JP2011227786A - Microcomputer control system, charging device using the same and photovoltaic power supply system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a microcomputer control system for recognizing the runaway state even when any of a plurality of microcomputers installed in a microcomputer control system falls into a runaway state.SOLUTION: In a microcomputer control system equipped with a plurality of microcomputers 5 and 6, the plurality of microcomputers 5 and 6 are respectively provided with: operation confirmation signal generation parts 7 and 8 for generating operation confirmation signals A1 and A2 for transmitting self-operation states to the other microcomputers 6 and 5; and operation state recognition parts (operation state determination control parts 9 and 10) for recognizing the operation states of the other microcomputers 6 and 5 based on the operation confirmation signals A2 and A1 from the other microcomputers 6 and 5.

Description

  The present invention relates to a microcomputer control system including a plurality of microcomputers for controlling different control objects, and in particular, a microcomputer control system mounted on a device that requires safety, such as a high-capacity charger or a power generation system. About.

  2. Description of the Related Art Conventionally, in a microcomputer control system having two microcomputers for controlling different control objects, one microcomputer is equipped with a monitoring program for monitoring the operation result of the other microcomputer. The monitoring program determines whether there is an abnormality in the other microcomputer and incorporates an instruction to generate a watchdog pulse periodically in the monitoring program of one microcomputer, and the watchdog timer captures the watchdog pulse. In order to detect whether there is an abnormality in the monitoring program of one microcomputer, it is proposed to determine whether there is an abnormality in the monitoring program of one microcomputer (see, for example, Patent Document 1).

Japanese Patent Laid-Open No. 2002-227661

  As described above, in a microcomputer control system including two microcomputers that control different control objects, a system that monitors the presence or absence of an abnormality of a microcomputer with a watchdog timer has been conventionally proposed.

  However, the watchdog timer can detect the stop of the microcomputer but cannot detect the runaway. A runaway is a program that deviates from a predetermined flow. For example, the process may be repeated without exiting from a subroutine. The conventional configuration of monitoring a microcomputer with a watchdog timer could not cope with runaway.

  In view of the above-described conventional problems, the present invention provides a microcomputer control system including a plurality of microcomputers that control different control targets. An object of the present invention is to provide a microcomputer control system capable of recognizing the runaway state when the runaway state deviates, and a charging device and a solar power supply system using the microcomputer control system.

  The microcomputer control system according to the present invention is a microcomputer control system including a plurality of microcomputers, and each of the plurality of microcomputers transmits an operation confirmation signal to another microcomputer. And an operation state recognizing unit for recognizing the operation state of the other microcomputer based on an operation confirmation signal from another microcomputer. A pulse signal or a serial code signal can be used as the operation confirmation signal.

  According to another aspect of the present invention, in the microcomputer control system of the present invention described above, the operation state recognition unit of each of the plurality of microcomputers is configured based on an operation confirmation signal from another microcomputer. When the computer recognizes that it is in a runaway state, an overall stop signal for stopping the operation of the microcomputer control system is generated.

  According to another aspect of the present invention, in the microcomputer control system of the present invention described above, the microcomputer control system includes a plurality of subsystems, and one microcomputer is provided in each of the plurality of subsystems. When the operation state recognition unit of each of the plurality of microcomputers recognizes that the other microcomputer is in a runaway state based on an operation confirmation signal from the other microcomputer, the other microcomputer An individual stop signal for stopping the operation of the subsystem provided with is generated. All or a part of the plurality of microcomputers may stop the operation of the subsystem provided with the microcomputer by an individual stop signal when other microcomputers recognize that the microcomputer is in a runaway state.

  According to another aspect of the present invention, in the microcomputer control system of the present invention described above, the microcomputer control system includes a plurality of subsystems, and the safety device for electrically disconnecting the plurality of subsystems from a power source. Each of the plurality of subsystems is provided with one microcomputer, and the operation state recognition unit of each of the plurality of microcomputers is based on an operation confirmation signal from another microcomputer. When another microcomputer recognizes that it is in a runaway state, an operation signal for operating the safety device is generated to electrically disconnect the plurality of subsystems from the power source.

  According to another aspect of the present invention, in the microcomputer control system of the present invention described above, the microcomputer control system includes a plurality of subsystems, and the safety device for electrically disconnecting the plurality of subsystems from a load. Each of the plurality of subsystems is provided with one microcomputer, and the operation state recognition unit of each of the plurality of microcomputers is based on an operation confirmation signal from another microcomputer. When another microcomputer recognizes that it is in a runaway state, an operation signal for operating the safety device is generated to electrically disconnect the plurality of subsystems from the load.

  According to another aspect of the present invention, in the microcomputer control system of the present invention described above, the operation state recognition unit of each of the plurality of microcomputers is based on an operation confirmation signal from another microcomputer. When the microcomputer is recognized as being in a runaway state, a reset signal for resetting the other microcomputer to an initial state is generated.

  According to another aspect of the present invention, in the microcomputer control system of the present invention described above, the operation state recognition unit of each of the plurality of microcomputers prevents the microcomputer from being reset to an initial state. The reset prevention signal is generated when another microcomputer recognizes that it is in a runaway state.

  Further, according to another aspect of the present invention, in the microcomputer control system of the present invention described above, a reset blocking unit for blocking transmission of a reset signal from another microcomputer is provided outside each of the plurality of microcomputers. And each of the plurality of microcomputers prevents a reset prevention unit provided outside the microcomputer from being operated by a reset prevention signal.

  The charging device of the present invention includes the microcomputer control system of the present invention described above.

  The solar power supply system of the present invention is characterized by including the microcomputer control system of the present invention described above, particularly a microcomputer control system including a safety device.

  According to a preferred embodiment of the present invention, even if any one of a plurality of microcomputers provided in the microcomputer control system falls into a runaway state in which the process is repeated without exiting from a certain subroutine, the runaway occurs. Recognizing the status, it is possible to stop the operation of the entire microcomputer control system, stop the operation of the subsystem provided with the microcomputer in the runaway state, and disconnect the subsystem from the power supply. The safety of the microcomputer control system can be increased. Further, the microcomputer in the runaway state can be reset to the initial state.

1 is a configuration diagram of a microcomputer control system according to Embodiment 1 of the present invention. The figure which shows an example of the operation confirmation signal in Embodiment 1 of this invention The figure which shows an example of the cooperation of the communication between microcomputers in Embodiment 1 of this invention The figure which shows an example of the cooperation of the communication between microcomputers in Embodiment 1 of this invention The figure which shows an example of the cooperation of the communication between microcomputers in Embodiment 1 of this invention The block diagram of the microcomputer control system in Embodiment 2 of this invention The block diagram of the other example of the microcomputer control system in Embodiment 2 of this invention Configuration diagram of charging apparatus according to Embodiment 3 of the present invention Configuration diagram of microcomputer control system in Embodiment 4 of the present invention Configuration diagram of charging apparatus according to Embodiment 5 of the present invention The block diagram of the microcomputer control system in Embodiment 6 of this invention Configuration diagram of charging apparatus according to Embodiment 7 of the present invention The block diagram of the microcomputer control system in Embodiment 8 of this invention Configuration diagram of charging apparatus according to Embodiment 9 of the present invention Configuration diagram of charging apparatus according to Embodiment 10 of the present invention The block diagram of the solar power supply system in Embodiment 11 of this invention

  Embodiments of the present invention will be described below with reference to the drawings. In the following embodiments, a microcomputer control system including two microcomputers that control different control objects will be described as an example. However, the number of microcomputers is not limited to two.

(Embodiment 1)
FIG. 1 shows a configuration diagram of the microcomputer control system according to the first embodiment of the present invention. As shown in FIG. 1, the microcomputer control system 1 according to the first embodiment includes a first subsystem 2, a second subsystem 3, and an overall system control unit that controls the entire microcomputer control system 1. 4, the first subsystem 2 includes a first microcomputer 5, and the second subsystem 3 includes a second microcomputer 6. Hereinafter, the microcomputer is referred to as a microcomputer. Further, the microcomputer control system 1 may be referred to as the entire system 1.

  The microcomputers 5 and 6 are the operation confirmation signal generators 7 and 8 that generate the operation confirmation signals A1 and A2 for transmitting their operation states to the other microcomputers 6 and 5, and the operations from the other microcomputers 6 and 5. Based on the confirmation signals A2 and A1, operation state determination control units 9 and 10 are provided for determining whether or not the other microcomputers 6 and 5 are in a runaway state.

  The operation confirmation signals A1 and A2 are signals corresponding to the operation states of the microcomputers 5 and 6. A pulse signal or a serial code signal can be used for the operation confirmation signals A1 and A2. The operation state determination control units 9 and 10 are an example of an operation state recognition unit that recognizes the operation state of the other microcomputer based on an operation confirmation signal from the other microcomputer.

  The microcomputers 5 and 6 receive the operation confirmation signal output terminals 11 and 12 for transmitting the operation confirmation signals A1 and A2 to the other microcomputers 6 and 5, and the operation confirmation signals A2 and A1 from the other microcomputer. Operation confirmation signal input terminals 13 and 14 for the microcomputer 5, the operation confirmation signal output terminal 11 of the microcomputer 5 is connected to the operation confirmation signal input terminal 14 of the microcomputer 6, and the operation confirmation signal output terminal 12 of the microcomputer 6 is connected to the microcomputer 5. The operation check signal input terminal 13 is connected to each.

  Depending on the communication method between the microcomputers 5 and 6, operation confirmation for transmitting / receiving operation confirmation signals between the microcomputers 5 and 6 instead of the operation confirmation signal output terminals 11 and 12 and the operation confirmation signal input terminals 13 and 14 is possible. Signal input / output terminals may be provided in the microcomputers 5 and 6.

  In the first embodiment, when the operation state determination control units 9 and 10 determine (recognize) that the other microcomputers 6 and 5 are in a runaway state based on the operation confirmation signals A2 and A1, the operation of the entire system 1 is performed. The total stop signals B1 and B2 to be stopped are generated.

  The microcomputers 5 and 6 are provided with overall stop signal output terminals 15 and 16 for transmitting overall stop signals B1 and B2. Both of the overall stop signal output terminals 15 and 16 are connected to the system overall control unit 4. ing. The overall stop signals B1 and B2 are transmitted to the overall system control unit 4 via the overall stop signal output terminals 15 and 16. When receiving either one of the overall stop signals B1 and B2, the overall system control unit 4 stops the operation of the overall system 1.

  When the operation state determination control units 9 and 10 determine that the other microcomputers 6 and 5 are in a runaway state based on the operation confirmation signals A2 and A1, the reset signal resets the other microcomputers 6 and 5 to the initial state. C1 and C2 are generated.

  The microcomputers 5 and 6 have reset signal output terminals 17 and 18 for transmitting reset signals C1 and C2 and reset signal input terminals for receiving reset signals C2 and C1 from the other microcomputers 6 and 5 (see FIG. The reset signal output terminal 17 of the microcomputer 5 is connected to the reset signal input terminal of the microcomputer 6, and the reset signal output terminal 18 of the microcomputer 6 is connected to the reset signal input terminal of the microcomputer 5, respectively. . The reset signals C1 and C2 are transmitted to the reset signal input terminals of the other microcomputers 6 and 5 via the reset signal output terminals 17 and 18, respectively.

  The microcomputers 5 and 6 include reset units 19 and 20 that return their state to the initial state. The reset units 19 and 20 receive reset signals C2 from the other microcomputers 6 and 5 via a reset signal input terminal. When C1 is received, the state of the microcomputers 5 and 6 is returned to the initial state.

  Next, the operation confirmation signal will be described. For example, a pulse signal can be adopted as the operation confirmation signal. In order to transmit the operation state of the microcomputer to other microcomputers with a pulse signal, for example, a command for setting a flag when each normal process is completed is added to a program of the microcomputer that repeats a plurality of normal processes in a certain order. In addition, every time all normal processing cycles through the microcomputer program, the flag group is checked, and if all the flags are set, the flag group is reset after generating a pulse, and some of all the flags are reset. If not standing, add a command to reset the flags without generating a pulse. Then, a program is constructed so that normal processing is resumed after completion of resetting the flag group.

  In this way, when the microcomputer is operating normally, a pulse is generated every time the entire normal process is completed. On the other hand, when the microcomputer goes into a runaway state, a pulse may not be generated, so that the runaway state can be recognized by another microcomputer. For example, the presence or absence of a runaway state can be determined based on whether or not the period of the received pulse is within a predetermined allowable range.

  Further, for example, the above-described flag group confirmation processing, pulse generation / non-occurrence processing, and flag group reset processing are executed by a timer interrupt every predetermined time from the start of the head normal processing. After that, the head normal process may be started. The predetermined time is set to be longer than the time required for all normal processes.

  In this way, a pulse is generated when all the normal processes are completed at the time when the process of checking the flag group is executed, but no pulse is generated otherwise. Whether or not there is a runaway state can be determined based on whether or not the cycle of the pulse is longer than a preset time. In addition, it is possible to cope with a runaway in which the time required for one normal process is longer than expected, and the cycle of the pulse fluctuates more than twice in the runaway state. Can be judged.

  For example, each normal process may be divided into time. For example, when a normal process is assigned a count value in advance, the timer starts counting from the start of the first normal process, and the normal process does not end by the count value assigned thereto, the normal process flag May not be set up. The flag group confirmation process, the pulse generation / non-occurrence process, and the flag group reset process are executed by a timer interrupt.

  In this way, a pulse is generated when there is a normal process that has not been completed within a predetermined time period even though all the normal processes have been completed when the process for checking the flag group is executed. Therefore, the presence or absence of runaway can be determined more accurately.

  In addition, when dividing each normal process in this way, it is possible to ensure the immediacy of the emergency process and manage the order of the normal process if it is not shifted to the next normal process unless a flag is set. You can also.

  The normal process may be divided into a plurality of groups, and the flag group confirmation process, the pulse generation / non-occurrence process, and the flag group reset process may be executed at the end of each group.

  Also, when checking the pulse period and determining the presence or absence of a runaway state, the time corresponding to one pulse period may be used, but an erroneous determination due to the influence of noise on the operation confirmation signal occurs. In order to avoid this, it is preferable to use a time corresponding to two or more periods of the pulse. FIG. 2 shows an example of an operation confirmation signal (pulse signal) when the presence or absence of runaway is determined using the time corresponding to two pulse periods.

  In FIG. 2, a broken line portion D indicates an operation confirmation signal during normal operation, a broken line portion E indicates an operation confirmation signal in a state where no pulse is generated for one cycle due to noise, and a broken line portion F indicates a pulse for two cycles. The operation confirmation signals in a state where no occurrence has occurred are shown. When determining the presence or absence of runaway using the time corresponding to two cycles of the pulse, if the operation confirmation signal is in the state of broken lines D and E, it is not determined that the microcomputer is running out of control, and the state of broken line E Is determined to be in a runaway state.

  In addition, the determination method of the presence or absence of the runaway state is not limited to the method of confirming the cycle of the pulse. For example, the number of pulses is counted for each predetermined cycle, and the microcomputer runs away according to the count number. It may be determined whether or not.

  Also, here, during normal operation, when all normal processing ends, the signal level changes from L level to H level, and the pulse level changes from H level to L level before the start of normal processing at the beginning. However, conversely, when all the normal processing ends, the signal level changes from the H level to the L level, and the signal level changes from the L level to the H level before the head normal processing is started. A transition pulse signal may be generated.

  Further, although the case where the pulse signal is generated as the operation confirmation signal has been described, for example, after the flag group confirmation processing, a serial code signal may be generated instead of the pulse signal. The serial communication can be realized by a known technique such as I2C, UART, or 3-wire serial.

  When a serial code signal is employed as the operation confirmation signal, for example, a serial code signal indicating a different code may be generated depending on whether all flags are set. The two types of codes may be generated with reference to a table, for example.

  Further, for example, the serial code to be transmitted may be changed according to the received serial code. For example, the result of calculating the received serial code is transmitted. Specifically, when a serial code indicating “0” is received from the microcomputer that has started processing, a serial code indicating “1” is transmitted, and when a serial code indicating “1” is received, “2” is set. When the serial code indicating “2” is transmitted, the serial code indicating “3” may be transmitted. In this way, when the scheduled code cannot be received from the counterpart microcomputer, it can be determined that the counterpart microcomputer is in a runaway state.

  Furthermore, when a scheduled code cannot be received from the partner microcomputer, it is not immediately determined that the partner microcomputer is in a runaway state, but a predetermined code is transmitted and the result of calculating the predetermined code is calculated. The presence or absence of a runaway state may be determined based on whether or not the serial code shown can be received. In this way, it is possible to suppress the occurrence of erroneous determination due to the influence of noise on the operation confirmation signal. Note that the number of times of continuing the process of transmitting a predetermined code when a scheduled code cannot be received is not limited to one, and may be continued a plurality of times.

  For example, when the state where all the flags are set continues, the code may be changed every time the serial code is generated. In this way, it is possible to improve the accuracy of determining whether or not there is a runaway state.

  Further, for example, a serial code serving as a code corresponding to the state of the flag group may be generated. In this way, it is possible to recognize which process has a problem.

  Subsequently, the operation of the microcomputer control system 1 according to the first embodiment will be described by taking an example in which the operation confirmation signal is a pulse signal. For example, when the second microcomputer 6 runs out of control, no pulse is generated from the operation confirmation signal generator 8 of the second microcomputer 6, and the operation state determination controller 9 of the first microcomputer 5 It is determined that the second microcomputer 6 is in a runaway state by confirming the cycle of the pulses received from, and the entire stop signal B1 and the reset signal C1 are generated.

  The overall stop signal B1 is transmitted to the overall system control unit 4 via the overall stop signal output terminal 15 of the first microcomputer 5. When receiving the overall stop signal B1 from the first microcomputer 5, the overall system control unit 4 stops the operation of the overall system 1.

  On the other hand, the reset signal C <b> 1 is transmitted to the second microcomputer 6 via the reset signal output terminal 17 of the first microcomputer 5. When receiving the reset signal C1 from the first microcomputer 5, the reset unit 20 of the second microcomputer 6 resets the second microcomputer 6 to an initial state.

  Thus, when the second microcomputer 6 runs away, the second microcomputer 6 can be returned to the initial state and the operation of the entire system 1 can be stopped. When the first microcomputer 5 runs away, the operation is the same as when the second microcomputer 6 runs away.

  Next, the processing linkage between the first microcomputer 5 and the second microcomputer 6 will be described by taking an example in which the operation confirmation signals A1 and A2 are pulse signals. For example, after both the microcomputers 5 and 6 have performed the reception processing of the pulses from the other microcomputers 6 and 5, the normal processing is performed and the operation status is confirmed by checking the flag group, and the pulse Occurrence / non-occurrence processing and flag group reset processing may be performed. That is, the first microcomputer 5 and the second microcomputer 6 may execute processing alternately.

  An example of this communication linkage is shown in FIG. In FIG. 3, RX indicates a pulse reception process, and TX indicates a pulse transmission process. As shown in FIG. 3, the microcomputers 5 and 6 execute the pulse reception process RX from the other microcomputers 6 and 5, execute the normal process, and then execute the pulse transmission process TX. Further, after executing the pulse transmission process TX, the microcomputers 5 and 6 stand by without executing the normal process until the pulse reception process RX from the other microcomputers 6 and 5 is executed. The pulse reception process RX is executed at predetermined intervals by a timer interrupt.

  However, when the first microcomputer 5 and the second microcomputer 6 execute processing alternately as described above, a standby time occurs as is apparent from FIG. Therefore, for example, in one microcomputer, the pulse transmission process may be executed immediately after the pulse reception process. In this way, the first microcomputer 5 and the second microcomputer 6 can execute normal processing simultaneously.

  An example of this communication linkage is shown in FIG. In FIG. 4, RX indicates a pulse reception process, and TX indicates a pulse transmission process. As shown in FIG. 4, the first microcomputer 5 executes the pulse reception process RX from the second microcomputer 6, and then immediately executes the pulse transmission process TX and then executes the normal process. On the other hand, the second microcomputer 6 executes a normal process from the execution of the pulse reception process RX from the first microcomputer 5 to the execution of the pulse transmission process TX.

  However, in this way, when one of the microcomputers executes the pulse transmission process immediately after the pulse reception process, as shown in FIG. 4, the second microcomputer 6 uses the first microcomputer 5 as the pulse reception process. From the time when RX is executed until the time when the pulse transmission process TX is executed, a standby state is entered. Therefore, for example, even in one of the microcomputers, the pulse transmission process is not performed immediately after the pulse reception process, but the pulse reception process is performed and then the normal process is performed and then the pulse transmission process is performed. Processing may be executed. In this way, both the microcomputers 5 and 6 can suppress the standby time.

  An example of this communication linkage is shown in FIG. In FIG. 5, RX indicates a pulse reception process, and TX indicates a pulse transmission process. As shown in FIG. 5, the interval between the pulse reception process RX and the pulse transmission process TX may be changed.

  As described above, in the first embodiment, the first microcomputer 5 and the second microcomputer 6 monitor the operation state of each other, and based on the monitoring result, the runaway microcomputer is reset and the operation of the entire system 1 is performed. It can be stopped and the safety of the entire system 1 can be improved.

  In addition, although both the first microcomputer 5 and the second microcomputer 6 set a flag at the end of each normal process and confirmed their own operating state by checking the flag group, It is also possible to simplify the process of checking the operation state of the microcomputer.

  For example, when the second microcomputer 6 is simplified, the operation confirmation signal A2 may be generated based only on the process of determining whether or not the first microcomputer 5 is in a runaway state. Alternatively, in the case where a serial code signal is used as the operation confirmation signal, the operation confirmation signal A2 may be generated based only on the arithmetic processing of the serial code when the result obtained by computing the received serial code is transmitted.

(Embodiment 2)
Next, a second embodiment of the present invention will be described. However, differences from the first embodiment will be mainly described, and points overlapping with the matters described in the first embodiment will be omitted or simply described.

  FIG. 6 shows a configuration diagram of the microcomputer control system according to the second embodiment of the present invention. In addition, the same code | symbol is attached | subjected about the element corresponding to the element demonstrated in the said Embodiment 1. FIG.

  In the microcomputer control system according to the second embodiment, when the operation state determination control units 9 and 10 determine (recognize) that the other microcomputers 6 and 5 are in a runaway state based on the operation confirmation signals A2 and A1. The point that the reset prevention signals G1 and G2 are generated in addition to the entire stop signals B1 and B2 and the reset signals C1 and C2 is different from the first embodiment.

  The reset prevention signal G1 generated in the first microcomputer 5 is a signal that prevents the first microcomputer 5 from being reset to the initial state, and is transmitted to the reset unit 19 of the first microcomputer 5. On the other hand, the reset prevention signal G2 generated in the second microcomputer 6 is a signal that prevents the second microcomputer 6 from being reset to the initial state, and is transmitted to the reset unit 20 of the second microcomputer 6.

  When the reset unit 19 of the first microcomputer 5 receives the reset prevention signal G1 from the operation state determination control unit 9, the reset unit 19 enters an operation disabled state. Similarly, when the reset unit 20 of the second microcomputer 6 receives the reset prevention signal G2 from the operation state determination control unit 10, the reset unit 20 enters an operation disabled state.

  Next, the operation of the microcomputer control system 1 in the second embodiment will be described. For example, when the second microcomputer 6 runs away, the operation state determination control unit 9 of the first microcomputer 5 determines that the second microcomputer 6 is in a runaway state based on the operation recognition signal A2, and the entire stop signal B1. The reset signal C1 and the reset prevention signal G1 are generated.

  Then, the overall system control unit 4 receives the overall stop signal B1 from the first microcomputer 5 and stops the operation of the entire system 1, and the reset unit 20 of the second microcomputer 6 resets from the first microcomputer 5. Receiving the signal C1, the second microcomputer 6 is reset to the initial state. Further, the reset unit 19 of the first microcomputer 5 receives the reset prevention signal G1 from the operation state determination control unit 9 and becomes inoperable.

  Therefore, even if the reset signal C2 is erroneously transmitted from the second microcomputer 6 in the runaway state, the reset unit 19 of the first microcomputer 5 does not erroneously reset the first microcomputer 5 to the initial state. Therefore, the first microcomputer 5 can be protected. When the first microcomputer 5 runs away, the operation is the same as when the second microcomputer 6 runs away.

  As the reset prevention signal, for example, in the case of a specification in which a reset operation is performed when the reset unit receives an L level voltage signal, an H level voltage signal may be used. On the other hand, in the case of a specification in which a reset operation is performed when the reset unit receives an H level voltage signal, an L level voltage signal may be used as the reset prevention signal.

  As described above, in the second embodiment, the first microcomputer 5 and the second microcomputer 6 monitor the operation state of each other, and the runaway microcomputer is reset according to the monitoring result and the operation of the entire system 1 is performed. In addition, it is possible to avoid a malfunction in which a normally operating microcomputer is reset by a microcomputer that has runaway, and the safety of the entire system 1 can be improved.

  That is, in the first embodiment, depending on the noise characteristics of the microcomputer and the system itself and the usage environment, when the microcomputer runs away and its operation state becomes unstable, a reset signal is erroneously generated. If the normally operating microcomputer is reset, the microcomputer that has runaway may be reset and the operation of the entire system 1 may not be stopped.

  On the other hand, in the second embodiment, when one microcomputer recognizes the runaway of the other microcomputer, a reset prevention signal for preventing the reset operation of the one microcomputer is generated. It can be avoided that the microcomputer being reset is erroneously reset, and the microcomputer that has runaway cannot be reset and the operation of the entire system 1 cannot be stopped.

  Although the case where the H level or L level voltage signal is transmitted to the reset unit as the reset prevention signal has been described, the reset operation may be invalidated programmatically. For example, a control program that prevents the reset unit from performing a reset operation is prepared separately, and when a reset signal is input to the storage unit of the control program, the control program operates to make the reset unit inoperable. It may be.

  Further, a protection circuit may be separately provided outside the microcomputer so that the reset unit does not perform the reset operation. For example, as shown in FIG. 7, reset prevention signal output terminals 21 and 22 for transmitting reset prevention signals G1 and G2 are provided to the microcomputers 5 and 6, respectively, and reset prevention units are provided outside the microcomputers 5 and 6, respectively. 23 and 24 may be provided, and the reset prevention signal output terminals 21 and 22 and the reset prevention units 23 and 24 may be connected.

  In this case, reset prevention signals G1 and G2 generated from the microcomputers 5 and 6 operate the reset prevention units 23 and 24, and reset signals C2 and C1 from the other microcomputers 6 and 5 are reset by the microcomputers 5 and 6, respectively. 19 and 20 are prevented, and the microcomputers 5 and 6 are prevented from being reset to the initial state. The reset prevention units 21 and 22 can be realized by, for example, a switch element.

(Embodiment 3)
Subsequently, Embodiment 3 of the present invention will be described. In addition, about the point which overlaps with the matter demonstrated in the said Embodiment 1 and 2, the description is abbreviate | omitted or only demonstrated.

  FIG. 8 shows a configuration diagram of a charging apparatus according to Embodiment 3 of the present invention. The microcomputer control system according to the second embodiment is applied to the charging device 25. In FIG. 8, elements corresponding to those described in the first and second embodiments are denoted by the same reference numerals.

  The charging device 25 is an AC / DC converter, and is connected to a driving power source 26 that is an AC power source and a battery 27 that is a charging target. The charging device 25 converts the AC voltage from the drive power supply 26 into a DC voltage, and charges the battery 27 with the converted DC voltage.

  In the third embodiment, the AC / DC converter that is the charging device 25 includes two microcomputers 5 and 6, and the functions of the AC / DC converter are distributed to the two microcomputers 5 and 6. It is the composition made to do.

  That is, the charging device 25 includes an operation control unit 28 that controls the operation of the charging device 25, a current control unit 29 that controls a charging current supplied from the charging device 25 to the battery 27, and an input / output state of the charging device 25. An input / output control unit 30 for controlling is provided.

  Here, the charging device 25 is the entire system 1 in the second embodiment, the operation control unit 28 is the first subsystem 2 in the second embodiment, and the current control unit 29 is the second embodiment. Corresponds to the second subsystem 3 in FIG. That is, the first microcomputer 5 is mounted on the operation control unit 28, and the second microcomputer 6 is mounted on the current control unit 29.

  Further, the input / output control unit 30 includes a stop unit 31 corresponding to the overall system control unit 4 in the second embodiment. The stop unit 31 stops the operation of the charging device 25 when receiving one of the overall stop signals B1 and B2 generated from the microcomputers 5 and 6.

  By configuring the charging device as described above, when one of the first microcomputer 5 and the second microcomputer 6 mounted on the operation control unit 28 and the current control unit 29 runs away, the runaway microcomputer is reset. In addition, the operation of the charging device can be stopped, and a malfunction in which the microcomputer that is operating normally by the microcomputer that has runaway can be avoided.

  For example, since a large current of 20 [mA] flows through a charging device for a large-capacity battery such as a forklift battery, if the microcomputer runs away, a fire may occur unless the operation of the charging device is stopped immediately. There is. On the other hand, in the third embodiment, the runaway microcomputer can be quickly stopped, and the safety of the charging device can be improved.

  In the third embodiment, the case where the microcomputer control system in the second embodiment is applied to the charging apparatus has been described. However, the microcomputer control system in the first embodiment is applied to the charging apparatus. May be.

(Embodiment 4)
Next, a fourth embodiment of the present invention will be described. However, points different from those of the first embodiment will be mainly described, and the description overlapping with the matters described in the first to third embodiments will be omitted or simply described.

  FIG. 9 shows a configuration diagram of the microcomputer control system according to the fourth embodiment of the present invention. In addition, the same code | symbol is attached | subjected about the element corresponding to the element demonstrated in the said Embodiment 1. FIG.

  In the microcomputer control system according to the fourth embodiment, the subsystems 2 and 3 are provided with subsystem overall controllers 32 and 33 in place of the system overall controller for controlling the entire system 1, and the microcomputers 5 and 6 are entirely The individual stop signal output terminals 34 and 35 are provided instead of the stop signal output terminals, and the operation state determination control units 9 and 10 generate the individual stop signals H1 and H2 instead of the entire stop signal. Different from the first embodiment.

  Specifically, the subsystem overall control unit 32 controls the operation of the entire subsystem 2, and the subsystem overall control unit 33 controls the operation of the entire subsystem 3. When the operation state determination control units 9 and 10 determine (recognize) that the other microcomputers 6 and 5 are in a runaway state based on the operation confirmations A2 and A1, the operation state determination control units 9 and 10 generate individual stop signals H1 and H2 for stopping the operation of the subsystem. appear. The individual stop signal output terminals 34 and 35 are both connected to the subsystem overall control unit 32 and the subsystem overall control unit 33, and the individual stop signals H1 and H2 are sent to the subsystem overall control unit 32 and the subsystem overall control unit 33, respectively. Send to. The subsystem overall control units 32 and 33 stop the operations of the subsystems 2 and 3 when receiving either one of the individual stop signals H1 and H2.

  With the configuration described above, also in the microcomputer control system according to the fourth embodiment, the first microcomputer 5 and the second microcomputer 6 monitor the operation state of each other, as in the first embodiment. According to the monitoring result, the runaway microcomputer can be reset and the operation of the entire system 1 can be stopped, and the safety of the entire system 1 can be improved. The microcomputer control system according to the fourth embodiment may be equipped with the reset malfunction prevention function described in the second embodiment.

(Embodiment 5)
Next, a fifth embodiment of the present invention will be described. In addition, about the point which overlaps with the matter demonstrated in the said Embodiment 1 thru | or 4, the description is abbreviate | omitted or only demonstrated.

  FIG. 10 shows a configuration diagram of a charging apparatus according to Embodiment 5 of the present invention. The microcomputer control system in the fourth embodiment is applied to the charging device 36. In FIG. 10, elements corresponding to those described in the first to fourth embodiments are denoted by the same reference numerals.

  In the fifth embodiment, the charging device 36 includes an AC / DC converter 37 that converts an AC voltage into a DC voltage, and a DC / DC converter that converts the DC voltage converted by the AC / DC converter 37 into a desired voltage value. The drive power source 26 which is an AC power source is connected to the input side of the AC / DC converter 37, and the battery 27 to be charged is connected to the output side of the DC / DC converter 38, respectively. Therefore, the battery 27 is charged with the DC voltage converted by the DC / DC converter 38.

  The AC / DC converter 37 includes an AC / DC converter main circuit 39 that is a circuit that converts an alternating voltage into a direct voltage, and an AC / DC converter main circuit drive control that controls the conversion operation of the AC / DC converter main circuit 39. The unit 40 is provided.

  The DC / DC converter 38 is a DC / DC converter main circuit 41 that is a circuit that converts the DC voltage converted by the AC / DC converter 37 into a desired voltage value, and the conversion operation of the DC / DC converter main circuit 41. A DC / DC converter main circuit drive control unit 42 is provided.

  Here, the charging device 36 is in the whole system 1 in the fourth embodiment, the AC / DC converter 37 is in the first subsystem 2 in the fourth embodiment, and the DC / DC converter 38 is in the above-described embodiment. This corresponds to the second subsystem 3 in the fourth embodiment, and the first microcomputer 5 is mounted on the AC / DC converter main circuit 39 and the second microcomputer 6 is mounted on the DC / DC converter main circuit 41, respectively. .

  The AC / DC converter main circuit drive control unit 40 includes a stop unit 43 corresponding to the subsystem overall control unit 32 in the fourth embodiment, and the DC / DC converter main circuit drive control unit 42 has the above-described embodiment. A stop unit 44 corresponding to the subsystem overall control unit 33 in the fourth embodiment is provided. When receiving any one of the individual stop signals H1 and H2 generated from the microcomputers 5 and 6, the stop unit 43 stops the operation of the AC / DC converter 37. Similarly, when the stop unit 44 receives any one of the individual stop signals H1 and H2 generated from the microcomputers 5 and 6, the stop unit 44 stops the operation of the DC / DC converter 38.

  By configuring the charging device as described above, when either the first microcomputer 5 or the second microcomputer 6 mounted on the AC / DC converter 37 and the DC / DC converter 38 runs away, the microcomputer runs away. And the operation of the charging device can be stopped, and the safety of the charging device can be improved.

(Embodiment 6)
Subsequently, Embodiment 6 of the present invention will be described. However, differences from the fourth embodiment will be mainly described, and the points overlapping with the items described in the first to fifth embodiments will be omitted or simply described.

  FIG. 11 shows a configuration diagram of the microcomputer control system according to the sixth embodiment of the present invention. In addition, the same code | symbol is attached | subjected about the element corresponding to the element demonstrated in the said Embodiment 1 thru | or 5.

  In the microcomputer control system according to the sixth embodiment, the individual stop signal H1 generated by the operation state determination control unit 9 of the first microcomputer 5 is transmitted only to the subsystem overall control unit 33 provided in the subsystem 3. This is different from the fourth embodiment described above.

  With the configuration described above, in the microcomputer control system according to the sixth embodiment, when the first microcomputer 5 runs away, not only the first subsystem 2 in which the runaway microcomputer 5 is mounted but also operates normally. The operation of the second subsystem 3 equipped with the microcomputer 6 is also stopped, and the operation of the entire system 1 is stopped. On the other hand, when the second microcomputer 6 runs away, only the operation of the second subsystem 3 on which the runaway microcomputer 6 is mounted stops. Therefore, the portion where the operation is stopped can be suppressed to the minimum necessary level according to the importance and danger of the system in which the runaway microcomputer is mounted, and the safety and efficiency of the entire system 1 can be improved. The microcomputer control system according to the sixth embodiment may be equipped with the reset malfunction prevention function described in the second embodiment.

(Embodiment 7)
Subsequently, Embodiment 7 of the present invention will be described. In addition, about the point which overlaps with the matter demonstrated in the said Embodiment 1 thru | or 6, the description is abbreviate | omitted or only demonstrated.

  FIG. 12 shows a configuration diagram of a charging apparatus according to Embodiment 7 of the present invention. The microcomputer control system in the sixth embodiment is applied to the charging device 36. In FIG. 12, elements corresponding to those described in the first to sixth embodiments are given the same reference numerals.

  In the charging device according to the seventh embodiment, the individual stop signal H1 generated by the first microcomputer 5 provided in the AC / DC converter 37 is transmitted only to the stop unit 44 provided in the DC / DC converter 38. This is different from the fifth embodiment described above.

  By configuring the charging device as described above, when the first microcomputer 5 mounted on the AC / DC converter 37 runs away, the operations of the AC / DC converter 37 and the DC / DC converter 38 can be stopped. . That is, the operation of the charging device can be stopped. On the other hand, when the second microcomputer 6 mounted on the DC / DC converter 38 runs away, only the operation of the DC / DC converter 38 can be stopped.

  The reason for this configuration is as follows. That is, when the first microcomputer 5 mounted on the AC / DC inverter 37 goes out of control, the AC / DC inverter 37 goes out of control, and the DC voltage converted by the AC / DC converter 37 becomes abnormally large and the DC / DC Electronic components that are input to the DC converter 38 and constitute the DC / DC converter 38, in particular, diodes that constitute the DC / DC converter main circuit 41 may be destroyed. Therefore, when the first microcomputer 5 goes out of control, the operations of both the AC / DC converter 37 and the DC / DC converter 38 must be stopped. On the other hand, when the second microcomputer 6 mounted on the DC / DC converter 38 runs out of control, the AC / DC converter 37 is not affected by this, so that it is not necessary to stop the operation of the AC / DC converter 37. When the second microcomputer 6 runs away, only the operation of the DC / DC converter 37 may be stopped.

  According to the seventh embodiment, the runaway microcomputer can suppress the portion where the operation is stopped to the minimum necessary level, and the efficiency of the system can be improved while improving the safety of the charging device. .

(Embodiment 8)
Next, an eighth embodiment of the present invention will be described. However, the differences from the first embodiment will be mainly described, and the description overlapping with the matters described in the first to seventh embodiments will be omitted or simply described.

  FIG. 13 shows a configuration diagram of the microcomputer control system according to the eighth embodiment of the present invention. In addition, the same code | symbol is attached | subjected about the element corresponding to the element demonstrated in the said Embodiment 1. FIG.

  In the microcomputer control system according to the eighth embodiment, a safety device 45 for electrically disconnecting the subsystem 2 and the subsystem 3 from at least one of the power source and the load is used instead of the system overall control unit for controlling the entire system 1. The operation signals output terminals 46 and 47 are provided in the microcomputers 5 and 6 in place of the overall stop signal output terminals, and the operation state determination control units 9 and 10 are replaced by the safety device 45 in place of the overall stop signal. The point of generating the operation signals I1 and I2 for operating is different from the first embodiment.

  Specifically, the operation state determination control units 9 and 10 generate operation signals I1 and I2 when it is determined (recognized) that the other microcomputers 6 and 5 are in a runaway state based on the operation confirmations A2 and A1. The operation signal output terminals 46 and 47 are both connected to the safety device 45 and transmit the operation signals I 1 and I 2 to the safety device 45. When the safety device 45 receives one of the operation signals I1 and I2, the safety device 45 electrically disconnects the subsystem 2 and the subsystem 3 from at least one of the power supply and the load.

  As the safety device 45, for example, a switch element or the like that is normally in a short state and that is opened when one of the operation signals I1 and I2 is received can be used. In addition, it is also possible to use a fuse or the like that is normally in a conducting state and that is cut when receiving one of the operation signals I1 and I2.

  Next, the operation of the microcomputer control system 1 in the eighth embodiment will be described. For example, when the second microcomputer 6 runs away, the operation state determination control unit 9 of the first microcomputer 5 determines that the second microcomputer 6 is in a runaway state based on the operation recognition signal A2, and the operation signal I1 A reset signal C1 is generated.

  Then, the safety device 45 receives the operation signal I1 from the first microcomputer 5, electrically disconnects the subsystem 2 and the subsystem 3 from at least one of the power source and the load, and the reset unit 20 of the second microcomputer 6 Receives the reset signal C1 from the first microcomputer 5 and resets the second microcomputer 6 to the initial state.

  Thus, when the second microcomputer 6 runs away, the second microcomputer 6 can be returned to the initial state, and the subsystem 2 and the subsystem 3 can be electrically disconnected from at least one of the power source and the load. When the first microcomputer 5 runs away, the operation is the same as when the second microcomputer 6 runs away.

  As described above, in the eighth embodiment, the first microcomputer 5 and the second microcomputer 6 monitor the operating state of each other, and reset the runaway microcomputer according to the monitoring result. The subsystem 3 can be electrically disconnected from at least one of the power source and the load. The microcomputer control system according to the eighth embodiment may be equipped with the reset malfunction prevention function described in the second embodiment.

(Embodiment 9)
Subsequently, Embodiment 9 of the present invention will be described. In addition, about the point which overlaps with the matter demonstrated in the said Embodiment 1 thru | or 8, the description is abbreviate | omitted or only demonstrated.

  FIG. 14 shows a configuration diagram of a charging apparatus according to Embodiment 9 of the present invention. The charging device 48 is applied with the microcomputer control system in the eighth embodiment. In FIG. 14, elements corresponding to those described in the first to eighth embodiments are denoted by the same reference numerals.

  This charging device 48 includes an AC / DC converter 49 and a safety device 45, and the input side of the AC / DC converter 49 is connected to the drive power source 26 that is an AC power source via the safety device 45. Is connected to the battery 27 to be charged. The charging device 49 converts the AC voltage from the drive power supply 26 into a DC voltage by the AC / DC converter 49, and charges the battery 27 with the converted DC voltage.

  The AC / DC converter 49 is equipped with two microcomputers 5 and 6 as in the third embodiment, and the function of the AC / DC converter is distributed to the two microcomputers 5 and 6. It has a configuration.

  Here, the charging device 48 is in the entire system 1 in the eighth embodiment, and the operation control unit 28 of the AC / DC converter 49 is in the first subsystem 2 in the eighth embodiment. The current controller 29 corresponds to the second subsystem 3 in the eighth embodiment. That is, the first microcomputer 5 is mounted on the operation control unit 28, and the second microcomputer 6 is mounted on the current control unit 29.

  The safety device 45 electrically disconnects the AC / DC converter 49 from the drive power supply 26 when receiving one of the operation signals I1 and I2 generated from the microcomputers 5 and 6.

  By configuring the charging device as described above, when one of the first microcomputer 5 and the second microcomputer 6 mounted on the operation control unit 28 and the current control unit 29 runs away, the runaway microcomputer is reset. In addition, the AC / DC converter 49 can be electrically disconnected from the drive power supply 26.

  For example, since a large current of 20 [mA] flows through a charging device for a large-capacity battery such as a forklift battery, if the microcomputer runs away, a fire may occur if the charging device and the power source are not disconnected quickly. There is sex. On the other hand, in the ninth embodiment, when the microcomputer runs away, the AC / DC converter can be quickly disconnected from the power source, and the safety of the charging device can be improved.

  Note that the output side of the AC / DC converter 49 may be connected to the battery 27 as a load via the safety device 45. In this way, when the microcomputer runs away, the charging device can be electrically disconnected from the battery 27 as well as the power source, and safety can be further improved.

  In the ninth embodiment, the case where the safety device 45 is arranged on the input side of the AC / DC converter 49 has been described. However, the safety device 45 may be connected only to the output side of the AC / DC converter 49. Even in this case, when the microcomputer runs away, the charging device can be electrically disconnected from the battery 27 as a load, and safety can be improved.

(Embodiment 10)
Subsequently, Embodiment 10 of the present invention will be described. In addition, about the point which overlaps with the matter demonstrated in the said Embodiment 1 thru | or 9, the description is abbreviate | omitted or only demonstrated.

  FIG. 15 shows a configuration diagram of a charging apparatus according to Embodiment 10 of the present invention. The microcomputer control system according to the eighth embodiment is applied to the charging device 36. In FIG. 15, elements corresponding to those described in the first to ninth embodiments are denoted by the same reference numerals.

  In the tenth embodiment, the charging device includes a safety device 45, an AC / DC converter 37, and a DC / DC converter 38, and a drive power source that is an AC power source on the input side of the AC / DC converter 37. 26 is connected via a safety device 45, and a battery 27 to be charged is connected to the output side of the DC / DC converter 38.

  Here, the charging device 36 is in the entire system 1 in the eighth embodiment, the AC / DC converter 37 is in the first subsystem 2 in the eighth embodiment, and the DC / DC converter 38 is in the above-described embodiment. This corresponds to the second subsystem 3 in the eighth mode, and the first microcomputer 5 is added to the AC / DC converter main circuit 39 of the AC / DC converter 37, and the DC / DC converter main circuit 41 of the DC / DC converter 38. The second microcomputer 6 is mounted on each.

  The safety device 45 electrically disconnects the AC / DC converter 37 from the drive power supply 26 when receiving any one of the operation signals I1 and I2 generated from the microcomputers 5 and 6.

  By configuring the charging device as described above, when either the first microcomputer 5 or the second microcomputer 6 mounted on the AC / DC converter 37 and the DC / DC converter 38 runs away, the microcomputer runs away. And the AC / DC converter 37 and the DC / DC converter 38 connected to the AC / DC converter 37 can be electrically disconnected from the drive power supply 26.

  Note that the output side of the DC / DC converter 38 may be connected to the battery 27 as a load via the safety device 45. In this way, when the microcomputer runs away, the charging device can be electrically disconnected from the battery 27 as well as the power source, and safety can be further improved.

  In the tenth embodiment, the case where the safety device 45 is arranged on the input side of the AC / DC converter 37 has been described. However, the safety device 45 may be connected only to the output side of the DC / DC converter 38. Even in this case, when the microcomputer runs away, the charging device can be electrically disconnected from the battery 27 as a load, and safety can be improved.

  Similarly to the ninth embodiment, the charging device according to the tenth embodiment is suitable for enhancing the safety of a charging device for a large capacity battery such as a forklift battery.

(Embodiment 11)
Next, an eleventh embodiment of the present invention will be described. In addition, about the point which overlaps with the matter demonstrated in the said Embodiment 1 thru | or 10, the description is abbreviate | omitted or only demonstrated.

  The block diagram of the solar power supply system in Embodiment 11 of this invention is shown in FIG. This solar power supply system 50 is applied with the microcomputer control system in the eighth embodiment. In FIG. 16, elements corresponding to those described in the first to tenth embodiments are given the same reference numerals.

  In the eleventh embodiment, the solar power supply system 50 includes a solar power supply 51 that is generated by sunlight, two safety devices 45, a DC / DC converter 52, and a DC / AC converter 53. The input side of the DC / DC converter 52 is connected to the solar power source 51 via the safety device 45, and the output side of the DC / AC converter 53 is connected to the load 54 and the system power source 55 via the safety device 45. ing.

  The DC / DC converter 52 converts the DC voltage generated by the power generation of the solar power source 51 into a desired voltage value, and the DC / AC converter 53 converts the DC voltage converted by the DC / DC converter 52 into an AC voltage. Converted and supplied to the load 54. The load 54 is, for example, a TV used at home, etc., and the system power source 55 is a power source in a general home distributed by a power company when the solar power supply system 50 is used in a general home, for example. . The load 54 and the system power supply 55 are connected to the solar power supply system 50 in parallel. The system power supply 55 becomes a load on the solar power supply system 50.

  The DC / DC converter 52 includes a DC / DC converter main circuit 56 that is a circuit that converts a direct-current voltage into a desired voltage value, and a DC / DC converter main circuit that controls the conversion operation of the DC / DC converter main circuit 56. A drive control unit 57 is provided.

  The DC / AC converter 53 is a DC / AC converter main circuit 58 that is a circuit that converts a direct current voltage into an alternating voltage, and a DC / AC converter main circuit drive control that controls the conversion operation of the DC / AC converter main circuit 58. A portion 59 is provided.

  Here, the solar power supply system 50 is the entire system 1 in the eighth embodiment, the DC / DC converter 52 is the first subsystem 2 in the eighth embodiment, and the DC / AC converter 53 is the above-described one. This corresponds to the second subsystem 3 in the eighth embodiment, and the first microcomputer 5 is mounted on the DC / DC converter main circuit 56 and the second microcomputer 6 is mounted on the DC / AC converter main circuit 58, respectively. ing.

  When the safety device 45 connected to the input side of the DC / DC converter 52 receives one of the operation signals I 1 and I 2 generated from the microcomputers 5 and 6, the safety device 45 connects the DC / DC converter 52 from the solar power source 51. When the safety device 45 that is electrically disconnected and connected to the output side of the DC / AC converter 53 receives any one of the operation signals I1 and I2 generated from the microcomputers 5 and 6, the safety device 45 turns on the DC / AC converter 53. It is electrically disconnected from the load 54 and the system power supply 55.

  By configuring the solar power supply system as described above, when one of the first microcomputer 5 and the second microcomputer 6 mounted on the DC / DC converter 52 and the DC / AC converter 53 runs away, the runaway occurs. In addition to resetting the microcomputer, the DC / DC converter 52 and the DC / AC converter 53 can be electrically disconnected from the solar power source 51, the load 54, and the system power source 55.

  In particular, when a solar power system is used in ordinary homes, power is supplied to the load from the solar power system and the power system power supply of the power company. If not immediately disconnected from the power source or load, a fire may occur. On the other hand, in the eleventh embodiment, when the microcomputer runs away, the DC / DC converter and the DC / AC converter can be quickly disconnected from the power source and the load, thereby improving the safety of the solar power system. be able to.

  In the eleventh embodiment, the case where the safety devices 45 are arranged on the input side of the DC / DC converter 52 and the output side of the DC / DC converter 53 has been described, but the input side of the DC / DC converter 52 and the DC / Safety device 45 may be connected to only one of the output sides of DC converter 53.

  The microcomputer control system according to the present invention can recognize the runaway state even if any of the plurality of microcomputers provided in the microcomputer control system falls into the runaway state. This is useful for a charger or a power generation system equipped with a microcomputer control system.

1 Microcomputer control system (entire system)
2 1st subsystem 3 2nd subsystem 4 Whole system control part 5 1st microcomputer (1st microcomputer)
6 Second microcomputer (second microcomputer)
7, 8 Operation confirmation signal generator 9, 10 Operation state determination control unit 11, 12 Operation confirmation signal output terminal 13, 14 Operation confirmation signal input terminal 15, 16 Overall stop signal output terminal 17, 18 Reset signal output terminal 19, 20 Reset unit 21, 22 Reset prevention signal output terminal 23, 24 Reset prevention unit 25 Charging device (AC / DC converter)
26 drive power supply 27 battery 28 operation control unit 29 current control unit 30 input / output control unit 31 stop unit 32, 33 subsystem overall control unit 34, 35 individual stop signal output terminal 36 charging device 37 AC / DC converter 38 DC / DC converter 39 AC / DC converter main circuit 40 AC / DC converter main circuit drive control unit 41 DC / DC converter main circuit 42 DC / DC converter main circuit drive control unit 43, 44 Stop unit 45 Safety device 46, 47 Operation signal output terminal 48 Charging device 49 AC / DC converter 50 Solar power supply system 51 Solar power supply 52 DC / DC converter 53 DC / AC converter 54 Load 55 System power supply 56 DC / DC converter main circuit 57 DC / DC converter main circuit drive controller 58 DC / AC converter The main circuit 59 DC / AC converter main circuit drive control unit

Claims (24)

  A microcomputer control system comprising a plurality of microcomputers, wherein each of the plurality of microcomputers generates an operation confirmation signal for transmitting an operation state signal to another microcomputer; A microcomputer control system comprising: an operation state recognition unit for recognizing an operation state of the other microcomputer based on an operation confirmation signal from the other microcomputer.   2. The microcomputer control system according to claim 1, wherein each of the plurality of microcomputers includes an operation confirmation signal output terminal for transmitting an operation confirmation signal from the microcomputer and an operation confirmation signal from another microcomputer. An operation confirmation signal input terminal for receiving the operation confirmation signal, or an operation confirmation signal input / output terminal for transmitting and receiving an operation confirmation signal between the microcomputer and the other microcomputer. Microcomputer control system.   3. The microcomputer control system according to claim 1, wherein the operation confirmation signal is a pulse signal or a serial code signal.   4. The microcomputer control system according to claim 1, wherein the operation state recognition unit of each of the plurality of microcomputers is based on an operation confirmation signal from another microcomputer. When the computer recognizes that it is in a runaway state, the microcomputer control system generates an overall stop signal for stopping the operation of the microcomputer control system.   5. The microcomputer control system according to claim 4, wherein each of the plurality of microcomputers includes an overall stop signal output terminal for transmitting an overall stop signal from the microcomputer. .   6. The microcomputer control system according to claim 1, wherein the microcomputer control system includes a plurality of subsystems, and each of the plurality of subsystems is provided with one microcomputer. A microcomputer control system characterized by comprising:   4. The microcomputer control system according to claim 1, wherein the microcomputer control system includes a plurality of subsystems, and each of the plurality of subsystems is provided with one microcomputer. When the operation state recognition unit of each of the plurality of microcomputers recognizes that the other microcomputer is in a runaway state based on an operation confirmation signal from the other microcomputer, the other microcomputer is provided. A microcomputer control system for generating an individual stop signal for stopping the operation of a specified subsystem.   8. The microcomputer control system according to claim 7, wherein all or a part of the plurality of microcomputers recognizes that the operation of a subsystem provided with the microcomputer is a runaway state of another microcomputer. A microcomputer control system which is sometimes stopped by an individual stop signal.   9. The microcomputer control system according to claim 7, wherein each of the plurality of microcomputers includes an individual stop signal output terminal for transmitting an individual stop signal from the microcomputer. A microcomputer control system.   10. The microcomputer control system according to claim 1, wherein the operation state recognition unit of each of the plurality of microcomputers is based on an operation confirmation signal from another microcomputer. When the computer recognizes that it is in a runaway state, it generates a reset signal for resetting the other microcomputer to an initial state.   11. The microcomputer control system according to claim 10, wherein each of the plurality of microcomputers receives a reset signal output terminal for transmitting a reset signal from the microcomputer and a reset signal from another microcomputer. And a reset signal input terminal for the microcomputer control system.   12. The microcomputer control system according to claim 10, wherein the operation state recognition unit of each of the plurality of microcomputers prevents the microcomputer from being reset to an initial state. A microcomputer control system, characterized in that a signal is generated when another microcomputer recognizes that it is in a runaway state.   13. The microcomputer control system according to claim 12, further comprising: a reset blocking unit that blocks transmission of a reset signal from another microcomputer outside each of the plurality of microcomputers. A microcomputer control system, wherein each computer operates a reset prevention unit provided outside the microcomputer by a reset prevention signal.   14. The microcomputer control system according to claim 13, wherein each of the plurality of microcomputers includes a reset prevention signal output terminal for transmitting a reset prevention signal from the microcomputer. .   4. The microcomputer control system according to claim 1, wherein the microcomputer control system includes a plurality of subsystems, and further includes a safety device for electrically disconnecting the plurality of subsystems from a power source. Each of the plurality of subsystems is provided with one microcomputer, and the operation state recognition unit of each of the plurality of microcomputers is configured based on an operation confirmation signal from another microcomputer. When the microcomputer recognizes that the microcomputer is in a runaway state, an operation signal for operating the safety device is generated to electrically disconnect the plurality of subsystems from a power source.   4. The microcomputer control system according to claim 1, wherein the microcomputer control system includes a plurality of subsystems, and further includes a safety device for electrically disconnecting the plurality of subsystems from a load. Each of the plurality of subsystems is provided with one microcomputer, and the operation state recognition unit of each of the plurality of microcomputers is configured based on an operation confirmation signal from another microcomputer. When the microcomputer recognizes that it is in a runaway state, an operation signal for operating the safety device is generated to electrically disconnect the plurality of subsystems from the load.   17. The microcomputer control system according to claim 15, wherein each of the plurality of microcomputers includes an operation signal output terminal for transmitting an operation signal from the microcomputer. Microcomputer control system.   18. The microcomputer control system according to claim 15, wherein the operation state recognition unit of each of the plurality of microcomputers is based on an operation confirmation signal from another microcomputer. When the computer recognizes that it is in a runaway state, it generates a reset signal for resetting the other microcomputer to an initial state.   19. The microcomputer control system according to claim 18, wherein each of the plurality of microcomputers receives a reset signal output terminal for transmitting a reset signal from the microcomputer and a reset signal from another microcomputer. And a reset signal input terminal for the microcomputer control system.   20. The microcomputer control system according to claim 18, wherein the operation state recognition unit of each of the plurality of microcomputers prevents the microcomputer from being reset to an initial state. A microcomputer control system, characterized in that a signal is generated when another microcomputer recognizes that it is in a runaway state.   21. The microcomputer control system according to claim 20, further comprising: a reset blocking unit configured to block transmission of a reset signal from another microcomputer outside each of the plurality of microcomputers. A microcomputer control system, wherein each computer operates a reset prevention unit provided outside the microcomputer by a reset prevention signal.   24. The microcomputer control system according to claim 21, wherein each of the plurality of microcomputers includes a reset prevention signal output terminal for transmitting a reset prevention signal from the microcomputer. .   A charging apparatus comprising the microcomputer control system according to any one of claims 1 to 22. A solar power supply system comprising the microcomputer control system according to any one of claims 1 to 3 or claims 15 to 22.

Images