JP2011123569A - Processor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a processor which more accurately detects an abnormal operation in a processing part, on the basis of a WD pulse from the processing part, to improve safety. <P>SOLUTION: Pulse signals, which a CPU 10 periodically outputs when it is in a normal state, are output from a plurality of terminals and then input in a monitoring circuit 14 which monitors the operation of the CPU 10 to detect abnormality. The monitoring circuit 14 operates as a restarting part which restarts the CPU 10 when abnormality is detected. The monitoring circuit 14 determines whether the pulse signals from the plurality of terminals of the CPU 10 are periodically output. When the pulse signals are periodically output from all of the terminals, the monitoring circuit 14 determines that the CPU 10 is normal, and, when the pulse signals are not output from any of the terminals, it determines that the CPU 10 is abnormal to input a resetting signal. When some of the pulse signals are output but any other pulse signals are not output, it detects that disconnection occurs and then makes output. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a processing apparatus using a CPU (Central Processing Unit), and more particularly, to a processing apparatus that can more accurately determine whether or not the operation of a CPU is abnormal based on a WD pulse from a CPU.

  2. Description of the Related Art Control devices that perform processing for controlling devices using a microcomputer (hereinafter referred to as a microcomputer) that can execute various operations by executing a program stored in a built-in storage unit are often used.

  Particularly in the field of vehicles, a control system in which a plurality of ECUs (Electronic Control Units) using microcomputers are connected is being used to shift to a configuration in which actuators are electrically controlled in cooperation with each other.

  In addition, power saving is encouraged in each field. As microcomputers used in the field of vehicles, those having a function of shifting to a sleep (pause, power saving) state are widely used.

  In the processing using the microcomputer, the microcomputer may not be able to maintain normal operation when an unexpected situation occurs or when an abnormal signal is input. In the field of vehicles, it must be possible to avoid abnormal operation as much as possible for safety. For this reason, a watchdog pulse (hereinafter referred to as a WD (Watch Dog) pulse) is periodically output from the microcomputer (CPU), and the watchdog pulse is input by a monitoring device that monitors the operation of the microcomputer. A method of resetting the microcomputer by determining that the operation of the microcomputer is abnormal when the periodicity of the watchdog pulse is broken has been proposed (Patent Document 1, etc.).

JP 2002-91802 A

  When detecting an abnormal operation of the microcomputer (CPU) using the WD pulse, there is usually one output terminal for the WD pulse. At this time, if a disconnection occurs in the wiring from the output terminal of the WD pulse to the monitoring device, the monitoring device cannot receive the WD pulse even though the operation of the microcomputer is normal. Is determined to be abnormal. Further, in this case, the monitoring device resets the microcomputer, but after that, because the WD pulse from the microcomputer cannot be received due to the disconnection, it continues to be reset and cannot be recovered.

  As described above, since the output terminal of the WD pulse is usually one, the monitoring device that inputs the WD pulse cannot distinguish between the abnormal operation of the microcomputer and the disconnection in the wiring from the output terminal. The operation is erroneously judged as abnormal.

  The present invention has been made in view of such circumstances, and provides a processing apparatus that can increase the safety by detecting a malfunction of a microcomputer (CPU) more accurately by using a plurality of output terminals of WD pulses. For the purpose.

  A processing apparatus according to a first aspect of the present invention includes a processing unit having a plurality of terminals for performing signal processing for controlling devices and inputting / outputting signals related to the signal processing, and a restarting unit for restarting the processing unit The processing unit is configured to periodically output the same pulse signal from any of the plurality of terminals, and the restarting unit outputs the same pulse signal. Each of the plurality of terminals has a plurality of input terminals, and includes a determination unit that determines whether or not each of the pulse signals input from the plurality of terminals is periodically received. When it is determined that none of the pulse signals to be received is received periodically, the processing unit is restarted.

  In the processing device according to the second invention, when the restarting unit determines that the determination unit does not periodically receive any one of the pulse signals respectively input from the plurality of terminals, the processing unit The disconnection of the connection line is detected.

  In the processing apparatus according to a third aspect of the invention, the processing unit and the restarting unit are configured to output or input the pulse signal from a plurality of terminals that are separated from each other among a plurality of terminals that the processing unit and the restarting unit each have. And

  In the processing device according to a fourth aspect of the present invention, each of the processing unit and the restarting unit includes a communication unit that transmits and receives information, and the restarting unit transmits a detection result to the processing unit by the communication unit. The processing unit further includes a storage unit that stores a detection result received by the communication unit from the restart unit.

  The processing apparatus according to a fifth aspect is characterized in that the processing unit further includes means for outputting the detection result received by the communication means to the outside.

  In the processing device according to a sixth aspect of the present invention, the processing unit further includes means for determining whether its own operation is in an operating state or transitioning to a dormant state, and the result of determination by the means is transmitted to the restarting unit by the communication unit And the restarting unit detects an abnormality in the operation of the processing unit based on the determination result and the determination by the determination unit.

  In the first invention, the same pulse signal periodically output from the processing unit is output from a plurality of terminals, and is input to a restart unit that restarts the processing unit when an operation abnormality occurs in the processing unit. The restarting unit determines whether or not all the pulse signals from the processing unit are periodically output. Since both are the same pulse signal, they cannot be received if there is an abnormality in the operation of the processing unit. It is possible to distinguish the occurrence of a problem, that is, the occurrence of a disconnection, and it is avoided that the operation of the processing unit is erroneously determined as abnormal.

  In the second invention, when any of the same pulse signals output from the plurality of terminals of the processing unit cannot be received periodically, it is detected that a disconnection has occurred in the connection line between the processing unit, The detection can be distinguished from the abnormal operation of the processing unit.

  In the third invention, the processing unit and the restarting unit have terminals used in addition to the input / output of the pulse signal, and the input / output of the pulse signal is performed by a plurality of spaced terminals. Even if a situation occurs in which a plurality of adjacent terminals are short-circuited with solder, it is possible to accurately determine an abnormal operation of the processing unit and avoid erroneous determination.

  In the fourth invention, the processing unit and the restarting unit have communication means for transmitting / receiving information to / from each other, and the restarting unit separates a detection result such as abnormality or disconnection from a terminal for inputting / outputting a pulse signal. It transmits to a process part by a communication means by a path | route, and the received detection result is memorize | stored in a process part. The stored detection results may be stored in time series so that they can be referred to from outside later, or the processing unit may output them to the outside. Moreover, you may utilize for the determination criterion of the operation | movement in a process part. For example, when the detection result that the disconnection has occurred is stored, a part of the operation of the processing unit may be limited.

  In the fifth invention, the processing unit outputs the received detection result to the outside. Thereby, it becomes possible to grasp the event in the processing apparatus from the outside. In particular, in the case of a processing device that controls equipment mounted on a vehicle, safety can be ensured by notifying the driver of the detection result.

  In the sixth aspect of the invention, the processing unit is configured to operate in either an active (active) state or a sleep (sleep) state, and the processing unit transitions to which state it is in. And the determination result is transmitted to the restarting unit. In the restarting unit, the operation of the processing unit is combined with the determination whether the pulse signal from the processing unit can be received periodically at any of the plurality of terminals and the determination result of the operating state of the processing unit. It is possible to perform processing with high accuracy without unnecessary restarting of the processing unit by detecting an abnormality and avoiding erroneously determining the operation of the processing unit as abnormal.

  According to the present invention, the restarting unit that restarts when the operation of the processing unit is abnormal receives the same pulse signal that is periodically output from the processing unit at each of the plurality of terminals, and the period from any of the terminals. The processing unit is restarted for the first time when it cannot be received automatically. If there is an abnormality in the operation of the processing unit, it should be impossible to receive any of them, so restart the processing unit when it can be reliably determined that it is abnormal, and it is abnormal even though the processing unit is normal. It is possible to improve safety by avoiding erroneous detection. On the other hand, if only one part of the pulse signal output from multiple terminals cannot be received, it is not an output source of the pulse signal, but is identified as an error during input / output, that is, a disconnection of the connection line. It is possible to improve safety by avoiding false detection.

It is a block diagram which shows the structure of ECU in this Embodiment. It is a functional block diagram which shows the function implement | achieved by the microcomputer and ASIC of ECU of this Embodiment. It is explanatory drawing which shows the example of the content of the judgment criterion memorize | stored in the status table of the monitoring circuit in this Embodiment. It is explanatory drawing which shows the content example of the information of the processing content memorize | stored in the status table of the monitoring circuit in this Embodiment. It is a flowchart which shows an example of the process sequence which the monitoring circuit of ECU in this Embodiment performs with the function of a monitoring part. It is a flowchart which shows an example of the process sequence which the microcomputer of ECU in this Embodiment performs.

  Hereinafter, the present invention will be specifically described with reference to the drawings showing embodiments thereof. In the embodiment described below, a case where the processing apparatus according to the present invention is applied to an ECU mounted on a vehicle will be described as an example.

  FIG. 1 is a configuration diagram showing the configuration of the ECU 1 in the present embodiment. The ECU 1 is a body ECU that controls the operation of, for example, lights and mirrors mounted on a vehicle, and transmits and receives data including numerical values of various physical quantities such as measured values by sensors, calculated values, control values, A control device that executes control processing based on the data.

  The ECU 1 includes a microcomputer 100 and an ASIC (Application Specific Integrated Circuit) 101.

  The microcomputer 100 of the ECU 1 stores a CPU (core) 10 that performs control processing of the entire ECU 1, a ROM 11 that stores a control program for realizing an operation as a body ECU, and information generated by the operation of the CPU 10. And a communication unit 13.

  The CPU 10 implements an operation as a body ECU by reading and executing a control program stored in the ROM 11. The CPU 10 includes a terminal for inputting a reset (RESET) signal. When the reset signal is input, the CPU 10 restarts itself.

  The CPU 10 has two terminals that output a control pulse for controlling a circuit in the ASIC 101 and two terminals that output a WD pulse. In the present embodiment, a control pulse for controlling processing in the ASIC 101 is output to the peripheral circuit 15 included in the ASIC 101.

  The ROM 11 uses an EEPROM (Electronically Erasable Programmable Read Only Memory), a flash memory, or the like. The ROM 11 stores the control program described above and information for control.

  The RAM 12 uses DRAM (Dynamic Random Access Memory), SRAM (Static Random Access Memory), or the like. A flash memory may be used. Information generated by the control of the CPU 10 or information received by the communication unit 13 by the CPU 10 may be stored in the RAM.

  The communication unit 13 realizes serial communication with the ASIC 101. The communication unit 13 transmits and receives information to and from the ASIC 101 in synchronization with a clock signal from a clock (not shown) provided in the ECU 1. Note that communication by the communication unit 13 is used not only for communication of state information as described later but also for transmission / reception of information for other processing.

  Note that the microcomputer 100 (CPU 10) can transition its operation state between a sleep state (or a power saving state) and an active state (normal operation state).

  The ASIC 101 monitors the operation of the microcomputer 100 (CPU 10), and performs a specified process and a monitoring circuit 14 having a function as a restarting unit that restarts the microcomputer 100 when an abnormality occurs in the operation of the microcomputer 100. A peripheral circuit 15 is provided.

  The peripheral circuit 15 of the ASIC 101 is a circuit designed to perform a process defined by hardware in order to realize the operation as the ECU 1. The peripheral circuit 15 is configured to perform processing based on a control pulse from the CPU 10. As an example of the processing content of the peripheral circuit 15, a signal output from the microcomputer 100 is processed after being subjected to predetermined processing to a device such as a sensor or a switch connected to the ECU 1, or is controlled by the microcomputer 100. There is a process of performing a process of inputting an input signal to be used and transmitting each information indicated by the signal to the microcomputer 100.

  The monitoring circuit 14 receives WD pulses (WD1 and WD2) from the CPU 10, respectively. The monitoring circuit 14 monitors these two WD pulses, respectively. Specifically, the monitoring circuit 14 detects the rising edge of the edge of the WD pulse from the CPU 10.

  The communication unit 16 corresponds to the communication unit 13 of the microcomputer 100 and transmits / receives information to / from the microcomputer 100. The communication unit 16 may realize not only communication with the microcomputer 100 but also communication with another ECU (not shown). Communication with other ECUs may be executed by a separately provided communication unit.

  Details of functions realized in the ECU 1 configured as described above will be described with reference to a functional block diagram. FIG. 2 is a functional block diagram showing functions realized by the microcomputer 100 and the ASIC 101 of the ECU 1 of the present embodiment.

  The CPU 10 of the microcomputer 100 of the ECU 1 has functions of a WD output unit 102, a control pulse output unit 103, a state determination unit 104, and a communication control unit 105 by reading and executing a program.

  The CPU 10 outputs a WD pulse from the WD output unit 102 according to a predetermined WD pulse cycle. For example, the CPU 10 outputs a WD pulse at a cycle of 20 milliseconds. As described above, the CPU 10 has two terminals (WD1, WD2) for outputting WD pulses, and outputs the same WD pulse from each. Since they are the same WD pulse, the output period of the WD pulse is the same. It is preferable that the terminals that output the WD pulse are separated such that there are terminals used for input / output of other signals. In the present embodiment, as shown in FIG. 2, there is a terminal to which a control pulse from the control pulse output unit 103 is output. Thereby, it is possible to avoid the occurrence of a short circuit due to solder between terminals that output the same WD pulse. Note that the output period of the WD pulse may differ depending on the state, such as a 20 millisecond period in the active state and a 60 millisecond period in the sleep state.

  The CPU 10 outputs a control pulse from the control pulse output unit 103 by its own operation as the ECU 1. The CPU 10 acquires information from devices such as sensors or switches connected to the ECU 1, and performs arithmetic processing and signal processing based on a program stored in the ROM 11. In accordance with these arithmetic processing and signal processing, for example, a control pulse is output to the switch to be controlled.

  With the function of the state determination unit 104, the CPU 10 determines whether the microcomputer 100 (CPU 10) of the ECU 1 is in the active state, in the sleep state, further transitions from the active state to the sleep state, or from the sleep state to the active state. Judge whether to transition. The state determination unit 104 passes the determination result to the communication control unit 105 so as to be transmitted from the communication unit 13 to the ASIC 101.

  The CPU 10 realizes serial communication by the communication unit 13 by the function of the communication control unit 105. More specifically, it implements processing such as formatting information to be transmitted / received according to a serial communication protocol or extracting information from a received communication signal. The CPU 10 receives the detection result transmitted from the monitoring circuit 14 of the ASIC 101 by the function of the communication control unit 105, and stores it in the RAM 12 (or ROM 11) when necessary.

  On the other hand, the monitoring circuit 14 of the ASIC 101 has functions of a reset output unit 141 and a monitoring unit 142. The monitoring circuit 14 determines the necessity of the reset signal from the reset output unit 141 by referring to the status table 143 as described later by the function of the monitoring unit 142.

  The reset output unit 141 outputs a reset signal to the CPU 10 when instructed by the monitoring unit 142 as described later.

  The monitoring unit 142 inputs WD pulses to be periodically output from the WD output unit 102 of the CPU 10 from two terminals, and monitors each of them. Specifically, the monitoring unit 142 determines that the operation of the CPU 10 is normal when a pulse is received from any terminal at the output period of the WD pulse. When a time longer than a predetermined time (a time longer than the output period of the WD pulse) has passed since the monitoring unit 142 also received the WD pulse input from the two terminals most recently, the operation of the CPU 10 Is judged abnormal. Then, when a time longer than the predetermined time has passed since the monitoring unit 142 received the latest WD pulse of only one of the two terminals, the monitoring unit 142 is connected to the output terminal of the WD pulse of the CPU 10. Judge that the connection line is broken. If the monitoring unit 142 determines that there is an abnormality, the monitoring unit 142 instructs the reset output unit 141 to output a reset signal. At this time, the monitoring unit 142 operates the CPU 10 for the first time only when a phenomenon of grounds for determining an abnormality (for example, any terminal cannot detect a WD pulse even after a predetermined period of time) is detected a predetermined number of times. You may judge that it is abnormal.

  The monitoring unit 142 passes a detection result such as abnormality or disconnection to the communication unit 16 and transmits the detection result from the communication unit 16 to the microcomputer 100. The monitoring unit 142 may also transmit a detection result indicating normality. At this time, the monitoring unit 142 may transmit the detection result to the outside from another communication unit that realizes communication with another ECU (not shown). As an example of the transmission destination, there is a diagnosis ECU that executes processing related to diagnosis information.

  The monitoring unit 142 adjusts the predetermined time based on the determination result by the state determination unit 104 of the CPU 10 received via the communication unit 16. The output period of the WD pulse differs depending on the state, such as a period of 20 milliseconds when the microcomputer 100 is in the active state and a period of 60 milliseconds when the microcomputer 100 is in the sleep state. This should be adjusted according to the state of the microcomputer 100 (CPU 10). Therefore, when the determination result received by the communication unit 16 is in the active state, the monitoring unit 142 adjusts the predetermined time to 25 milliseconds, which is slightly longer than 20 milliseconds, for example, and transitions to the sleep state. The predetermined time is adjusted to 70 milliseconds, which is slightly longer than 60 milliseconds. As a result, it is possible to avoid erroneously determining that the operation of the CPU 10 is abnormal and to perform processing with high accuracy without unnecessary restart of the CPU 10.

  The status table 143 stores information on whether the monitoring unit 142 determines whether the operation of the CPU 10 is abnormal or information on processing contents to be performed when a disconnection is detected. The status of the WD pulse from the terminal is checked against the status table 143 for determination. Note that the operation state of the microcomputer 100 transmitted from the microcomputer 100 may be checked against the status table 143 to make a determination according to the operation state.

  In the ASIC 101, a signal from the control pulse 103 is received by the peripheral circuit 15 and specified processing is performed. Note that processing may be performed based on information received via the communication unit 16.

  FIG. 3 is an explanatory diagram showing an example of the contents of the judgment criteria stored in the status table 143 of the monitoring circuit 14 in the present embodiment. In the status table 143, as shown in FIG. 3, the determination result of whether or not the two terminals (WD ports) to which the WD pulse from the CPU 10 is input can be received in a predetermined cycle, and the detected state is shown. The contents, that is, correspondence with whether the operation of the CPU 10 is normal, abnormal, or occurrence of disconnection is stored.

  The monitoring unit 142 collates the reception states at the two terminals (WD ports) to which the WD pulse is input from the CPU 10 with the status table 143 as shown in FIG. Judgment is made. When the content example shown in FIG. 3 is collated, when the monitoring unit 142 can periodically receive (OK) at any of the two terminals (WD ports) to which the WD pulse is input, the operation of the CPU 10 is performed. If it is judged normal and cannot be received at either one of the two terminals (NG), it is determined that a disconnection has occurred, and if it cannot be received at either of the two terminals (NG), the CPU 10 operates as follows. Judge as abnormal.

  FIG. 4 is an explanatory diagram showing an example of the content of the processing content information stored in the status table 143 of the monitoring circuit 14 in the present embodiment. As shown in FIG. 4, the status table 143 stores the correspondence between the determination result and the processing content to be executed. Examples of the processing contents of FIG. 4 include reset signal output, history storage, and user notification.

  The monitoring unit 142 executes the processing content corresponding to the determination result. Specifically, when the monitoring unit 142 determines that the operation of the CPU 10 is normal, the monitoring unit 142 does not perform any of reset signal output, history storage, and user notification. When the monitoring unit 142 determines that the operation of the CPU 10 is abnormal, the monitoring unit 142 outputs a reset signal. If the monitoring unit 142 determines that a disconnection has occurred, the monitoring unit 142 does not output a reset signal, but stores the disconnection occurrence information as a history in a storage unit (not shown) and sends the determination result to the outside (via the communication unit 16). And output to a microcomputer 100 or another ECU).

  An operation performed by the microcomputer 100 and the ASIC 101 in the ECU 1 configured as described above will be described with reference to a flowchart.

  FIG. 5 is a flowchart illustrating an example of a processing procedure executed by the monitoring circuit 142 of the ECU 1 according to the function of the monitoring unit 142 in the present embodiment. The monitoring circuit 14 repeats the following procedure in the output period of the input WD pulse.

  The monitoring circuit 14 determines whether or not the WD pulse from the WD1 of the CPU 10 is periodically received by one of the two terminals by the function of the monitoring unit 142 (step S11). Specifically, the monitoring circuit 14 clears the timer when the rising edge of the WD pulse from WD1 is detected, measures the elapsed time from the edge, and determines a predetermined time (for example, more than the WD pulse output cycle). It is determined whether the edge can be detected again within a long time). At this time, it may be determined whether or not it is periodically received or not, or it may be determined whether or not it is within a predetermined frequency band by measuring the frequency of the WD pulse.

  If the monitoring circuit 14 determines that the WD pulse is periodically received in step S11 (S11: YES), the WD pulse from the WD2 of the CPU 10 is also periodically received for the other of the two terminals. It is determined whether or not it has been received (step S12). The specific determination process here is the same as that in step S11.

  When the monitoring circuit 14 determines that the WD pulse is periodically received in step S12 (S12: YES), the monitoring circuit 14 determines that the operation of the microcomputer 100 (CPU 10) is normal (step S13), and performs the processing. finish. The monitoring circuit 14 returns the processing to step S11 again and repeats the processing procedure from step S11.

  If the monitoring circuit 142 determines that the WD pulse from the WD1 of the CPU 10 is not periodically received in step S11 by the function of the monitoring unit 142 (S11: NO), the monitoring circuit 142 receives the WD pulse from the WD2 of the CPU 10. Also, it is determined whether or not it is periodically received (step S14). When the monitoring circuit 14 determines that the WD pulse from the WD 2 is periodically received (S14: YES), the monitoring circuit 14 refers to the determination criteria of the status table 143, and one of them is NG. (Step S15). The monitoring circuit 14 refers to the processing contents of the status table 143 by the function of the monitoring unit 142 and does not output a reset signal, but records the occurrence of disconnection in a storage unit (not shown) and detects the occurrence of disconnection from the communication unit 16. The result is transmitted (step S16), and the process is terminated. The monitoring circuit 14 returns the processing to step S11 again and repeats the processing procedure from step S11.

  In step S14, the monitoring circuit 14 determines that the WD pulse from the WD2 is not periodically received, that is, the CPU 10 does not receive the two WD pulses from the WD1 and WD2 periodically. In the case (S14: NO), the judgment criteria of the status table 143 are referred to, and since both are NG, it is judged that an abnormality has occurred in the operation of the microcomputer 100 (step S17). Then, the monitoring circuit 14 refers to the processing contents of the status table 143 by the function of the monitoring unit 142, outputs a reset signal from the reset output unit 141 to the CPU 10 (step S18), and ends the processing. The monitoring circuit 14 returns the processing to step S11 again and repeats the processing procedure from step S11.

  When the monitoring circuit 14 determines in step S12 that the WD pulse is not received periodically (S12: NO), that is, when only the WD pulse from WD1 of the CPU 10 is periodically received (S11: (YES, S12: NO), the process proceeds to step S15, and it is determined that a disconnection has occurred, and the subsequent processes are executed.

  Through such processing, the CPU 10 can be connected to the monitoring circuit 14 without distinguishing that the disconnection has occurred in spite of the normal operation of the microcomputer 100 (CPU 10). It is possible to avoid unnecessary resetting due to erroneous operation determination.

  Next, processing on the microcomputer 100 side will be described. FIG. 6 is a flowchart showing an example of a processing procedure executed by the microcomputer 100 (CPU 10) of the ECU 1 in the present embodiment. The CPU 10 of the microcomputer 100 repeatedly executes the processing procedure shown below at a constant period.

  The CPU 10 determines whether the CPU 10 is in the active state or is going to transition to the sleep state by the function of the state determination unit 104 (step S21). The CPU 10 transmits the determination result of step S201 from the communication unit 13 to the monitoring circuit 14 of the ASIC 101 via the communication control unit 105 (step S22).

  Next, the CPU 10 determines whether or not the detection result from the monitoring circuit 14 of the ASIC 101 has been received by the communication unit 13 (step S23), and if it has not been received (S23: NO), the process is ended as it is. In addition, CPU10 returns a process to step S21 again, and repeats the process sequence from step S21.

  If the CPU 10 determines that it has been received in step S23 (S23: YES), it stores the detection result in the RAM 12 (or ROM 11) as a history (step S24). At this time, it is desirable to store the information in a time series in a non-volatile memory such as a flash memory so that it can be referred to as log information later.

  Next, the CPU 10 outputs to the outside to notify the user according to the received detection result (step S25), and ends the process. Specifically, the CPU 10 outputs a control signal to a switch such as a warning lamp or a buzzer, or transmits information to display other warning information on the display panel to another ECU (not shown) that controls the display panel. An instruction may be transmitted to another ECU that controls a switch such as a warning lamp or a buzzer. CPU10 complete | finishes a process, returns a process to step S21 again, and repeats the process sequence from step S21.

  When the monitoring circuit 14 of the ASIC 101 is configured to transmit the detection result from the communication unit 16 to the microcomputer 100 even when the detection result is normal, the CPU 10 determines whether or not the received detection result is normal. When it is determined that it is not normal, the processes of steps S24 and S25 are executed. If it is determined to be normal, the process is terminated as it is, and the process is repeated from S21.

  By such processing, the microcomputer 100 (CPU 10) side can grasp its own state, and not only can the detection result be stored so that it can be referred to later, but also as a reference for the operation of the CPU 10 itself. Also good. When disconnection occurs, flexible processing is possible, such as partially limiting processing related to signals input and output at terminals around the terminal. Further, since the ECU 1 is a device mounted on the vehicle, safety can be ensured by notifying the driver so that the driver can grasp it, particularly when the detection result is not normal.

  In this embodiment, the monitoring circuit 14 is configured to input the WD pulse from the CPU 10 from two terminals. However, the WD pulse input from one terminal is not necessarily used, as in the existing system, without using two terminals. And a configuration for determining whether or not can be received periodically. Thus, the WD pulse can be applied to various systems such as a microcomputer that is not suitable for the output configuration from the two terminals.

  In the present embodiment, the CPU 10 and the monitoring circuit 14 are configured to transmit and receive WD pulses at two terminals. However, the present invention is not limited to this, and when transmission / reception is performed at three or more terminals and WD pulses can be received periodically at all terminals, it is determined as normal and WD pulses cannot be received at all terminals. In some cases, the above may be determined.

  The disclosed embodiments should be considered as illustrative in all points and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

1 ECU (Processor)
10 CPU (Processor)
102 WD output unit 103 control pulse output unit 104 state determination unit 13, 16 communication unit 14 monitoring circuit (abnormality detection unit)
141 Reset output unit 142 Monitoring unit WD1, WD2 terminal

Claims (6)

In a processing apparatus including a processing unit that performs signal processing for controlling a device and has a plurality of terminals that input and output signals related to the signal processing, and a restarting unit that restarts the processing unit.
The processing unit is configured to periodically output the same pulse signal from any of the plurality of terminals.
The restarting unit
A plurality of terminals for inputting the same pulse signal,
A judgment means for judging whether or not each of the pulse signals inputted from the plurality of terminals is periodically received;
The processing apparatus, wherein when the determination means determines that none of the pulse signals respectively input from the plurality of terminals is periodically received, the processing unit is restarted. The restarting unit
When the determination means determines that any one of the pulse signals respectively input from the plurality of terminals is not periodically received, the disconnection of the connection line with the processing unit is detected. The processing apparatus according to claim 1. 3. The processing unit and the restarting unit are configured to output or input the pulse signal from a plurality of terminals that are separated from each other among a plurality of terminals that the processing unit and the restarting unit respectively have. Processing equipment. The processing unit and the restarting unit each have communication means for transmitting and receiving information,
The restarting unit is configured to transmit a detection result to the processing unit by the communication means,
The processing apparatus according to claim 1, wherein the processing unit further includes a storage unit that stores a detection result received by the communication unit from the restarting unit. The processor is
The processing apparatus according to claim 4, further comprising means for outputting the detection result received by the communication means to the outside. The processor is
Means for determining whether its own operation is in an active state or a transition to a dormant state;
The determination result by the means is transmitted to the restart unit by the communication means,
The restarting unit
The processing apparatus according to claim 4, wherein an abnormality in the operation of the processing unit is detected based on the determination result and the determination by the determination unit.

Images