JP2012137920A - Electronic control device and start control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an electronic control device capable of performing start management for each application according to priority of application in which abnormality is detected.SOLUTION: An electronic control device 100 has a microcomputer 80 comprising a processor 12 executing a plurality of applications and a monitoring circuit comprising reset means 21 for resetting the microcomputer 80. The monitoring circuit has: start request means 24 for repeatedly outputting a start request of each application to the microcomputer 80 at start timing predetermined for each application; and abnormality detection means 22 for detecting abnormality in each application. When priority of an application in which abnormality is detected by the abnormality detection means 22 is equal to or less than a threshold, the start request means 24 stops outputting a start request of the application.

Description

  The present invention relates to an electronic control apparatus that is executed by a plurality of applications, and more particularly, to an electronic control apparatus that can detect an abnormality of each application.

  When one microcomputer executes a plurality of applications, abnormalities may occur in each application. An application abnormality is detected by a WDT (Watch Dog Timer) or the like, but it is known that resetting the microcomputer is effective in eliminating the abnormality.

  However, when the microcomputer is reset, even if one application has an abnormality, all the applications are stopped from the reset to the restart. Here, there are applications with low priority other than those with high priority required for control of in-vehicle devices, for example, applications such as waiting for interrupts. It is not preferable that an application with high priority stops.

  A technique has been devised for controlling the execution of an application in consideration of the priority of the application when a failure occurs (see, for example, Patent Document 1). In Patent Document 1, during execution of a job having a high execution priority, it is detected that a failure that requires the job to stop is detected, the job is temporarily stopped, and execution priority is not affected by the failure. An image forming apparatus that starts execution of a low-frequency job is disclosed.

Japanese Patent Laid-Open No. 10-190897

  However, the device disclosed in Patent Document 1 does not disclose processing when a job abnormality with a low priority is detected. For this reason, when the image forming apparatus detects an abnormality of a job with a low priority, if the microcomputer is reset, the above-described problem that a job with a high priority cannot be executed cannot be solved.

  In addition, in embedded devices, applications are usually started regularly, but once an application has failed, there is a high possibility that it will cause an abnormality again, so it should be prohibited from starting periodically. . Conventionally, however, it has not been considered to selectively stop activation of an application with a low priority while an application with a high priority is activated when an abnormality of an application with a low priority is detected.

  In view of the above problems, an object of the present invention is to provide an electronic control device that can perform activation management for each application in accordance with the priority of an application in which an abnormality is detected.

  In view of the above problems, the present invention is an electronic control device having a microcomputer provided with a processor for executing a plurality of applications and a monitoring circuit provided with reset means for resetting the microcomputer, wherein the monitoring circuit is determined for each application. A startup request unit that repeatedly outputs a startup request for each application to the microcomputer at a given startup timing; and an abnormality detection unit that detects an abnormality for each application; and When the priority is equal to or lower than the threshold, the activation request unit stops the activation request for the application.

  It is possible to provide an electronic control device that can perform activation management for each application according to the priority of the application in which an abnormality is detected.

It is an example of the figure explaining an electronic controller. It is an example of the schematic block diagram of an electronic controller. It is an example of the figure which illustrates operation | movement of an electronic control apparatus typically. It is an example of the flowchart figure which shows the procedure in which a starting and monitoring circuit operate | moves. It is a figure explaining another example of an electronic controller. (Example 2) which is an example of the figure explaining an electronic controller. It is an example of the schematic block diagram of an electronic controller. It is an example of the figure which illustrates operation | movement of an electronic control apparatus typically. It is an example of the flowchart figure explaining operation | movement of a schedule means. It is an example of the sequence diagram which shows the operation | movement procedure of a microcomputer and a starting and monitoring circuit. It is a figure explaining another example of an electronic controller.

  Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings.

  FIG. 1 is an example of a diagram illustrating an electronic control device 100 according to the present embodiment. The electronic control device 100 includes a microcomputer and a start / monitor circuit. The activation / monitoring circuit has a function of activation control for causing a microcomputer to execute an application (hereinafter simply referred to as an application) and a function of application abnormality monitoring. Conventionally, a function called start control has been provided on the microcomputer side, but when an abnormality occurs in the application due to the activation / monitoring circuit outside the microcomputer, other applications are not affected by the application in which the abnormality is detected. Can be controlled.

  The activation / monitoring circuit has a WDT (Watch Dog Timer) 1 cleared by the app A and a WDT 2 cleared by the app B, and monitors the abnormality of the corresponding app A or app B when the WDT 1 or WDT 2 overflows. ing. For the activation / monitoring circuit, WDT 1 or 2 that is cleared by an app A or app B having a higher priority is known.

Based on the above configuration, the start / monitor circuit and the reset circuit 21 operate as follows.
(1) The activation / monitoring circuit periodically activates application A and application B, respectively.
(2) When the application B with low priority overflows WDT 2 (lower left in FIG. 1), the activation circuit stops activation of only the application B. In this case, the reset circuit does not reset the microcomputer.
(3) When the application A having a high priority overflows WDT 1 (lower right in FIG. 1), the reset circuit 21 resets the microcomputer.

  In this way, even if an abnormality is detected in the low priority application B, the reset circuit 21 does not reset the microcomputer, so that the low priority application A is prevented from being stopped due to an abnormality in the high priority application B. it can. In addition, when an abnormality is detected in the application B having a low priority, the activation circuit does not activate the application B. Therefore, it is possible to prevent the abnormality from being repeatedly generated in the application B and the abnormality being transmitted to the application A.

[Configuration example of electronic control unit]
FIG. 2 shows an example of a schematic configuration diagram of the electronic control device 100. An electronic control unit (ECU) 100 is used to control various in-vehicle devices such as an engine, a drive motor, and wheel cylinder pressure.

  The electronic control device 100 includes a microcomputer 80 and a start / monitor circuit 90. The microcomputer 80 includes a CPU 12, a ROM 14, a RAM 11, a BRG 16, and an INTC (interrupt controller) 15 connected to the system bus 10.

  The ROM 14 stores an application 17 (referred to as applications A and B when distinguished) executed by the electronic control apparatus 100 for control. In addition, communication software such as an OS (for example, OSEK OS, ITRON, etc.), a driver, and a CAN protocol may be stored. For the apps A and B, the app A has a higher priority. For example, the OS manages the priority of each app. A case where the microcomputer 80 executes three or more applications will be described later.

  For example, the application A is a program that calculates the control amounts of the engine, the motor, and the brake hydraulic pressure, and the application B is a program that provides a register check, fail-safe processing, a waiting state by an infinite loop, and the like.

  The CPU 12 includes a local RAM 122, and executes the plurality of applications 17 in a time-sharing manner using this and the RAM 11 as a working memory. The CPU 12 may be a multi-core type having a plurality of cores 121 or may have a plurality of CPUs 12. In this case, the apps A and B can be assigned for each core.

  The INTC 15 is connected to the activation circuit 24 by the same number of control lines as the number of applications 17. The INTC 15 arbitrates interrupt factors from the activation circuit 24 and other peripheral devices (such as a timer, a sensor, and other ECUs) and issues an interrupt request to the CPU 12. For example, the INTC 15 causes the CPU 12 to execute the application A or the application B in response to the interruption from the activation circuit 24.

  The BRG 16 is connected to the I / O 161 via the I / O bus 9. The BRG 16 mutually converts bus frequencies, voltage values, and the like with various I / Os 23. The I / O 161 is an interface for connecting the electronic control device 100 and an external device. For example, various actuators, sensors, switches, and the like are connected.

  The reset terminal 13 is a terminal that resets the microcomputer 80 when a signal input to the reset terminal 13 changes from Low → High.

  The activation / monitoring circuit 90 includes a reset circuit 21, a WDT (hereinafter referred to as WDT 1 and WDT 2) 22, and an activation circuit 24. First, WDT1 is a timer that counts up or counts down based on some clock source such as a clock generator. When a certain value is reached or the counter reaches zero (hereinafter, simply referred to as “overflow” in any case). The start circuit 24 and the reset circuit 21 are notified.

  The CPU 12 and the WDTs 1 and 2 are respectively connected by control lines, and are designed to clear WDT1 when the CPU 12 executes the application A and before overflowing WDT2 when the application B is executed. That is, if app A runs away, WDT1 is not cleared, and if app B runs away, WDT2 is not cleared. , WDT2 is detected not to overflow, and app B is detected to be normal.

  Note that there may be one WDT 22. In this case, the WDT 22 counts two timers independently and monitors the overflow of each count value.

  As described above, the activation circuit 24 detects the abnormal application A or application B based on the notification from the WDT 1 or 2. The activation circuit 24 periodically outputs activation requests for the apps A and B to the INTC 15 when the WDTs 1 and 2 do not overflow. There are many applications 17 that are periodically activated, such as a process that repeats every cycle time and a process that calculates a control amount every cycle time. The activation circuit 24 counts the elapse of a regular time determined for each of the applications A and B based on the clock source, and outputs an activation request. Some applications 17 are triggered by external signals that are input almost regularly. For example, the engine speed is calculated by an application that the NE sensor interrupts and executes the microcomputer 80 every time the crank angle changes by 15 degrees. For such an application, the activation circuit 24 detects a periodic interrupt from the outside and outputs an activation request.

  Then, the activation circuit 24 stops the activation request for the application B when WDT2 overflows. Thereby, the microcomputer 80 can prevent starting the application B from which abnormality was detected again. In addition, when the WDT 1 overflows, the activation circuit 24 resumes the activation request for the application A and the application B after the microcomputer 80 is restarted. By doing so, return and restart are always given priority to the application A.

  The reset circuit 21 outputs a Low signal to the reset terminal 13 when either predetermined WDT 1 or 2 overflows. The predetermined WDT 22 is a WDT 22 that is cleared by the application A having a high priority.

  In FIG. 2, the activation / monitoring circuit 90 is realized by a hardware IC (for example, an ASIC). However, the activation / monitoring circuit 90 may be realized by software by the CPU executing a program.

[Operation procedure]
FIG. 3 is an example of a diagram for schematically explaining the operation of the electronic control device 100. The activation circuit 24 outputs an application A activation request (High active) to the activation unit 31 when the activation timing of the application A is reached. Output.

  As shown in FIG. 3B, the application A activation request and the application B activation request are periodically output from the activation / monitoring circuit 90 to the microcomputer 80. In the figure, the activation intervals of application A and application B are similar, but may be different. Further, the execution frequency may be different.

  The activation means 31 of the microcomputer 80 is realized, for example, when the INTC 15 interrupts the CPU 12 in response to the activation request. The INTC 15 accepts the activation request as a kind of interrupt, and arbitrates the priority order of the applications. For example, even if an application B activation request is input to the INTC 15 during the execution of the application A, the INTC 15 does not interrupt the CPU 12 until the application A ends. On the other hand, if the application A activation request is input during the execution of the application B, the INTC 15 interrupts the CPU 12, so the CPU 12 saves the execution state of the application B and activates the application A. Note that whether or not such a context switch occurs depends on the activation cycle and execution time of the apps A and B. Therefore, the activation cycle of the apps A and B can be optimized so that overhead is suppressed. . Further, when the CPU 12 is multi-core and the apps A and B are assigned to the respective cores, even if the execution times of the apps A and B are overlapped, a context switch corresponding to the priority level does not occur.

  The CPU 12 executes the instruction of the interrupt vector (address) corresponding to the interrupt number notified by the INTC 15 from the vector table set in the ROM 14 or RAM 11. In this embodiment, the interrupt handler corresponding to the interrupt vector activates application A or application B.

  In this way, the activation unit 31 activates the application A in response to the application A activation request from the activation circuit 24 and activates the application B in response to the application B activation request from the activation circuit 24. Application A and application B each have an execution state update unit 32 (referred to as execution state update units A and B when distinguished). The execution state update unit A notifies the activation state of the application A to the activation / monitoring circuit 90, and the execution state update unit B notifies the execution state of the application B to the activation / monitoring circuit 90. Specifically, as shown in FIG. 3B, the execution state update unit A notifies the execution history to the WDT 1 at least once before the application A starts up. The same applies to the execution state update unit B. The notification of the execution history is a reset of WDT 1 and 2. The activation / monitoring circuit 90 detects that an abnormality has occurred in the applications A and B by the execution state update units A and B not resetting the WDTs 1 and 2. In this case, the WDTs 1 and 2 overflow when a time (for example, n (> 1) times the execution interval) longer than the execution interval (from the last activation of the applications A and B to the next activation) elapses. Is set as follows.

  In addition, when the apps A and B can stop / restart the counts of the WDTs 1 and 2 of the activation / monitoring circuit 90, the execution state update units A and B start counting the WDTs 1 and 2 with the execution start notification and end the execution It can also be reset by notification. In this case, the WDTs 1 and 2 are set to overflow when a time (for example, n (> 1) times the execution time) that is longer than the execution time (from the start to the end of the applications A and B) elapses. The In this case, the execution time of each application can be measured.

  As shown in FIG. 3B, the execution state update unit B of the application B started at time t4 could not notify the WDT 2 of the execution history or the end of execution. Since this means an abnormality in the application B, the WDT 2 notifies the activation circuit 24 and the reset circuit 21 of the abnormality in the application B. As a result, the activation circuit 24 stops outputting the application B activation request to the activation unit 31.

  Next, the execution state update unit A of the application A activated at time t6 has not been able to notify the WDT 1 of the execution history or the end of execution. Since this means an abnormality of the application A, the WDT 1 notifies the activation circuit 24 and the reset circuit 21 of the abnormality of the application A. As a result, the reset circuit 21 outputs a reset signal to the reset terminal 13 (time t7 in the figure). Further, the activation circuit 24 stops outputting the application A activation request to the activation unit 31 until the microcomputer is restarted.

  When the microcomputer 80 is reset, the reset vector of the ROM 14 is set in the program counter, so that the startup program is executed. The startup program initializes not only the microcomputer 80 but also the startup / monitoring circuit 90, and the startup circuit 24, WDT1 and WDT2 also start activation. As a result, as shown at time t8, the activation circuit 24 resumes the periodic output of the application application A activation request and the application B activation request in the same manner as before the abnormality is detected. Therefore, the microcomputer 80 periodically executes the app A and the app B again.

[Operation procedure]
FIG. 4 is an example of a flowchart showing a procedure for operating the activation / monitoring circuit 90 of the present embodiment. The procedure in FIG. 4 is executed when the application A or application B is activated.

  First, the activation circuit 24 refers to a timer (S10). This timer is a clock that detects the activation timing of the application A or the application B, and the activation circuit 24 stores the time when the application A activation request and the application B activation request were last output and stores the elapsed time from that time. Monitoring. Alternatively, the timer may output a -High signal to the activation circuit 24 at each activation timing of the application A and the application B.

  The activation circuit 24 determines whether it is the activation timing of the application A (S20). When it is not the activation timing of the application A (No in S20), the process proceeds to step S60.

  When it is the activation timing of the application A (Yes in S20), the activation circuit 24 determines whether or not the application A that was activated last time has ended normally (S30). Whether or not the process has ended normally is determined by whether or not WDT1 has overflowed. Therefore, if WDT1 has not overflowed, the determination in step S30 is No.

  When the application A that was activated last time is completed normally (Yes in S30), the activation circuit 24 outputs an application A activation request to the microcomputer 80 (S40). Thereby, the microcomputer 80 can start the application A.

  If the previously activated application A has not ended normally (No in S30), WDT1 has overflowed, so the reset circuit 21 outputs a reset signal to the microcomputer 80 (S50). Thereby, the microcomputer 80 is reset, and the application A and the application B are executed again.

  Next, in step S60, the activation circuit 24 determines whether it is the activation timing of the application B (S60). When it is not the activation timing of the application B (No in S20), the process of FIG. 4 ends.

  When it is the activation timing of the application B (Yes in S60), the activation circuit 24 determines whether or not the application B that was activated last time has ended normally (S70). Whether or not the process has ended normally is determined by whether or not WDT2 has overflowed. Therefore, if WDT2 has not overflowed, the determination in step S70 is No.

  When the application B that was activated last time has ended normally (Yes in S70), the activation circuit 24 outputs an application B activation request to the microcomputer 80 (S80). Thereby, the microcomputer 80 can start the application B.

  If the application B that was activated last time has not ended normally (No in S70), the WDT2 has overflowed, so that the activation circuit 24 does not output an application B activation request so that the application B is not activated again. Thereby, the restart of the application B can be prevented. Since the overflow notification from the WDT 2 to the activation circuit 24 is only once per overflow, the activation circuit 24 stores the fact that the WDT 2 has overflowed with a flag or the like. Thereby, when the activation timing of the application B arrives (Yes in S60) when the next procedure of FIG. 4 is executed, the activation circuit 24 can be prevented from outputting an application B activation request.

[When there are 3 or more apps]
Similarly, when the microcomputer 80 executes three or more applications, the trajectory can be controlled.

  FIG. 5A shows an example of the electronic control device 100 having three or more applications. In the figure, the microcomputer 80 executes n applications, and the activation / monitoring circuit 90 has n WDTs 22. When the microcomputer 80 executes three or more applications, the designer can select three or more applications from the viewpoint of whether the microcomputer 80 should be reset even if other applications are stopped when an abnormality occurs in one application. Are classified into a low priority application and a high priority application based on a certain priority (threshold).

  The classification result is stored in the activation circuit 24 and the reset circuit 21. For example, in the startup circuit 24, the identification information of the WDT 22 that should stop the startup request due to overflow is set in a register or the like at startup, and in the reset circuit 21, the identification information of the WDT 22 that should be reset due to overflow is stored in the register or the like at startup. Is set.

  Therefore, even when there are three or more applications, the activation / monitoring circuit 90 stops the activation of the application and executes the high-priority application in the case of an abnormality in the low-priority application, as in the case of two applications. The microcomputer 80 can be reset for abnormalities in high-priority apps.

  Further, the activation / monitoring circuit 90 can also reset the microcomputer 80 when two or more abnormalities are detected even in a low-priority application that is not a reset target. In this case, the reset circuit 21 stores an application corresponding to the overflowed WDT 22, and the reset circuit 21 resets the microcomputer 80 when a predetermined number of low-priority application abnormalities are detected.

  If two or more apps are abnormal even in a low-priority application, there is a possibility that abnormality may occur in the high-priority application, so the microcomputer 80 can be reset early.

  FIG. 5B is a diagram illustrating an example of an ECU system in which the microcomputer 80 and the activation / monitoring circuit 90 are mounted in separate ECUs 1 and 2. In FIG. 5B, both the microcomputer 80 and the activation / monitoring circuit 90 have the CAN communication unit 33 and can communicate via the CAN bus 34. The communication protocol may be any type such as FlexRay.

  In this case, the activation / monitoring circuit 90 is also equipped with a CPU that executes a communication program. A predetermined program corresponding to the activation circuit 24 transmits an application A activation request and an application B activation request to the ECU 1 via the CAN bus 34. When the INTC 15 processes the reception interrupt of the CAN communication unit 1, the activation unit 31 can activate the application A and the application B as described above.

  The execution state update unit A of the application A and the execution state update unit B of the application B notify the ECU 2 of the execution history or the execution end via the CAN bus 34. The predetermined program of the ECU 2 clears the WDT 1 and 2 when the execution end is received. Therefore, WDT 1 and 2 do not overflow if there is no abnormality in apps A and B.

  When WDT2 overflows, the program corresponding to the activation circuit 24 stops outputting the application B activation request. Further, when WDT 1 overflows, the reset circuit 21 outputs a reset signal to the reset terminal 13. Thereby, the microcomputer 80 of the ECU 1 is reset.

  Therefore, even when the microcomputer 80 and the activation / monitoring circuit 90 are mounted in different ECUs 1 and 2, it is possible to control whether to reset the microcomputer 80 according to the priority of the application 17 in which an abnormality is detected. In the form as shown in FIG. 5B, it is possible to consolidate the activation / monitoring circuits 90 of the plurality of microcomputers 80 into one ECU 2, so that the manufacturing cost of the electronic control device 100 can be expected to be reduced.

  As described above, the electronic control device 100 according to the present exemplary embodiment allows the external activation / monitoring circuit 90 of the microcomputer 80 to control the activation of the application so that the application is not affected by the application in which the abnormality is detected. Whether to start each time can be controlled. Further, whether to reset the microcomputer 80 can be controlled according to the priority of the application 17 in which an abnormality is detected.

  In the first embodiment, when the number of applications 17 increases, the connection between the microcomputer 80 and the start / monitor circuit 90 may increase. Therefore, in this embodiment, an electronic control device 100 that can reduce the number of connections between the microcomputer 80 and the start / monitor circuit 90 will be described.

  FIG. 6 is an example of a diagram illustrating the electronic control device 100 according to the present embodiment. The electronic control device 100 of FIG. 6 is an electronic control device 100 in which the process of separating the application 17 in which an abnormality has occurred is left in the microcomputer 80 from the activation / monitoring circuit 90.

  The microcomputer 80 according to the present embodiment includes the schedule unit 36 and the AND circuit 20, and the activation / monitoring circuit 90 includes the activation circuit 24. The scheduling means 36 schedules activation of the application A and the application B. The AND circuit 20 is a circuit that is turned on when both the application A and the application B output execution end notifications to the flag F19 (referred to as flags Fa and Fb, respectively), and clears the WDT 22. Therefore, when an abnormality occurs in either app A or app B, WDT 22 is not cleared.

  As shown in FIG. 6B, when the WDT 22 overflows, the interrupt activation circuit 24 notifies the scheduling means 36 of an interrupt activation request. The schedule unit 36 detects that the WDT 22 has overflowed due to the interrupt activation request (an abnormality has occurred in the application A or the application B). The activation / monitoring circuit 90 stores the request for interrupt activation.

  As shown in FIG. 6 (c), the scheduling means 36 that has acquired the interrupt activation request estimates an app (app B in the figure) in which an abnormality has occurred in app A or app B, and Exclude from schedule. Thereby, the application B in which an abnormality has occurred can be separated. Further, the schedule means 36 sets “1” to the flag Fb in order to turn on the AND circuit 20 even if the application B is not activated. Note that when the app that is estimated to have an abnormality is app A and the priority is high, the scheduling unit 36 does not set “1” in the flag Fa.

  As shown in FIG. 6D, when the application A is abnormal, the flag Fa is not set to “1”, so the WDT 22 overflows again. In this case, the activation / monitoring circuit 90 detects that there is already a record of outputting an interrupt activation request when the WDT 22 overflows, and resets the microcomputer 80 by the reset circuit 21.

  Therefore, since the microcomputer 80 can execute the application A by excluding the application B having a low priority from the schedule target, the application A having a high priority can be suppressed from being stopped due to the abnormality of the application B. In addition, the number of connections between the microcomputer 80 and the activation / monitoring circuit 90 can be suppressed to three as illustrated regardless of the number of applications.

[Configuration example of electronic control unit]
FIG. 7 shows an example of a schematic configuration diagram of the electronic control device 100. 7, the same parts as those in FIG. 2 are denoted by the same reference numerals, and the description thereof is omitted.

  The microcomputer 80 of this embodiment has the flag 19 and the AND circuit 20 described above. The flag Fa is a flag operated by the application A, and the flag Fb is a flag operated by the application B. Further, the flags Fa and Fb are periodically reset by the schedule means 36. This timing is, for example, immediately before the execution of the apps A and B. When the apps A and B set the flags Fa and Gb to “1”, it can be confirmed that the apps A and B are normal.

  Unlike the first embodiment, the INTC 15 does not cause the CPU 12 to execute the application A or the application B in response to the interruption from the activation circuit 24 but causes the scheduling means 36 to execute. The schedule means 36 is mainly provided by the OS 18, but can be implemented as a kind of application without using the OS 18. The schedule means 36 will be described below.

  The configuration of the activation / monitoring circuit 90 is the same as that of the first embodiment, but this embodiment has only one WDT 22. The WDT 22 is cleared when the AND circuit 20 is turned on, and notifies the activation circuit 24 when the AND circuit 20 is not turned on and overflows. The mounting by the AND circuit 20 is an example, and may be replaced by some software means. For example, the software means may have a function of clearing the WDT 22 by detecting that the CPU 12 has finished execution up to the last instruction of the apps A and B.

  The activation circuit 24 outputs an interrupt activation request to the INTC 15 so that the microcomputer 80 activates the schedule means 36 when the WDT 22 overflows. In addition, the activation circuit 24 stores a request for interrupt activation as a flag or the like. By doing so, the next overflow can be detected when the WDT 22 overflows the next time. In response to the second overflow, the activation circuit 24 requests the reset circuit 21 to reset. Since the reset circuit 21 outputs Low to the reset terminal 13, the microcomputer 80 can be reset.

<Schedule means>
FIG. 8A is an example of a diagram for schematically explaining the operation of the electronic control device 100. As described above, when the activation circuit 24 outputs an interrupt activation request to the activation unit 31, the microcomputer 80 activates the schedule unit 36. The activation means 31 of the microcomputer 80 is realized by, for example, the INTC 15 interrupting the CPU 12 in response to an interrupt activation request, as in the first embodiment. The INTC 15 accepts an interrupt activation request as a kind of interrupt, and the CPU 12 executes an interrupt vector (address) instruction corresponding to the interrupt activation request from the vector table. In this embodiment, the interrupt handler corresponding to the interrupt vector activates the schedule means 36.

  The schedule unit 36 activates the apps A and B according to the schedule table 37 (assigned to the CPU 12). In the schedule table 37, the activation timings of the applications A and B are registered in consideration of the execution time of the priorities of the applications A and B. When the applications A and B are periodically activated as in the first embodiment, the schedule unit 36 activates the application A or the application B at the respective activation timing while monitoring the timer.

  Further, the scheduling means 36 can also preferentially assign to the CPU 12 a higher priority application that can be executed according to the state of the applications A and B (executable, executing, waiting for execution, etc.). When the apps A and B are related to each other (for example, when the app B uses the processing result of the app A, or vice versa), the apps A and B are in an execution waiting state. The state transitions of A and B are monitored, and the apps A and B assigned to the CPU 12 are scheduled in consideration of the priority. The schedule means 36 is activated not only when the activation circuit 24 transmits an interrupt activation request, but also every time the application A or B is completed or periodically.

  FIG. 9 is an example of a flowchart for explaining the operation of the schedule means 36.

  First, the microcomputer 80 acquires an interrupt activation request from the activation / monitoring circuit 90, and the schedule means 36 is activated (S110).

  The schedule means 36 estimates whether the app causing the abnormality is the app A or the app B (S120). There are several estimation methods. For example, the program counter address saved by the execution of the schedule means 36 can be estimated based on which address of the application A or B corresponds. In addition, when the scheduling means 36 has an inter-process communication function, it is also possible to estimate an abnormal application from the presence / absence of a response by inquiring a message to the applications A and B. Further, since the scheduling means 36 schedules the apps A and B, it can be estimated that the app A or B assigned to the CPU 12 immediately before is abnormal.

  When the scheduling means 36 estimates an application in which an abnormality is detected, the scheduling means 36 determines whether there is a low priority at which the application may be stopped (S130). Since the priority of each application A and B is known to the scheduling means 36, the scheduling means 36 determines whether or not the application can be stopped based on whether or not the priority of the application estimated to be abnormal is equal to or less than a threshold (applications). If there are two, determine whether it is high or low).

  When the priority is low enough that the application B may be stopped (Yes in S130), the schedule unit 36 deletes the application B causing the abnormality from the schedule table 37 (S140). Thereby, the application B is forcibly terminated, and the areas of the local RAM 122 and the RAM 11 occupied by the application B are released. Further, the deleted application B is recorded in the schedule means 36. By recording, even if the application B is generated again, the execution can be prohibited, or the schedule unit 36 can execute the operation by changing the operation of the flag Fb.

  Then, the schedule unit 36 resumes the execution of the application A (S150). By doing so, it is possible to stop only the app B with a low priority and continue only the app A with a high priority. The schedule means 36 operates the flag Fb instead of the stopped application B, and this process will be described later.

  If the priority is not low enough to stop the application A (No in S130), the schedule unit 36 resumes the execution of the application without stopping the application A that caused the abnormality (S150). By doing so, if there is an abnormality in the high-priority application A, the WDT 22 overflows again, and the reset circuit 21 can reset the microcomputer 80.

  FIG. 8B is an example of a diagram schematically illustrating signals output from the microcomputer 80 and the start / monitor circuit 90. A WDC (Watch Dog timer Clear) pulse is a pulse output from the AND circuit 20 and clears the WDT 22 for each pulse. Therefore, when the WDC pulse is stopped, the WDT 22 is not cleared and the activation circuit 24 outputs an interrupt activation request to the microcomputer 80.

  As a result, the scheduling unit 36 performs the processing described with reference to FIG. 9. However, when an abnormality occurs in the high-priority application A, the WDC pulse is not resumed as illustrated even if an interrupt activation request is output. Therefore, the WDT 22 overflows again. Thereby, the reset circuit 21 outputs a reset signal.

  Although not shown, when an abnormality occurs in the application B with a low priority, the WDC pulse is resumed after an interrupt activation request, and therefore the reset circuit 21 does not output a reset signal.

[Operation procedure]
FIG. 10 is an example of a sequence diagram showing an operation procedure of the microcomputer 80 and the start / monitor circuit 90.
If there is no abnormality in the applications A and B, the schedule means 36 is activated periodically and activates the applications A and B according to the schedule.

  When no interrupt activation request is output from the activation / monitoring circuit 90 and the schedule has not been changed (No in S210), the scheduling unit 36 clears the flag Fa corresponding to the application A to be activated (S220).

  Next, since the schedule means 36 starts the application A (S230), the execution state update part A sets "1" to the flag Fa (S310).

  Similarly, the schedule means 36 clears the flag Fb corresponding to the application B at the activation timing of the application B (S240) and activates the application B (S250), so that the execution state update unit B sets “1” to the flag Fb. "Is set (S320).

  Thereby, the AND circuit 20 can output the WDC pulse to the WDT 22 (S330).

  In steps S210 to S250, when an abnormality occurs in the application A or the application B, the AND circuit 20 does not output a WDC pulse, so that the WDT 22 overflows. When the WDT 22 overflows (Yes in S410), the activation circuit 24 detects it and determines whether an interrupt activation request has already been output (S420). If the WDT 22 has not overflowed (No in S410), the activation / monitoring circuit 90 does not perform processing.

  If no interrupt activation request has been output (No in S420), the activation circuit 24 outputs an interrupt activation request to the microcomputer 80 because it is the first overflow after resetting the microcomputer 80 (S430). At this time, the activation circuit 24 records the output of the interrupt activation request with a flag or the like.

  The schedule means 36 executes the procedure of FIG. 9 by acquiring the interrupt activation request, and when an abnormality is detected in the application B with a low priority, the schedule is changed, and an abnormality is detected in the application A with a high priority. If this happens, do not change the schedule.

  For example, when the schedule is changed (Yes in S210), similarly, the schedule means 36 clears the flag Fa corresponding to the application A at the activation timing of the application A (S260), and activates the application B (S270). ), The execution state update unit A sets “1” in the flag Fa (S320).

  However, when the schedule is changed (Yes in S210), the schedule unit 36 does not activate the application B at the activation timing of the application B, and sets “1” in the flag Fb (S280). Thereby, even if the application B is not activated, the AND circuit 20 can output the WDC pulse to the WDT 22 (S330).

  On the other hand, since the schedule is not changed when the abnormality is detected in the application A having a high priority (No in S210), the application A is activated, but the application A in which the abnormality is detected has “1” in the flag Fa. Is not considered to be set. For this reason, the WDT 22 overflows for the second time.

  When the WDT 22 overflows (Yes in S410), the activation circuit 24 detects it and determines whether or not an interrupt activation request has already been output (S420). The activation circuit 24 has already output an interrupt activation request. Therefore, the reset circuit 21 is requested to reset without outputting an interrupt activation request (S440). Thereby, the reset circuit 21 can reset the microcomputer 80. The activation circuit 24 can count the output number of interrupt activation requests, and can reset the reset circuit 21 when the predetermined number is reached.

[When there are 3 or more apps]
The electronic control device 100 according to the present embodiment can also be suitably applied when the microcomputer 80 executes three or more applications as in the first embodiment.

  FIG. 11A shows an example of an electronic control device 100 having three or more applications. The microcomputer 80 has n flags Fa to Fn corresponding to n applications A to n. There is no change in the start / monitor circuit 90.

  From the viewpoint of whether or not the microcomputer 80 should be reset even if other apps are stopped when an abnormality occurs, the designer defines three or more apps as low priority apps based on a certain priority (threshold). The high priority application is classified and registered in the schedule means 36. Alternatively, if a priority level that is a threshold value is registered in the schedule unit 36, it can be determined whether the app 17 estimated to have an abnormality is a high priority level or a low priority level.

  Thereby, the schedule means 36 can reset the microcomputer 80 because the schedule is not changed when the application 17 estimated to have an abnormality has a high priority. In the case of low priority, the schedule is changed and “1” is set in the flag F corresponding to the application 17, so that only the low priority application 17 can be stopped without stopping the high priority application 17. it can.

  Moreover, the schedule means 36 can be guided to stop the change of the schedule and reset the microcomputer 80 when two or more abnormalities are detected even in the low-priority application that is not the reset target.

  FIG. 11B is a diagram showing an example of an ECU system in which the microcomputer 80 and the start / monitor circuit 90 are mounted in different ECUs 1 and 2. In FIG. 11B, both the microcomputer 80 and the activation / monitoring circuit 90 have the CAN communication unit 33 and can communicate via the CAN bus 34.

  In this case, since the communication application that detects the ON state of the AND circuit 20 notifies the ECU 2 via the CAN bus 34, the ECU 2 also clears the WDT 22 by a predetermined program. When the WDT 22 overflows, a predetermined program corresponding to the activation circuit 24 transmits an interrupt activation request to the ECU 1 via the CAN bus 34. When the WDT 22 overflows again, the reset circuit 21 outputs a reset signal to the reset terminal 13. Thereby, the microcomputer 80 of the ECU 1 is reset.

  Therefore, even when the microcomputer 80 and the activation / monitoring circuit 90 are mounted in different ECUs, it is possible to control whether the microcomputer 80 is reset according to the priority of the application in which the abnormality is detected.

  As described above, the electronic control device 100 according to the present embodiment has the same effects as those of the first embodiment, and the microcomputer 80 controls the activation of the application 17 so that the microcomputer 80 and the external activation / monitoring circuit 90 can be controlled. The connection between them can be reduced.

11 RAM
12 CPU
13 Reset terminal 14 ROM
15 INTC
21 Reset circuit 22 WDT
23 I / O
24 start-up circuit 80 microcomputer 90 start-up / monitoring circuit 100 electronic control unit

Claims (11)

An electronic control device having a monitoring circuit with a microcomputer having a processor for executing a plurality of applications and a reset means for resetting the microcomputer,
The monitoring circuit is a start request means for repeatedly outputting a start request for each application to the microcomputer at a start timing determined for each application;
An anomaly detecting means for detecting an anomaly for each application,
If the priority of the application in which the abnormality detection unit detects an abnormality is equal to or lower than a threshold, the activation request unit stops the activation request for the application.
An electronic control device characterized by that. The reset unit resets the microcomputer only when the priority of the application in which the abnormality detection unit has detected an abnormality is greater than the threshold value.
The electronic control device according to claim 1. When the abnormality detection means detects an abnormality of a plurality of applications having a priority level equal to or lower than the threshold, the reset means resets the microcomputer.
The electronic control device according to claim 1. An electronic control device having a monitoring circuit with a microcomputer having a processor for executing a plurality of applications and a reset means for resetting the microcomputer,
The monitoring circuit is a start request means for repeatedly outputting a start request for each application to the microcomputer at a start timing determined for each application;
An anomaly detecting means for detecting an anomaly for each application,
If the priority of the application in which the abnormality detection unit has detected an abnormality is greater than a threshold, the reset unit resets the microcomputer.
An electronic control device characterized by that. An electronic control device having a monitoring circuit with a microcomputer having a processor for executing a plurality of applications and a reset means for resetting the microcomputer,
The microcomputer is a schedule control means for repeatedly starting each application according to a schedule;
A normal notification means for outputting a normal notification to the monitoring circuit when detecting that all of the applications are operating normally,
The monitoring circuit includes an abnormality detection means for detecting an abnormality of any application depending on the presence / absence of the normal notification;
An abnormality notification means for notifying the microcomputer that the abnormality detection means has detected an application abnormality;
The schedule control means estimates an application in which an abnormality has occurred, and when the priority of the application is equal to or lower than a threshold, excludes the application from the activation target and Notify normal notification means,
An electronic control device characterized by that. After notifying that the abnormality notification means has detected an application abnormality to the microcomputer, again, when the abnormality detection means detects an application abnormality,
The reset means resets the microcomputer;
The electronic control device according to claim 5. The schedule control means forcibly terminates the application presumed that an abnormality has occurred;
The electronic control device according to claim 5 or 6, wherein When the number of applications whose priority is equal to or less than a threshold value estimated by the schedule control unit is equal to or greater than a predetermined number, the normal notification unit is not notified that an application in which an abnormality has occurred is operating normally.
The electronic control device according to claim 5.   6. The electronic control device according to claim 1, wherein the abnormality detection means is a watch dog timer. An activation control method for an electronic control device having a microcomputer having a processor for executing a plurality of applications and a monitoring circuit having a reset means for resetting the microcomputer,
The monitoring circuit repeatedly outputs a startup request for each application to the microcomputer at a startup timing determined for each application;
A step of detecting an abnormality for each application by the abnormality detection means;
If the priority of the application in which the abnormality detection unit has detected an abnormality is equal to or lower than a threshold, the activation request unit stops the activation request for the application;
An activation control method characterized by comprising: An activation control method for an electronic control device having a microcomputer having a processor for executing a plurality of applications and a monitoring circuit having a reset means for resetting the microcomputer,
The microcomputer schedule control means repeatedly starts each application according to the schedule,
When the normal notification means detects that all of the applications are operating normally, outputting a normal notification to the monitoring circuit;
The abnormality detection means of the monitoring circuit detects an abnormality of any application depending on the presence or absence of the normal notification;
Anomaly notifying means notifying the microcomputer that the anomaly detecting means has detected an application anomaly;
The schedule control means estimates an application in which an abnormality has occurred, and if the priority of the application is equal to or lower than a threshold, excludes the application from the activation target and confirms that the application in which the abnormality has occurred is operating normally. Notifying the normal notification means;
An activation control method characterized by comprising:

Images