JP2011134025A - Processor and control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a processor and a control method for, when a main operation part fails, seamlessly selecting another processing part to control a control target while ensuring safety. <P>SOLUTION: When a CPU 20 of a main microcomputer 2 executes a program stored in a memory 21, an output value to be output from the CPU 20 is successively stored in a memory 31 of a sub-microcomputer 3. A monitoring circuit 32 of the sub-microcomputer 3 determines whether the CPU 20 is in normal operation or not, based on a reception cycle of a WD pulse to be successively output from the CPU 20, and when determining that the CPU 20 fails, outputs a reset signal to the CPU 20 of the main microcomputer 2. A CPU 30 of the sub-microcomputer 3 sets the self-output terminal to an output port, and outputs a value stored in the memory 31, and output from the main microcomputer 2 just before the CPU 20 fails, to a driving circuit 4. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a processing apparatus using a CPU (Central Processing Unit), and more particularly to a processing apparatus and a control method capable of controlling a signal output to the outside when an abnormality occurs in the operation state of the CPU.

  2. Description of the Related Art Control devices that control devices using a microcomputer (hereinafter referred to as a microcomputer) that can execute various programs by executing a program stored in a built-in storage unit are widely used. Particularly in the field of vehicles, a control system in which a plurality of ECUs (Electronic Control Units) using microcomputers are connected is being used to shift to a configuration in which actuators are electrically controlled in cooperation with each other. For example, power window opening / closing control, handle lock control for theft prevention, etc. are performed by combining motors and relays and motor rotation control, and the CPU controls the motors and relays.

  In the processing using the microcomputer, the microcomputer may not be able to maintain normal operation when the processing becomes an unexpected situation or when an abnormal signal is input to the microcomputer. In the field of vehicles, it must be possible to avoid abnormal operation as much as possible for safety. For this reason, a watchdog pulse (hereinafter referred to as a WD (Watch Dog) pulse) is periodically output from the microcomputer, the watchdog pulse is monitored by a monitoring device that monitors the operation of the microcomputer, and the WD pulse is output. A configuration in which it is determined whether or not the operation of the microcomputer is normal based on the state is becoming common.

  In Patent Document 1, a main microcomputer and a sub microcomputer are used. The sub microcomputer monitors the operation of the main microcomputer with a WD pulse from the main microcomputer, and when an abnormality occurs in the operation of the main microcomputer, the sub microcomputer Techniques for switching to control have been proposed.

Japanese Patent No. 3817855

  However, in the technique disclosed in Patent Document 1, when the operation of the main microcomputer is abnormal and the control by the main microcomputer is switched to the control by the sub microcomputer, the sub microcomputer sets the fail-safe value set in advance as a control target. It is the structure which outputs. In other words, the sub-microcomputer outputs a fail-safe value set in advance without considering the operation state of the main microcomputer immediately before the operation of the main microcomputer occurs. The value cannot be output. Therefore, when the output value from the main microcomputer immediately before the abnormality occurs in the main microcomputer and the fail safe value are different, there is a situation in which switching from the control by the main microcomputer to the control by the sub microcomputer cannot be performed seamlessly. Moreover, it is not always preferable to output the fail safe value. If possible, it may be desirable to maintain the control state immediately before the point of occurrence of the abnormality. However, in the technique disclosed in Patent Document 1, since the sub-microcomputer controls the control target based on the fail safe value, there is a possibility that appropriate control cannot be performed.

  The present invention has been made in view of such circumstances, and an object of the present invention is to control by different processing units while ensuring safety when an abnormality occurs in the operation of the main processing unit. It is an object of the present invention to provide a processing apparatus and a control method capable of seamlessly switching to target control.

  The processing apparatus according to the present invention includes a plurality of processing units that perform signal processing, an abnormality detection unit that detects an abnormality in the operation of the one processing unit based on a signal periodically output from the one processing unit, In the processing apparatus comprising: a holding unit that holds a signal output when the one processing unit executes signal processing; and the abnormality detection unit detects an abnormality in the operation of the one processing unit, An output stop unit that stops output of a signal when one processing unit executes signal processing, and the other processing unit stops output of a signal from the one processing unit. In this case, a signal held by the holding unit before the abnormality detecting unit detects an abnormal operation of the one processing unit is output to the outside.

  In the processing apparatus according to the present invention, the holding unit accumulates signals output from the one processing unit over a predetermined time, and the other processing unit includes the abnormality detecting unit. A signal based on the signal accumulated in the holding unit is output to the outside for a predetermined time before detecting an abnormal operation of the processing unit.

  The processing apparatus according to the present invention includes a plurality of processing units that perform signal processing corresponding to each of a plurality of control states, and an operation of the one processing unit based on a signal periodically output from the one processing unit. A processing unit including an abnormality detection unit that detects an abnormality in the first processing unit, a holding unit that holds a control state of signal processing being performed by the one processing unit, and an abnormality in the operation of the one processing unit. An output stop unit that stops the output of a signal when the one processing unit executes signal processing, and the other processing unit has the output stop unit from the one processing unit. When output of the signal is stopped, the abnormality detection unit executes signal processing corresponding to the control state held by the holding unit before detecting the abnormality of the operation of the one processing unit. It is characterized by being.

  In the processing device according to the present invention, the holding unit accumulates a control state of the signal processing being executed by the one processing unit over a predetermined time, and the other processing unit is configured to detect the abnormality. The signal processing unit is configured to perform signal processing according to a control state based on a control state accumulated by the holding unit over a predetermined time before detecting an abnormality in the operation of the one processing unit. .

  A control method according to the present invention includes: a plurality of processing units that perform signal processing; an abnormality detection unit that detects an abnormality in the operation of the one processing unit based on a signal periodically output from the one processing unit; In the control method for outputting a signal output by executing the signal processing by the one processing unit to the outside in the processing apparatus, the output is performed by the one processing unit executing the signal processing. A step of holding a signal, a step of stopping output of a signal when the one processing unit executes signal processing when the abnormality detecting unit detects an abnormality in the operation of the one processing unit, and When the output of the signal from the one processing unit is stopped, the processing unit outputs the signal held by the abnormality detection unit before detecting the abnormal operation of the one processing unit to the outside And including a step to To.

  The control method according to the present invention includes a plurality of processing units that perform signal processing corresponding to each of a plurality of control states, and an operation of the one processing unit based on a signal periodically output from the one processing unit. In the control device when the signal output by the one processing unit executing signal processing is output to the outside, the processing unit includes an abnormality detecting unit that detects an abnormality in the first processing unit. Holding the control state of the signal processing in the middle, and when the abnormality detection unit detects an abnormality in the operation of the one processing unit, the signal output by the one processing unit executing the signal processing is performed. A step of stopping, and when the other processing unit stops outputting the signal from the one processing unit, the abnormality detecting unit holds before detecting an abnormality in the operation of the one processing unit. Signal processing according to the control state Characterized in that it comprises the steps that.

  According to the present invention, a plurality of processing units that perform signal processing are provided, and the holding unit holds a signal that is output when one processing unit that operates mainly performs signal processing. Then, when an abnormality occurs in the operation of one processing unit, the output of the signal from the one processing unit is stopped, and the other processing unit operates before the abnormality occurs in the operation of the one processing unit. The held signal is output. Therefore, when an abnormality occurs in the operation of one processing unit operating in the main, control by a different processing unit is performed while the command state (output signal from one processing unit) before the occurrence of the abnormality is maintained. Seamless transition.

  According to the present invention, when the holding unit accumulates a signal output from one processing unit operating in the main over a predetermined time and an abnormality occurs in the operation of the one processing unit, an abnormality occurs. A signal based on the signal accumulated in the holding unit over the previous predetermined time is output to the outside. Therefore, when an abnormality occurs in the operation of one processing unit operating in the main, the control target is determined based on the command state (output signal from one processing unit) that has continued for a predetermined time before the abnormality occurs. Since it is controlled, it is possible to control the controlled object while ensuring safety.

  According to the present invention, a plurality of processing units that execute signal processing corresponding to each of a plurality of control states are provided, and the holding unit holds the control state of the signal processing being performed by one processing unit that operates in the main. deep. Then, when an abnormality occurs in the operation of one processing unit, the output of the signal from the one processing unit is stopped, and the other processing unit operates before the abnormality occurs in the operation of the one processing unit. The signal processing according to the control state that has been held is executed. Therefore, when an abnormality occurs in the operation of one processing unit operating in the main, the control state of the one processing unit before the abnormality occurs is retained, and signal processing is performed based on the same control state. The control by different processing units can be seamlessly transferred.

  According to the present invention, when the holding unit accumulates the control state of the signal processing being executed by the one processing unit operating in the main over a predetermined time, and an abnormality occurs in the operation of the one processing unit, The signal processing according to the control state based on the control state accumulated by the holding unit over a predetermined time before the occurrence of abnormality is executed. Therefore, when an abnormality occurs in the operation of one processing unit that operates in the main, the controlled object is controlled by signal processing corresponding to the control state that has continued for a predetermined time before the abnormality occurs, so safety is ensured. The controlled object can be controlled while ensuring the above.

  In the present invention, when an abnormality occurs in the operation of one processing unit operating in the main, the controlled object is controlled by the command state (output signal from one processing unit) before the abnormality occurs. The control by different processing units can be seamlessly transferred while ensuring the performance.

FIG. 2 is a configuration diagram showing a configuration of an ECU in the first embodiment. It is a time chart for demonstrating operation | movement of ECU. 4 is a flowchart showing a procedure of processing performed by a sub microcomputer of the ECU according to the first embodiment. FIG. 6 is a configuration diagram showing a configuration of an ECU in a second embodiment. It is a schematic diagram which shows the storage content of a control specification table. 6 is a time chart for explaining the operation of the ECU according to the second embodiment. 6 is a flowchart showing a procedure of processing performed by a sub-microcomputer of the ECU according to the second embodiment.

  Hereinafter, the present invention will be specifically described with reference to the drawings showing embodiments thereof. In the embodiment described below, a case where the processing apparatus according to the present invention is applied to an ECU mounted on a vehicle will be described as an example.

(Embodiment 1)
FIG. 1 is a configuration diagram showing the configuration of the ECU according to the first embodiment. The ECU 1 is a power management ECU that performs signal processing including, for example, power distribution to in-vehicle devices mounted on a vehicle or charge / discharge control processing in a battery and an alternator. The ECU 1 is a processing device that outputs a control signal to a control target such as an alternator based on various physical quantities such as a measured value or a calculated value or a control value acquired from a device connected to itself or a device such as various switches. is there.

  The ECU 1 includes a main microcomputer 2, a sub microcomputer 3, a drive circuit 4, and the like. The main microcomputer 2 of the ECU 1 includes a CPU (core) 20 that performs control processing of the entire ECU 1, a memory 21 that stores a program for realizing an operation as a power management ECU, and the like. The CPU 20 of the main microcomputer 2 implements an operation as a power management ECU by reading and executing a program stored in the memory 21. When executing a program stored in the memory 21, the CPU 20 outputs a signal to be output to, for example, an external alternator (control target) via the drive circuit 4.

  Further, the CPU 20 includes a terminal to which a reset (RESET) signal is input. When the reset signal is input, the CPU 20 sets an output terminal that outputs a signal when operating as a power management ECU as an input port. That is, when the reset signal is input, the CPU 20 prohibits the output of the signal from the output terminal. Further, the CPU 20 has a built-in watchdog (WD) timer for measuring a preset watchdog (WD) pulse output period, and the WD timer measures a WD pulse for indicating that its own operation is normal. It is generated every WD pulse output period and output to the sub-microcomputer 3.

  The memory 21 is an EEPROM (Electronically Erasable Programmable Read Only Memory), a flash memory, or the like, and stores control information together with a program for realizing an operation as a power management ECU.

  Similar to the main microcomputer 2, the sub-microcomputer 3 includes a CPU (core) 30 that performs control processing of the ECU 1 as a whole, and a memory 31 that stores a program for realizing an operation as a power management ECU. 2 (CPU 20) is provided. The CPU 30 of the sub-microcomputer 3 also reads out and executes the program stored in the memory 31, thereby realizing an operation as a power management ECU. For example, the drive circuit 4 outputs a signal to be output to an external alternator (control target). Output via. Note that the CPU 30 of the sub-microcomputer 3 starts the operation when the monitoring circuit 32 detects an abnormality in the operation of the main microcomputer 2 as will be described later. When starting the operation, the CPU 30 of the sub-microcomputer 3 switches its output terminal from the input port setting to the output port setting.

  The monitoring circuit 32 monitors WD pulses periodically output from the CPU 20 of the main microcomputer 2. Specifically, the monitoring circuit 32 includes a circuit having a terminal for receiving a WD pulse signal from the CPU 20, and detects the rising edge of the WD pulse as the WD pulse in the circuit. The monitoring circuit 32 monitors a WD pulse to be periodically output from the CPU 20, measures an elapsed time since the most recent detection of the WD pulse, and has a predetermined cycle (a preset WD pulse output cycle). When the WD pulse is received, the CPU 20 determines that it is normal. On the other hand, when the elapsed time since the most recent detection of the WD pulse is longer than the WD pulse output cycle, the monitoring circuit 32 determines that the CPU 20 is abnormal.

  Specifically, the monitoring circuit 32 determines that an abnormality has occurred in the CPU 20 when the WD pulse cannot be received even after the WD pulse output period has elapsed since the most recent detection of the WD pulse. When the monitoring circuit 32 determines that an abnormality has occurred in the CPU 20, the monitoring circuit 32 instructs the CPU 30 to start the operation, and outputs a reset signal to the CPU 20. At this time, the monitoring circuit 32 determines that the operation of the CPU 20 is abnormal for the first time only when a phenomenon (for example, a WD pulse cannot be detected even after the WD monitoring time elapses) is detected a predetermined number of times. May be. Alternatively, the CPU 20 may determine that an abnormality has occurred even when the elapsed time since the most recent detection of the WD pulse is shorter than the WD pulse output period.

  The memory 31 of the sub-microcomputer 3 is also an EEPROM, a flash memory or the like, and stores control information together with a program for realizing an operation as a power management ECU. The memory 31 of the sub-microcomputer 3 stores a signal output from the CPU 20 of the main microcomputer 2 and input to the drive circuit 4 when output from the drive circuit 4.

  A signal output from the main microcomputer 2 (CPU 20) or the sub microcomputer 3 (CPU 30) is input to the drive circuit 4, and is output to an external control target at a predetermined timing. In the drive circuit 4, when the main microcomputer 2 (CPU 20) is operating normally, a signal from the CPU 20 of the main microcomputer 2 is detected, and when an abnormality occurs in the main microcomputer 2 (CPU 20). A signal from the CPU 30 of the sub-microcomputer 3 is input.

  In the ECU 1 of the first embodiment, the monitoring circuit 32 of the sub-microcomputer 3 determines whether or not the CPU 20 is operating normally based on the WD pulse from the CPU 20 of the main microcomputer 2. If it is determined that an abnormality has occurred in the CPU 20, the monitoring circuit 32 instructs the CPU 30 to start the operation of the power management ECU and outputs a reset signal to the CPU 20. The CPU 30 instructed to start the operation of the power management ECU executes the program stored in the memory 31 and starts the operation as the power management ECU.

  At this time, the CPU 30 of the sub-microcomputer 3 sets an output terminal that outputs a signal when operating as a power management ECU to the output port, and the CPU 20 of the main microcomputer 2 receives a reset signal from the monitoring circuit 32 of the sub-microcomputer 3. If received, set its own output terminal as an input port. As a result, the signal input to the drive circuit 4 is switched from the signal from the main microcomputer 2 to the signal from the sub-microcomputer 3.

  The CPU 30 of the sub-microcomputer 3 reads the output value from the CPU 20 that the memory 31 has acquired from the drive circuit 4 and stored immediately before the monitoring circuit 32 detects the abnormality of the CPU 20 and outputs it to the drive circuit 4 as its own output signal. To do. As a result, when an abnormality occurs in the main microcomputer 2, the output signal from the main microcomputer 2 immediately before the abnormality occurs is output from the sub-microcomputer 3 to the controlled object via the drive circuit 4. Therefore, since the command state before the abnormality occurs in the main microcomputer 2 is maintained, it is possible to seamlessly shift from the control by the main microcomputer 2 to the control by the sub-microcomputer 3 while ensuring safety.

  FIG. 2 is a time chart for explaining the operation of the ECU 2. FIG. 2 shows outputs 1 and 2 output from the main microcomputer 2 and outputs 1 and 2 output from the sub-microcomputer 3 in order from the top with the horizontal axis as the time axis. 2 shows an example in which two output values are output from the main microcomputer 2 and the sub microcomputer 3, respectively.

  In the ECU 1 according to the first embodiment, the CPU 20 of the main microcomputer 2 appropriately outputs an output signal as a result of executing the program stored in the memory 21 until an abnormality occurs in the main microcomputer 2. After the abnormality occurs in the main microcomputer 2, the output terminal of the CPU 20 of the main microcomputer 2 is set as an input port, so the CPU 20 does not output an output signal.

  On the other hand, since the output terminal of the CPU 30 of the sub-microcomputer 3 is set as an input port until an abnormality occurs in the main microcomputer 2, the CPU 30 does not output an output signal. Then, after an abnormality occurs in the main microcomputer 2, the CPU 30 of the sub-microcomputer 3 outputs an output signal of the CPU 20 immediately before the abnormality occurs in the main microcomputer 2. Specifically, immediately before an abnormality occurs in the main microcomputer 2, the main microcomputer 2 outputs a signal having an OFF (0) value as the output 1 and outputs a signal having an ON (1) value as the output 2. It was. Therefore, after an abnormality occurs in the main microcomputer 2, the sub-microcomputer 3 outputs an OFF (0) value signal as the output 1 and an ON (1) value signal as the output 2.

  As described above, when an abnormality occurs in the main microcomputer 2, the signal output from the main microcomputer 2 to the drive circuit 4 immediately before that is output from the sub-microcomputer 3 to the drive circuit 4. It is possible to maintain the control state of the controlled object before the abnormality occurs. Therefore, it is possible to seamlessly shift from the control by the main microcomputer 2 to the control by the sub-microcomputer 3 while ensuring safety.

  An operation performed by the monitoring circuit 3 in the ECU 1 configured as described above will be described with reference to a flowchart. FIG. 3 is a flowchart showing a procedure of processing performed by the sub-microcomputer 3 of the ECU 1 in the first embodiment.

  Each time the CPU 30 of the sub-microcomputer 3 acquires the output signal from the CPU 20 of the main microcomputer 2 via the drive circuit 4, it stores it in the memory 31 (S1). On the other hand, every time the monitoring circuit 32 of the sub-microcomputer 3 receives the data (WD pulse) of the WD pulse output period received from the CPU 20 of the main microcomputer 2, it monitors the reception state of the WD pulse (S2). Here, the monitoring circuit 32 monitors the interval at which WD pulses are received from the CPU 20.

  The monitoring circuit 32 determines whether or not the main microcomputer 2 (CPU 20) is abnormal based on the reception interval of the WD pulse from the CPU 20 (S3). The monitoring circuit 32 indicates that the CPU 20 (main microcomputer 2) is abnormal when the reception interval of the WD pulse from the CPU 20 is shorter than the preset WD pulse output period by a predetermined time or longer than the predetermined time. Judge.

  When the monitoring circuit 32 determines that the main microcomputer 2 is normal (S3: NO), the sub-microcomputer 3 returns the process to step S1 and stores the output signal from the CPU 20 of the main microcomputer 2 in the memory 31. The monitoring of the reception state of the WD pulse from the CPU 20 of the main microcomputer 2 is continued. When the monitoring circuit 32 determines that the main microcomputer 2 is abnormal (S3: YES), the monitoring circuit 32 outputs a reset signal to the CPU 20 (S4).

  The monitoring circuit 32 instructs the CPU 30 to start the operation of the power management ECU, and the CPU 30 sets its own output terminal as an output port (S5). When the CPU 20 of the main microcomputer 2 acquires a reset signal from the monitoring circuit 32 of the sub microcomputer 3, the CPU 20 sets the output terminal as an input port. The CPU 30 reads the output value stored in the memory 31, that is, the output value output from the CPU 20 immediately before the monitoring circuit 23 detects the abnormality of the main microcomputer 2, and outputs the output value to the drive circuit 4 (S6). Exit.

  As a result, even when an abnormality occurs in the main microcomputer 2, the ECU 1 can output the output value that the main microcomputer 2 has output to the control object immediately before the sub microcomputer 3. Therefore, even when an abnormality occurs in the main microcomputer 2, the process can be seamlessly shifted from the control by the main microcomputer 2 to the control by the sub-microcomputer 3, and the controlled object can be controlled safely.

  In the ECU 1 according to the first embodiment, after an abnormality occurs in the main microcomputer 2 and the control of the control target by the main microcomputer 2 is switched to the control of the control target by the sub microcomputer 3, the main microcomputer 2 immediately before the occurrence of the abnormality The output value is fixed. Accordingly, in addition to the above-described configuration, whether the output value output from the sub-microcomputer 3 after an abnormality has occurred in the main microcomputer 2 is the output value stored in the memory 31 of the sub-microcomputer 3, for example, input by a driver You may provide the structure which switches whether it is set as the value input by operation.

  In the ECU 1 according to the first embodiment, when an abnormality occurs in the main microcomputer 2, the CPU 30 of the sub-microcomputer 3 stores the memory 31 of the sub-microcomputer 3 from the main microcomputer 2 immediately before the abnormality occurs. The controlled object is controlled based only on the output value. In addition to this, for example, the output signal from the main microcomputer 2 (CPU 20) is stored in the memory 31 of the sub-microcomputer 3 for a predetermined time, and is stored in the memory 31 when an abnormality occurs in the main microcomputer 2. Based on the signal, the signal output from the CPU 30 of the sub-microcomputer 3 to the control target may be determined.

  For example, it is assumed that the CPU 20 outputs an OFF (0) value signal as an output 1 and an ON (1) value signal as an output 2 for 10 minutes immediately before an abnormality occurs in the main microcomputer 2. . In this case, the CPU 30 of the sub-microcomputer 3 may output an OFF (0) value signal as the output 1 and an ON (1) value signal as the output 2. In this way, the sub-microcomputer 3 outputs to the control target based on the output value output from the CPU 20 over a long period (predetermined period) as well as the output value from the CPU 20 immediately before the abnormality occurs in the main microcomputer 2. By determining the signal, it is possible to secure the safety and control the controlled object.

(Embodiment 2)
FIG. 4 is a configuration diagram showing the configuration of the ECU according to the second embodiment. Since the ECU 1 of the second embodiment has the same configuration as the ECU 1 of the first embodiment described above, the same reference numerals are given to the same configurations, and description thereof is omitted.

  In addition to the configuration shown in FIG. 1, the ECU 1 of the second embodiment stores a control specification table 33 as shown in FIG. 5 in the memory 31 of the sub-microcomputer 3 in advance. FIG. 5 is a schematic diagram showing the contents stored in the control specification table 33. The control specification table 33 stores output values (ON = 1, OFF = 0) for each control state (control mode) when the ECU 1 controls a predetermined control target.

  In the control specification table 33 shown in FIG. 5, three control states of a normal state, a power cut state 1 and a power cut state 2 are registered as control states. However, the present invention is not limited to such a configuration, and an output value may be stored for each number of control states corresponding to the processing content to be performed by the ECU 1. Further, in the control specification table 33 shown in FIG. 5, two output values (output 1 and output 2) are stored as output values, but the number of output values corresponding to the processing content to be performed by the ECU 1 is stored. Will be.

  In the ECU 1 of the second embodiment, the CPU 20 of the main microcomputer 2 grasps the current control state based on the operation state of the vehicle and the operation states of other ECUs. Then, the CPU 20 reads out a program corresponding to the current control state from the memory 21 and executes it, thereby performing control processing according to the current control state on the external alternator (control target). Further, every time the current control state is changed, the CPU 20 notifies the current control state to the sub-microcomputer 3 and stores it in the memory 31 of the sub-microcomputer 3. That is, in the first embodiment described above, the output signal from the CPU 20 of the main microcomputer 2 is sequentially stored in the memory 31 of the sub-microcomputer 3, but in the second embodiment, the current control state in the ECU 1 is Stored sequentially.

  In the ECU 1 according to the second embodiment, when the monitoring circuit 32 detects an abnormality of the CPU 20, the CPU 30 of the sub-microcomputer 3 stores the memory 31 from the main microcomputer 2 immediately before the monitoring circuit 32 detects the abnormality of the CPU 20. Read the acquired control status. Then, the CPU 30 reads the output value corresponding to the control state read from the memory 31 from the control specification table 33 and outputs it to the drive circuit 4 as its own output signal.

  Thereby, when an abnormality occurs in the main microcomputer 2, the control state in the main microcomputer 2 immediately before the abnormality occurs is held, and the sub-microcomputer 3 controls the control target by the output value corresponding to this control state. Therefore, since the command state before the abnormality occurs in the main microcomputer 2 is maintained, it is possible to seamlessly shift from the control by the main microcomputer 2 to the control by the sub-microcomputer 3 while ensuring safety.

  FIG. 6 is a time chart for explaining the operation of the ECU 2 according to the second embodiment. FIG. 6 shows the state of the main microcomputer 2 (control state), the outputs 1 and 2 output from the main microcomputer 2, the state of the sub microcomputer 3 (control state), the sub microcomputer in order from the top with the horizontal axis as the time axis. 3 shows output 1 and output 2 output from 3. The time chart shown in FIG. 6 shows an example in which two output values are output from the main microcomputer 2 and the sub-microcomputer 3, respectively.

  In the ECU 1 of the second embodiment, the CPU 20 of the main microcomputer 2 executes the program stored in the memory 21 according to the control state that is appropriately changed until an abnormality occurs in the main microcomputer 2, The resulting output signal is output as appropriate. In the example shown in FIG. 6, the control state is switched from the normal state to the power cut state 1, and the CPU 20 performs processing according to the control state at that time and outputs output signals as outputs 1 and 2. . Until the abnormality occurs in the main microcomputer 2, the sub microcomputer 3 is in the monitoring state of the main microcomputer 2 based on the WD pulse from the main microcomputer 2, and the output terminal of the CPU 30 of the sub microcomputer 3 is connected to the input port. Is set.

  On the other hand, after an abnormality occurs in the main microcomputer 2, the output terminal of the CPU 20 of the main microcomputer 2 is set as an input port, and as a control state in the sub microcomputer 3, the main microcomputer 2 immediately before the abnormality occurs in the main microcomputer 2. The control state (power supply cut state 1 in FIG. 6) is taken over. Then, the CPU 30 of the sub-microcomputer 3 reads an output value corresponding to the power cut state 1 from the control specification table 33, outputs an OFF (0) value signal as the output 1, and an ON (1) value as the output 2. The signal is output.

  As described above, when an abnormality occurs in the main microcomputer 2, the control state of the control target by the main microcomputer 2 immediately before that can be maintained. Therefore, it is possible to seamlessly shift from the control by the main microcomputer 2 to the control by the sub-microcomputer 3 while ensuring safety.

  An operation performed by the monitoring circuit 3 in the ECU 1 configured as described above will be described with reference to a flowchart. FIG. 7 is a flowchart showing a procedure of processing performed by the sub-microcomputer 3 of the ECU 1 in the second embodiment.

  The CPU 30 of the sub-microcomputer 3 stores the current control state in the main microcomputer 2 from the CPU 20 of the main microcomputer 2 in the memory 31 (S11). On the other hand, each time the monitoring circuit 32 of the sub-microcomputer 3 receives the data (WD pulse) of the WD pulse output period received from the CPU 20 of the main microcomputer 2, it monitors the reception state of the WD pulse (S12). Here, the monitoring circuit 32 monitors the interval at which WD pulses are received from the CPU 20.

  The monitoring circuit 32 determines whether or not the main microcomputer 2 (CPU 20) is abnormal based on the reception interval of the WD pulse from the CPU 20 (S13). The monitoring circuit 32 indicates that the CPU 20 (main microcomputer 2) is abnormal when the reception interval of the WD pulse from the CPU 20 is shorter than the preset WD pulse output period by a predetermined time or longer than the predetermined time. Judge.

  When the monitoring circuit 32 determines that the main microcomputer 2 is normal (S13: NO), the sub-microcomputer 3 returns the process to step S11, stores the current control state in the main microcomputer 2 in the memory 31, The monitoring of the reception state of the WD pulse from the CPU 20 of the main microcomputer 2 is continued. When the monitoring circuit 32 determines that the main microcomputer 2 is abnormal (S13: YES), the monitoring circuit 32 outputs a reset signal to the CPU 20 of the main microcomputer 2. (S14)

  The monitoring circuit 32 instructs the CPU 30 to start the operation of the power management ECU, and the CPU 30 sets its own output terminal as an output port (S15). When the CPU 20 of the main microcomputer 2 acquires a reset signal from the monitoring circuit 32 of the sub microcomputer 3, the CPU 20 sets the output terminal as an input port. The CPU 30 reads the control state stored in the memory 31, that is, the control state immediately before the monitoring circuit 23 detects the abnormality of the main microcomputer 2 (S16), and outputs the output value corresponding to the read control state to the control specification table. 33 is read out and output to the drive circuit 4 (S17), and the process is terminated.

  Thereby, even if it is a case where abnormality has generate | occur | produced in the main microcomputer 2, ECU1 can control a control object by the process based on the control state in the main microcomputer 2 immediately before by the submicrocomputer 3. FIG. Therefore, even when an abnormality occurs in the main microcomputer 2, the process can be seamlessly shifted from the control by the main microcomputer 2 to the control by the sub-microcomputer 3, and the controlled object can be controlled safely.

  In the ECU 1 according to the second embodiment, after an abnormality occurs in the main microcomputer 2 and the control of the control object by the main microcomputer 2 is switched to the control of the control object by the sub-microcomputer 3, the main microcomputer 2 immediately before the abnormality occurs is switched. The output value corresponding to the control state is fixed. Therefore, in addition to the above-described configuration, whether the output value output from the sub-microcomputer 3 after an abnormality has occurred in the main microcomputer 2 is set to the output value defined in the control specification table 33, for example, input by an input operation by a driver You may provide the structure which switches whether it is set as the set value.

  In the ECU 1 according to the second embodiment, when an abnormality occurs in the main microcomputer 2, the CPU 30 of the sub-microcomputer 3 stores the control of the main microcomputer 2 immediately before the abnormality occurs, which is stored in the memory 31 of the sub-microcomputer 3. The controlled object was controlled based only on the state. In addition, for example, the control state in the main microcomputer 2 (CPU 20) is accumulated for a predetermined time in the memory 31 of the sub-microcomputer 3, and when an abnormality occurs in the main microcomputer 2, it is accumulated in the memory 31. Based on the control state, the control state when the CPU 30 of the sub-microcomputer 3 controls the control target may be determined.

  For example, if the control state in the main microcomputer 2 is in the normal state for 10 minutes immediately before the abnormality occurs in the main microcomputer 2, the control target is controlled by processing based on the normal state even after the abnormality occurs in the main microcomputer 2. It is often preferable. Therefore, in this case, the CPU 30 of the sub-microcomputer 3 may output an output value corresponding to the normal state. As described above, the sub-microcomputer 3 controls the control target based not only on the control state in the main microcomputer 2 immediately before the abnormality occurs in the main microcomputer 2 but also on the control state continued for a long time (predetermined period). It is possible to control the controlled object while ensuring more safety.

  In the first and second embodiments described above, the output signal from the CPU 20 or the control state in the main microcomputer 2 is stored in the memory 31 of the sub-microcomputer 3. In addition, for example, a memory such as an EEPROM may be provided separately from the sub-microcomputer 3, and an output signal from the CPU 20 or a control state in the main microcomputer 2 may be stored in this memory. In this case, when the monitoring circuit 32 detects an abnormality of the main microcomputer 2, the CPU 30 of the sub-microcomputer 3 may read the output signal from the CPU 20 or the control state in the main microcomputer 2 from an external memory.

  In the first and second embodiments described above, the ECU 1 has two microcomputers 2 and 3. However, the processing apparatus of the present application is not limited to such a configuration, and more stable processing can be performed by mounting three or more microcomputers in the ECU 1.

  The disclosed embodiments should be considered as illustrative in all points and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

1 ECU (Processor)
2 Main microcomputer 20 CPU (Processor)
3 Sub-microcomputer 30 CPU (Processor)
31 Memory (holding unit)
32 Monitoring circuit (abnormality detection unit, output stop unit)

Claims (6)

In a processing apparatus comprising: a plurality of processing units that perform signal processing; and an abnormality detection unit that detects an abnormal operation of the one processing unit based on a signal periodically output from the one processing unit.
A holding unit that holds a signal output by the one processing unit executing signal processing;
An output stop unit that stops output of a signal when the one processing unit executes signal processing when the abnormality detecting unit detects an abnormality in operation of the one processing unit;
When the output stop unit stops the output of the signal from the one processing unit, the other processing unit has the holding unit before the abnormality detection unit detects an abnormality in the operation of the one processing unit. The processing apparatus is characterized in that the signal held by is output to the outside. The holding unit is configured to accumulate a signal output from the one processing unit over a predetermined time,
The other processing unit is configured to output a signal based on a signal accumulated by the holding unit over a predetermined time before the abnormality detection unit detects an abnormality in the operation of the one processing unit. The processing apparatus according to claim 1. A plurality of processing units that perform signal processing corresponding to each of a plurality of control states, and an abnormality detection unit that detects an abnormality in the operation of the one processing unit based on a signal periodically output from the one processing unit A processing apparatus comprising:
A holding unit for holding a control state of the signal processing being executed by the one processing unit;
An output stop unit that stops output of a signal when the one processing unit executes signal processing when the abnormality detecting unit detects an abnormality in operation of the one processing unit;
When the output stop unit stops the output of the signal from the one processing unit, the other processing unit has the holding unit before the abnormality detection unit detects an abnormality in the operation of the one processing unit. A processing apparatus is characterized in that signal processing corresponding to a control state held by the computer is executed. The holding unit accumulates the control state of the signal processing being executed by the one processing unit over a predetermined time,
The other processing unit performs signal processing according to a control state based on a control state accumulated by the holding unit for a predetermined time before the abnormality detection unit detects an abnormality in the operation of the one processing unit. The processing apparatus according to claim 3, wherein the processing apparatus is configured as described above. A processing apparatus comprising: a plurality of processing units that perform signal processing; and an abnormality detection unit that detects an abnormality in operation of the one processing unit based on a signal periodically output from the one processing unit. In the control method when outputting the signal output by the processing unit of the signal processing to the outside,
Holding the signal output by the one processing unit performing signal processing;
When the abnormality detection unit detects an abnormality in the operation of the one processing unit, the step of stopping the output of the signal by the one processing unit executing signal processing;
When the output of the signal from the one processing unit is stopped by another processing unit, the signal held before the abnormality detection unit detects an abnormality in the operation of the one processing unit to the outside And a step of outputting. A plurality of processing units that perform signal processing corresponding to each of a plurality of control states, and an abnormality detection unit that detects an abnormality in the operation of the one processing unit based on a signal periodically output from the one processing unit In a control method for outputting a signal output by executing the signal processing by the one processing unit to the outside,
Holding the control state of the signal processing being executed by the one processing unit;
When the abnormality detection unit detects an abnormality in the operation of the one processing unit, the step of stopping the output of the signal by the one processing unit executing signal processing;
Depending on the control state held by the abnormality detection unit before detecting an abnormality in the operation of the one processing unit when the output of the signal from the one processing unit is stopped by another processing unit And a step of executing the signal processing.

Images