FORM 2
THE PATENTS ACT 1970
(39 of 1970)
&
THE PATENTS RULES, 2003
COMPLETE SPECIFICATION
(See Section 10 and rule 13)
TITLE OF THE INVENTION
Integrated Self RESET and User Controlled RESET system for an electronic controller
APPLICANT
TATA MOTORS LIMITED, an Indian company
Having its registered office at Bombay House,
24 Homi Mody Street, Hutatma Chowk,
Mumbai 400 001 Maharashtra, India
INVENTORS
Ajay Dandge, Neeraj Sharma and Ganesh Nalawade
All are Indian Nationals of
TATA MOTORS LIMITED,
an Indian company having its registered office
at Bombay House, 24 Homi Mody Street, Hutatma Chowk,
Mumbai 400 001 Maharashtra, India
PREAMBLE TO THE DESCRIPTION
The following specification particularly describes the invention and the manner in which it is to be performed.

FIELD OF THE INVENTION
The present invention generally relates to a power on reset mechanism for body control module in vehicles and more particularly to an integrated self reset and user controlled reset mechanism for body control module during software runaway condition.
BACKGROUND OF THE INVENTION
A body control module is a microcontroller based unit in vehicle which performs various operations like central door locking, security alarm system, wiper control, interior lighting, air conditioning etc. To perform these functionalities a software algorithm is written in the microcontroller. But due to hardware limitation, improper software structuring and other abnormal system conditions, the software flow get stuck causing "software runaway" condition.
The microcontroller based embedded system needs to tackle software runaway condition during vehicle operation. The software runaway occurs due to incompetent hardware design/software structuring leading to the microcontroller performing same unnecessary task again and again. This condition is dangerous as the microcontroller based system in reference becomes totally unsusceptible to any given input. Hence there is a need to detect the software stuck condition for successful return of microcontroller from stuck condition to active condition.
There are certain conditions that causes microcontroller based electronic control unit to reset some of which are momentary loss of power, low voltage detection, illegal address detection, computer operating properly (COP) reset, momentary loss of system clock, reset signal on microcontroller pin by external hardware circuit etc. Any of these reasons may cause microcontroller to reset and again start either from initialization state or recover from last state before reset but sometimes due to hardware limitation or software structuring, software does not reset again of its own

and get stuck. Such conditions typically require external hardware reset as final resort to pull system from inactive to active condition.
In conventional systems a self reset mechanism is provided to control the software runaway condition. The self reset mechanism works until the software loaded in to the system is running successfully, but when the software program gets stuck then there is a need to reset the microcontroller unit.
OBJECTS OF THE INVENTION
The primary object of the present invention is to provide an integrated self reset and user controlled reset mechanism for body control module during software runaway condition in vehicles.
Yet another object of the present invention is to provide a user input controlled hardware reset circuit to activate the reset circuit during software stuck condition.
Yet another object of the present invention is to provide a body control module with an external user controlled input signal as a power on reset signal to recover the microcontroller from software stuck mode to active mode,
SUMMARY OF THE INVENTION
The embodiments herein provides an integrated self reset and user controlled reset mechanism to reset the microcontroller unit of body control module during software runway condition. The body control module comprises a user controlled power supply reset circuit, an external watchdog timer interfaced between said microcontroller unit and user controlled power supply reset circuit and a power supply unit connected between said user controlled power supply reset circuit and said microcontroller unit. The user controlled power supply reset circuit includes a logic OR gate and a momentary switch. The reset circuit acts as a fail safe circuit and is activated only during software runaway condition.

According to present invention, the power supply reset circuit in the body control module receives two inputs for reset circuit activation. The first input to the power supply reset circuit is an enable signal from the external watchdog timer, this signal is an active low type and it is activated by missing timing pulse from the microcontroller. The second input to the power supply reset circuit is by user controlled momentary switch input, this is also active low input provided by the user in the event of microcontroller software stuck condition. The two specific types of signals are selected to activate the reset circuit and to avoid continuous operation of the reset circuit.
When the enable signal from the external watchdog timer and reset signal from momentary switch is active (short to ground) the reset circuit is activated, both the inputs to logic OR gate are at active low level, shutting OFF the output from logic OR gate and acts as a microcontroller power ON reset signal. The reset signal is active as long as both inputs to logic OR gate IC are active low. The power on reset to microcontroller brings back the microcontroller from software stuck mode to normal mode. The external watchdog timer constantly monitors the microcontroller units timing signal. When the microcontroller asserts software stuck condition, the timing signal to external watchdog timer is disrupted which triggers reset signal from timer to microcontroller. The external watchdog timer performs dual functionality of resetting the microcontroller and activating the failsafe circuitry if predefined timing signal from microcontroller is missed for predefined time.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG.l shows a block diagram illustrating an integrated self reset and user controlled reset mechanism for Body Control Module during software runaway condition, according to present invention.
FIG. 2 shows a flow chart illustrating an operation of the body control module during failsafe condition and reset generation, according to present invention.

FIG. 3 shows hardware reset circuit for user controlled power ON reset of the microcontroller, according to present invention.
DETAILED DESCRIPTION OF THE INVENTION
The embodiments herein provide an integrated self reset and user controlled reset mechanism to reset the microcontroller unit 3 of body control module during software runway condition. The electronic control unit in the body control module includes a hardware circuit and a software algorithm to detect software stuck condition and resets the microcontroller 3 accordingly.
FIG.l shows a block diagram illustrating an integrated self reset and user controlled reset mechanism for body control module during software runaway condition, according to present invention. With respect to FIG. 1 the body control module includes a user controlled power supply reset circuit 1, an external watchdog timer 2 interfaced between said microcontroller unit 3 and user controlled power supply reset circuit 1. The user controller power supply reset circuit 1 is communicating with a power supply unit 4 powering the microcontroller unit 3. The user controlled power supply reset circuit 1 acts as a fail safe circuit and is activated only during software stuck condition. According to present invention, the power supply reset circuit 1 in the body control module receives two inputs for reset circuit activation. The first input to the power supply reset circuit 1 is an enable signal from the external watchdog timer 2, this signal is an active low type and it is activated by missing timing pulse from the microcontroller 3. The timing pulse from microcontroller 3 acts as input signal for external watchdog and is an indication of microcontroller 3 sound health condition. The second input to the power supply reset circuit 1 is by user controlled momentary switch input, this is also active low input provided by the user in the event of microcontroller 3 software stuck condition.
The two specific types of signals are selected to activate the reset circuit 1 and to avoid continuous operation of the reset circuit 1. The primary purpose of the

present invention is to activate the reset circuit 1 during software stuck condition. As shown in FIG. 1, one signal is a momentary signal from user and other is continuous active high signal in normal condition and becomes active low signal during microcontroller software stuck condition. The momentary signal from the user performs two functions. In normal software working condition, the input from the momentary switch is fed to different circuitry for doing routine input for normal ECU operation and during software runaway condition the same input from the momentary switch is used to reset the microcontroller unit. Consider for example, in normal software working condition the left indicator input which is used to turn ON the left indicator lamps is used for resetting the microcontroller unit during software stuck condition. When both the enable signal from the external watchdog timer 2 and reset signal from momentary switch is active (short to ground) the hardware circuit shown in FIG. 3 is activated, both the inputs to logic OR gate IC are at active low level, shutting OFF the output from OR gate IC. When output from gate is at active low (Ovolts DC), the power supply inhibit pin is pulled low acting as microcontroller power ON reset signal. The reset signal is active as long as both inputs to logic OR gate IC are active low. The power on reset to microcontroller unit 3 brings back the microcontroller unit 3 from software stuck mode to normal mode during momentary disappearance of clock signal, illegal address stuck condition, watchdog triggered and not reset condition and software stuck in infinite loop execution etc.
The body control module according to present invention also includes an external watchdog timer 2 to constantly monitor the microcontroller 3 timing signal. This timing signal is unique and is mapped with predefined RC time constant used by external watchdog timer 2 as a reference signal. If microcontroller unit 3 asserts software stuck condition, timing signal (pulse) to external watchdog timer 2 is disrupted which triggers reset signal from timer to microcontroller unit 3. The external watchdog timer 2 according to the present invention performs dual functionality of resetting the microcontroller unit 3 and activating the failsafe circuitry if predefined timing signal from microcontroller 3 is missed for predefined

time. This requires use of external watchdog timer 2 to monitor the microcontroller 3 generated timing signals. The external watchdog timer 2 in addition to providing reset signal to microcontroller unit 3 also triggers failsafe circuitry or reset circuit 1. The external watchdog timer 2 is designed in such a way that, if the microcontroller timing pulse misses then the failsafe circuitry takes control of the certain critical BCM functions such as turning ON of left/right indicators, low beam lamps, fog lamps etc.
FIG. 2 shows a flow chart illustrating an operation of the body control module during failsafe condition and reset generation, according to present invention. The microcontroller unit (MCU) 3 is initialized (12) when the power is applied (11) through battery 5 or any other power source to the body control module. Then the microcontroller unit 3 reads the resistor capacitor (RC) frequency and synchronizes with the watchdog timer (13). Then the microcontroller unit 3 checks whether the RC frequency is in synchronous with the predefined RC time constant used by external watchdog timer 2. If the microcontroller unit 3 is in synchronous with the watchdog and failsafe controller (WFC) then the microcontroller unit 3 starts working normally (15). If the MCU and WFC are not synchronized, then WFC gives reset signal to the MCU to reset the MCU (16) and activate the fail safe circuit (17) and reads the RC frequency and synchronizes with the watchdog timer. If the software program get stuck or MCU fail or RC value changes (18), then the watchdog timer 2 sends reset signal to the MCU (19). The watchdog timer 2 receives a timing pulse during software stuck condition (20) and activates the failsafe circuit (21). The reset circuit, according to present invention is activated only when an active low signal is received from both the watchdog timer and the user controlled momentary switch. On the other hand the reset circuit receives an active low input from the watchdog timer only when there is a software stuck condition and hence the user can operate the momentary switch to restart the microcontroller. Hence during normal operation the momentary switch input is used as a routine input for normal ECU operation and during software stuck condition it can be used as a reset switch. FIG. 2 illustrates the BCM operation

during failsafe mode; it also shows use of external RC timing signal and activation of reset signal to microcontroller 3 from external watchdog timer 2. The RC time constant as used by external watchdog timer. 2 is directly given as input signal to the microcontroller unit 3 for using it as a reference signal to generate required timing signal to the external watchdog timer 2. This reduces the timing variations occurring due to variation in resistance and capacitance values with varied tolerance levels. By feeding RC timing signal directly the microcontroller unit 3 generates its own timing signal flexibly based on instantaneous timing signal input from RC network circuit. This technique largely takes care of mismatch occurring due RC component value variation because microcontroller 3 timing pulse is decided by RC time constant. The exemplary embodiment shown herein can be extended to any electronic controller which is functioning based on user inputs.
ADVANTAGE
To provide an integrated self reset and user controlled reset mechanism for body control module during software runaway condition in vehicles.
To provide a user input controlled hardware reset circuit to activate the reset circuit only during software stuck condition.
To provide an external user controlled input signal as a power on reset signal to recover the microcontroller from software stuck mode to active mode.

WE CLAIM
1. A reset system for a control module comprising, a microcontroller of said control module, a power supply unit for powering said microcontroller, a watch dog timer communicating with said microcontroller, a power supply reset circuit configured for receiving inputs from said watch dog timer and an user input switch, and controlling said power supply unit for inhibiting the power supply to said microcontroller based on the inputs.
2. A reset system as claimed in claim 1 wherein said watch dog timer is configured to receive predefined pulse (signal) from microcontroller and match with the reference pulse (signal) stored in the watch dog timer.
3. A reset system as claimed in claim 2 wherein said watch dog timer set to send an enable signal to said power supply reset circuit in the event of absence of pulse from said microcontroller or mismatching with the received signal and the reference signal.
4. A reset system as claimed in any one of the preceding claims wherein said circuit reset the power supply unit when the user input and enable signal from the watch dog timer is present.
5. A reset system as claimed in any one of the preceding claims wherein a RC timing circuit is communicating with said microcontroller and said external watch dog timer to generate reference timing window.
6. A reset system as claimed in any one of the preceding claims wherein said user input switch is a standard functioning momentary type switch connected to said control module.
7. A reset system as claimed in any one of the preceding claims wherein said system controls the critical functions of said control module in the event of absence of pulse from said microcontroller.

8. A reset system as claimed in any one of the preceding claims wherein said control module is a Body Control Module for a vehicle.