Microcontroller Check Code for Execution Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In safety-relevant sensor circuits for motor vehicles, incorrect processing of programs in microcontrollers can lead to incorrect sensor data transmission, potentially causing unwanted braking interventions, which existing monitoring methods are unable to effectively prevent.
Innovation Solution
A method where a check code is generated based on the correct execution of the program in the microcontroller and transmitted to an execution unit, allowing for the validation of sensor data without requiring a second microcontroller, using a logically predefined check code that predicts error-free execution and marks errors, and includes a hardware monitoring unit for detecting program hangs and resetting the microcontroller.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a second microcontroller is used for monitoring the program execution, then the reliability of program execution monitoring is improved, but the device complexity and cost increase
Solution Approach 1:
The microcontroller monitors its own program execution by generating a check code internally through a monitoring unit that tracks program counter values and instruction execution. This self-monitoring mechanism eliminates the need for a separate monitoring microcontroller while maintaining reliable detection of execution errors such as hangs or unexpected program states.
Solution Approach 2:
A check code serves as an intermediary signal between the program execution process and the monitoring function. The check code is generated based on program counter values and execution state, then transmitted to an evaluation unit that compares it against expected values to determine whether the program executed correctly, providing a simple yet effective monitoring mechanism.
2Reliability
If program monitoring is implemented using existing methods (request-response monitoring or program flow monitoring), then the reliability of error detection is improved, but the device complexity and cost increase
Solution Approach 1:
The monitoring function is extracted from complex multi-microcontroller systems and implemented as a lightweight check code generation mechanism within the single microcontroller. By extracting only the essential monitoring capability (program counter tracking and check code generation) rather than implementing full request-response monitoring, the system achieves error detection with minimal added complexity.
Solution Approach 2:
The check code is a simple, lightweight data structure that can be easily generated and transmitted. Rather than implementing complex monitoring protocols, the system uses this disposable check code signal that carries execution verification information from the microcontroller to the evaluation unit, providing cost-effective error detection.
3Reliability
If the check code is transmitted in a separate message from sensor data, then the reliability of error indication is improved, but the transmission efficiency and cost-effectiveness decrease
Solution Approach 1:
The check code is merged with the sensor data transmission by including it within the same message frame. The evaluation unit can then process both the sensor data and the check code together, determining whether the sensor data should be accepted based on the check code verification result, thereby maintaining transmission efficiency while ensuring error indication reliability.
Data Source
Figure 1~3
Figure 4
Figure 5
AI summary
The invention relates to a microcontroller (MC) which can be coupled to an execution unit (EU). For the operation of the microcontroller (MC), a program (PR) in the microcontroller (MC) generates a message (MSG) as a function of input data (S_1, S_2) and transmits said message (MSG) to the execution unit (EU). For the operation of the microcontroller (MC), accompanying the message (MSG), a check code (CV) is generated as a function of the execution of the program (PR) and is transmitted to the execution unit (EU). For the operation of the execution unit (EU), a test determines whether the check code (CV) is logically predefined and/or received within a predetermined time interval (T_INT), wherein in the case of a positive test result, the message (MSG) is designated as valid, and in the case of a negative result, the message (MSG) is designated as invalid.