplary embodiment of the present invention has a second apparatus, arrangement or structure. At least one transmission line for test data signals runs between the second apparatus, arrangement or structure of the CU and the MC.
The second apparatus, arrangement or structure applies a test data signal to the MC. The MC calculates a test data output signal, which is dependent upon the test data input signal and the states inside the MC. Defective states result in a changed test data output signal of the MC.
In the second apparatus, arrangement or structure of the CU, the test data input signal is also processed to form a test data output signal that is used as a reference signal for checking the test data output signal of the MC. When calculating the test data output signal, the CU assumes an error-free, functioning MC. The completed calculation may have a xe2x80x9cvery simplexe2x80x9d design.
The microcomputer does not have a double design, and the same computation is not carried out by the CU as by the MC, as is the case for parallel computer systems. Rather, starting from the input data of a predefined test function, the MC calculates the output data whose results are checked by the CU using the reference signal calculated by it. The test function used for calculating the output data may be xe2x80x9cvery simplexe2x80x9d in its implementation. The calculation only requires minimal computing time. However, complex tests and results from the application programs can also be included in this test function.
Finally, the test data output signal of the CU is compared to the test data output signal of the MC. If they deviate from one another, or if the deviation exceeds a predetermined threshold value, the CU recognizes an error of the MC. The test result can be displayed by a display device and/or it can be provided that upon occurrence of an error, and the system may be controlled and/or regulated by the control unit to be switched off.
According to another exemplary embodiment of the present invention, the first apparatus, arrangement or structure includes an IDDQ measuring circuit, a voltage supply, an IDDQ measuring run control (MAS), and a control system of the CU, and that the connection between the first apparatus, arrangement or structure, and the MC includes two handshake lines that run from the IDDQ-MAS to the MC and at least one voltage supply line that runs from the voltage supply to the MC, at least one of the voltage supply lines running through {or across} the IDDQ measuring circuit. In semiconductors, IDD designates the positive supply current. IDDQ designates the quiescent current. The handshake lines are, for example, configured as START and END handshake lines for starting and acknowledging the completion of the functional test.
The communication between the MC and the CU for measuring the quiescent current is carried out via the two handshake lines. The quiescent current of the MC is measured by the CU via the separate voltage supply lines.
As stated, the exemplary embodiment of the present invention relates to a control unit having a monitoring unit for checking the microcomputer of the control unit. A voltage supply unit is provided for supplying voltage to the control unit and, as such, also to the microcomputer. The control unit of the CU includes an apparatus, arrangement or structure that can bring the MC into specific operating states.
Furthermore, the IDDQ measuring circuit includes a measuring apparatus, arrangement or structure that ascertains the current or voltage in the voltage supply circuit of the MC, whereupon the determined current or the determined voltage may be compared in a comparison apparatus, arrangement or structure, also present in the IDDQ measuring circuit, to at least one predefined threshold value.
By measuring the current or voltage, a plurality of possible errors in the computer can be ascertained using the IDDQ measurement. In this context, it is believed that what may be the most frequent errors in the components of the MC can be substantially covered using a minimum of test steps. Such errors can be lock-up errors (stuck-at), bridge errors (bridging), and/or interrupt errors (stuck-open).
As a result of the combination of the quiescent current measurement and another suitable checking method, in particular including a check of the functionality of the MC based on test data records, it is believed that errors may be widely covered with respect to the significant errors in computer modules, in particular in CMOS processors, in a way that may be particularly advantageous for safety-critical applications.
The abovementioned elimination of the second processor is largely retained so as to provide an economic advantage of the control unit according to the exemplary embodiment of the present invention, since the quiescent current measurement according to the exemplary embodiment of the present invention may only require a minimal hardware expenditure.
By specially controlling the MC, the IDDQ-MAS brings predetermined components of the MC into a low-current state. The background of this control involves the