Controller with fail-safe function

• US 20040064519A1
• Filed: 04/07/2003
• Published: 04/01/2004
• Est. Priority Date: 04/10/2002
• Status: Active Grant

• Current Assignee: ALPS Electric Company Limited (Alps Alpine Co., Ltd.)
• Original Assignee: ALPS Electric Company Limited (Alps Alpine Co., Ltd.)
• Inventors: Kato, Hironori, Sanpei, Yoshio
• Granted Patent: US 7,373,487 B2
• Time in Patent Office: Days
• US Class Current: 709/208
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/16 Error detection or correction of the data by redundancy in hardware

Abstract

A master CPU and a slave CPU for processing data supplied from a detector unit, and a timer cleared by a clear signal supplied every predetermined time period from the master CPU when the operation of the master CPU is normal and adapted for supplying a reset signal to the master CPU and the slave CPU after the lapse of the predetermined time period and further after the lapse of another predetermined time period when anomaly occurs in the operation of the master CPU are provided. The master CPU monitors the processing data outputted from the slave CPU, and supplies a forced reset signal to the slave CPU when anomaly in the operation of the slave CPU is detected from the result of monitoring.

Claims

1. A controller with a fail-safe function comprising:

a master central processing unit and a slave central processing unit for processing data supplied from a detector unit and outputting the processing data, respectively; and

a timer cleared by a clear signal supplied every predetermined time period from the master central processing unit when the operation of the master central processing unit is normal, and adapted for supplying a reset signal to the master central processing unit and the slave central processing unit after the lapse of the predetermined time period and further after the lapse of another predetermined time period when anomaly occurs in the operation of the master central processing unit;

wherein the master central processing unit monitors the processing data outputted from the slave central processing unit, and supplies a forced reset signal to the slave central processing unit to restore an initial operation of the slave central processing unit when anomaly in the operation of the slave central processing unit is detected from the result of monitoring.

2. A controller with a fail-safe function comprising:

a master central processing unit and a slave central processing unit for processing data supplied from a detector unit and outputting first and second processing data, respectively;

a communication line connected between the master central processing unit and the slave central processing unit;

a bus line;

a first repeater unit connected between the master central processing unit and the bus line; and

a second repeater unit connected between the slave central processing unit and the bus line;

wherein the master central processing unit judges the operation state of the master central processing unit and the slave central processing unit using the first processing data and the second processing data acquired via the communication line, and when the slave central processing unit outputs the second processing data to the bus line via the second repeater unit, the master central processing unit acquires the second processing data from the bus line via the first repeater unit and monitors the operation of the slave central processing unit on the basis of the acquired second processing data.

3. The controller with a fail-safe function as claimed in claim 2, wherein the master central processing unit compares the first processing data with the second processing data acquired from the slave central processing unit via the communication line, temporarily stops the operation of the master central processing unit and the slave central processing unit when the first and second processing data are not coincident with each other as a result of the comparison, and restores an initial operation of the master central processing unit and the slave central processing unit after the lapse of a predetermined time period, and when the first and second processing data are coincident with each other as a result of the comparison, the master central processing unit causes the slave central processing unit to send the second processing data to the bus line via the second repeater unit, acquires the second processing data sent to the bus line via the first repeater unit, compares the first processing data with the acquired second processing data, temporarily stops the operation of the slave central processing unit when the first and second processing data are not coincident with each other as a result of the comparison, and restores the initial operation of the slave central processing unit after the lapse of a predetermined time period.