JP2008293420A - Electronic control unit - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To allow a microcomputer to more securely execute abnormality processing to be performed in the event of abnormality in an electronic control unit (ECU) equipped with a monitoring IC for monitoring the microcomputer. <P>SOLUTION: A monitoring IC 10 monitors an operation of a microcomputer 20, and when it detects the abnormal state of the microcomputer 20, it outputs a fail safe signal (FSINIT) to the microcomputer 20. The FSINIT is inputted to an NMI terminal for generating a non-maskable interrupt in the microcomputer 20. Thereby the non-maskable interrupt is generated in the microcomputer 20. Since the monitoring IC 10 detects the abnormal state of the microcomputer 20, the abnormal state is detected more reliably irrespective of the kinds of abnormal states of the microcomputer 20, and the non-maskable interrupt is generated in the microcomputer 20 reliably. The microcomputer 20 executes abnormality processing by this non-maskable interrupt, thereby executing abnormality processing without fail. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an electronic control device that includes a microcomputer and a monitoring IC that monitors the operation of the microcomputer, and that resets the microcomputer when an abnormality occurs in the microcomputer.

  Conventionally, in an electronic control device for a vehicle (hereinafter referred to as ECU), when an abnormality occurs in the microcomputer, the microcomputer is reset. In particular, in the ECU of Patent Document 1, when an abnormality occurs in the microcomputer, for example, after the microcomputer executes a process of saving information necessary for analyzing the abnormality in a memory (hereinafter referred to as a saving process), the microcomputer It is supposed to be reset.

More specifically, in the ECU of Patent Document 1, the microcomputer includes a watchdog timer that monitors the operation of the microcomputer. When an abnormality is detected by the watchdog timer, an interrupt is generated from the watchdog timer. The microcomputer executes the saving process as described above in the process at the time of the interruption.
JP-A-6-221218

  However, in the ECU of Patent Document 1 described above, if an abnormality has occurred in the watchdog timer of the microcomputer, the abnormality of the microcomputer cannot be detected. That is, depending on the type of abnormality of the microcomputer, the abnormality is not detected, and in this case, an interruption for the microcomputer to execute the saving process does not occur.

  By the way, as a method for detecting an abnormality of a microcomputer, for example, a method of providing a monitoring IC for monitoring the operation of the microcomputer and detecting the abnormality of the microcomputer by the monitoring IC is well known. According to this method, unless an abnormality occurs in the monitoring IC, the abnormality of the microcomputer can be detected more reliably regardless of the type of abnormality of the microcomputer. The applicant of the present application pays attention to this point and considered that the microcomputer can more reliably detect the abnormality of the microcomputer so that the microcomputer can carry out the process to be performed when the abnormality occurs.

  It is an object of the present invention to provide an electronic control device having a monitoring IC for monitoring the operation of a microcomputer, and when the microcomputer has an abnormality, the microcomputer can more reliably execute a process to be performed in the event of the abnormality. It is said.

  The electronic control device according to claim 1, which has been made to achieve the above object, includes a microcomputer that performs processing for controlling a controlled object, and a monitoring IC that monitors the operation of the microcomputer. When an abnormality is detected, the microcomputer in which the abnormality is detected is reset.

When the monitoring IC detects an abnormality in the microcomputer, the monitoring IC outputs an abnormality notification signal for notifying the abnormality to the microcomputer that has detected the abnormality.
In addition, the microcomputer has an interrupt generation circuit that generates an interrupt that cannot be masked (hereinafter referred to as non-maskable interrupt) when an opportunity signal is input, and it is necessary for the analysis of abnormalities with the non-maskable interrupt. A save process for storing various information in a predetermined memory is performed.

  Further, when the monitoring IC outputs an abnormality notification signal to the microcomputer, the microcomputer is then reset, and the abnormality notification signal is sent to the interrupt generation circuit as a trigger signal for generating a non-maskable interrupt. It is configured to be entered.

By the way, in the case of a configuration in which the microcomputer detects its own abnormality, if an abnormality has occurred in the function of detecting the abnormality, no abnormality is detected.
In this regard, in the electronic control device according to the first aspect, since the monitoring IC detects the abnormality of the microcomputer, the abnormality of the microcomputer can be detected more reliably regardless of the type of abnormality of the microcomputer.

  When an abnormality in the microcomputer is detected, an abnormality notification signal for notifying the abnormality is input from the monitoring IC to the microcomputer interrupt generation circuit, and a non-maskable interrupt is generated in the microcomputer. Since the evacuation process can be executed and then the microcomputer is reset, the microcomputer can be surely restored. For this reason, for example, when analyzing the abnormality of the microcomputer via an external diagnostic device or the like, it is advantageous because information for elucidating the cause of the abnormality can be obtained more reliably.

Here, the interrupt generation circuit may be specifically configured as in claim 2.
According to another aspect of the present invention, the interrupt generation circuit includes an NMI (Non Maskable Interrupt) terminal that receives an input signal as a trigger signal for generating an unmaskable interrupt.

The abnormality notification signal is input to the NMI terminal as a trigger signal for generating a non-maskable interrupt.
The NMI terminal is a terminal that the microcomputer normally includes. If the NMI terminal is used as in the second aspect, it is not necessary to add a dedicated terminal serving as a trigger for executing the saving process, which is advantageous.

By the way, in order to detect abnormality of a microcomputer, it can be specifically configured as in claims 3 to 5.
According to a third aspect of the present invention, in the electronic control device according to the first or second aspect, the microcomputer generates a signal that generates a pulse every predetermined time (hereinafter referred to as a normal notification signal) if the microcomputer operates normally. Is output.

When the monitoring IC monitors the normal notification signal and determines that the pulse is not output within a predetermined time, the monitoring IC determines that the microcomputer is abnormal.
According to the configuration of the third aspect, the monitoring IC can reliably detect the abnormality of the microcomputer with a simple configuration. More specifically, a so-called watch dog pulse signal can be considered as the normal notification signal. If the monitoring IC is provided with a watchdog timer for monitoring the watchdog pulse signal, it is advantageous that a new configuration need not be added to the microcomputer or the monitoring IC.

  According to a fourth aspect of the present invention, in the electronic control unit according to the third aspect, the monitoring IC determines that the microcomputer is abnormal when the output level of the normal notification signal does not reverse for a predetermined period. In other words, the monitoring IC determines that the microcomputer is abnormal when the output level of the normal notification signal is high or low for a predetermined period.

  The electronic control device stores the value of a predetermined period used for determination by the monitoring IC in a rewritable manner. According to this, the value of the predetermined period can be set to a desired value according to the specification of the microcomputer. Note that the value of the predetermined period may be stored in, for example, a microcomputer, or may be stored in a monitoring IC.

  Next, an electronic control device according to a fifth aspect is the electronic control device according to the third or fourth aspect, wherein the monitoring IC calculates the frequency of the pulse, and if the calculated frequency does not match the predetermined frequency, It is supposed to be abnormal. For example, if the pulses are set to be output at regular time intervals, the pulse frequency is calculated to determine whether the pulses are output at regular time intervals, in other words, whether the microcomputer is abnormal. I can judge. The electronic control device stores a value of a predetermined frequency used for judgment by the monitoring IC in a rewritable manner. According to this, the value of a predetermined frequency can be made into a desired value according to the specification of a microcomputer and the setting of pulse output. Note that the value of the predetermined frequency may be stored in, for example, a microcomputer, or may be stored in a monitoring IC.

By the way, in order to reset the microcomputer, it is preferable to configure as in the sixth aspect.
According to a sixth aspect of the present invention, in the electronic control device according to the first to fifth aspects, the microcomputer includes a reset terminal, and the monitoring IC outputs a failure notification signal, and a predetermined time has elapsed. After that, a reset signal is output to the reset terminal.

  According to such an electronic control device of claim 6, the microcomputer is surely reset regardless of the type of abnormality of the microcomputer, preventing the microcomputer from continuing to run out of control, and the reliability of the electronic control device. Improves. Further, since the microcomputer is not reset immediately after the monitoring IC outputs the abnormality notification signal, the save process can be executed in the microcomputer.

On the other hand, in order to reset the microcomputer, it may be configured as in claims 7 and 8.
According to a seventh aspect of the present invention, in the electronic control device according to the first and second aspects, the microcomputer includes a reset terminal. When the microcomputer receives the abnormality notification signal, the microcomputer executes the evacuation process and completes the evacuation process A pulse indicating the completion (hereinafter referred to as a evacuation completion pulse) is output to the monitoring IC.

  Then, the monitoring IC executes a reception determination process for determining whether or not a save completion pulse has been received, and outputs a reset signal to the reset terminal when it is determined that the save completion pulse has been received in the reception determination process. It has become.

  According to this, after the saving process is completed in the microcomputer, the microcomputer is reset. In other words, the microcomputer can reliably complete the save process before being reset. For this reason, for example, when analyzing the abnormality of the microcomputer via an external diagnostic device or the like, the cause of the abnormality can be clarified more reliably.

  An electronic control device according to an eighth aspect of the present invention is the electronic control device according to the third to fifth aspects, and has the same configuration as that of the seventh aspect. In particular, the electronic control device according to claim 8 can be configured as in claim 9.

  According to another aspect of the electronic control device of the present invention, the microcomputer outputs the evacuation completion pulse from the same port as the port that outputs the normal notification signal, and the monitoring IC outputs the evacuation completion pulse and the normal notification signal pulse. It can be distinguished from the other.

  According to this, it is not necessary to newly add a configuration for outputting the evacuation completion pulse to the microcomputer or newly add a configuration for inputting the evacuation completion pulse to the monitoring IC. This is advantageous from the viewpoint of cost and simplification of the configuration.

The electronic control device according to claim 9 may be configured specifically as in claim 10.
In the electronic control device according to the tenth aspect, the monitoring IC outputs an abnormality notification signal while the microcomputer is abnormal, and does not output an abnormality notification signal while the microcomputer is normal.

  Then, the monitoring IC determines that the pulse received from the microcomputer when the abnormality notification signal is output is a evacuation completion pulse, and the pulse received from the microcomputer when the abnormality notification signal is not output is the pulse of the normal notification signal. It comes to judge.

  If the microcomputer is abnormal, an abnormality notification signal is output from the monitoring IC to the microcomputer, a non-maskable interrupt occurs in the microcomputer, and the save process is executed. Further, while the abnormality notification signal is being output, the microcomputer is abnormal, so that the normal notification signal is not output from the microcomputer. Therefore, the monitoring IC can determine that the pulse received from the microcomputer when the abnormality notification signal is being output is the evacuation completion pulse.

  On the other hand, if the microcomputer is normal, an abnormality notification signal is not output from the monitoring IC, so that the non-maskable interrupt does not occur in the microcomputer and the saving process is not executed. For this reason, the monitoring IC can determine that the pulse received from the microcomputer when the abnormality notification signal is not output is the pulse of the normal notification signal.

In such an electronic control device according to the tenth aspect, the save completion pulse and the normal notification signal can be used as a port, and the resources of the microcomputer and the monitoring IC can be saved.
Next, in order to reset the microcomputer, a configuration as in claim 11 may be adopted.

  An electronic control device according to an eleventh aspect is the electronic control device according to any one of the first to tenth aspects, wherein the microcomputer includes a reset terminal, and the electronic control device resets the reset signal by a signal from an output port included in the microcomputer. A reset signal output circuit is provided.

  Further, when the saving process is completed, the microcomputer outputs a signal from the output port to the reset signal output circuit, and causes the reset signal output circuit to output a reset signal.

  In other words, in the electronic control device according to the eleventh aspect, when the saving process is completed, the microcomputer itself resets itself. According to this, the microcomputer is immediately reset after the evacuation process is completed. In other words, the microcomputer quickly returns to the normal state, which is advantageous.

Next, the electronic control device according to the eleventh aspect may be configured specifically as the twelfth aspect.
According to another aspect of the electronic control device of the present invention, the reset signal is a low level signal, and the reset signal output circuit includes a switch provided between the reset terminal and the low level potential. When the saving process is completed, the microcomputer outputs a signal from the output port to the switch and turns on the switch. When the switch is turned on, a reset signal is input to the reset terminal.

In other words, when the switch is turned on, the reset terminal is connected to a low-level potential. Thereby, the reset becomes valid and the microcomputer is reset.
By the way, the electronic control device according to the eleventh and twelfth aspects may be configured as in the thirteenth aspect in order to prevent the microcomputer from being reset accidentally.

The electronic control device according to claim 13 is characterized in that the processing executed by the microcomputer to output a signal from the output port includes a plurality of processing steps.
For example, if a signal is output from the output port of the microcomputer to the reset signal output circuit by taking one processing step, if the microcomputer accidentally executes that one processing step, the microcomputer will immediately It is not preferable because it is reset.

  On the other hand, in the electronic control device according to the thirteenth aspect, since a signal is not output from the output port of the microcomputer to the reset signal output circuit unless a plurality of processing steps are performed, the probability that the microcomputer is erroneously reset can be suppressed. it can.

Next, the electronic control device according to claims 11 to 13 may be configured as in claim 14.
In the electronic control device according to the fourteenth aspect, when the reset signal is input to the reset terminal and the microcomputer itself is reset, the output state of the signal of the output port becomes high impedance.

By using this configuration, the switch of the reset signal output circuit can be automatically turned off, so that the reset signal output circuit can be easily configured.
In the seventh to tenth aspects, there is a case where the evacuation completion pulse is not output for some reason. Further, in claims 11 to 14, it is conceivable that the microcomputer cannot reset itself for some reason.

  Therefore, the electronic control device according to claim 15 is the electronic control device according to any of claims 7 to 14, wherein the monitoring IC detects that the microcomputer is abnormal when a predetermined time elapses after the abnormality notification signal is output to the microcomputer. If it is determined again whether or not it is abnormal, a reset signal is output to the reset terminal. The predetermined time is longer than the time required for the microcomputer to complete the saving process.

  According to the electronic control device of the fifteenth aspect, even when the evacuation completion pulse is not output or the microcomputer cannot reset itself, it is predetermined after the monitoring IC outputs the abnormality notification signal. If time passes, the microcomputer is reset. That is, the microcomputer is surely reset. Further, since the predetermined time is longer than the time required for the microcomputer to complete the save process, the microcomputer can be reset after the save process is completed in the microcomputer.

Next, an electronic control device according to a sixteenth aspect is characterized in that, in the electronic control device according to the first to fifteenth aspects, the predetermined memory is a backup RAM that is constantly powered.
According to this, as long as the power supply is not stopped intentionally, information necessary for the analysis of the abnormality is retained, so that it is safe.

Next, an electronic control device according to a seventeenth aspect is the electronic control device according to the first to fifteenth aspects, wherein the predetermined memory is a non-volatile memory.
According to this, even if the power supply is stopped, the information necessary for analyzing the abnormality is retained, so that it is more secure.

Next, an electronic control device according to an eighteenth aspect is the electronic control device according to the first to seventeenth aspects, wherein the predetermined memory is provided outside the microcomputer.
By providing a memory for storing information necessary for analyzing an abnormality outside the microcomputer, it is possible to improve the stability of information retention.

  Next, an electronic control device according to a nineteenth aspect is characterized in that in the electronic control device according to the first to eighteenth aspects, the information necessary for analyzing the abnormality is information on both or one of ROM and RAM included in the microcomputer. Yes.

According to this, it is possible to analyze the abnormality of the program executed by the CPU of the microcomputer, the abnormality of the calculation result of the CPU, and the like.
Next, an electronic control device according to a twentieth aspect is characterized in that, in the electronic control device according to the first to nineteenth aspects, the information necessary for analyzing the abnormality is information stored in a register included in the microcomputer.

More specifically, for example, information on an error flag can be considered. According to this, it becomes easy to specify the function or location where the abnormality has occurred.
Next, an electronic control device according to a twenty-first aspect is characterized in that in the electronic control device according to the first to twentieth aspects, information necessary for analyzing an abnormality is information on a stack area of a microcomputer and a stack pointer register.

According to this, it becomes possible to know the state of change of the execution target address of the program, and for example, it becomes easy to specify in which routine an abnormality has occurred.
Next, an electronic control device according to a twenty-second aspect is the electronic control device according to the first to twenty-first aspects, wherein the electronic control device is an electronic control device that controls each part of the vehicle. It is characterized by being information representing the state of

  According to this, since the situation of the vehicle at the time of occurrence of an abnormality can be understood, it becomes easier to guess or identify the cause of the abnormality. In addition, based on the stored vehicle status, the vehicle status at the time of occurrence of an abnormality can be reproduced, making debugging easier.

Embodiments of the present invention will be described below with reference to the drawings.
[First Embodiment]
FIG. 1 is a configuration diagram of a vehicle electronic control device (hereinafter referred to as ECU) 1 according to a first embodiment to which the present invention is applied.

As shown in FIG. 1, the ECU 1 includes a microcomputer 20 that performs processing for controlling a controlled object, and a monitoring IC 10 that monitors the operation of the microcomputer 20.
The monitoring IC 10 includes a monitoring control circuit 12, a watchdog timer 14, a communication circuit 16, and an output port 18.

The monitoring control circuit 12 controls the overall operation of the monitoring IC 10.
The watchdog timer 14 is for monitoring the operation of the microcomputer 20. Specifically, a watchdog timer clear pulse (hereinafter referred to as a WDC pulse) for clearing the watchdog timer 14 is input from the microcomputer 20 to the watchdog timer 14 every predetermined time. .

  If the watchdog timer 14 is not cleared for a certain period of time, that is, if a state in which no WDC pulse is output from the microcomputer 20 continues for a certain period of time, it is determined that the microcomputer 20 is abnormal, and the watchdog timer 14 (Hereinafter referred to as FSINIT) is output to the microcomputer 20. FSINIT is input to the NMI (non-maskable interrupt) terminal 32 of the microcomputer 20. Further, hereinafter, outputting FSINIT means outputting a low level signal as an active level, and stopping FSINIT output means setting an active level signal to an inactive level (high level). Shall be said.

The communication circuit 16 is a circuit for communicating with the microcomputer 20.
The output port 18 is a port for outputting an initialization signal (hereinafter referred to as INIT) for resetting the microcomputer 20 to the microcomputer 20. INIT is input to the RESET terminal 40 of the microcomputer 20. Hereinafter, outputting INIT means outputting a low level signal as an active level for one pulse.

  The microcomputer 20 includes an injection control circuit 22 that controls fuel injection to the engine of the vehicle, an ignition control circuit 24 that performs ignition control, a throttle control circuit 26 that controls an electronic throttle, and monitoring control that monitors these control circuits. A circuit 28, an interrupt control circuit 30, a communication circuit 36 for communicating with the monitoring IC 10, a system control circuit 38, a CPU 42 that controls the function of the microcomputer 20, a backup RAM 44 that is constantly powered, and a CPU 42. ROM 46 for storing a program to be executed, RAM 48 for storing calculation results of CPU 42, I / O port 50 for inputting / outputting signals, ADC 52 for converting an input analog signal into a digital signal, and the aforementioned WDC And an output port 54 for outputting a pulse.

  The interrupt control circuit 30 includes an NMI terminal 32 and an INT terminal 34. When an active level signal is input to the NMI terminal 32, the interrupt control circuit 30 generates a non-maskable interrupt (hereinafter referred to as a non-maskable interrupt). In other words, a non-maskable interrupt is an interrupt that cannot be prohibited.

  In the present embodiment, when a non-maskable interrupt occurs, the execution target address of the program executed by the CPU 42 overlaps the start address of the save processing program. The saving process is a process for saving information representing the state of the microcomputer 20 to the backup RAM 44. The information indicating the state of the microcomputer 20 is information on the ROM 46 and the RAM 48, or information on a register, a stack area, and a stack pointer register (not shown).

Further, when an active level signal is input to the INT terminal 34, the interrupt control circuit 30 generates a maskable (prohibitable) normal interrupt.
Next, the system control circuit 38 includes a RESET terminal 40.

  When an active level signal is input to the RESET terminal 40, the microcomputer 20 is reset. Specifically, the execution target address of the program overlaps with the start address of the initial program executed by the CPU 42 at the initial start.

Next, processing executed in the monitoring IC 10 and the microcomputer 20 will be described.
First, FIG. 2 is a flowchart showing processing executed by the microcomputer 20. The processing of FIG. 2 is periodically executed.

In this process, first, in S110, a WDC pulse is output.
Next, the process proceeds to S120, where it is determined whether FSINIT has been input to the NMI terminal 32. If it is determined that FSINIT has been input (S120: YES), the process proceeds to S130, and save processing is executed. At this time, a non-maskable interrupt has occurred. The save process is as described above.

Next, the process proceeds to S140, where it is determined whether or not the saving process is completed. If it is determined that the save process is completed (S140: YES), the process proceeds to S150.
In S150, it is determined whether INIT is input to the RESET terminal 40. If it is determined that INIT is not input (S150: NO), the processing of S150 is repeated again. On the other hand, if it is determined in S150 that INIT is input to the RESET terminal 40 (S150: YES), the process proceeds to S180 and the microcomputer 20 is reset. Thereafter, the process is terminated.

  If it is determined in step S120 that FSINIT is not input to the NMI terminal 32 (S120: NO), the process proceeds to step S170, and it is determined whether INIT is input to the RESET terminal 40.

  If it is determined in S170 that INIT is not input (S170: NO), the process returns to S120. On the other hand, if it is determined that INIT is input (S170: YES), the process proceeds to S180.

If it is determined in S140 that the saving process has not been completed (S140: NO), the process proceeds to S160, and it is determined whether INIT is input to the RESET terminal 40 or not.
If it is determined in S160 that INIT has not been input (S160: NO), the process returns to S130. If it is determined in S160 that INIT has been input (S160: YES), the process proceeds to S180.

Next, FIG. 3 is a flowchart showing processing executed in the monitoring IC 10. The processing of FIG. 3 is periodically executed.
First, in S210, the monitoring IC 10 determines whether or not the WDC pulse has stopped (in other words, whether or not the WDC pulse has been detected). If the monitoring IC 10 determines that the WDC pulse has not stopped (S210: NO), the monitoring IC 10 returns to S210. Return. On the other hand, if it is determined in S210 that the WDC pulse has stopped (S210: YES), it is determined that the microcomputer 20 is abnormal, the process proceeds to S220, and FSINIT is output.

  Then, it progresses to S230 and enters a loop process. Specifically, in S240, counting is started by a timer (not shown), and in S250, it is determined whether or not the count value of the timer is larger than a predetermined value. If the count value of the timer is equal to or smaller than the predetermined value, the process returns to S240 again. On the other hand, if the count value of the timer is larger than the predetermined value, the loop process is exited and the process proceeds to S260.

In S260, INIT is output.
Next, in S270, the output of FSINIT is stopped. Thereafter, the process is terminated.

Next, FIG. 4 is a time chart showing the operation of the present embodiment.
In FIG. 4, the first stage represents a WDC pulse, the second stage represents FSINIT, the third stage schematically represents an execution mode of NMI processing (evacuation processing), and the fourth stage represents INIT.

When the microcomputer 20 is operating normally (normal operation), WDC pulses are periodically output ((1) in FIG. 4, S110, S210: NO).
If any abnormality occurs in the microcomputer 20 and the WDC pulse is not output ((2) in FIG. 4), this is detected by the watchdog timer 14 of the monitoring IC 10 (S210: YES), and the monitoring IC 10 sets FSINIT. Output (S220). In the microcomputer 20, when FSINIT is input (S120: YES), a non-maskable interrupt is generated and the saving process is executed (S130).

  Further, when a predetermined time elapses after outputting FSINIT, the monitoring IC 10 exits the loop processing of S230 to S250 and outputs INIT ((3) and S260 in FIG. 4). The predetermined time is longer than the time required for the microcomputer 20 to complete the saving process.

  In the microcomputer 20, when INIT is input to the RESET terminal 40, the microcomputer 20 is reset ((4) in FIG. 4, S150: YES → S180). As a result, the microcomputer 20 returns and the WDC pulse is periodically output again ((5) in FIG. 4).

Note that the monitoring IC 10 stops the output of FSINIT in accordance with the inversion of INIT (becomes inactive level) (S270).
As described above, in this embodiment, since the monitoring IC 10 monitors the WDC pulse from the microcomputer 20 and detects an abnormality of the microcomputer 20, the abnormality type of the microcomputer 20 is determined unless an abnormality occurs in the monitoring IC 10. Regardless, the abnormality of the microcomputer 20 can be detected more reliably. When an abnormality is detected in the microcomputer 20, FSINIT is input to the NMI terminal 32 of the microcomputer 20, so that a non-maskable interrupt is surely generated in the microcomputer 20. On the other hand, the microcomputer 20 executes (starts) a saving process for storing information indicating the state of the microcomputer 20 in the backup RAM 44 by this non-maskable interrupt, and the non-maskable interrupt occurs more reliably. From this, it can be said that the saving process is more reliably executed (started).

  Furthermore, since the monitoring IC 10 resets the microcomputer 20 after a sufficient time has elapsed for completion of the saving process, the microcomputer 20 can reliably store information indicating the state of the microcomputer 20 in the backup RAM 44. (In other words, the evacuation process can be completed with certainty). According to this, for example, when analyzing an abnormality through an external diagnostic device or the like, the abnormality can be easily clarified, which is advantageous.

Further, since the monitoring IC 10 resets the microcomputer 20, the microcomputer 20 is surely reset as compared with the case where the microcomputer 20 resets itself.
In the present embodiment, the interrupt control circuit 30 and the NMI terminal 32 correspond to an interrupt generation circuit, and the WDC signal (a signal including a WDC pulse) corresponds to a normal notification signal.
[Second Embodiment]
Next, a second embodiment will be described. The description will focus on the differences from the first embodiment.

FIG. 5 is a configuration diagram of the ECU 1 of the second embodiment.
First, the ECU 1 of the second embodiment is different from the first embodiment in that the microcomputer 20 includes an output port 56. Further, the ECU 1 is different in that the ECU 1 includes a pull-up resistor R and a transistor Tr. The pull-up resistor R has one end connected to the RESET terminal 40 and the other end connected to the power supply voltage. The transistor Tr is a bipolar transistor, and has a collector terminal connected to the RESET terminal 40, a base terminal connected to the output port 56 of the microcomputer 20, and an emitter terminal connected to a low level potential. With such a configuration, when the transistor Tr is off, the pull-up resistor R is valid, and the output level of the initialization signal input to the RESET terminal 40 is high (inactive level). On the other hand, when the transistor Tr is turned on, the output level of the initialization signal becomes a low level (active level).

The second embodiment is different in that the microcomputer 20 outputs a high signal from the output port 56 in a dedicated procedure as will be described later after the non-maskable interrupt occurs and the save process is executed. . The following are examples of dedicated procedures.
<1> First, data for setting in a register for the output port 56 (hereinafter referred to as POUT) is prepared in a general-purpose register different from the POUT. In this case, for example, a move instruction (MOV) is used.
<2> Next, for example, the same value as POUT is set in the PCMD register. For example, a store instruction (ST) is used.
<3> Subsequently, POUT is set.
<4> Next, a NOP instruction is inserted. For example, five are inserted.
Examples of programs <1> to <4> are as follows.
MOV 0x01, r10
ST. Br10, PCMD: PCMD writing ST. Br10, POUT: POUT setting NOP: Dummy instruction NOP: Dummy instruction NOP: Dummy instruction NOP: Dummy instruction NOP: Dummy instruction (next instruction):
Only by a sequence determined by such a program, the register value for the output port 56 is rewritten, and a high signal is output from the output port 56.

  Next, the second embodiment is different in that the monitoring IC 10 executes the process of FIG. 6 instead of the process of FIG. The process of FIG. 6 is periodically executed. In the process of FIG. 6, the same steps as those of the process of FIG.

  In the process of FIG. 6, when the monitoring IC 10 outputs FSINIT (S220) and enters the loop process (S230), the monitoring IC 10 determines whether or not a high signal is output from the output port 56 in S310. The monitoring IC 10 can determine whether or not a high signal is output from the output port 56 by communicating with the microcomputer 20 via the communication circuit 16 and acquiring the state of the microcomputer 20. .

If it is determined in S310 that a high signal has been output (S310: YES), the process proceeds to S320, and the output of FSINIT is stopped. Subsequently, the process proceeds from S330 to S340 to S350.
In S330, counting is started by a timer (not shown), and in subsequent S340, it is determined whether or not the count value of the timer is larger than a predetermined value. If the count value of the timer is equal to or smaller than the predetermined value, the process returns to S310 again. On the other hand, if the count value of the timer is larger than the predetermined value, the loop process is exited and the process proceeds to S350.

  In S350, it is determined whether FSINIT is output. In other words, it is determined again whether the microcomputer 20 is still abnormal. In S350 that has proceeded from S310: YES, the microcomputer 20 has already been reset, and the monitoring IC 10 has not output FSINIT. Therefore, a negative determination is made (S350: NO), and the process ends.

On the other hand, if it is determined in S310 that a high signal is not output (S310: NO), then the process proceeds from S330 to S340 to S350.
In S350, which has advanced from S310: NO, the microcomputer 20 has not yet been reset, and the monitoring IC 10 has still output FSINIT, so an affirmative determination is made (S350: YES), and the flow proceeds to S260.

In S260, INIT is output, and in subsequent S270, output of FSINIT is stopped. Thereafter, the process is terminated.
Next, FIGS. 7 to 9 are time charts showing the operation of the second embodiment. FIG. 7 is an example in which a high signal is output from the output port 56 of the microcomputer 20, while FIG. 9 is an example in which a high signal is not output from the output port 56 of the microcomputer 20 for some reason. FIG. 8 is a diagram illustrating the relationship between the signal of the output port 56 and INIT.

7 and 9, the first to third stages are the same as the first to third stages of FIG. 4, and the fourth stage represents a signal output from the output port 56, and the fifth stage represents the four stages of FIG. It represents the same INIT as the eye.
First, FIG. 7 will be described. 7 is the same as FIG. 4 until the save process is executed.

  On the other hand, in the second embodiment, when the save process is completed, the microcomputer 20 outputs a high signal from the output port 56 as shown in the fourth stage. At this time, the microcomputer 20 outputs a high signal by the dedicated procedure as described above.

  When a high signal is output from the output port 56, the transistor Tr (see FIG. 5) is turned on, and the level of the initialization signal becomes low (INIT becomes low). For this reason, the microcomputer 20 is reset. Then, the output state of the signal from the output port 56 becomes high impedance, thereby turning off the transistor Tr, enabling the pull-up resistor R, and the level of the initialization signal becomes high (INIT is reduced). High level).

Further, when a high signal is output from the output port 56 of the microcomputer 20 (S310: YES), the monitoring IC 10 stops the output of FSINIT (S320).
Here, the relationship between the signal of the output port 56 and INIT will be described in detail with reference to FIG.

  As shown in FIG. 8, when a high signal is output from the output port 56, the transistor Tr (see FIG. 5) is turned on, and the level of the initialization signal to the RESET terminal 40 becomes a low level. That is, INIT becomes low level. At this time, a slight delay occurs from when the high signal is output from the output port 56 until INIT becomes low level (delay time t1).

When INIT goes low, the reset becomes valid (reset valid period T).
When the microcomputer 20 is reset, the output state of the output port 56 becomes high impedance, the base voltage of the transistor Tr becomes low level, and the transistor Tr is turned off. Along with this, the pull-up resistor R (see FIG. 5) becomes effective, and the level of the initialization signal to the RESET terminal 40 becomes a high level. That is, INIT goes high and reset is released. There is a slight delay (delay time t2) from when the output state of the output port 56 becomes high impedance until the reset is released.

Next, FIG. 9 will be described. In FIG. 9, the first to fifth steps are the same as the first to fifth steps in FIG.
9 is the same as that in FIG. 7 until the saving process is executed in the microcomputer 20.

  When the monitoring IC 10 executes the save process in the microcomputer 20 and does not output a high signal from the output port 56 of the microcomputer 20 ((3) in FIG. 9, S310: NO), the count value of the timer is predetermined. At the timing when the value is exceeded (S340), it is determined whether or not FSINIT is output (S350).

  In this case, since the monitoring IC 10 still outputs FSINIT (S350: YES), it outputs INIT ((4) in FIG. 9, S260). Thereby, the microcomputer 20 is reset. Further, when outputting the INIT, the monitoring IC 10 stops the output of FSINIT (S270).

  As described above, in the ECU 1 of the second embodiment, since the microcomputer 20 resets itself at the timing when the evacuation process is completed, the microcomputer 20 is quickly reset. That is, it is possible to further shorten the time from when the abnormality of the microcomputer 20 is detected until the microcomputer 20 returns.

  Further, since the monitoring IC 10 resets the microcomputer 20 after a lapse of a predetermined time since the FSINIT is output from the monitoring IC 10 to the microcomputer 20, even if the microcomputer 20 cannot reset itself for some reason, the microcomputer 20 is surely reset. Become so. For this reason, it is possible to prevent the microcomputer 20 from continuing to run away.

  In the second embodiment, since the microcomputer 20 outputs a high signal from the output port 56 by following the dedicated procedure as described above, the register for the output port 56 is erroneously affected by, for example, disturbance. It is possible to prevent the microcomputer 20 from being erroneously reset by writing a value.

In the second embodiment, the circuit composed of the pull-up resistor R and the transistor Tr corresponds to the reset signal output circuit, the transistor Tr corresponds to the switch, and the process of S310 corresponds to the reception determination process.
[Third Embodiment]
Next, a third embodiment will be described. The ECU 1 of the third embodiment has the same configuration as the ECU 1 of the first embodiment.

  On the other hand, the ECU 1 of the third embodiment is different from the ECU 1 of the first embodiment in that the microcomputer 20 executes the process of FIG. 10 instead of the process of FIG. Further, the monitoring IC 10 is different in that the process of FIG. 11 is executed instead of the process of FIG. In FIG. 10, the same steps as those in FIG. 2 are denoted by the same reference numerals. In FIG. 11, the same steps as those in FIGS.

Specifically, the process of FIG. 10 differs from the process of FIG. 2 in that the process of S410 is further executed.
That is, in the process of FIG. 10, if it is determined that the save process is completed in S140 (S140: YES), the process proceeds to S410, and a save completion pulse indicating that the save process is completed is output to the monitoring IC 10.

  Here, the microcomputer 20 outputs an evacuation completion pulse from the output port 54 that outputs the WDC pulse. The monitoring IC 10 determines whether the pulse received from the microcomputer 20 is an evacuation completion pulse or a WDC pulse.

  Specifically, the monitoring IC 10 determines that a pulse received from the microcomputer 20 while outputting FSINIT is a evacuation completion pulse, and determines a pulse received from the microcomputer 20 while not outputting FSINIT is a WDC pulse. .

  For example, in S410, the microcomputer 20 has not been reset yet (INIT has not been received). Then, FSINIT is output from the monitoring IC 10. For this reason, the pulse output to the monitoring IC 10 in S410 is recognized as a evacuation completion pulse in the monitoring IC 10.

Next, the process of FIG. 11 is different from the process of FIG. 6 in that the process of S310 is not executed and the processes of S510 and S520 are executed in FIG.
That is, in the process of FIG. 11, when FSINIT is output (S220) and the loop process is started (S230), it is determined in S510 whether or not an evacuation completion pulse has been received.

  If it is determined in S510 that the save completion pulse has been received (S510: YES), it is determined that the save process has been completed, the process proceeds to S520, and INIT is output. Then, the process proceeds to S320. The processing of S320 to S350, S260, and S270 is the same as the processing of FIG.

On the other hand, if it is determined in S510 that the save completion pulse has not been received (S510: NO), the process proceeds to S330.
Next, FIGS. 12 and 13 are time charts showing the operation of the third embodiment. FIG. 12 is an example in which a save completion pulse is output from the microcomputer 20, and FIG. 13 is an example in which a save completion signal pulse is not output from the microcomputer 20 for some reason.

12 and 13, the first to fourth stages are the same as the first to fourth stages in FIG. 1.
As shown in FIG. 12, when the saving process is completed (S140: YES), the microcomputer 20 outputs a saving completion pulse (S410).

When the monitoring IC 10 receives the evacuation completion signal pulse from the microcomputer 20 (S510: YES), the monitoring IC 10 outputs INIT to the microcomputer 20 (S520). After that, it is the same as FIG.
Next, FIG. 13 will be described.

  In FIG. 13, after the evacuation process is completed, if the evacuation completion pulse is not output for some reason ((3) in FIG. 13, S510: NO), at the timing when the count value of the timer exceeds the predetermined value (S340), It is determined whether FSINIT is output (S350).

  In this case, since the monitoring IC 10 still outputs FSINIT (S350: YES), it outputs INIT ((4) in FIG. 13, S260). Thereby, the microcomputer 20 is reset. Further, when outputting the INIT, the monitoring IC 10 stops the output of FSINIT (S270).

In other words, even if the save completion pulse is not output from the microcomputer 20, the microcomputer 20 is reset when a predetermined time elapses after FSINIT is output.
As described above, in the third embodiment, the microcomputer 20 outputs the save completion pulse to the monitoring IC 10 at the timing when the save process is completed, and the monitoring IC 10 resets the microcomputer 10 when receiving the save completion pulse. The microcomputer 10 is quickly and reliably reset. Further, even if the evacuation completion pulse is not output from the microcomputer 20 for some reason, the monitoring IC 10 resets the microcomputer 20 after a predetermined time has elapsed since outputting FSINIT, thus preventing the microcomputer 20 from continuing to run away. can do.

As mentioned above, although one Embodiment of this invention was described, this invention is not limited to the said embodiment, A various form can be taken within the technical scope of this invention.
For example, in the above embodiment, when outputting the WDC pulse, the general-purpose port included in the microcomputer 20 and the register for the general-purpose port are used, and the WDC pulse is output from the general-purpose port by setting a value in the register. Alternatively, a WDC pulse may be output using a communication circuit.

  In the above embodiment, the monitoring IC 10 may calculate the period of the WDC pulse, and if the period does not coincide with the predetermined period, the monitoring IC 10 may determine that the microcomputer 20 is abnormal, or the WDC pulse (or the WDC pulse may be detected). If the included signal) does not invert for a predetermined period, it may be determined that the microcomputer 20 is abnormal. In this case, it is preferable that the ECU 1 stores the value of the predetermined period and the value of the predetermined period used for the determination in a rewritable manner.

In the above embodiment, a sub-microcomputer that monitors the operation of the microcomputer 20 may be provided instead of the monitoring IC 10.
In the above embodiment, the backup RAM 44 may be provided outside the microcomputer 20.

  In the above embodiment, information indicating the state of the microcomputer 20 may be stored in a nonvolatile memory (not shown). The nonvolatile memory may be provided inside the microcomputer or may be provided outside the microcomputer.

Further, in the above-described embodiment, information representing the state of the vehicle such as the engine speed and the vehicle speed of the vehicle may be saved in the backup RAM 44.
In the second embodiment, the third embodiment may be applied. That is, the microcomputer 20 may reset itself upon completion of the saving process and output a saving completion pulse to the monitoring IC 10. According to this, the microcomputer 20 can be expected to be reset by at least one of reset by itself and reset from the monitoring IC 10, and can more reliably prevent the microcomputer 20 from continuing to run away.

It is a block diagram of ECU1 of 1st Embodiment. It is a flowchart of the process which CPU42 of the microcomputer 20 of 1st Embodiment performs. It is a flowchart of the process which the monitoring IC10 of 1st Embodiment performs. It is a time chart showing the effect | action of 1st Embodiment. It is a block diagram of ECU1 of 2nd Embodiment. It is a flowchart of the process which the monitoring IC10 of 2nd Embodiment performs. It is a time chart showing the effect | action of 2nd Embodiment (the 1). It is a detailed view showing the relationship between port output and INIT. It is a time chart showing the effect | action of 2nd Embodiment (the 2). It is a flowchart of the process which CPU42 of the microcomputer 20 of 3rd Embodiment performs. It is a flowchart of the process which the monitoring IC10 of 3rd Embodiment performs. It is a time chart showing the effect | action of 3rd Embodiment (the 1). It is a time chart showing the effect | action of 3rd Embodiment (the 2).

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... ECU, 10 ... Monitoring IC, 12 ... Monitoring control circuit, 14 ... Watchdog timer, 16 ... Communication circuit, 18 ... Output port, 20 ... Microcomputer, 22 ... Injection control circuit, 24 ... Ignition control circuit, 26 ... Throttle Control circuit 28 ... Monitoring control circuit 30 ... Interrupt control circuit 32 ... NMI terminal 34 ... INT terminal 36 ... Communication circuit 38 ... System control circuit 40 ... RESET terminal 42 ... CPU 44 ... Backup RAM 46 ... ROM, 48 ... RAM, 50 ... I / O port, 54, 56 ... output port.

Claims (22)

A microcomputer that performs processing for controlling the controlled object; and a monitoring IC that monitors the operation of the microcomputer; when the monitoring IC detects an abnormality in the microcomputer, the microcomputer in which the abnormality is detected is reset. In the electronic control device configured in
The monitoring IC is
When an abnormality of the microcomputer is detected, an abnormality notification signal for notifying the abnormality is output to the microcomputer that has detected the abnormality.
The microcomputer is
An interrupt generation circuit that generates a non-maskable interrupt (hereinafter referred to as a non-maskable interrupt) when a trigger signal is input is provided, and information necessary for analyzing an abnormality is predetermined by the non-maskable interrupt. The evacuation process to be stored in the memory is performed,
Further, when the monitoring IC outputs the abnormality notification signal to the microcomputer, the microcomputer is then reset, and the abnormality notification signal is used as a trigger signal for generating the non-maskable interrupt. An electronic control device configured to be input to an interrupt generation circuit. The electronic control device according to claim 1.
The interrupt generation circuit includes a non-maskable interrupt (NMI) terminal that receives an input signal as a trigger signal for generating the non-maskable interrupt, and the abnormality notification signal includes the non-maskable interrupt signal. An electronic control device, wherein the electronic control device is adapted to be input to the NMI terminal as a trigger signal for generating a trouble. The electronic control device according to claim 1 or 2,
The microcomputer outputs a signal (hereinafter referred to as a normal notification signal) in which a pulse is generated within a predetermined time if its own operation is normal,
The monitoring IC monitors the normal notification signal, and determines that the microcomputer is abnormal if it determines that the pulse is not output within the predetermined time. . The electronic control device according to claim 3.
When the output level of the normal notification signal does not reverse for a predetermined period, the monitoring IC determines that the microcomputer is abnormal.
The electronic control device is characterized in that the monitoring IC stores the value of the predetermined period used for the determination in a rewritable manner. The electronic control device according to claim 3 or 4,
The monitoring IC calculates the frequency of the pulse, and if the calculated frequency does not match a predetermined frequency, the monitoring IC determines that the microcomputer is abnormal.
The electronic control apparatus is characterized in that the monitoring IC stores the value of the predetermined frequency used for the determination in a rewritable manner. The electronic control device according to any one of claims 1 to 5,
The microcomputer has a reset terminal,
The electronic control device, wherein the monitoring IC outputs a reset signal to the reset terminal after a predetermined time has elapsed after outputting the abnormality notification signal. The electronic control device according to claim 1 or 2,
The microcomputer is
It has a reset terminal,
When the saving process is executed by receiving the abnormality notification signal and the saving process is completed, a pulse indicating the completion (hereinafter referred to as a saving completion pulse) is output to the monitoring IC. ,
The monitoring IC executes a reception determination process for determining whether or not the save completion pulse has been received, and outputs a reset signal to the reset terminal when the reception IC determines that the save completion pulse has been received. An electronic control device characterized by that. The electronic control device according to any one of claims 3 to 5,
The microcomputer is
It has a reset terminal,
When the saving process is executed by receiving the abnormality notification signal and the saving process is completed, a pulse indicating the completion (hereinafter referred to as a saving completion pulse) is output to the monitoring IC. ,
The monitoring IC executes a reception determination process for determining whether or not the save completion pulse has been received, and outputs a reset signal to the reset terminal when the reception IC determines that the save completion pulse has been received. An electronic control device characterized by that. The electronic control device according to claim 8.
The microcomputer is configured to output the evacuation completion pulse from the same port that outputs the normal notification signal,
The electronic control device, wherein the monitoring IC is configured to be able to distinguish between the evacuation completion pulse and the normal notification signal pulse. The electronic control device according to claim 9.
The monitoring IC outputs the abnormality notification signal while the microcomputer is abnormal, and does not output the abnormality notification signal while the microcomputer is normal.
The monitoring IC determines the pulse received from the microcomputer when the abnormality notification signal is output as the evacuation completion pulse, and the pulse received from the microcomputer when the abnormality notification signal is not output. An electronic control unit characterized in that it is determined as a pulse of a normal notification signal. The electronic control device according to any one of claims 1 to 10,
The microcomputer has a reset terminal,
The electronic control device includes a reset signal output circuit that outputs a reset signal to the reset terminal according to a signal from an output port included in the microcomputer.
Furthermore, the microcomputer outputs a signal from the output port to the reset signal output circuit when the save process is completed, and causes the reset signal output circuit to output the reset signal. Electronic control device. The electronic control device according to claim 11,
The reset signal is a low level signal,
The reset signal output circuit includes a switch provided between the reset terminal and a low level potential,
When the microcomputer completes the saving process, the microcomputer outputs a signal to the switch from the output port, and turns on the switch.
The electronic control device, wherein the reset signal is input to the reset terminal when the switch is turned on. The electronic control device according to claim 11 or 12,
The electronic control device characterized in that the processing executed by the microcomputer to output a signal from the output port includes a plurality of processing steps. The electronic control device according to any one of claims 11 to 13,
The electronic control device according to claim 1, wherein when the reset signal is input to the reset terminal and the microcomputer is reset, the microcomputer sets the output state of the signal of the output port to high impedance. The electronic control device according to any one of claims 7 to 14,
The monitoring IC re-determines whether or not the microcomputer is abnormal when a predetermined time has elapsed after outputting the abnormality notification signal to the microcomputer, and determines that the microcomputer is abnormal. Is output to the reset terminal, and the predetermined time is a time longer than a time required for the microcomputer to complete the saving process. . The electronic control device according to any one of claims 1 to 15,
The electronic control apparatus according to claim 1, wherein the predetermined memory is a backup RAM that is constantly supplied with power. The electronic control device according to any one of claims 1 to 15,
The electronic control apparatus according to claim 1, wherein the predetermined memory is a non-volatile memory. The electronic control device according to any one of claims 1 to 17,
The electronic control apparatus, wherein the predetermined memory is provided outside the microcomputer. The electronic control device according to any one of claims 1 to 18,
The information necessary for the analysis of the abnormality is information on both or one of ROM and RAM included in the microcomputer. The electronic control device according to any one of claims 1 to 19,
The electronic control apparatus according to claim 1, wherein the information necessary for analyzing the abnormality is information stored in a register included in the microcomputer. The electronic control device according to any one of claims 1 to 20,
The information required for the analysis of the abnormality is information on a stack area and a stack pointer register of the microcomputer. The electronic control device according to any one of claims 1 to 21,
The electronic control device is an electronic control device that controls each part of the vehicle,
The information necessary for analyzing the abnormality is information representing a state of the vehicle.

Images