JP2007328679A - Runaway monitoring apparatus for multiplexed cpu - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a runaway monitoring apparatus for multiplexed CPUs which can notify an abnormal side CPU or reset only the abnormal side CPU. <P>SOLUTION: The runaway monitoring apparatus for the multiplexed CPUs is provided with: a first determination means (19) for determining runaway of a main CPU (11); a first resetting means (19) for resetting the main CPU when the first determination means determines runaway of the main CPU; a second determination means (11a) mounted inside the main CPU to determine runaway of a sub-CPU; a first abnormality notifying means (21) for notifying the outside about the runaway of the sub-CPU when the second determination means determines the runaway of the sub-CPU; a second resetting means (20) for resetting the sub-CPU when the second determination means determines the runaway of the sub-CPU; a third determination means (12a) mounted inside the sub-CPU to determine runaway of the main CPU; and a second abnormality notifying means (22) for notifying the outside about the runaway of the main CPU when the third determination means determines the runaway of the main CPU. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a multiplexed CPU runaway monitoring apparatus, for example, an apparatus suitable for monitoring an abnormal operation of a multiplexed CPU that electronically controls the operation of important safety components such as a brake hydraulic solenoid valve in a vehicle. About.

  Today, electronic control of vehicles such as automobiles is remarkable, and there is a tendency that not only engine control and automatic transmission control but also parts closely related to traveling safety such as brake control and steering control are electronically controlled.

  Note that “electronic control” generally means a control function configured by hardware logic such as a transistor, and also means a control function realized by software mainly using a CPU (computer). “Electronic control” in the specification means the latter, that is, a control function realized by organic coupling of a hardware resource such as a CPU and a software resource such as an appropriately designed program.

  In a control function realized by software mainly using a CPU, a multiplexed CPU composed of a plurality of CPUs may be employed to improve reliability. In particular, brake control and operation in a vehicle are employed. There is a strong tendency for parts closely related to driving safety such as direction control.

  FIG. 2 is a configuration diagram of a conventional multiplexing CPU described in Patent Document 1 below. In this figure, two CPUs (hereinafter referred to as a main CPU 1 and a sub CPU 2) execute the same program, pass through an output logic determination circuit 3 and a drive circuit 4, and pass through a required load 5 (for example, brake fluid pressure in a vehicle). Control the operation of the solenoid valve.

  Each of the main CPU 1 and the sub CPU 2 includes monitoring circuits 1a and 2a. While the monitoring circuits 1a and 2a exchange signals periodically or at a predetermined timing, abnormalities (runaway runaway) of the counterpart CPU occur. ). In other words, it is determined to be normal while a signal is obtained periodically or at a predetermined timing from the counterpart CPU, but it is determined that an abnormality has occurred in the counterpart CPU when the signal is not obtained. This is notified to the runaway monitoring circuit 7 via the OR gate 6.

  The runaway monitoring circuit 7 applies a reset signal to both CPUs (the main CPU 1 and the sub CPU 2) when an abnormality is notified from one of the CPUs via the OR gate 6, and those CPUs (the main CPU 1 and the sub CPU 2). To reset.

  Therefore, according to such a configuration, when either one of the main CPU 1 and the sub CPU 2 runs away, both the CPUs (the main CPU 1 and the sub CPU 2) can be reset and returned from the runaway state.

Japanese Patent No. 2906789

However, in the configuration of FIG. 2, since an abnormality notification is transmitted via the OR gate 6, there is no way to know which CPU has an abnormality, and troubles may occur in the case of subsequent repairs. There is an inconvenience of coming.
In addition, when either one of the main CPU 1 and the sub CPU 2 runs out of control, both the CPUs (the main CPU 1 and the sub CPU 2) are reset, so that the other CPUs are operating normally. Since the normal operation CPU is also reset, for example, the failure history or the like cannot be recorded by the normal CPU, and in this respect, there is an inconvenience that a trouble is caused at the time of subsequent failure repair.

  Accordingly, an object of the present invention is to provide a multiplexed CPU runaway monitoring device that can notify an abnormal CPU or can reset only the abnormal CPU.

A multiplexed CPU runaway monitoring apparatus according to the present invention is a multiplexed CPU runaway monitoring apparatus that monitors the runaway of a main CPU and a secondary CPU that execute the same program to control the operation of a common load. First determining means for determining whether the main CPU is out of control by the first determining means, first reset means for resetting the main CPU, and mounted in the main CPU, A second determination means for determining a runaway; a first abnormality notification means for notifying the secondary CPU of a runaway when the second determination means determines a runaway of the secondary CPU; and the second determination means. A second reset means for resetting the sub CPU when it is determined that the sub CPU is out of control; Means, characterized in that a second abnormality notification unit for notifying the runaway of the main CPU to the outside when the runaway of the main CPU is determined by the third determination means.
In a preferred aspect of the present invention, the first determination unit determines whether the main CPU is out of control based on a signal output from the main CPU periodically or at a predetermined timing.
Alternatively, the second determination unit determines whether the sub CPU is out of control based on a signal output from the sub CPU periodically or at a predetermined timing.
Alternatively, the third determination means determines whether the main CPU is out of control based on a signal output from the main CPU periodically or at a predetermined timing.

According to the present invention, when the main CPU runs out of control, the runaway is determined by the first determining means, and the main CPU is reset by the first resetting means, and at the same time, the third determination mounted on the normal side sub CPU. The main CPU runaway is determined by the means, and the main CPU runaway is notified to the outside by the second abnormality notification means.
Further, when the sub CPU runs away, the runaway is determined by the second determination means, and the sub CPU is reset by the second reset means, and at the same time, the first CPU notifies the outside of the runaway of the sub CPU. The
Therefore, it is possible to provide a multiplexed CPU runaway monitoring device that can individually notify the abnormal CPU and can reset only the abnormal CPU.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. It should be noted that the specific details or examples in the following description and the illustrations of numerical values, character strings, and other symbols are only for reference in order to clarify the idea of the present invention, and the present invention may be used in whole or in part. Obviously, the idea of the invention is not limited. In addition, a well-known technique, a well-known procedure, a well-known architecture, a well-known circuit configuration, and the like (hereinafter, “well-known matter”) are not described in detail, but this is also to simplify the description. Not all or part of the matter is intentionally excluded. Such well-known matters are known to those skilled in the art at the time of filing of the present invention, and are naturally included in the following description.

  FIG. 1 is a configuration diagram of a multiplexed CPU runaway monitoring apparatus according to the present embodiment. In this figure, a multiplexed CPU runaway monitoring device 10 (hereinafter simply referred to as “runaway monitoring device”) includes a main CPU 11, a sub CPU 12, a main output unit 13, a sub output unit 14, an output combining unit 15, and a total output monitoring unit 16. , A secondary output monitoring unit 17, a primary output monitoring unit 18, a primary CPU runaway monitoring unit 19, a secondary CPU reset unit 20, a secondary CPU failure notification unit 21, and a primary CPU failure notification unit 22. The “main” and “sub” of the main CPU 11 and the sub CPU 12 have no meaning in themselves and are merely prefixes for identification.

  The main CPU 11 executes a predetermined program (for example, a control program for a brake hydraulic pressure solenoid valve in a vehicle), outputs a control signal corresponding to the execution result to the main output unit 13 via the terminal O1, and outputs the main output. The unit 13 generates a drive signal corresponding to the control signal from the main CPU 11 and outputs the drive signal to the combined output unit 15, and also outputs the drive signal to the main output monitoring unit 18.

  The main output monitoring unit 18 converts the drive signal from the main output unit 13 into a digital main output signal and inputs it to the terminal I1 of the sub CPU 12.

  The sub CPU 12 executes the same program as the main CPU 11 and outputs a control signal corresponding to the execution result to the sub output unit 14 via the terminal O1, and the sub output unit 14 receives the control signal from the sub CPU 12 as a control signal. A corresponding analog drive signal is generated and output to the combined output unit 15, and the drive signal is also output to the sub-output monitoring unit 17.

  The sub output monitoring unit 17 converts the drive signal from the sub output unit 14 into a digital sub output signal and inputs the digital sub output signal to the terminal I 1 of the main CPU 11.

  The combined output unit 15 is configured by combining, for example, unidirectional elements 15a and 15b such as diodes. The combined output unit 15 combines drive signals from the main output unit 13 and the sub output unit 14 and uses the drive signal to load 23. (In this case, the brake hydraulic pressure electromagnetic valve) is driven, and the drive signal is also output to the composite output monitoring unit 16.

  The composite output monitoring unit 16 converts the composite drive signal from the composite output unit 15 into a digital composite output signal and inputs it to the terminal I2 of the main CPU 11.

  The main CPU 11 and the sub CPU 12 have monitoring circuits 11a and 12a, respectively. The monitoring circuits 11a and 12a monitor signals output from the counterpart CPU periodically or at a predetermined timing to monitor the counterpart CPU. Monitors CPU abnormalities (runaway). That is, it is determined to be normal while a signal is obtained periodically or at a predetermined timing from the counterpart CPU, and when no signal is obtained, it is determined that an abnormality has occurred in the counterpart CPU. Even if a signal is obtained from the other party's CPU, if the contents of the signal are incorrect or the incorrect state continues for a predetermined time, an abnormality has occurred in the other party's CPU. It may be determined that

  Here, when the monitoring circuit 11a of the main CPU 11 determines that the sub CPU 12 is out of control, a signal prompting the sub CPU reset unit 20 to reset the sub CPU 12 is output from the terminal O3 of the main CPU 11. In response to this signal, the secondary CPU reset unit 20 enables the RESET terminal of the secondary CPU 12 to reset the secondary CPU 12. At the same time, an abnormality notification signal of the sub CPU 12 is output from the terminal O5 of the main CPU 11 to the sub CPU failure notification unit 21, and the sub CPU failure notification unit 21 displays the sub CPU failure indicator 24 provided in the driver's seat or the like. It is lit to notify the driver or the like that a failure has occurred in the sub CPU 12.

  On the other hand, a signal is output from the terminal O4 of the main CPU 11 to the main CPU runaway monitoring unit 19 periodically or at a predetermined timing. The main CPU runaway monitoring unit 19 determines that the main CPU 11 is operating normally while the signal from the main CPU 11 is being input, but when the signal from the main CPU 11 is no longer input, It is determined that an abnormality (runaway) has occurred, the RESET terminal of the main CPU 11 is enabled, and the main CPU 11 is reset.

  At this time, since the monitoring circuit 12a of the sub CPU 12 also determines that the main CPU 11 has runaway, an abnormality notification signal for the main CPU 11 is output from the terminal O5 of the sub CPU 12 to the main CPU failure notification unit 22, and the main CPU failure The notification unit 22 lights a main CPU failure indicator 25 provided in the driver's seat or the like to notify the driver or the like that a failure has occurred in the main CPU 11.

Next, the operation will be described.
First, the monitoring function of the runaway monitoring device 10 in the present embodiment includes the “composite output monitoring function”, “sub output monitoring function”, “main output monitoring function”, “mutual monitoring function”, and “main CPU runaway monitoring function”. It can be divided into five. Hereinafter, each monitoring function will be described.

(1) Composite output monitoring function:
The composite output monitoring function is a function realized by the composite output monitoring unit 16 and the main CPU 11. The control result of the main CPU 11 and the composite output of the composite output unit 15 are collated, and if there is a mismatch, the composite output is abnormal. It is a function to determine.

  Based on the determination result of the composite output monitoring function and the determination result of the “sub output monitoring function” or “mutual monitoring function” described later, it is determined which of the main CPU 11 and the sub CPU 12 is abnormal. If an abnormality has occurred in the main CPU 11, a signal to the main CPU runaway monitoring unit 19 is stopped to prompt the reset of the main CPU 11, or if an abnormality has occurred in the sub CPU 12, A signal is output to the secondary CPU reset unit 20 to prompt the secondary CPU 12 to be reset.

  Alternatively, when both the main CPU 11 and the sub CPU 12 are abnormal, the signal to the main CPU runaway monitoring unit 19 is stopped to prompt the main CPU 11 to be reset, and a signal is output to the sub CPU reset unit 20. Then, the sub CPU 12 is prompted to reset.

(2) Sub output monitoring function:
The sub-output monitoring function is a function realized by the sub-output monitoring unit 17 and the main CPU 11. The control result of the main CPU 11 and the output of the sub-output unit 14 are collated, and if there is a mismatch, the sub CPU 12 malfunctions (incorrect). This is a function for determining the output state.

  Here, the erroneous output state is (a) a state where no signal is output when the signal should be output, or (a) a state where a signal is output when the signal should not be output. Point to either. Specifically, in each state of (a) “main output = ON and sub output = OFF” or (b) “main output = OFF and sub output = ON”, It is determined that there is an abnormality when the logic of its own output and the output of the counterpart CPU are different.

  When an abnormality of the sub CPU 12 is determined by the sub output monitoring function, a signal is output from the terminal O3 of the main CPU 11 to the sub CPU reset unit 20, the sub CPU 12 is reset, and a sub CPU failure notification is issued from the terminal O3 of the main CPU 11. A signal notifying the abnormality of the sub CPU 12 is output to the unit 21.

(3) Main output monitoring function:
The main output monitoring function is a function realized by the main output monitoring unit 18 and the sub CPU 12. The control result of the sub CPU 12 and the output of the main output unit 13 are collated, and if there is a mismatch, the main CPU 11 malfunction (error) This is a function for determining the output state.

  Here, the erroneous output state is the same as the definition of the secondary output monitoring function. That is, it indicates either (a) a state in which no signal is output when a signal is to be output, or (a) a state in which a signal is output when a signal is not to be output. Specifically, in each state of (a) “main output = ON and sub output = OFF” or (b) “main output = OFF and sub output = ON”, It is determined that there is an abnormality when the logic of its own output and the output of the counterpart CPU are different.

  When an abnormality of the main CPU 11 is determined by the main output monitoring function, a signal notifying the abnormality of the main CPU 11 is output from the terminal O3 of the sub CPU 12 to the main CPU failure notification unit 22. At the same time, a signal is not input from the terminal O4 of the main CPU 11 to the main CPU runaway monitoring unit 19 due to the abnormality of the main CPU 11, so the main CPU runaway monitoring unit 19 enables the RESET terminal of the main CPU 11 to be in an enabled state. The main CPU 11 is reset.

(4) Mutual monitoring function:
This mutual monitoring function is realized by the monitoring circuits 11a and 12a mounted on the main CPU 11 and the sub CPU 12, respectively. That is, the monitoring circuit 11a of the main CPU 11 determines the runaway of the sub CPU 12 when the signal from the sub CPU 12 is no longer input, and the monitoring circuit 12a of the sub CPU 12 determines when the signal from the main CPU 11 is no longer input. The runaway of the main CPU 11 is determined. As described above, since the abnormality of the CPU on the other side can be determined mutually, for example, when the main CPU 11 determines that the secondary CPU 12 is out of control, the driver or the like is notified via the secondary CPU failure notification unit 21. The abnormality of the main CPU 11 can be notified to the driver or the like via the main CPU failure notification unit 22 when the abnormality of the main CPU 11 is determined by the sub CPU 12. be able to.

(5) Main CPU runaway monitoring function:
This function is realized by the main CPU runaway monitoring unit 19. That is, the main CPU runaway monitoring unit 19 monitors a signal output from the terminal O4 of the main CPU 11 periodically or at a predetermined timing, and an abnormality has occurred in the main CPU 11 when this signal is not input. Is determined, the RESET terminal of the main CPU 11 is enabled, and the main CPU 11 is reset.

  As described above, in the present embodiment, the abnormality (runaway) of the main CPU 11 and the sub CPU 12 can be individually determined, and further, the abnormal CPU can be notified. For this reason, it becomes possible to notify the driver of which abnormality has occurred, and in addition, it is possible to reset only the abnormal CPU while leaving the normal operation CPU unchanged. it can. Therefore, for example, the normal operation side CPU can notify the abnormal side CPU to the driver, and it is also possible to leave a failure history, etc., and to improve the efficiency at the time of failure repair after the fact. The special effect of being able to do is obtained.

It is a block diagram of the multiplexing CPU runaway monitoring apparatus which concerns on this embodiment. It is a block diagram of the conventional multiplexing CPU.

Explanation of symbols

10 Multiplex CPU runaway monitoring device 11 Main CPU
11a Monitoring circuit (second determination means)
12 Sub CPU
12a Monitoring circuit (third determining means)
19 Main CPU runaway monitoring unit (first determination means, first reset means)
20 Sub CPU reset section (second reset means)
21 Sub CPU failure notification section (first abnormality notification means)
22 Main CPU failure notification section (second abnormality notification means)
23 Load

Claims (4)

In a multiplexed CPU runaway monitoring device that monitors the runaway of the main CPU and the secondary CPU that execute the same program and control the operation of a common load,
First determination means for determining the runaway of the main CPU;
First reset means for resetting the main CPU when the first CPU determines that the main CPU has run out of control;
Second determination means mounted inside the main CPU for determining runaway of the sub CPU;
First abnormality notification means for notifying the outside of the secondary CPU when the secondary CPU is determined to be out of control by the second determination means;
Second reset means for resetting the sub CPU when the second determination means determines that the sub CPU is out of control;
Third determination means mounted in the sub CPU and determining the runaway of the main CPU;
A multiplexed CPU runaway monitoring device, comprising: a second abnormality notification means for notifying the outside of the main CPU when the main CPU runaway is judged by the third judging means. 2. The multiplexed CPU runaway monitoring apparatus according to claim 1, wherein the first judging unit judges runaway of the main CPU based on a signal output from the main CPU periodically or at a predetermined timing. . 2. The multiplexed CPU runaway monitoring apparatus according to claim 1, wherein the second judgment unit judges runaway of the secondary CPU based on a signal output from the secondary CPU periodically or at a predetermined timing. . 2. The multiplexed CPU runaway monitoring apparatus according to claim 1, wherein the third judging means judges runaway of the main CPU based on a signal output from the main CPU periodically or at a predetermined timing. .

Images