External monitoring device for monitoring a plurality of microcontroller cores, and electronic control unit
Patent Information
- Application Number
- PCT/DE2026/100214
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2025-04-16
- Filing Date
- 2026-02-23
- Publication Date
- 2026-10-22
Smart Images
Figure DE2026100214_22102026_PF_FP_ABST
Abstract
Description
[0001] 202500223
[0002] 1
[0003] Description
[0004] External monitoring device for monitoring multiple microcontroller cores and electronic control unit
[0005] The present disclosure relates to an external monitoring device for monitoring at least two microcontroller cores. The present disclosure further relates to an electronic control unit comprising at least two microcontroller cores and the aforementioned external monitoring unit.
[0006] As the functional safety requirements for vehicle control units increase, so does the effort required to monitor safety-relevant microcontrollers. In addition to the power management-integrated monitoring of the supply voltage, safety-relevant microcontrollers also require external watchdogs.
[0007] The purpose of this disclosure is to keep the number of components of a system with multiple safety-relevant microcontroller cores low while simultaneously enabling compliance with the safety objectives.
[0008] This task is accomplished by the external monitoring device and the electronic control unit with the features according to the independent claims. Advantageous embodiments are the subject of the dependent claims.
[0009] A monitoring device as disclosed for monitoring at least two microcontroller cores comprises a safety watchdog for each of the at least two microcontroller cores to be monitored.
[0010] Safety watchdogs are designed to meet predefined functional safety requirements. Each safety watchdog is assigned to one of at least two microcontroller cores to be monitored.
[0011] 2
[0012] Each microcontroller core has its own peripherals through which it can communicate with its assigned safety watchdog.
[0013] Safety watchdogs, in turn, communicate with a safety state controller, which can switch off the components connected to the microcontrollers or reset the faulty microcontroller cores using a reset generator.
[0014] In particular, at least one of the microcontroller cores can be a safety-relevant microcontroller core. The safety watchdogs are preferably adapted to the safety objectives of the monitored microcontrollers.
[0015] The external monitoring device also includes fault signal monitoring for receiving static or dynamic fault signals from the microcontroller cores.
[0016] The microcontroller cores can transmit an error signal via their peripherals, which is received by the error signal monitor. The error signal monitor can be connected to multiple error signal lines and receive static or dynamic error signals from several microcontrollers. The error signal monitor then forwards this information centrally to a safety state controller.
[0017] The proposed solution allows for component savings compared to a solution where each microcontroller is assigned a separate external watchdog as its own IC. Furthermore, the safety watchdogs can be designed for higher safety objectives.
[0018] Meeting the specified functional safety requirements through the safety watchdogs may include the respective safety watchdog being indexed with an Automotive Safety Integrity Level A, Automotive Safety Integrity Level B, Automotive Safety Integrity Level C, or Automotive Safety Integrity Level D according to the ISO 26262 standard.
[0019] 3
[0020] In at least one advantageous embodiment, the monitoring device is designed as an application-specific integrated circuit (ASIC). An example of this is an IP functional block, which can be part of the power management system.
[0021] At least one of the safety watchdogs can be configured as a question-and-answer watchdog. Such a question-and-answer watchdog can also be referred to as an intelligent watchdog. The question-and-answer watchdog requires the microcontroller to be active and respond to dynamic conditions, rather than simply adhering to a time limit. For example, dynamic calculations must be performed, and authentication questions must be answered correctly if necessary. This allows for higher safety requirements and reduces the risk of undetected malfunctions.
[0022] The question-and-answer watchdog can thus achieve more complex safety monitoring. Particularly in the automotive industry, high safety standards apply to control systems relevant to vehicle operation, such as steering, braking, or the control of an electric motor; these standards must be met through appropriate monitoring of the microcontroller cores.
[0023] The monitoring device can also be equipped with a pin watchdog. The pin watchdog monitors specific pins or signals and can react very quickly to a missing or faulty signal.
[0024] The pin watchdog can be configured as a window watchdog. With such a pin window watchdog, the microcontroller must report to the watchdog within a predefined time window. Time intervals are specified for premature and late reports, and the report is only permitted and required within this time window.
[0025] In particular, safety watchdogs of various designs can be integrated into the monitoring device. The selection is not limited to PIN or question-and-answer watchdogs; any type can be used.
[0026] 4
[0027] Watchdogs are selected that meet the security objectives of the microcontrollers. For monitoring devices whose microcontroller cores to be monitored have different security objectives,
[0028] Safety watchdogs with appropriate response times can be selected. Individual monitoring of the microcontroller cores allows for targeted adjustment of the desired fault response times. Integrating different types of safety watchdogs into an external monitoring device enables support for multicore systems with high safety objectives. For example, a first microcontroller core, intended to achieve an ASIL-D safety objective, can be assigned a safety watchdog with a response time of less than 10 ms, while a second microcontroller core, intended to achieve an ASIL-B safety objective, can be assigned a safety watchdog with a response time of less than 100 ms. Alternatively, it is also possible for several or all microcontroller cores to have an ASIL-D safety objective and be monitored with safety watchdogs with a response time of less than 10 ms. In this case, the
[0029] Safety watchdogs that meet the ASIL-D standard can be of the same or different types. A significant advantage of using different types of safety watchdogs is that their hardware design, software control, and / or software evaluation differ, thus reducing the probability of failure, as the systems do not necessarily behave identically when a fault occurs.
[0030] The supply voltage of the microcontroller cores can be monitored using a supply voltage monitor. This monitor can be mounted on the monitoring device and connected to the supply ports of the microcontroller cores. The supply voltage monitor itself can be connected to a safety state controller, which can send a corresponding signal to a reset generator in response to a change in the supply voltage.
[0031] The aforementioned safety status control can also be integrated into the monitoring device. It can receive signals from the safety watchdogs, the power supply monitoring, and the fault signal monitoring. So202500223
[0032] 5
[0033] The various monitoring information can be collected centrally, allowing for flexible responses to the relevant information. The fault response of the different microcontroller cores can be handled separately. Based on the received signals, the safety state controller can directly shut down the components connected to and controlled by the microcontrollers, such as sensors or actuators, via shutdown paths. These shutdown paths can be separate, enabling each external component to be shut down individually based on the information available to the safety state controller. Alternatively, a central fault message can trigger a system-level response. The safety state controller is also connected to a reset generator that can restore the cores to an initial state.
[0034] Further advantages of integrating all monitoring functions into an external monitoring device include cost reduction due to the reduced number of components, as well as broader diagnostic capabilities achieved through greater diversity, enabling the attainment of higher safety standards such as ASIL-D. Furthermore, a monitoring device where the monitoring functions are integrated on a single circuit exhibits greater robustness and voltage resistance compared to a PMIC (Power Management Integrated Circuit) solution.
[0035] An electronic control unit as disclosed comprises at least two microcontroller cores with their own peripherals and an external monitoring unit according to one of the preceding aspects.
[0036] The microcontroller cores can be arranged on physically separate microcontrollers or implemented as separate partitions on a single microcontroller. The safety objectives of the microcontroller cores can vary, and the monitoring capabilities and response times of the safety watchdogs can be selected according to these objectives.
[0037] 6
[0038] Each microcontroller core has its own peripherals through which it can communicate with its assigned safety watchdogs, as well as interfaces for the supply voltage, error signals and reset commands.
[0039] The present revelation is described below with reference to the figure.
[0040] Figure 1 shows a structure of an electronic control unit according to the disclosure with an external monitoring device according to the disclosure.
[0041] An embodiment of the present disclosure is described below with reference to Figure 1. It should be noted that the following description of the embodiment is only exemplary and is not intended to limit the scope of the disclosure.
[0042] Figure 1 shows an exemplary structure of an electronic control unit 100 according to the disclosure. The control unit 100 comprises a first microcontroller 200, a second microcontroller 300, and an external monitoring device 400. Both microcontrollers 200, 300 have a microcontroller core 201, 301, as well as a reset interface 205, 305, a power supply interface 202, 302, and an error signal interface 204, 304.
[0043] The first microcontroller core 201 is monitored by a first safety watchdog 407. This first safety watchdog 407 is configured, for example, as a question-and-answer watchdog. The first safety watchdog 407 fulfills, in particular, initial predefined safety requirements. For example, the first
[0044] Safety guard dog with an Automotive Safety Integrity Level D according to the ISO 26262 standard.
[0045] The first microcontroller 200 has a COM interface 203, in particular an SPI (Serial Peripheral Interface) bus interface, an I2C (Inter-Integrated Circuit) bus interface or an MSC (Micro Second Channel) bus interface,202500223
[0046] 7
[0047] on, the counterpart of which is located on the external monitoring device 400 and forwards the signals to the first safety watchdog 407.
[0048] The first safety watchdog, 407, poses a question to the microcontroller core 201, which must be answered correctly within a specified time. If the answer is incorrect or is not received within the time window, the first safety watchdog, 407, forwards the information about the state of the microcontroller core 201 to the safety state controller, 411.
[0049] The microcontroller core 301 of the second microcontroller 300 is monitored by a second safety watchdog 408. The second safety watchdog 408 is configured, for example, as a pin watchdog, specifically as a pin window watchdog.
[0050] The second Safety Watchdog 408 fulfills, in particular, two specified safety requirements. For example, the second Safety Watchdog can be certified with an Automotive Safety Integrity Level B according to the ISO 26262 standard.
[0051] The second microcontroller 300 has an input / output interface 303, which is connected to the second safety watchdog 408. The second safety watchdog 408 forwards information about the state of the microcontroller core 301 to the safety state controller 411.
[0052] The microcontrollers 200 and 300 also output a static or dynamic error signal via an error signal interface 204 and 304. The error signals are received and evaluated centrally by an error signal monitor 409 on the external monitoring device 400.
[0053] The external monitoring device 400 comprises, on an ASIC, the two safety watchdogs 407 and 408, the power supply monitoring 406, and the fault signal monitoring 409, as well as a reset generator 410, all of which are connected to the safety status controller 411. The function of the 202500223
[0054] 8
[0055] Safety watchdogs 407 and 408 and fault signal monitoring 409 are explained above. Supply monitoring 406 monitors the supply voltage of microcontrollers 200 and 300 and, if there is a deviation from a setpoint or range, sends an error message to the safety status controller 411.
[0056] The safety status controller 411 centrally receives and manages the monitoring signals from the control unit 100 and, if necessary, can activate the reset generator 410 and directly switch off the external sensor or actuator components connected to the microcontrollers 200 and 300. The reset generator 410 can receive a command from the safety status controller 411 to reset a suspicious microcontroller 200 or 300 to an initial state. The microcontrollers 200 and 300 have reset interfaces 205 and 305, where the command is received and the reset of the microcontroller 201 or 301 is performed.
[0057] The external components controlled by microcontrollers 200 and 300 are connected to the safety state controller 411 via shutdown paths. The safety state controller 411 can shut down the components based on information from the power supply monitor 406, the fault signal monitor 409, and the two safety watchdogs 407 and 408. This can involve shutting down individual components or executing a central fault response.
[0058] Reference symbol list
[0059] 100 electronic control units
[0060] 200 first microcontroller
[0061] 300 second microcontroller
[0062] 201, 301, microcontroller core
[0063] 202, 302 Supply interface
[0064] 203 COM interface
[0065] 303 Input / Output Interface
[0066] 204, 304 Fault signal interface
[0067] 205, 305 Reset interface
[0068] 400 external monitoring device 406 supply monitoring
[0069] 407 Question and Answer Watchdog
[0070] 408 Pin-Watchdog
[0071] 409 Fault signal monitoring
[0072] 410 Reset Generator
[0073] 411 Safety status control
Claims
202500223 10 Claims 1. External monitoring device (400) for monitoring at least two microcontroller cores (201, 301), wherein -each of the microcontroller cores has its own peripherals and - the external monitoring device (400) has a safety watchdog (407, 408) for each of the at least two microcontroller cores (201, 301) to be monitored, - the respective safety watchdog (407, 408) meets specified functional safety requirements and is assigned to one of the at least two microcontroller cores (201, 301) to be monitored, - the external monitoring device (400) has a fault signal monitoring (409) for receiving static or dynamic fault signals from the microcontroller cores (201, 301).
2. External monitoring device (400) according to claim 1, wherein The external monitoring device is designed as an Application Specific Integrated Circuit (ASIC).
3. External monitoring device (400) according to claim 1 or 2, wherein at least one of the safety watchdogs is a question-answer watchdog (407).
4. External monitoring device (400) according to any of the preceding claims, wherein at least one of the safety watchdogs is a pin watchdog (408):
5. External monitoring device (400) according to one of the preceding claims, wherein at least two of the safety watchdogs (407, 408) are different versions of safety watchdogs.
6. External monitoring device (400) according to one of the preceding claims, wherein 202500223 11 which have at least two microcontroller cores (201, 301) with different safety goals and the safety watchdog (407, 408) assigned to the respective microcontroller core (201, 301) has a response time corresponding to the safety goal of the core.
7. External monitoring device (400) according to one of the preceding claims, wherein the external monitoring device (400) comprises a supply monitoring (406).
8. External monitoring device (400) according to one of the preceding claims, wherein the fulfillment of the specified functional safety requirements by the safety watchdogs (407, 408) comprises that the respective safety watchdog (407, 408) is indexed with an Automotive Safety Integrity Level A or Automotive Safety Integrity Level B or Automotive Safety Integrity Level C or Automotive Safety Integrity Level D according to the standard ISO 26262.
9. External monitoring device (400) according to one of the preceding claims, wherein the external monitoring device (400) comprises a safety state control (411) for switching off the microcontroller cores (201, 301) and components connected to the microcontroller cores (201, 301).
10. Electronic control unit (100) comprising: - at least two microcontroller cores (201, 301), each with its own peripherals, - an external monitoring unit (400) according to any one of claims 1 to 9.