Electronic Control Unit WDT BIST State Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing electric power steering apparatus faces challenges in ensuring system safety due to the restriction that the external watchdog timer (WDT) cannot detect abnormalities in the microcontroller unit (MCU) during built-in self-test (BIST) execution, potentially leading to dangerous operations if the MCU fails.
Innovation Solution
The electronic control unit is designed to maintain the external WDT in a disable state during BIST execution, using a pulse signal to confirm MCU normal operation and transition to an enable state, ensuring the inverter is driven only when the MCU is functioning correctly, and stopped otherwise to prevent system hazards.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the external watchdog timer (WDT) operates in enable state to detect MCU abnormalities, then system safety is improved, but false abnormality detection occurs during BIST execution
Solution Approach 1:
The system performs BIST execution before normal operation, and during this preliminary phase, the external WDT is set to disable state. This preliminary action prevents the WDT from falsely detecting abnormalities during the self-test period, while still enabling abnormality detection during subsequent normal operation.
Solution Approach 2:
The external WDT dynamically transitions between disable state (during BIST execution) and enable state (during normal operation). This dynamic state change allows the system to adapt the WDT's monitoring function according to the current operational phase, preventing false detections while maintaining safety monitoring capability.
2Measurement precision
If the external WDT is in disable state during BIST execution, then false abnormality detection is prevented, but MCU failures during BIST cannot be detected
Solution Approach 1:
A state management mechanism acts as an intermediary between the BIST execution and the external WDT. This intermediary controls the WDT's enable/disable state based on the operational phase, ensuring that the WDT is disabled during BIST to prevent false detections, while still providing a pathway to detect genuine failures through state transitions.
Solution Approach 2:
The system employs periodic state transitions of the external WDT, switching between disable state during BIST execution and enable state during normal operation. This periodic action ensures that the WDT is appropriately configured for each operational phase, preventing false detections during BIST while maintaining safety monitoring during normal operation.
3Productivity
If the inverter is driven during MCU abnormalities, then system productivity is maintained, but dangerous operations occur
Solution Approach 1:
The external WDT provides continuous feedback on MCU operational status during normal operation. When the WDT detects an abnormality (such as failure to receive periodic reset signals), it generates a stop signal that immediately halts the inverter, preventing dangerous operations while maintaining system safety.
Solution Approach 2:
The system prepares anti-action measures in advance by having the external WDT ready to issue stop signals to the inverter. This preliminary preparation ensures that when MCU abnormalities occur, the inverter can be immediately stopped to prevent dangerous operations, without waiting for complex diagnostic procedures.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
[Problem] An object of the present invention is to provide an electronic control unit where an external WDT can always normally detect an abnormality (a failure) to an MCU relatedto a BIST function and which can maintain safety of a system. [Means for solving the problem] The present invention is the electronic control unit that is controlled by the MCU via an inverter constituted by a semiconductor switching device, comprises an external watch dog timer (an external WDT) to detect an abnormality of the MCU, a reset circuit to reset the MCU when the external WDT detects the abnormality of the MCU, and an ON/OFF control section to turn a gate of the semiconductor switching device on or off in accordance with the external WDT, the inverter is stopped by turning the gate off via the ON/OFF control section when the external WDT is a disable state, and when the abnormality of the MCU is not detected in an enable state to which the external WDT transits from the disable state, the inverter is driven by turning the gate on via the ON/OFF control section, and when the abnormality of the MCU is detected, the inverter is stopped by turning the gate off via the ON/OFF control section and the MCU is reset by the reset circuit.