JP2010224759A - Electronic controller and abnormality monitoring method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an electronic controller and an abnormality monitoring method capable of reliably monitoring abnormality of a microcomputer during operation of a CPU of the microcomputer. <P>SOLUTION: The electronic controller 10 includes: the microcomputer 11; and an abnormality monitoring circuit 13 which detects the abnormality of the microcomputer 11 based on a pulse signal output from the microcomputer 11 when abnormality monitoring is permitted by a monitoring control signal to permit or forbid abnormality monitoring. The microcomputer 11 includes a monitoring control circuit 114 which switches the output state of the monitoring control signal according to the output state of the control signal to stop operation of the CPU 111 of the microcomputer 11. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an abnormality that detects an abnormality of the microcomputer based on a pulse signal output from the microcomputer when the abnormality monitoring is permitted by the microcomputer and a monitoring control signal that permits or prohibits the abnormality monitoring. The present invention relates to an electronic control device including a monitoring circuit and an abnormality monitoring method.

  Generally, electronic devices are controlled by a microcomputer. In electronic devices that require high safety, for example, electronic control devices mounted on vehicles (hereinafter referred to as ECU (Electric Control Unit)), the microcomputer may run away or the circuit may be damaged due to noise or the like. In order to be prepared for a situation where it does not operate normally, a microcomputer abnormality monitoring device is usually provided outside the microcomputer.

  The abnormality monitoring device monitors the pulse signal output from the microcomputer, and determines that an abnormality such as software runaway has occurred in the microcomputer when the input of the pulse signal to the abnormality monitoring device is interrupted for a predetermined period. Then, a reset signal is output to the microcomputer.

  By the way, a plurality of ECUs are mounted on the vehicle, and these ECUs include an ECU that is powered only when the ignition switch is on, and an ECU that is constantly powered regardless of whether the ignition switch is on or off. These ECUs are interconnected by one or a plurality of networks, for example, a CAN (Controller Area Network) bus, a LIN (Local Interconnect Network) bus, or the like.

  ECUs that are powered only when the ignition switch is on include ECUs that control the engine, ECUs that control the brakes, etc., and ECUs that are constantly powered regardless of whether the ignition switch is on or off. There are gateway ECUs that perform different protocol conversions in each network, a door lock control ECU, an ECU that manages security such as theft prevention, and the like.

  When the ignition switch is off, the ECU, which is constantly powered regardless of whether the ignition switch is on or off, shifts the microcomputer to a standby state, and when the ignition switch is turned on or through the CAN bus In order to save power, it is effective to wake up and operate the microcomputer only when an interrupt occurs, such as when an interrupt is received.

  There are several types of standby states to which the microcomputer shifts, for example, a mode in which the operation clock of the CPU is stopped. When shifting to such a mode, the microcomputer cannot output a pulse signal. Then, the abnormality monitoring device may erroneously determine that an abnormality has occurred in the microcomputer because the pulse signal from the microcomputer in the standby state is interrupted for a predetermined period.

  In order to prevent such a misjudgment, when the microcomputer shifts to the standby state, it outputs a signal (monitoring prohibition signal) for prohibiting the microcomputer from monitoring the abnormality to the abnormality monitoring device, and then enters the standby state. The migration process was executed. Here, the transition processing to the standby state is, for example, execution of an instruction to stop the oscillation circuit provided in the microcomputer.

  Further, when the microcomputer returns from the standby state, after executing the return processing from the standby state, the microcomputer outputs a signal (monitoring permission signal) for allowing the abnormality monitoring of the microcomputer to the abnormality monitoring device. . Here, the return processing from the standby state is, for example, processing for prohibiting interruption after return or processing for providing a delay period until the clock oscillates normally.

  Patent Document 1 discloses a watchdog timer type abnormality monitoring device that detects a microcomputer abnormality when a pulse output from the microcomputer does not satisfy a predetermined time condition. The abnormality monitoring apparatus includes a WDT monitoring unit that controls the operation / stop of the monitoring operation, and an abnormality monitoring instruction that instructs the operation / stop of the monitoring operation of the microcomputer by using a standby signal for shifting the microcomputer to the standby state. A signal is input to the WDT monitoring unit, and the WDT monitoring unit controls its operation / stop by this abnormality monitoring instruction signal.

JP 2004-326629 A

  However, the microcomputer executes the control program stored in the memory, that is, the output of the monitoring prohibition signal and the transition to the standby state, and the recovery of the standby state and the output processing of the monitoring permission signal. I went with software. Accordingly, as shown in FIG. 1A, time lags t1 and t2 of a predetermined period occur from the output of the monitoring prohibition signal to the transition to the standby state and from the return from the standby state to the output of the monitoring permission signal. There was a risk of it.

  When an abnormality occurs in the microcomputer during the predetermined periods t1 and t2, the abnormality monitoring apparatus is prohibited from monitoring the abnormality during the predetermined periods t1 and t2. Therefore, it may be determined that an abnormality has occurred in the microcomputer. could not. That is, in the conventional abnormality monitoring device, there is a period during which the abnormality of the microcomputer cannot be monitored.

  In the abnormality monitoring apparatus described in Patent Document 1, the abnormality monitoring instruction signal is input to the WDT monitoring unit without going through the microcomputer, but the abnormality monitoring instruction signal instructing the stop of the monitoring operation is the WDT monitoring unit. Since the CPU does not stop at the same time as the input to, there is no change in the period during which the microcomputer cannot be monitored even though the CPU is operating.

  In addition, Patent Document 1 discloses an abnormality monitoring device that can monitor abnormal operation of a microcomputer even in a standby state. However, in such an abnormality monitoring device, there is an extremely high possibility that the microcomputer operates abnormally. Even in a small standby state, although abnormality monitoring is executed even though power consumption is taken into consideration, power saving cannot be achieved compared to prohibiting abnormality monitoring.

  In view of the above-described conventional problems, an object of the present invention is to provide an electronic control device and an abnormality monitoring method capable of reliably monitoring an abnormality of a microcomputer while the CPU of the microcomputer is operating. It is in.

  In order to achieve the above-described object, the characteristic configuration of the electronic control device according to the present invention is such that abnormality monitoring is permitted by a microcomputer and a monitoring control signal that permits or prohibits abnormality monitoring output from the microcomputer. And an abnormality monitoring circuit that detects an abnormality of the microcomputer based on a pulse signal output from the microcomputer, wherein the microcomputer performs output control of the pulse signal. A CPU that controls output of a control signal for shifting itself to a stop state and a monitoring control circuit that switches the output state of the monitoring control signal in accordance with the output state of the control signal are provided.

  According to the above-described configuration, the monitoring control circuit sets the monitoring control signal output state to the state in which abnormality monitoring is prohibited when the output state of the control signal indicates a stop of the CPU. Since the operation and stop and the output state of the monitoring control signal can be switched at the same time, as shown in FIG. 1B, until the output of the monitoring inhibition signal and the transition to the standby state, and the return from the standby state There is no time lag before the monitoring permission signal is output.

  As described above, according to the present invention, it is possible to provide an electronic control device that can reliably monitor abnormality of a microcomputer while the CPU of the microcomputer is operating.

(A) is a timing chart showing the operation state of the conventional microcomputer and the output of the monitoring prohibition / permission signal and the monitoring state of the abnormality monitoring device, and (b) is the operation state of the microcomputer and the monitoring prohibition / permission signal of the present invention. Timing chart showing monitoring status of output and abnormality monitoring device Block configuration diagram of a plurality of electronic control devices provided in a vehicle Block diagram of electronic control unit Block diagram of microcomputer and abnormality monitoring circuit Timing chart for explaining operation of abnormality monitoring circuit Microcomputer circuit diagram Block diagram of clock generation circuit (A) is a circuit diagram of a delay circuit, (b) is a circuit diagram of an RS flip-flop, and (c) is a truth table of the RS flip-flop. General-purpose I / O port circuit diagram Circuit diagram of general-purpose I / O port with input circuit Flowchart for explaining the processing of the microcomputer Flow chart for explaining processing of abnormality monitoring circuit Timing chart for explaining the processing of the electronic control unit

  Hereinafter, an embodiment in which an electronic control device (hereinafter referred to as ECU) and an abnormality monitoring method according to the present invention are applied to a vehicle will be described.

  As shown in FIG. 2, the ECU is composed of a group that is fed from the battery when the ignition switch is turned on and a group that is fed from the battery even when the ignition switch is turned off. The former includes an engine ECU, a mission ECU, and a brake ECU connected by a high-speed CAN bus, and the latter includes a security management ECU connected by a low-speed CAN bus or a LIN bus, and a door lock control. An ECU and a gateway ECU that relays data by connecting high-speed and low-speed buses to each other are included.

  The ECU according to the present invention is embodied in the latter ECU, and includes a microcomputer 11, an interface circuit 12, an abnormality monitoring circuit 13, and the like as shown in FIG.

  The interface circuit 12 is a communication circuit that transmits and receives data to and from other ECUs via a network such as a CAN bus or a LIN bus, and inputs data from various sensors and converts the data into signals that can be input by the microcomputer 11. And an output circuit that receives the control signal output from the microcomputer 11 and converts it into a signal for driving a controlled object (for example, a door lock switch) and outputs the signal to the starter relay. Etc.

  As shown in FIG. 4, the microcomputer 11 includes a CPU 111, a memory 112 such as a RAM and a ROM, an interrupt controller 113, and the like, and the CPU 111 executes a control program stored in the ROM. A steady process as the ECU 10 is performed.

  The steady process includes, for example, security management when the ECU 10 is an ECU for security management, door lock control when the ECU 10 is a door lock ECU, and protocol conversion process when the ECU 10 is a gateway ECU.

  The interrupt controller 113 will be described in detail. The microcomputer 11 is provided with an interrupt register composed of one or a plurality of bits, a priority setting register, and the like for each interrupt factor.

  In the interrupt register, when an interrupt factor such as an external interrupt that is activated when the ignition switch is turned on or a timer interrupt that is activated at a predetermined time interval occurs, an interrupt that activates the corresponding task A request flag is set. In the priority setting register, a priority is set so that a task to be preferentially processed is activated when an interrupt request flag is simultaneously set in a plurality of interrupt registers.

  Then, the interrupt controller 113 sets or resets flags in these registers based on various signals (for example, a signal that the ignition switch is turned on) input to the microcomputer 11, and sets the flag state of each register. The interrupt processing for the microcomputer 11 is controlled by outputting the interrupt signal based on the CPU 111 or the like.

  The microcomputer 11 has a plurality of operation modes. For example, the microcomputer 11 has a mode for operating with a high-speed clock during normal operation (hereinafter referred to as an operation mode) and a function for executing a startup process for an interrupt factor such as a wake-up signal input by completely stopping the clock. A mode (hereinafter referred to as a stop mode) for stopping all the functions other than.

  Further, when the current mode is the operation mode, the microcomputer 11 outputs a pulse signal having a predetermined cycle to the abnormality monitoring circuit 13 described below. Further, the microcomputer 11 outputs a monitoring control signal for permitting or prohibiting the abnormality monitoring of the microcomputer 11 by the abnormality monitoring circuit 13 to the abnormality monitoring circuit 13 via the monitoring control circuit 114 described later.

  The abnormality monitoring circuit 13 detects an abnormality of the microcomputer 11 based on the pulse signal output from the microcomputer 11 when the abnormality monitoring is permitted by the monitoring control signal that permits or prohibits the abnormality monitoring.

  As shown in FIGS. 4 and 5, the abnormality monitoring circuit 13 is counted up at the rising edge (or falling edge) of the clock signal output from the clock circuit 132 and the rising edge of the pulse signal output from the CPU 111 ( Or a falling edge), and a counter circuit 131 that restarts the count after the reset, a clock circuit 132 that outputs a clock signal to the counter circuit 131, a reset signal output circuit 133, and the like.

  The reset signal output circuit 133 does not input the pulse signal to the counter circuit at an appropriate cycle (predetermined cycle), so that the count value exceeds the predetermined threshold Cth, that is, from the latest rising edge (or falling edge) of the pulse signal. If there is no input of the rising edge (or falling edge) of the pulse signal even after the predetermined period, a reset signal is output to the microcomputer 11.

  That is, the abnormality monitoring circuit 13 is a circuit that determines that an abnormality has occurred in the microcomputer 11 and resets the microcomputer 11 when no pulse signal is input for a predetermined period.

  Further, the abnormality monitoring circuit 13 operates when a monitoring control signal for permitting abnormality monitoring is input (a count-up process by the counter circuit 131, a clock signal output process by the clock circuit 132, and a reset by the reset signal output circuit 133). When the monitoring control signal indicating that the abnormal start is prohibited is input, the operation is stopped (count-up stop and count value reset by the counter circuit 131, clock signal output stop by the clock circuit 132, and The reset signal output circuit 133 stops reset signal output).

  Returning to the description of the microcomputer 11. As shown in FIG. 4, the microcomputer 11 includes a monitoring control circuit 114 that switches the output state of the monitoring control signal in accordance with the output state of the control signal that stops the operation of the CPU 111.

  For example, the control signal is a signal that is switched when a stop command is executed by the CPU 111, and the monitoring control circuit 114 switches the monitoring control signal so as to prohibit the abnormality monitoring in accordance with the switching of the signal. The control signal is a signal that switches based on a wake-up signal that switches the CPU 111 from the stop mode to the operation mode, and the monitoring control circuit 114 switches the monitoring control signal so as to permit abnormality monitoring according to the switching of the signal.

  The stop command stops an oscillation circuit (for example, a high-speed system clock oscillation circuit, a high-speed internal oscillation circuit, a low-speed internal oscillation circuit, a subsystem clock oscillation circuit, etc.) provided in the microcomputer 11 and stops the microcomputer 11 Instruction to be executed by the CPU 111. Then, a stop signal that is a signal indicating execution of the stop instruction is output from the CPU 111 to the monitoring control circuit 114. The CPU 111 shifts from the operation mode to the stop mode by executing a stop command.

  The signal that is switched when the stop command is executed is, for example, a signal that switches to a low level regardless of the signal level up to that point when the stop signal is input to the monitoring control circuit 114.

  The wake-up signal is an interrupt signal that is input to the CPU 111 or the like when the ignition switch is turned on or a reset signal is input from the abnormality monitoring circuit 13, and the CPU 111 stops when the interrupt signal is received. Transition from mode to operation mode. The wakeup signal is also input to the monitor control circuit 114.

  The signal that is switched based on the wakeup signal is, for example, a signal that switches to a high level regardless of the previous signal level when the wakeup signal is input to the monitoring control circuit 114.

  Hereinafter, the monitoring control circuit 114 will be described in detail with reference to FIG. In the microcomputer 11 shown in FIG. 6, it is assumed that the stop signal and the wakeup signal are high active signals. That is, the stop signal outputs a high level pulse when a stop command is executed, but maintains a low level in other cases. The wake-up signal is output from the OR circuit 119 when an active level (high level) interrupt signal is input from the interrupt controller 113 or when an active level (high level) reset signal is input from the abnormality monitoring circuit 13. A high level pulse is output, but the low level is maintained when no interrupt signal or reset signal is input.

  In FIG. 6, the microcomputer 11 includes a clock generation circuit 115 that generates and outputs a CPU clock. Here, the CPU clock is an operation clock of the CPU. For example, as shown in FIG. 6, the clock generation circuit 115 includes two inverters and a NAND circuit. The clock generation circuit 115 receives an input signal from an oscillator connected to the XIN terminal as an output signal of the monitoring control circuit 114. Is a circuit that outputs to the CPU 111 and outputs to the outside of the microcomputer 11 from the XOUT terminal.

  Note that the clock generation circuit 115 is not limited to the configuration illustrated in FIG. 6, and may have a configuration illustrated in FIG. 7, for example. In the clock generation circuit 115 shown in FIG. 7, a clock having a predetermined frequency output from the high-speed system clock oscillation circuit 1152 connected to the oscillator 1151 is divided by the prescaler 1153 and input to the selector 1154, and is configured by a single bit or a plurality of bits. In this circuit, a clock having a frequency based on the set value of the clock control register 1155 is output from the selector 1154 as a CPU clock. The clock generation circuit 115 illustrated in FIG. 7 stops when the stop signal is input to the high-speed system clock oscillation circuit 1152 and the high-speed system clock oscillation circuit 1152 stops.

  In FIG. 6, the monitoring control circuit 114 includes a clock control circuit 114 that controls the clock generation circuit 115. A circuit of the RS flip-flop 114 used in FIG. 6 is shown in FIG. 8B, and a truth table of the circuit of FIG. 8B is shown in FIG. In FIG. 6, the clock control circuit 114 is configured by an RS flip-flop. However, the clock control circuit 114 is not limited to the RS flip-flop as long as it has a function described below.

  When an active level (high level) stop signal is input from the CPU 111, that is, when a high level signal is input to the set terminal S of the RS flip-flop, the clock control circuit 114 outputs a high level to the clock generation circuit 115. When a clock control signal is output and an active level (high level) wakeup signal is input from the interrupt controller 113 or the abnormality monitoring circuit 13, that is, when a high level signal is input to the reset terminal R of the RS flip-flop. The low level clock control signal is output to the clock generation circuit 115.

  When a low level clock control signal is input from the clock control circuit 114, the clock generation circuit 115 outputs a signal obtained by inverting the logic of the signal input from the XIN terminal from the NAND circuit 1151 as a CPU clock. When a high-level clock control signal is input from the control circuit 114, a high-level signal is output from the NAND circuit 1151 regardless of the level of the signal input from the XIN terminal. That is, when a high level signal is input, the CPU clock is not output.

  As described above, the clock control circuit 114 stops the CPU clock based on the stop signal generated when the CPU 111 executes the stop command, and outputs the CPU clock based on the wakeup signal for switching the CPU 111 from the stop mode to the operation mode. To control.

  The control signal when the microcomputer 11 has the configuration shown in FIG. 6 is a clock control signal. That is, the microcomputer 11 of the ECU 10 according to the present invention connects the output of the clock control circuit 114 to the input / output port 116 as shown in FIG. In addition to being output to the generation circuit 115, it is also configured to output to the abnormality monitoring circuit 13 as a monitoring control signal via the input / output port 116. From the above description, in the case of FIG. 6, the monitoring control signal is high level prohibition of abnormality monitoring and low level permission of abnormality monitoring.

  According to the above-described configuration, the control signal is switched when a stop command for stopping the CPU clock is executed by the CPU 111, and is switched from a wake-up signal for outputting the CPU clock, that is, output from the clock control circuit. Clock control signal.

  Therefore, the output timing of the monitoring control signal to the abnormality monitoring circuit 13 whose output state can be switched in accordance with the output state of the control signal can be made simultaneously with the stop timing and output timing of the CPU clock, and the output of the monitoring prohibition signal There is no time lag until the transition to the standby state and until the return from the standby state and the output of the monitoring permission signal.

  That is, the ECU 10 according to the present invention is based on the pulse signal output from the microcomputer when the abnormality monitoring is permitted by the microcomputer and the monitoring control signal that permits or prohibits the abnormality monitoring output from the microcomputer. An abnormality monitoring circuit for detecting an abnormality of the microcomputer, and the microcomputer controls the output of the pulse signal and controls the output of the control signal for shifting itself to the stop state; and the control signal And a monitoring control circuit that switches the output state of the monitoring control signal in accordance with the output state.

  Further, as shown in FIG. 6, it is necessary that the control signal output as the monitoring control signal and the control signal output to the clock generation circuit 115 are the same by making the clock control signal which is a common signal. It is possible to prevent a mismatch between the two control signals.

  A delay circuit that delays the monitoring control signal when the monitoring control signal switches from the prohibited state to the permitted state may be provided in the signal line of the monitoring control signal.

  For example, as indicated by a broken line in FIGS. 4 and 6, a delay circuit 118 that delays and outputs an input signal for a predetermined time only when the monitoring control signal is switched from the prohibited state to the permitted state is provided at the subsequent stage of the monitoring control circuit 114. The microcomputer 11 delays the control signal output from the monitoring control circuit 114 for a predetermined time and outputs it to the abnormality monitoring circuit 13 as a monitoring control signal.

  An example of the delay circuit 118 is shown in FIG. 8A, the circuit of the RS flip-flops 114 and 1181 used in FIG. 8A is shown in FIG. 8B, and the truth value of the circuit in FIG. The table is shown in FIG.

  In FIG. 8, the delay circuit 118 includes an inverter 1182 connected in series with the output Q of the clock control circuit 114, a resistor R1 connected in series with the inverter 1182, and a capacitor C1 connected one to the resistor R1 and the other grounded. And the transistor Q1 whose collector is connected to the resistor R1 and whose emitter is grounded, and similarly to the clock control circuit 114, the stop signal and the wakeup signal are input to the set S and reset R, respectively, and the output Q is applied to the base of the transistor Q1. And an RS flip-flop 1181 connected thereto.

  When an active level (high level) stop signal is input to the clock control circuit 114 and the set S of the RS flip-flop 1181, the output Q (high level) of the clock control circuit 114 is logically inverted by the inverter 1182 to become a low level. It becomes. The transistor Q1 is turned on when the output (high level) of the RS flip-flop 1181 is input to the base of the transistor Q1. As a result, when a stop signal is input to the clock control circuit 114, the control signal (low level) output from the clock control circuit 114 and logically inverted by the inverter 1182 is output even if charge is accumulated in the capacitor C1. The monitoring control signal is output to the subsequent stage (input / output port 116) without delay. That is, the delay circuit 118 does not delay the monitoring control signal when the monitoring control signal switches from the permitted state to the prohibited state.

  On the other hand, when an active level (high level) wakeup signal is input to the reset R of the clock control circuit 114 and the RS flip-flop 1181, the output Q (low level) of the clock control circuit 114 is logically inverted by an inverter. Become high level. Further, the transistor Q1 is turned off when the output (low level) of the RS flip-flop 1181 is input to the base of the transistor Q1. As a result, when a wake-up signal is input to the clock control circuit 114, the control signal (high level) output from the clock control circuit 114 and logically inverted by the inverter 1182 until the electric charge is accumulated in the capacitor C1. Is output as a monitoring control signal to the subsequent stage (input / output port 116). That is, the delay circuit 118 delays the monitoring control signal when the monitoring control signal switches from the prohibited state to the permitted state.

  When the delay circuit 118 shown in FIG. 8 (a) is used, the monitoring control signal is in a permitted state at a high level and in a prohibited state at a low level, but when the logic is reversed, for example, a delay circuit is used. An inverter may be provided at the subsequent stage of 118.

  The microcomputer 11 may take a predetermined time from the switching of the monitoring control signal so as to permit the abnormality monitoring when the wake-up signal is input until the pulse signal is output to the abnormality monitoring circuit 13. The reason is as follows, for example. In other words, the microcomputer 11 may be set to decrease the frequency of the CPU clock immediately after the wake-up until the operation of the CPU 111 is stabilized, so that an instruction for outputting a pulse signal is executed. There is a delay before it is done.

  As a result, the abnormality monitoring circuit 13 is not input with a pulse signal for a predetermined time after the abnormality monitoring is permitted by the monitoring control signal, and the count value of the counter circuit 131 exceeds the predetermined threshold Cth. May erroneously determine that the microcomputer 11 is abnormal.

  However, according to the above-described configuration, by providing the delay circuit 118 that delays the switching timing of the monitoring control signal, it is possible to prevent the erroneous monitoring circuit 13 from making the erroneous determination as described above.

  In the above description, the case where the port to which the monitoring control signal is output is a port dedicated to the output of the monitoring control signal provided in the input / output port 116, but as shown in FIG. The output port is composed of a general-purpose input / output port 117 having a mode setting register 1172 for setting the port mode. When the microcomputer 11 is reset, the high-impedance state is set until the port mode is set by the mode setting register 1172. It may be set to be.

  This will be described in detail below. The general-purpose input / output port 117 is connected to, for example, the internal bus 119 of the microcomputer 11, an output latch 1171 that holds output data, designation of a port mode (input mode and output mode), and types of data to be input / output Mode setting register 1172 composed of one or a plurality of bits for designating the data, the data output from output latch 1171 based on the contents held in mode setting register 1172, and the control signal output from monitor control circuit 114 A selector 1173 that selects and outputs one of them and a three-state buffer 1174 that can switch whether the input is output as it is or a high impedance state based on the contents held in the mode setting register 1172 are provided.

  In the general-purpose input / output port 117, when the output mode is set by the mode setting register 1172, the three-state buffer 1174 is switched to output the input as it is. As a result, data (data output from the output latch 1171 or control signal output from the monitoring control circuit 114) is output from the terminal 1175 along a path indicated by a one-dot chain line arrow in FIG.

  On the other hand, when the input mode is set by the mode setting register 1172, the three-state buffer 1174 is switched to high impedance. As a result, data (data input from the outside via the terminal 1175) is output to the internal bus 119 through a path indicated by a two-dot chain line arrow in FIG.

  Further, the mode setting register 1172 is set so that the three-state buffer 1174 is set to high impedance at the moment when the setting of the mode setting register 1172 becomes possible when the microcomputer 11 is reset.

  According to the configuration described above, it is not necessary to provide an extra port dedicated to output of the monitoring control signal, so that the number of ports can be saved.

  If the port is set to be high impedance on the microcomputer 11 side, the initial value of the monitoring control signal can be set on the abnormality monitoring circuit 13 side. In other words, if the initial value is to be set to high level, a pull-up resistor is provided at the port to which the monitoring control signal of the abnormality monitoring circuit 13 is input. If the initial value is to be set to low level, a pull-down resistor is provided to the port. That's fine.

Further, when the microcomputer 11 is reset, the port is set to become high impedance at the moment when the mode setting register 1172 can be set, so that the port mode is set in the mode setting register 1172. ,
An inappropriate level signal can be prevented from being output from the general-purpose input / output port 117 to the abnormality monitoring circuit 13. As a result, the possibility of malfunction of the abnormality monitoring circuit 13 can be reduced.

  The ECU 10 may include a protect register 1176 that prohibits the change of the value of the mode setting register, as indicated by a broken line in FIG.

  For example, when the value of the mode setting register is changed, the CPU 111 first sets the value of the protect register 1176 to a predetermined value (for example, high level) and cancels the prohibition of changing the value of the mode setting register. Set the value of the setting register. Then, after setting the value of the mode setting register, the CPU 111 sets the value of the protect register to a predetermined value (for example, low level) different from the above to prohibit the change of the value of the mode setting register.

  According to the above configuration, it is possible to reduce the risk that the mode setting register is rewritten to an inappropriate value due to software runaway or the like.

  ECU10 may provide the input circuit which inputs the signal level of the port from which the monitoring control signal is output in the port.

  For example, as shown in FIG. 10, on the basis of the value held in the mode setting register 1172, either the data output from the selector 1173 or the data input from the outside via the terminal 1175 is selected and the internal An input circuit 1177 including a selector 1178 for outputting to the bus 119 is provided.

  The selector 1173 selects the control signal output from the monitoring control circuit 114, and the selector 1178 sets the mode setting register 1172 so as to select the data output from the selector 1173, whereby the monitoring control signal is output. Enter the port signal level.

  According to the above-described configuration, the contents of the monitoring control signal intended to be output by the microcomputer 11 and the contents of the monitoring control signal actually output are different due to abnormality of the monitoring control circuit 114 and the input / output port 116. Even in some cases, it is possible to detect the fact early and take appropriate action.

  For example, the microcomputer 11 determines that the microcomputer 11 has an abnormality and immediately stops all operations and enters the stop mode, or outputs a diagnosis code or the like to notify the user of the abnormality of the microcomputer 11. Can be taken. As a method for notifying the user, for example, a warning message is displayed on a display unit such as a liquid crystal panel of a navigation device mounted on a vehicle, and a voice message is output from a speaker.

  Hereinafter, the processing of the ECU 10 according to the present invention will be described based on the flowcharts shown in FIGS. 11 and 12 and the timing chart shown in FIG.

  The reset microcomputer 11 of the ECU 10 executes the initial setting when the CPU 111 is stabilized (SA1). The initial setting is, for example, set to a predetermined port mode (for example, an operation mode) by holding a predetermined value in a mode setting register in addition to a RAM check process and a clear process, an initial data input process to an input port, and the like. Timer register composed of one or more bits for port setting (SA2), pulse signal output permission (SA2), timing setting for starting timer interrupt processing, in other words, interrupt timer value for pulse signal cycle setting Timer value setting (SA3), interrupt permission (SA4), and the like.

  When the initial setting is completed, the ECU 10 executes a steady process by the microcomputer 11 or the like (SA5). Here, the steady process is, for example, security management when the ECU 10 is a security management ECU, door lock control when the ECU 10 is a door lock ECU, and protocol conversion process when the ECU 10 is a gateway ECU. . These steady processes are executed when the CPU 111 is in the operation mode even when the ignition switch is off.

  If the ignition switch is turned off by the vehicle driver or the like during the steady process (SA6), the microcomputer 11 executes a shutdown process (SA7). The shutdown process is, for example, saving data stored in the RAM to a nonvolatile memory such as an EEPROM.

  When the shutdown process is completed, the CPU 111 executes a stop command (SA8). When the stop instruction is executed by the CPU 111, the output state of the control signal is switched from permission to prohibition of abnormality monitoring, and the control signal whose state has been switched is output to the abnormality monitoring circuit 13 by the microcomputer 11 as a monitoring control signal. That is, the transition of the microcomputer 11 to the stop mode and the transition of the abnormality monitoring circuit 13 from the abnormality monitoring execution state to the stop state are performed substantially simultaneously.

  In the microcomputer 11, when an interrupt to which a wake-up signal is input occurs in the stop mode (SB1), the output state of the control signal is switched from prohibition of abnormality monitoring to permission, and the control signal whose state has been switched is used as a monitoring control signal. The information is output to the abnormality monitoring circuit 13 by the microcomputer 11. That is, the transition to the operation mode of the microcomputer 11 and the transition from the abnormality monitoring stop state to the execution state of the abnormality monitoring circuit 13 are performed substantially simultaneously.

  Further, when a timer interrupt occurs, the microcomputer 11 inverts the logic of the output pulse signal. That is, when the output pulse signal is on (eg, high level) (SD1), it is switched off (eg, low level) (SD2). When the output pulse signal is off (SD1), it is on. (SD3).

  The abnormality monitoring circuit 13 does not operate when a monitoring control signal for prohibiting abnormality monitoring is output from the microcomputer 11 to the abnormality monitoring circuit 13 by executing a stop command by the CPU 111 (SA8) (SC1).

  On the other hand, the abnormality monitoring circuit 13 outputs a monitoring control signal for permitting abnormality monitoring from the microcomputer 11 to the abnormality monitoring circuit 13 by an interrupt (SB1) to which a wakeup signal is input (SC1). The pulse signal output from the microcomputer 11 to the abnormality monitoring circuit 13 is referred to.

  When the rising edge of the pulse signal is not input (SC2), the abnormality monitoring circuit 13 counts up the count circuit 131 (SC3). When the rising edge of the pulse signal is input (SC2), the abnormality monitoring circuit 13 Reset (SC4).

  The reset signal output circuit 133 of the abnormality monitoring circuit 13 causes the count value of the counter circuit 131 after the processing of step SC3 or SC4 to be a predetermined threshold value Cth when no pulse signal is input from the microcomputer 11 due to an abnormality of the microcomputer 11 or the like. Is exceeded (SC5), it is determined that an abnormality has occurred in the microcomputer 11, and a reset signal for restarting the microcomputer 11 is output to the microcomputer 11 (SC6).

  The microcomputer 11 that has received the reset signal is reset and executes the processing after the initial setting described in step SA1.

  As described above, the abnormality monitoring method according to the present invention is based on the pulse signal output from the microcomputer when the abnormality monitoring is permitted by the monitoring control signal that permits or prohibits the abnormality monitoring output from the microcomputer. An abnormality monitoring method for detecting an abnormality of the microcomputer by switching the output state of the monitoring control signal in conjunction with the output state of the control signal for stopping the operation of the CPU of the microcomputer, that is, from the CPU of the microcomputer This is a method of switching the output state of the monitoring control signal in conjunction with the output state of the control signal that is output and shifts itself to the stop state.

  Hereinafter, another embodiment will be described. In the above-described embodiment, the case where the control signal is a signal that is switched when a stop command is executed by the CPU 111 has been described. However, the control signal is a signal that is switched when a low power consumption drive command is executed by the CPU 111, The monitoring control circuit 114 may switch the monitoring control signal so as to prohibit the abnormality monitoring in accordance with the switching of the signal.

  The low power consumption driving command is, for example, a mode in which the CPU 111 is not in the stop mode or the operation mode when a plurality of oscillation circuits are mounted on the microcomputer 11, that is, a part of the oscillation circuits (operation clock of the CPU 111). Is an instruction to stop the oscillation but shift to a mode (low power consumption drive mode) in which the oscillation circuits other than the part of the oscillation circuits continue to oscillate to reduce power consumption.

  In the low power consumption drive mode, the power consumption cannot be reduced as much as the stop mode in which the entire system is stopped. However, for example, although the oscillation of the high-speed internal oscillation circuit for generating the CPU clock during normal operation is stopped, the clock for driving the CPU 111 at a predetermined interval to operate with the low-speed clock (CPU clock during intermittent operation) If the oscillation of the low-speed internal oscillation circuit for generating is continued, the process at the time of intermittent operation can be restarted quickly.

  The interval of the intermittent operation is, for example, one or a plurality of interrupt timer values provided for timing setting for starting timer interrupt processing different from the above-described timer interrupt processing. It is determined by setting the timer register consisting of bits. Specifically, the interval of the intermittent operation is set to 1 hour, for example.

  The control signal is a signal that is switched when a stop command is executed by the CPU 111, a signal that is switched when a low power consumption driving command is executed by the CPU 111, or a stop command or a low power consumption driving command by the CPU 111 The selection as to which signal is to be switched when one of the above is executed is composed of a single bit or a plurality of bits provided for performing the selection at the time of initial setting of the microcomputer (for example, step SA1 in FIG. 11). It is executed by setting a value corresponding to each selection in the register.

  In such a low power consumption drive mode, the operation clock of the CPU 111 is stopped, the CPU 111 is not operating, and it is rare that an abnormality occurs in the CPU 111. Prohibiting monitoring is preferable from the viewpoint of power saving.

  Therefore, according to the above configuration, the power consumption of the microcomputer 11 can be reduced.

  Further, according to the above-described configuration, the control signal is a signal that is switched when the low power consumption drive command is executed by the CPU 111. Therefore, the output timing of the monitoring control signal that can be switched in accordance with the output state of the control signal to the abnormality monitoring circuit 13 can be set at the same time as the transition timing to the low power consumption driving mode. Therefore, according to the above-described configuration, there is no time lag between the output of the monitoring inhibition signal and the transition to the standby state.

  In the above-described embodiment, the case where the ECU 10 and the abnormality monitoring method according to the present invention are applied to a vehicle has been described. However, the abnormality monitoring circuit is provided, and it is necessary to switch permission / prohibition of microcomputer abnormality monitoring by the abnormality monitoring circuit. The device may be applied to a device other than a vehicle, such as a ship or an aircraft, as long as it is a device equipped with a certain device or a device using an abnormality monitoring method that requires switching between permission and prohibition of abnormality monitoring of a microcomputer.

  Further, the output signal of the monitoring control circuit provided in the microcomputer described above is not only output to the abnormality monitoring circuit provided outside, but also the operation of other external circuits is synchronized when the operation of the CPU is stopped. It can also be used to stop.

  The above-described embodiment is merely an example of the present invention, and the specific configuration of each block and the like can be changed and designed as appropriate within the scope of the effects of the present invention (for example, the active level of the logic level is changed from the high level to the low level) It goes without saying that the design can be changed when changing to

10: Electronic control unit 11: Microcomputer 13: Abnormality monitoring circuit 111: CPU
114: monitoring control circuit 117: general-purpose input / output port 118: delay circuit 1172: mode setting register 1176: protect register 1177: input circuit

Claims (10)

When abnormality monitoring is permitted by a microcomputer and a monitoring control signal that permits or prohibits abnormality monitoring output from the microcomputer, abnormality of the microcomputer is detected based on a pulse signal output from the microcomputer. An electronic control device comprising an abnormality monitoring circuit to detect,
The microcomputer controls the output of the pulse signal and controls the output of a control signal for shifting itself to a stop state; and the output state of the monitoring control signal according to the output state of the control signal An electronic control device comprising: a monitoring control circuit for switching between.   The control signal is a signal that is switched when a stop command is executed by the CPU, and the monitoring control circuit switches the monitoring control signal so as to prohibit abnormality monitoring according to switching of the signal. The electronic control device according to claim 1.   The control signal is a signal that switches based on a wake-up signal that switches the CPU from a stop mode to an operation mode, and the monitoring control circuit switches the monitoring control signal so as to permit abnormality monitoring according to the switching of the signal The electronic control device according to claim 1, wherein the electronic control device is an electronic control device.   The control signal stops the CPU clock based on a stop signal generated when the CPU executes a stop command, and outputs the CPU clock based on a wake-up signal that switches the CPU from the stop mode to the operation mode. 4. The electronic control unit according to claim 2, wherein the electronic control unit is a clock control signal output from a clock control circuit that controls the electronic control unit.   The control signal is a signal that is switched when a low power consumption drive command is executed by the CPU, and the monitoring control circuit switches the monitoring control signal so as to prohibit abnormality monitoring according to the switching of the signal. The electronic control apparatus according to claim 1, wherein the electronic control apparatus is characterized in that:   The port to which the monitoring control signal is output is composed of a general-purpose input / output port having a mode setting register for setting a port mode, and until the port mode is set by the mode setting register at the time of resetting the microcomputer, 7. The electronic control device according to claim 1, wherein the electronic control device is set to have high impedance.   The electronic control device according to claim 6, further comprising a protect register that prohibits a change in the value of the mode setting register.   8. The electronic control device according to claim 6, wherein an input circuit for inputting a signal level of a port to which the monitoring control signal is output is provided in the port.   The delay circuit for delaying the monitoring control signal when the monitoring control signal is switched from the prohibition state to the permission state is provided on a signal line of the monitoring control signal. The electronic control apparatus as described in. An abnormality monitoring method for detecting an abnormality of the microcomputer based on a pulse signal output from the microcomputer when the abnormality monitoring is permitted by a monitoring control signal permitting or prohibiting abnormality monitoring output from the microcomputer Because
An abnormality monitoring method for switching an output state of the monitoring control signal in conjunction with an output state of a control signal output from the CPU of the microcomputer and for shifting itself to a stop state.

Images