Computer monitoring system for indicating abnormalities in execution of main or interrupt program segments

• US 4,410,938 A
• Filed: 04/01/1980
• Issued: 10/18/1983
• Est. Priority Date: 04/02/1979
• Status: Expired due to Term

• Current Assignee: Nissan Motor Co., Ltd.
• Original Assignee: Nissan Motor Co., Ltd.
• Inventors: Higashiyama, Kazuhiro
• Primary Examiner(s): Thomas, James D.
• Assistant Examiner(s): WILLIAMS JR, ARCHIE E
• Application Number:
  US06/136,403
• Time in Patent Office: 1,295 Days
• Field of Search: 364/200 MS File, 364/900 MS File, 364/551, 364/550, 364/431.04, 364/431.11, 364/300, 371/4, 371/6, 371/9, 371/12, 371/14, 371/16, 371/19, 371/61, 371/62, 340/147 LP
• US Class Current: 714/47.1
• CPC Class Codes: F02D 41/263 the program execution being modifiable by physical parameters
• CPC Class Codes: G06F 11/0736 in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function testing or monitoring of automated control systems G05B23/02
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/28 by checking the correct order of processing G06F11/08 - G06F11/26 take precedence; monitoring patterns of pulse trains H03K5/19

Abstract

A watchdog-type fail-safe system monitors program execution by a computer used, e.g., in controlling operation of an automative vehicle engine. The system includes a control unit, with a microprocessor; and a memory, which stores program segments. These segments include a main routine for performing a background job (BGJ), and a plurality of interrupt routines for handling event generated interrupts. Completion of the BGJ causes transition of an emergency decision signal, provided by the control unit, to a first level. Initiation of a particular first interrupt routine causes transition of the decision signal to a second level. Abnormalities in program execution may result in non-transition of the decision signal. If there is non-transition of the decision signal for greater than a predetermined reference time period, a fault condition signal is generated. This may initiate various emergency procedures, e.g., stopping or resetting the computer, and visual or audio alarms. Detectable abnormalities include; non-return to the BGJ from any one of the interrupt routines; non-completion of the BGJ due to an excessive number of interrupts, as might occur due to unusally high engine speed; or non-advancement to processing of an interrupt, even though the control unit accepted a valid interrupt demand, as might occur due to temporary troubles in vibration susceptible signal lines between the computer and engine.

Claims

1. A system for monitoring program execution in a digital computer adapted to perform a main routine and at least one interrupt routine in response to an interrupt command signal generated during execution of the main routine in response to the occurrence of a particular event, said system comprising:

(a) first means including said digital computer for providing a decision signal with first and second levels, said digital computer being adapted to provide a transition of the signal to the first level upon termination of the main routine and to provide a transition of the signal to the second level upon beginning of the interrupt routine;

(b) means for developing a predetermined reference time period;

(c) means for measuring a period of time during which said decision signal is held without transition at either the first or second levels; and

(d) second means for generating a signal indicative of a fault condition in said digital computer in response to the decision signal being held without transitions at either the first level or the second level for a time greater than the reference time period.

2. A system according to claim 1, wherein said digital computer performs a plurality of interrupt routines and changes the decision signal to its second level at the beginning of a selected one of the interrupt routines.

3. A system according to claim 1, which further comprises means responsive to the fault condition indicative signal for resetting said digital computer.

4. A system according to claim 1, which further comprises means responsive to the fault condition indicative signal for stopping operation of said digital computer.

5. A system according to claim 1, which further comprises means responsive to the fault condition indicative signal for providing an indication of a fault condition in said digital computer.

6. A system according to claim 5, wherein said means for providing a fault condition indication is adapted to turn on an electric light.

7. A system according to claim 5, wherein said means for providing a fault condition indication is adapted to produce a sound.

8. A system according to claim 7, wherein said means for providing a fault condition indication is adapted to sound a buzzer.