Apparatus and method for detecting abnormality-Monitoring circuit malfunction

• US 6,240,534 B1
• Filed: 08/21/1998
• Issued: 05/29/2001
• Est. Priority Date: 09/24/1997
• Status: Expired due to Fees

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Nakane, Fumihiko
• Primary Examiner(s): HUA, LY
• Application Number:
  US09/137,524
• Time in Patent Office: 1,012 Days
• Field of Search: 714/24, 714/55, 714/48, 714/100, 714/51, 700/79
• US Class Current: 714/55
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/3013 where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems testing or monitoring of control systems or parts thereof G05B23/02
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16

Abstract

Reliably detecting malfunction of an abnormality-monitoring circuit during operation of a processing unit. An electronic control unit provided with a CPU level-inverts and outputs an actuating signal during each iteration of a base routine. An abnormality-monitoring circuit clocks a fall interval of the actuating signal as charging voltage of a gradually discharged capacitor, and outputs a reset signal to the CPU when this charging voltage falls to a defined value. When a check-starting condition is fulfilled, the CPU inhibits a subsequent level inversion of the actuating signal until a predetermined time elapses after a prior level inversion. When the signal inhibition is canceled, when the charging voltage VC of the capacitor is not within a reference range (VL-VH), the CPU determines the abnormality-monitoring circuit to have malfunctioned.

Claims

1. An apparatus for detecting malfunction of an abnormality monitoring circuit in an electronic control unit having a processing unit actuated in accordance with a stored program to output an actuating pulse signal within a fixed-time interval, and an abnormality-monitoring circuit to clock an output interval of said actuating pulse signal from said processing unit, and output a reset signal to said processing unit when said clocked time reaches a defined time established to be longer than said fixed-time interval, said apparatus comprising:

means for determining whether a predetermined inspection-execution condition has been fulfilled during operation of said processing unit;

means for prohibiting said processing unit from outputting a subsequent actuating pulse signal until at least a predetermined time has elapsed when said inspection-execution condition is determined by said condition-determining means to have been fulfilled; and

means for determining malfunction of said abnormality-monitoring circuit when said clocked time in said abnormality-monitoring circuit is detected before said processing unit outputs said actuating pulse signal, and said detected clocked time has not reached an established reference value when output prohibition of said actuating pulse signal by said prohibiting means has been released.

2. The apparatus of claim 1, wherein said prohibiting means inhibits output of said actuating pulse signal within a range wherein an output interval of said actuating pulse signal becomes shorter than said defined time.

3. The apparatus of claim 1, wherein said abnormality determining means determines the malfunction in said abnormality-monitoring circuit when said detected clocked time is not within a reference range from said reference value to an upper-limit value established in correspondence with a maximum output interval of said actuating pulse signal in a case when said inhibiting means has inhibited said actuating pulse signal.

4. The apparatus of claim 1, wherein said condition-determining means, said inhibiting means, and said abnormality-determining means are provided in said processing unit;

and

said condition-determining means determines that said inspection-execution condition has been fulfilled during a predetermined period of minimum processing.

5. The apparatus of claim 4, wherein said abnormality-monitoring circuit includes a capacitor that discharges or charges as time elapses, said circuit clocking an output interval of said actuating pulse signal as charge voltage of said capacitor, and outputting said reset signal when said capacitor is charged to a defined value corresponding to said defined time by returning said capacitor to an initial charge each time said actuating pulse signal is output from said processing unit;

and

said abnormality-determining means detects a charge voltage of said capacitor as said clocked time and determines whether said abnormality-monitoring circuit is normal on a basis of said detected charge voltage.

6. An electronic control unit, comprising:

a central processor programmed to perform a predetermined control function; and

a watchdog-timer circuit that is operative to clock an output interval of an actuated pulse signal output from the processor during execution of the control function, and to output a reset signal to the processor if the actuated pulse signal is received after a predetermined time interval;

the central processor also being programmed to detect a watchdog circuit inspection condition, to inhibit subsequent actuating pulse signal output if the watchdog circuit inspection condition exists, and to detect an abnormality at the watchdog circuit if the clocked output interval does not correspond to a predetermined reference value during the subsequent actuating pulse signal inhibition.

7. The control unit of claim 6, wherein the processor is further programmed to initiate a failsafe control program if an abnormality is detected at the watchdog circuit.

8. The control unit of claim 6, wherein the processor is operative to initiate the watchdog circuit inspection condition program only when a minimum processing load condition exists.

9. A method for detecting that an abnormality-monitoring circuit in an electronic control unit has malfunctioned, said electronic control unit including a processing unit actuated in accordance with a stored program to output an actuating pulse signal within a fixed-time interval, said abnormality-monitoring circuit being operative to clock an output interval of said actuating pulse signal from said processing unit, and to output a reset signal to said processing unit when said clocked output interval reaches a pre-determined limit, the method comprising the steps of:

inhibiting output of a subsequent actuating pulse signal from said processing unit after said processing unit has output said actuating pulse signal until at least a predetermined time has elapsed when a predetermined inspection-execution condition has been fulfilled during operation of said processing unit; and

subsequently determining that said abnormality-monitoring circuit has malfunctioned when said clocked output interval in said abnormality-monitoring circuit is detected before said processing unit outputs said actuating pulse signal after said actuating pulse signal is released and said detected clocked output interval has not reached an established reference value.

10. The method of claim 9, wherein said step of inhibiting said actuating pulse signal is performed within a range wherein an output interval of said actuating pulse signal according to said processing unit becomes shorter than said defined time.

11. The method of claim 9, wherein said step of determining determines that said abnormality-monitoring circuit is has malfunctioned when said detected clocked time is not within a reference range from said reference value to an upper-limit value corresponding to a maximum output interval of said actuating pulse signal when said step of inhibiting h as been performed.

12. The method of claim 9, wherein said inspection-execution condition is satisfied during a predetermined time of minimum processing at said processing unit.