Control unit for controlling safety-critical applications

A control unit for controlling a safety-critical application, the control unit comprising:

• a microcomputer;
• a monitoring unit including a first arrangement for measuring a quiescent current of the microcomputer, and including a second arrangement for applying a test data input signal, for processing test data output signals and for comparing a corresponding test data output signal of the microcomputer to a corresponding test data output signal of the monitoring unit;
• at least one quiescent current handshake line running between the first arrangement and the microcomputer for controlling the measuring of the quiescent current;
• at least one test data signal transmission line running between the second arrangement and the microcomputer;
• and
• peripheral circuits;
• wherein:
• the second arrangement includes a test data signal generator for applying the test data input signal to the microcomputer, a response generator for processing the test data input signal and for forming the corresponding test data output signal, a test data register for receiving the test data input signal and for transmitting the corresponding test data output signal, and a comparator for comparing the corresponding test data output signal of the microcomputer to the corresponding test data output signal of the monitoring unit;
• the at least one test data transmission line runs between the test data register of the second arrangement and the microcomputer;
• the second arrangement includes an error counter for counting an error if at least one of the following is satisfied:
• the corresponding test data output signal of the microcomputer is not consistent with the corresponding test data output signal of the monitoring unit;
• and the corresponding test data output signal of the microcomputer is available at the comparator at a different instant than one determined by the trigger generator;
• and
• there is a plurality of response thresholds for use with the error counter, and a different reaction results by exceeding each response threshold of the plurality of response thresholds results.

A control unit for controlling a safety-critical application, the control unit comprising:

• a microcomputer;
• a monitoring unit including a first arrangement for measuring a quiescent current of the microcomputer, and including a second arrangement for applying a test data input signal, for processing test data output signals and for comparing a corresponding test data output signal of the microcomputer to a corresponding test data output signal of the monitoring unit;
• at least one quiescent current handshake line running between the first arrangement and the microcomputer for controlling the measuring of the quiescent current;
• at least one test data signal transmission line running between the second arrangement and the microcomputer;
• and
• peripheral circuits;
• wherein:
• the second arrangement includes a test data signal generator for applying the test data input signal to the microcomputer, a response generator for processing the test data input signal and for forming the corresponding test data output signal, a test data register for receiving the test data input signal and for transmitting the corresponding test data output signal and a comparator for comparing the corresponding test data output signal of the microcomputer to the corresponding test data output signal of the monitoring unit;
• the at least one test data transmission line runs between the test data register of the second arrangement and the microcomputer;
• the at least one test data transmission line includes two test data transmission lines;
• and
• the second arrangement includes an initialization circuit for receiving an initialization signal from the voltage source after the control unit is switched on, for subsequently synchronizing the monitoring unit with the microcomputer, and for then activating the test data signal generator and the error counter.

A method for testing a microcomputer of a control unit for controlling safety-critical application, the control unit including the microcomputer, a monitoring unit, and peripheral circuits, the method comprising:

• measuring a quiescent current of the microcomputer, the measuring of the quiescent current being controlled by the monitoring unit;
• exchanging at least one handshake signal between the microcomputer and the monitoring unit;
• applying a test data input signal to the microcomputer;
• determining a first test data out signal;
• and
• comparing a second test data output signal of the microcomputer to the first test data output signal of the monitoring unit;
• wherein a quiescent current measurement corresponds to an IDDQ measurement, and
• wherein a clock generator is stopped by the microcomputer during at least one of:
• the IDDQ measurement;
• and the comparing of the second test data output signal of the microcomputer with the first test data output signal of the monitoring unit.

A method for testing a microcomputer of a control unit for controlling safety-critical application, the control unit including the microcomputer, a monitoring unit, and peripheral circuits, the method comprising:

• measuring a quiescent current of the microcomputer, the measuring of the quiescent current being controlled by the monitoring unit;
• exchanging at least one handshake signal between the microcomputer and the monitoring unit;
• applying a test data input signal to the microcomputer;
• determining a first test data output signal;
• and
• comparing a second test data output signal of the microcomputer to the first test data output signal of the monitoring unit;
• wherein a quiescent current measurement corresponds to an IDDQ measurement, and
• wherein the test data input signal of the monitoring unit is generated by a test data signal generator via a feedback shift register.