From the prior art, methods for monitoring a microcontroller using a watchdog are known in which an external hardware watchdog having an independent time base and fixed time window is used for logically and temporally monitoring the program sequence of safety-related program parts of the microcontroller. Such a watchdog is used, for example, as part of the monitoring of motor controllers in which a so-called three-level concept is applied. In this context, a first level comprises the software for controlling the motor, a second level comprises the software for monitoring the motor controller and finally a third level comprises the software for monitoring the hardware used on the first two levels. In this context, a hardware watchdog is used on the third level in order to check a microcontroller used on the first or second level.
In a simple configuration, monitoring the microcontroller using the watchdog can consist in the watchdog monitoring the arrival of reset pulses within a time interval of predetermined duration and initiating a reset of the microcontroller when the reset pulses do not arrive. In a configuration developed further, the watchdog can communicate test questions to the microcontroller and check its answers for correctness and time.
Such a method for monitoring a microcontroller can have the following sequence: the watchdog asks the microcontroller randomly one of several possible questions. The microcontroller forms an answer to this question by combining two answer contributions. The first answer contribution is obtained from a test of the logic of the microcontroller. The second answer contribution is obtained from a function-specific checking of a predetermined multiplicity of software modules, preferably with additional conditions such as correct order and a predetermined number of call ups of each module. The two answer contributions are combined and transmitted to the watchdog in a particular time window. The watchdog checks the answer for correct content and correct reception in time and increments an error counter when an error is detected or resets the error counter if no error is found. After that, the checking method is continued by the watchdog by asking a new question.
If the error counter of the watchdog exceeds a predetermined threshold, the watchdog initiates a safety-related method step which, for example, can consist in the output stages of the system driven by the microcontroller being switched off so that no further operation is possible.
Watchdogs implemented in hardware are usually constructed in a very simple manner and allow communication with only one microcontroller in each case so that, according to the prior art, monitoring of several microcontrollers is only possible by using the same number of watchdogs.