JP2013037550A - Control device having bus diagnosing function - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a control device for detecting a transfer error on a data bus and an address bus only when a central processing part accesses a safety relation part in a control device in which the safety relation part and a non-safety relation part are mixed.SOLUTION: A control device includes: a data bus diagnosis register 12 for, when a CPU 1a accesses a safety relation register, storing the value of the safety relation register in an integrated circuit 6a of the control device; an address bus diagnosis register 13 for storing the value of an address bus; and a bus diagnosis address determination part 14 for, only when the CPU1a accesses the safety relation register, supplying the value of the safety relation register to the data bus diagnosis register 12, and for supplying a bus diagnosis signal (CHKBUS) 15 for making the address bus diagnosis register 13 store the value of the address bus to the data bus diagnosis register 12 and the address bus diagnosis register 13.

Description

  The present invention relates to a control device having a bus diagnosis function, and more particularly to a technique for detecting a transfer error on a bus in a control device in which safety-related parts and non-safety-related parts are mixed.

  In a control device having a safety-related part, when the central processing unit and the integrated circuit are included in the safety-related part, a dangerous operation occurs due to an erroneous transfer of safety-related data exchanged between the two. In order to prevent this, it is common to diagnose a data transfer error by adding a parity bit or ECC bit to the data bus of the central processing unit. In order to make such a diagnosis, it is necessary to have a diagnosis function such as a parity check in the central processing unit. On the other hand, most recently developed central processing units for high-performance embedded applications have external data Since the bus does not have a diagnostic function such as parity check, this method cannot be taken. The safety-related part is a circuit and software part that performs functional safety to prevent a dangerous machine operation from occurring due to a malfunction or malfunction of the system.

  FIG. 6 is a block diagram showing a configuration example of a conventional control device provided with a parity processing circuit of a CPU bus in an IC package of the CPU 1b as a central processing unit. In this example, the parity generation circuit 30 for calculating the parity 31 for all the bits of the data on the data bus 2 when data is written to the integrated circuit 6c, which is an external device, in the package of the CPU 1b and the data from the integrated circuit 6c. Is read, the parity on the data bus 2 and the parity 31 are checked for consistency, and a parity error detection circuit 32 is provided for notifying the CPU core of an error when an error occurs. In a CPU incorporating such a parity check function, as shown in FIG. 6, a parity error detection circuit 33 that detects a parity error from the data bus 2 and the parity 31 that have passed through the input / output buffer 7 in the integrated circuit 6c. To prevent erroneous data from being written to the register group 34 when the write control signal WRN4 is valid. Further, when the CPU 1b reads the value of the register group 34, a parity generation circuit 35 that calculates a parity from the data output from the register group 34 is provided. When the CPU 1b reads the data from the register group 34, the parity generation circuit 35 is provided. By confirming that no error has been detected by the error detection circuit 32, it is confirmed that there is no error during data transfer and that the register contents can be read correctly. When an error occurs, it is determined that retry is performed or control cannot be normally performed, and the process proceeds to risk avoidance processing.

  FIG. 7 is a block diagram showing an embodiment of the prior art for detecting a circuit failure or transient data error in an integrated circuit, rather than a data bus and address bus transfer error detection which is an object of the present invention. FIG. In this example, the register included in the register group 34 holds data written from the CPU 1c like a RAM, and outputs the value at the time of reading. The register group 34 stores the parity calculated by the parity generation circuit 36 together with the write data from the CPU 1c, and when reading, the parity error detection circuit 37 checks the consistency between the stored data and the parity, and there is an abnormality. Transmits an error occurrence to the CPU 1c by making an interrupt request 38. In the interrupt process, the CPU 1c detects an error in the register and executes an appropriate process for ensuring safety.

  Similar to FIG. 7, techniques disclosed in Patent Documents 1 and 2 are disclosed as conventional techniques for detecting a failure in an integrated circuit. Patent Document 3 discloses a technique for detecting a bit error in a remote transmission unit of a digital input signal by inverting and transferring the digital input signal and comparing it with non-inverted data. . Claim 5 of Patent Document 4 discloses a technology for permitting output by comparing data sent via two buses and bit-inverted data on the output device side.

JP 2010-272089 A JP-A-7-121398 JP-A-3-288949 JP-A-8-328602

  In the conventional control device as shown in FIG. 6, a parity generation circuit and a parity error detection circuit are required inside the CPU. However, in recent years, high-performance built-in CPUs are used in the data bus and the address bus. Most CPUs do not add parity bits or ECC bits, and it is difficult to detect transfer errors on the data bus and address bus using a general embedded CPU. On the other hand, in Patent Document 1 to Patent Document 4, the data bus and the address are added by adding a circuit for detecting a transfer error on the data bus and the address bus in the integrated circuit connected to the CPU by the data bus and the address bus. Embodiments for detecting a transfer error on the bus are described, but in these examples, the circuit for detecting the transfer error operates without distinguishing whether it is a safety-related part or a non-safety-related part. In a system in which processing related to non-safety related parts is mixed in the processing routine of the CPU, the CPU detects a data bus and address bus transfer error when performing processing related to the safety related part, and When such processing is performed, it cannot be said that transfer error detection of the data bus and the address bus is not performed.

  An object of the present invention is to provide an integrated circuit having a safety-related register, which is a register belonging to a safety-related part, and a normal register belonging to a non-safety-related part, and a control device having a central processing part, and the central processing unit accesses the safety-related register. It is an object of the present invention to provide a control device that can detect a transfer error on a data bus and an address bus only when the error occurs.

  (1) The present invention is a control device having a data bus diagnosis function having an integrated circuit and a central processing unit connected to the integrated circuit through a data bus, the integrated circuit including the central processing unit A safety-related storage unit that stores data that defines the operational state of a predetermined safety-related unit and is accessed from the central processing unit and stores data that defines the operational state of a predetermined non-safety-related unit. A non-safety related storage unit, a data bus diagnosis storage unit, and a bus diagnosis address determination unit, wherein the bus diagnosis address determination unit is configured to access the central processing unit based on an access destination address of the central processing unit. When the destination is the safety-related storage unit, supply a bus diagnostic signal to the data bus diagnostic storage unit, and when the access destination of the central processing unit is the non-safety-related storage unit, The data bus diagnosis storage unit that has received the bus diagnosis signal from the bus diagnosis address determination unit does not supply a bus diagnosis signal to the data bus diagnosis storage unit, stores the data stored in the safety-related storage unit, and After the data stored in the safety-related storage unit is stored in the data bus diagnosis storage unit, the central processing unit stores the data stored in the data bus diagnosis storage unit and the data stored in the safety-related unit. A transfer error on the data bus is detected by reading and comparing the data stored in the data bus diagnostic storage unit with the data stored in the safety related storage unit.

  (2) In the control device having the data bus diagnosis function of (1), a plurality of the data bus diagnosis storage units of the integrated circuit are provided corresponding to the number of interrupt levels of the central processing unit. The integrated circuit further includes an interrupt level storage unit that stores data indicating an interrupt level when the central processing unit accesses the safety-related storage unit, and data stored in the interrupt level storage unit. Based on the selection, one of the plurality of data bus diagnosis storage units is selected, and the bus diagnosis signal supplied from the bus diagnosis address determination unit is supplied to the selected data bus diagnosis storage unit. And a circuit.

  (3) Further, the present invention is a control device having an address bus diagnosis function including an integrated circuit and a central processing unit connected to the integrated circuit by an address bus, the integrated circuit including the integrated circuit, A safety-related storage unit that stores data defining the operating state of a predetermined safety-related unit accessed from the central processing unit, and data that specifies the operating state of a predetermined non-safety-related unit accessed from the central processing unit A non-safety related storage unit for storing, an address bus diagnosis storage unit, and a bus diagnosis address determination unit, wherein the bus diagnosis address determination unit is based on an access destination address of the central processing unit. When the access destination is the safety-related storage unit, a bus diagnosis signal is supplied to the address bus diagnosis storage unit, and the access destination of the central processing unit is the non-safety-related storage unit When the bus diagnostic signal is not supplied to the address bus diagnostic storage unit and the bus diagnostic signal is received from the bus diagnostic address determination unit, the address bus diagnostic storage unit is supplied from the central processing unit. The address of the related storage unit is stored, and after the address of the safety related storage unit is stored in the address bus diagnostic storage unit, the central processing unit reads the address stored in the address bus diagnostic storage unit, A transfer error on the address bus is detected by comparing the address stored in the address bus diagnosis storage unit with the address of the safety-related storage unit.

  (4) In the control device having the address bus diagnosis function of (3), a plurality of the address bus diagnosis storage units of the integrated circuit are provided corresponding to the number of interrupt levels of the central processing unit. The integrated circuit further includes an interrupt level storage unit that stores data indicating an interrupt level when the central processing unit accesses the safety-related storage unit, and data stored in the interrupt level storage unit. Based on the selection, one of a plurality of the address bus diagnosis storage units is selected, and the bus diagnosis signal supplied from the bus diagnosis address determination unit is supplied to the selected one address bus diagnosis storage unit. And a circuit.

  (5) Further, the present invention is a control device having an integrated circuit and a data bus and address bus diagnosis function having a central processing unit connected to the integrated circuit by a data bus and an address bus, The integrated circuit is accessed from the central processing unit and stores a safety-related storage unit that stores data defining an operation state of a predetermined safety-related unit, and is accessed from the central processing unit and operates of a predetermined non-safety-related unit. A non-safety-related storage unit that stores data defining a state, a data bus diagnostic storage unit, an address bus diagnostic storage unit, and a bus diagnostic address determination unit, wherein the bus diagnostic address determination unit is the central processing unit When the access destination of the central processing unit is the safety-related storage unit based on the access destination address of the unit, the data bus diagnostic storage unit and the address bus diagnostic storage unit When the bus diagnosis signal is supplied and the access destination of the central processing unit is the non-safety related storage unit, the bus diagnosis signal is not supplied to the data bus diagnosis storage unit and the address bus diagnosis storage unit, and the bus diagnosis is performed. The data bus diagnosis storage unit that has received the bus diagnosis signal from the address determination unit stores the data stored in the safety-related storage unit, and the address bus that has received the bus diagnosis signal from the bus diagnosis address determination unit The diagnostic storage unit stores the address of the safety-related storage unit supplied from the central processing unit, the data stored in the safety-related storage unit is stored in the data bus diagnostic storage unit, and the address bus diagnostic storage After the address of the safety-related storage unit is stored in the unit, the central processing unit stores the data stored in the data bus diagnosis storage unit, the address bus diagnosis Read the address stored in the storage unit and the data stored in the safety-related unit, and compare the data stored in the data bus diagnostic storage unit with the data stored in the safety-related storage unit on the data bus The transfer error on the address bus is detected by comparing the address stored in the address bus diagnostic storage unit with the address in the safety-related storage unit.

  (6) The control device having the data bus and address bus diagnosis function of (5), wherein the data bus diagnosis storage unit and the address bus diagnosis storage unit of the integrated circuit are interrupts of the central processing unit. A plurality of levels corresponding to the number of levels are provided, and the integrated circuit further includes an interrupt level storage unit for storing data indicating an interrupt level when the central processing unit accesses the safety-related storage unit, and the interrupt Based on the data stored in the data level storage unit, one of the plurality of data bus diagnosis storage units is selected, and one of the plurality of address bus diagnosis storage units is selected and selected. Preferably, a selection circuit that supplies the bus diagnosis signal supplied from the bus diagnosis address determination unit to a set of one data bus diagnosis storage unit and an address bus diagnosis storage unit is provided.

  According to the above configuration, the value stored in the safety-related storage unit and the value of the address bus when the central processing unit accesses the safety-related storage unit whose address is registered in advance in the bus diagnosis address determination unit, They are stored in the data bus diagnostic register and the address bus diagnostic register, respectively. Thereafter, a transfer error on the data bus can be detected by reading and comparing the value stored in the data bus diagnostic register and the value stored in the safety-related register. Similarly, a transfer error on the address bus can be detected by comparing the value stored in the address bus diagnostic register and the address value of the safety-related part.

  Further, according to the above configuration, different data bus diagnostic registers and address bus diagnostic registers are used for each interrupt level, and at a plurality of interrupt levels, the diagnostic processing of the safety-related part can be performed independently. When a transfer error on the data bus and address bus is to be detected at a plurality of interrupt levels, a diagnostic processing program can be easily created without considering the processing contents of other interrupt levels.

  According to the present invention, in a control device having a central processing unit and an integrated circuit having a safety-related storage unit belonging to a safety-related unit and a non-safety storage unit belonging to a non-safety-related unit, the central processing unit is a safety-related storage unit. Only when accessed, transfer errors on the data bus and address bus can be detected.

It is a figure which shows an example of the control apparatus provided with the data bus and address bus diagnostic function which concern on embodiment of this invention. It is a figure which shows an example of the flowchart of CPU processing in embodiment shown in FIG. It is a figure which shows an example of the control apparatus provided with the data bus and address bus diagnostic function which concern on other embodiment of this invention. FIG. 4 is a diagram showing an example of a detailed configuration of a CPU bus diagnostic register group shown in FIG. 3. It is a figure which shows an example of the flowchart of CPU processing in embodiment shown in FIG. It is a figure which shows an example of the conventional bus diagnostic circuit. It is a figure which shows an example of the conventional register fault diagnostic circuit.

  FIG. 1 is a diagram illustrating an example of a control device having a data bus and address bus diagnosis function according to the present embodiment.

  A control device having a data bus and address bus diagnosis function according to this embodiment includes a CPU 1a, a data bus 2, an address bus 3, and an integrated circuit 6a, which are central processing units. The integrated circuit 6a includes a data bus diagnosis storage unit. Data bus diagnostic register 12 as address bus diagnostic register 13 as address bus diagnostic storage unit, bus diagnostic address determination unit 14, safety related register 1 as safety related storage unit to safety related register N (reference numerals 81 to 8N) N registers, M registers from normal register 1 to normal register M (reference numerals 91 to 9M) as non-safety related storage units, input / output buffer 7 for temporarily storing input / output values, address Address decoder 10 for selecting an access destination register from a bus value, selecting one of a plurality of input signals A data selector 11 to force.

  The CPU 1a, the safety-related register 1 to the safety-related register N (reference numerals 81 to 8N), the normal register 1 to the normal register M (reference numerals 91 to 9M), the data bus diagnostic register 12 and the data selector 11 are connected via the input / output buffer 7. The data buses 2 are connected to each other. Similarly, the data bus diagnostic register 12 and the data selector 11 are connected by the data bus 2.

  The CPU 1 a is connected to the address decoder 10, the bus diagnostic address determination unit 14, and the address bus diagnostic register 13 through the address bus 3. Further, the CPU 1a, the bus diagnostic address determination unit 14 and the address decoder 10 are connected by a control line for sending a write control signal (WRN) 4 and a read control signal (RDN) 5 in addition to being connected by an address bus 3. Is done.

  The bus diagnosis address determination unit 14, the data bus diagnosis register 12, and the address bus diagnosis register 13 are respectively connected by control lines for sending a bus diagnosis signal (CHKBUS) 15.

  Address decoder 10 and safety-related registers 1 to safety-related registers N (reference numerals 81 to 8N) and normal registers 1 to normal registers M (reference numerals 91 to 9M) are outputs of address decoder 10 (WRS1 to WRSN, WRN1 to WRNM). Are connected to each register by a control line. The address decoder 10 and the data selector 11 are connected by a control line for sending a register selection signal (REGSEL) 16 for selecting any one of a plurality of inputs of the data selector 11.

  The data selector 11 and the safety-related register 1 to the safety-related register N (reference numerals 81 to 8N) and the normal register 1 to the normal register M (reference numerals 91 to 9M) are configured so that the output of each register is input to the data selector 11. The data buses 2 are connected to each other.

  The bus diagnosis address determination unit 14 stores the address of the safety related register 1 to the safety related register N (reference numerals 81 to 8N) inside, and stores the address in the safety related register 1 to the safety related register N (reference numerals 81 to 8N). When a write control signal (WRN) 4 or a read control signal (RDN) 5 is received from the CPU 1a, a bus diagnostic signal (CHKBUS) 15 is output to the data bus diagnostic register 12 and the address bus diagnostic register 13. . When the bus diagnosis address determination unit 14 receives the write control signal (WRN) 4 or the read control signal (RDN) 5 from the normal register 1 to the normal register M (reference numerals 91 to 9M) from the CPU 1a, The bus diagnostic signal (CHKBUS) 15 is not output to the bus diagnostic register 12 and the address bus diagnostic register 13. Note that the bus diagnostic address determination unit 14 can detect a transfer error on the data bus and the address bus by outputting the bus diagnostic signal (CHKBUS) 15 only when the read control signal (RDN) 5 is received from the CPU 1a. Although it becomes possible, the bus diagnostic signal (CHKBUS) 15 is output even when the write control signal (WRN) 4 is received from the CPU 1a, so that the CPU 1a writes data to the safety related registers on the data bus and address bus. When the transfer error is detected, the value written in the safety-related register held by the CPU 1a can be used. Therefore, it is possible to shorten the time required for the CPU 1a to read the value stored in the safety-related register.

  The data bus diagnostic register 12 functions as a register for storing the output data DBOUT of the data selector 11 when the bus diagnostic signal (CHKBUS) 15 is received from the bus diagnostic address determination unit 14. In the present embodiment, the data bus diagnostic register 12 is configured to invert the stored DBOUT value and output all the bits. The address bus diagnosis register 13 functions as a register for storing an address value input from the CPU 1a when the bus diagnosis signal (CHKBUS) 15 is received from the bus diagnosis address determination unit 14.

  The data selector 11 has a function of referring to a register selection signal (REGSEL) 16 sent from the address decoder 10 and selecting and outputting one of the plurality of inputs of the data selector 11.

  Not only when the bus diagnosis address determination unit 14 receives the write control signal (WRN) 4, but also when it receives the read control signal (RDN) 5, the bus diagnosis signal (CHKBUS) 15 is used as a data bus diagnosis. The safety-related registers that are output to the register 12 include input-only registers, which may be accessed from other circuits in the integrated circuit 6a or circuits outside the integrated circuit 6a. This is because the values read from the specific safety-related register at different times may not be the same even if the register is not written.

  FIG. 2 is a diagram illustrating an example of a flowchart of processing of the CPU 1a in the present embodiment. As shown in steps S219 to S223 in FIG. 2, in this embodiment, two interrupt processes with different interrupt levels operate on the CPU 1a. Safety input / output processing 1 to safety input / output processing N, which is data input / output processing from safety related register 1 to safety related register N (reference numerals 81 to 8N), is performed only on the interrupt level 1 side. The priority level of the interrupt is higher in level 2 than in level 1, and if interrupt level 2 processing occurs during interrupt level 1 processing, interrupt level 2 processing is preferentially performed. Even if an interrupt level 1 process occurs during an interrupt level 2 process, the interrupt level 1 process is not started until the interrupt level 2 process is completed. The detailed execution procedure of the safety input / output processing 1 is shown in steps S201 to S218. Hereinafter, a detailed implementation procedure of the safety input / output process 1 will be described with reference to FIGS. 1 and 2.

  First, an outline of steps S201 to S218 of the safety input / output process 1 shown in FIG. 2 will be described. In steps S201 to S203, an abnormality in the safety-related register is detected. In steps S204 to S206, the CPU 1a detects a transfer error on the data bus 2 when writing data to the safety-related register 1 (reference numeral 81). In steps S207 to S209, the CPU 1a detects a transfer error on the address bus 3 when writing data to the safety-related register 1 (reference numeral 81). In steps S210 to S213, the CPU 1a detects a transfer error on the data bus 2 when reading data from the safety-related register 1 (reference numeral 81). In steps S214 to S216, the CPU 1a detects a transfer error on the address bus 3 when reading data from the safety-related register 1 (reference numeral 81). Hereinafter, each step will be described in detail.

  In step S201, the CPU 1a writes the value (referred to as aaa) of the output port SOUT1 of the CPU 1a to the safety related register 1 (reference numeral 81). At this time, the bus diagnosis address determination unit 14 receives the write control signal (WRN) 4 from the CPU 1a, and the address of N (reference numerals 81 to 8N) stored in the safety-related registers 1 and the CPU 1a are sent. The address of the safety-related register 1 (reference numeral 81), which is the address of the register of the write destination, is compared, and it is determined that the data is written to the register of the safety-related part, and the data bus diagnostic register 12 and the address bus diagnostic register A bus diagnosis signal (CHKBUS) 15 is output to 13.

  Further, the address decoder 10 refers to the address of the safety related register 1 (reference numeral 81) that is the address of the write destination register sent from the CPU 1a, and sends the address from the safety related register 1 (reference numeral 81) to the data selector 11. A register selection signal (REGSEL) 16 for instructing to select and output an input is output. The data selector 11 that has received the register selection signal (REGSEL) 16 selects and outputs the input from the safety-related register 1 (reference numeral 81) according to the instruction.

  When the data bus diagnostic register 12 receives the bus diagnostic signal (CHKBUS) 15 from the bus diagnostic address determination unit 14, the data bus diagnostic register 12 is a value output from the data selector 11 and is stored in the safety-related register 1 (reference numeral 81). Value (aaa) is stored. The address bus diagnosis register 13 stores the address (AAA) of the safety-related register 1 (reference numeral 81) sent from the CPU 1a when the bus diagnosis signal (CHKBUS) 15 is received from the bus diagnosis address determination unit 14. .

  In step S202, the CPU 1a reads the value (aaa) stored in the safety related register 1 (reference numeral 81) via the data selector 11 and the input / output buffer 7, and stores it in the register R1 in the CPU 1a. At this time, the bus diagnosis address determination unit 14 receives the read control signal (RDN) 5 from the CPU 1a and sends the bus diagnosis signal (CHKBUS) to the data bus diagnosis register 12 and the address bus diagnosis register 13 in the same manner as the processing in step S201. ) 15, the value (aaa) stored in the safety-related register 1 (reference numeral 81) in the data bus diagnostic register 12 is the address (AAA) of the safety-related register 1 (reference numeral 81) in the address bus diagnostic register 13. Is stored. In step S203, the CPU 1a checks whether or not the value of SOUT1 and the value stored in R1 are the same. If the value of SOUT1 and the value stored in R1 are the same, it is determined that safety-related register 1 (reference numeral 81) is normal, and the process proceeds to step S204. When the value of SOUT1 and the value stored in R1 are different, it is determined that there is an abnormality in the safety-related register 1 (reference numeral 81), and the abnormality processing 1 (step S217) for performing retry, risk avoidance processing, etc. Transition.

  In step S204, the CPU 1a reads the value (aaa) stored in the data bus diagnostic register 12 in step S201 through the data selector 11 and the input / output buffer 7, and stores it in the register R2 in the CPU 1a. In this embodiment, since the data bus diagnostic register 12 inverts the stored value and outputs all bits, the value stored in R2 is the value stored in the data bus diagnostic register 12 with all bits inverted. become. In order to make the value stored in R2 the same as the value stored in the data bus diagnostic register 12, in step S205, the CPU 1a inverts all bits of the value stored in R2.

  In step S206, the CPU 1a checks whether or not the value stored in the register R1 in the CPU 1a is the same as the value stored in the register R2 in the CPU 1a. Here, if the value stored in the register R1 is the same as the value stored in the register R2, there is no transfer error on the data bus 2 when the CPU 1a writes data to the safety related register 1 (reference numeral 81). As a result, the process proceeds to step S207. If the value stored in the register R1 and the value stored in the register R2 are different, it is determined that a transfer error has occurred on the data bus 2, and the process proceeds to an abnormal time process 1 (step S217).

  In step S207, the CPU 1a stores the address (AAA) of the safety related register 1 (reference numeral 81) in the register R1 of the CPU 1a. In step S208, the CPU 1a stores the address (AAA) of the safety-related register 1 (reference numeral 81) stored in the address bus diagnosis register 13 in step S201 in the register R2 of the CPU 1a.

  In step S209, the CPU 1a checks whether or not the value stored in the register R1 in the CPU 1a is the same as the value stored in the register R2. Here, if the value stored in the register R1 is the same as the value stored in the register R2, there is no transfer error on the address bus 3 when the CPU 1a writes data to the safety related register 1 (reference numeral 81). As a result, the process proceeds to step S210. If the value stored in the register R1 and the value stored in the register R2 are different, it is determined that a transfer error has occurred on the address bus 3, and the process proceeds to an abnormal time process 1 (step S217).

  In step S210, the CPU 1a reads the value (bbb) stored in the safety related register 2 (reference numeral 82) and stores the value in the input port SIN1 of the CPU 1a. At this time, the value (bbb) stored in the safety-related register 2 (reference number 82) is stored in the data bus diagnostic register 12 and the safety-related register 2 (reference number 82) is stored in the address bus diagnostic register 13 by the same processing as in step S201. ) Address (BBB) is stored.

  In step S211, the CPU 1a reads the value (bbb) stored in the data bus diagnostic register 12 in step S210 and stores it in the register R2 in the CPU 1a. In this embodiment, since the data bus diagnostic register 12 inverts the stored value and outputs all bits, the value stored in R2 is the value stored in the data bus diagnostic register 12 with all bits inverted. become. In order to make the value stored in R2 the same value as the value stored in the data bus diagnostic register 12, in step S212, the CPU 1a inverts all bits of the value stored in R2.

  In step S213, the CPU 1a checks whether or not the value stored in the register R1 in the CPU 1a is the same as the value stored in the register R2. If the value stored in the register R1 is the same as the value stored in the register R2, there is no transfer error on the data bus 2 when the CPU 1a reads data from the safety-related register 2 (reference numeral 82). As a result, the process proceeds to step S214. If the value stored in the register R1 and the value stored in the register R2 are different, it is determined that there has been a transfer error on the data bus 2, and the process proceeds to error processing 2 (step S218).

  In step S214, the CPU 1a stores the address (BBB) of the safety related register 2 (reference numeral 82) in the register R1 of the CPU 1a. In step S215, the CPU 1a stores the address (BBB) of the safety related register 2 (reference numeral 82) stored in the address bus diagnostic register 13 in step S210 in the register R2 of the CPU 1a.

  In step S216, the CPU 1a checks whether or not the value stored in the register R1 in the CPU 1a is the same as the value stored in the register R2. Here, if the value stored in the register R1 is the same as the value stored in the register R2, there is no transfer error on the address bus 3 when the CPU 1a reads data from the safety related register 2 (reference numeral 82). As a result, the process proceeds to step S220. If the value stored in the register R1 and the value stored in the register R2 are different, it is determined that there has been a transfer error on the address bus 3, and the process proceeds to error processing 2 (step S218).

  When the process of step S216 ends, the safety input / output process 1 ends, and the process proceeds to step S220.

  In step S220, when the CPU 1a writes a value to the normal register 1 (reference numeral 91), which is a register of the non-safety related part, the bus diagnosis address determination unit 14 does not store the address of the normal register 1, so that the bus The diagnostic address determination unit 14 does not output the bus diagnostic signal (CHKBUS) 15 to the data bus diagnostic register 12 and the address bus diagnostic register 13. For this reason, the data bus diagnostic register 12 and the address bus diagnostic register 13 do not store the value written in the normal register 1 (reference numeral 91) and its address, and the data bus 2 and address bus 3 are not diagnosed. Become.

  As described above, according to the present embodiment, when the CPU 1a accesses the register of the non-safety related part, the transfer error on the data bus 2 and the address bus 3 is not diagnosed and the register of the safety related part is accessed. In order to diagnose a transfer error on the data bus 2 and the address bus 3 only when processing is performed, the processing of the safety related part and the non-safety related part is included in the processing routine of the integrated circuit and CPU in which the safety related part and the non-safety related part are mixed. Even when a CPU with a mixture of symbols is used, a transfer error on the data bus and the address bus can be detected only when the CPU accesses the safety-related register.

  In this embodiment, a transfer error on the data bus and the address bus is detected. However, the address bus diagnosis register 13 is omitted from the configuration of this embodiment, and only a transfer error on the data bus is detected. Also good. In addition, the data bus diagnosis register 12 may be omitted from the configuration of the present embodiment, and only a transfer error on the address bus may be detected.

  Furthermore, in the present embodiment, the safety input / output process is performed at interrupt level 1 with a low interrupt priority, but may be performed at interrupt level 2. However, when safety I / O processing is performed at both interrupt levels, the value stored in each diagnostic register in the safety I / O processing at interrupt level 1 is overwritten during the safety I / O processing at interrupt level 2. Therefore, in this embodiment, safety input / output processing cannot be arranged at both interrupt levels.

  FIG. 3 is a diagram illustrating an example of a control device having a data bus and address bus diagnosis function according to another embodiment. Since the components other than the CPU bus diagnosis register group 21 and the interrupt level register 20 described later are the same as those in the above-described embodiment, a duplicate description is omitted.

  The integrated circuit 6b shown in FIG. 3 includes an interrupt level storage unit that stores values indicating the current interrupt level of the CPU bus diagnosis register group 21 and the CPU 1a in addition to the one included in the integrated circuit 6a shown in FIG. Level register 20 is provided. The data bus diagnostic register 12 and the address bus diagnostic register 13 included in the integrated circuit 6a shown in FIG. 1 are included in the CPU bus diagnostic register group 21 as described later.

  FIG. 4 is a diagram showing an example of the configuration of the CPU bus diagnostic register group 21. As shown in FIG. The configuration of the CPU bus diagnosis register 21 shown in FIG. 4 is an example in the case where the number of interrupt levels of the CPU 1a is four.

  The CPU bus diagnosis register group 21 reads the value of the interrupt level register 20, decodes and outputs the decoder 210, and the selection circuit 22 including the same number of interrupt gates 211 to 214 as the number of interrupt levels of the CPU 1a. The same number of data bus diagnostic registers 1 to data bus diagnostic registers 4 (reference numerals 220 to 223) as the number of interrupt levels, and the same number of address bus diagnostic registers 1 to address bus diagnostic registers 4 (reference numeral 215) to the number of interrupt levels of the CPU 1a. 218), a data selector 1 (reference numeral 224), and a data selector 2 (reference numeral 219).

  The selection circuit 22 and the data bus diagnostic register 1 to the data bus diagnostic register 4 (reference numerals 220 to 223) and the address bus diagnostic register 1 to the address bus diagnostic register 4 (reference numerals 215 to 218) send a bus diagnostic signal (CHKBUS) 15. Are connected by respective control lines.

The data selector 1 (reference numeral 224) and the data bus diagnostic register 1 to the data bus diagnostic register 4 (reference numerals 220 to 223) are connected by the data bus 2 so that the output of each register is input to the data selector 1 (reference numeral 224). Connected. The data selector 2 (reference numeral 219) and the address bus diagnosis register 1 to the address bus diagnosis register 4 (reference numerals 215 to 218) are arranged so that the output of each register is input to the data selector 2 (reference numeral 219). 2 are connected.

  The interrupt level register 20, the selection circuit 22, the data selector 1 (symbol 224), and the data selector 2 (symbol 219) are respectively connected by control lines for sending the current interrupt level number of the CPU.

  The selection circuit 22 refers to the current interrupt level value of the CPU 1a sent from the interrupt level register 20, and selects one of the data bus diagnostic registers 220 to 223 and one of the address bus diagnostic registers 215 to 218. It has a function of selecting any one and sending the bus diagnostic signal (CHKBUS) 15 received from the bus diagnostic address determination unit 14 to the selected data bus diagnostic register and address bus diagnostic register. For example, when the interrupt level of the CPU 1a is 1, the selection circuit 22 selects the data bus diagnosis register 1 and the address bus diagnosis register 1, and when the interrupt level of the CPU 1a is 2, the selection circuit 22 The data bus diagnostic register 2 and the address bus diagnostic register 2 are selected. Thus, the data bus diagnosis register and the address bus diagnosis register are selected as a set corresponding to the current interrupt level of the CPU 1a.

  The data selector 1 (symbol 224) and the data selector 2 (symbol 219) refer to the current interrupt level value of the CPU 1a sent from the interrupt level register 20, and the data selector 1 (symbol 224) and the data selector 2 ( A function of selecting and outputting any one of a plurality of inputs 219). For example, when the interrupt level of the CPU 1a is 1, the data selector 1 (reference numeral 224) and the data selector 2 (reference numeral 219) select values input from the data bus diagnosis register 1 and the address bus diagnosis register 1. When the interrupt level of the CPU 1a is 2, the data selector 1 (reference numeral 224) and the data selector 2 (reference numeral 219) select values input from the data bus diagnostic register 2 and the address bus diagnostic register 2. Output.

  FIG. 5 is a diagram illustrating an example of a flowchart of processing of the CPU 1a in the present embodiment. With respect to steps 501 to S517 and steps S520 to S531 shown in FIG. 5, portions different from those described with reference to FIG. 2 will be described. In the present embodiment, a case where a level 2 interrupt process occurs in the CPU 1a when step S501 at the interrupt level 1 is completed will be described.

  In step S501 at interrupt level 1, the CPU 1a writes the value (ccc) of the output port SOUT1 of the CPU 1a to the safety related register 1 (reference numeral 81). At this time, the bus diagnosis address determination unit 14 receives a write control signal (WRN) 4 for the safety-related register 1 (reference numeral 81) from the CPU 1a, and sends a selection circuit 22 in the CPU bus diagnosis register group 21 to the selection circuit 22 in the CPU bus diagnosis register group 21. A bus diagnostic signal (CHKBUS) 15 is output. The selection circuit 22 reads the value indicating the current interrupt level (level 1) of the CPU 1a from the interrupt level register 20, decodes it, and outputs it, so that the data bus diagnostic register 1 (reference numeral 220) and the address bus diagnostic register 1 (reference numeral 215) is selected. The bus diagnostic signal (CHKBUS) 15 is supplied to the selected data bus diagnostic register 1 (reference numeral 220) and the address bus diagnostic register 1 (reference numeral 215), and the value (ccc) of SOUT1 is supplied to the data bus diagnostic register 1 (reference numeral 220). And the address (referred to as CCC) of the safety related register 1 (reference numeral 81) is stored in the address bus diagnostic register 1 (reference numeral 215).

  After step S501 at interrupt level 1 is completed, if level 2 interrupt processing occurs in CPU 1a, level 2 interrupt processing is started (steps S526 to S531).

  In step S526, after the level 2 interrupt process is completed, the interrupt level value at the time when the level 2 interrupt process occurs is stored in the stack so that the process can return to the original interrupt level process. Store. In the present embodiment, since the interrupt level is 1 when the level 2 interrupt processing occurs, a value indicating the interrupt level 1 is stored in the stack. In step S527, a value indicating that the current interrupt level of the CPU 1a is 2 is stored in the interrupt level register 20.

  In step S528, the safety input / output process 5 is started. The processing contents of the safety input / output processing 5 are the same as those of the safety input / output processing 1. In step S501 at interrupt level 2, the CPU 1a writes the value of the output port SOUT1 of the CPU 1a (denoted as ddd) to the safety-related register 5 (reference numeral 85). At this time, the bus diagnosis address determination unit 14 receives a write control signal (WRN) 4 for the safety related register 5 (reference numeral 85) from the CPU 1a, and sends a selection circuit 22 in the CPU bus diagnosis register group 21 to the selection circuit 22 in the CPU bus diagnosis register group 21. A bus diagnostic signal (CHKBUS) 15 is output. The selection circuit 22 reads the value of the current interrupt level (level 2) of the CPU 1a from the interrupt level register 20, decodes and outputs it, so that the data bus diagnostic register 2 (reference numeral 221) and the address bus diagnostic register 2 (Symbol 216) is selected. The bus diagnosis signal (CHKBUS) 15 is supplied to the selected data bus diagnosis register 2 (reference numeral 221) and the address bus diagnosis register 2 (reference numeral 216), and the value (ddd) of SOUT1 is supplied to the data bus diagnosis register 2 (reference numeral 221). Is stored, and the address (DDD) of the safety-related register 5 (reference numeral 85) is stored in the address bus diagnostic register 2 (reference numeral 216).

  Thus, when the interrupt level of the CPU 1a is 2, the value of the output port SOUT1 of the CPU 1a is stored in the data bus diagnostic register 2 (reference numeral 221), and the safety related register is stored in the address bus diagnostic register 2 (reference numeral 216). The address value 5 (reference numeral 85) is stored, and the values of the data bus diagnostic register 1 (reference numeral 220) and the address bus diagnostic register 2 (reference numeral 215) are not rewritten.

  Thereafter, the processing up to step S516 is the same as that described with reference to FIG. 2 and will not be described. However, in the safety input / output processing at the interrupt level 2, the CPU 1a performs the data bus diagnosis register 2 ( Data bus diagnostic registers and address bus diagnostic registers other than reference numeral 221) and address bus diagnostic register 2 (reference numeral 216) are not accessed. For this reason, the values stored in the data bus diagnostic register 1 (reference numeral 220) and the address bus diagnostic register 1 (reference numeral 215) are not rewritten. When the safety input / output process 5 ends and the interrupt level 2 process proceeds to step S531, the interrupt level 2 process ends and the interrupt level 1 process resumes.

  As described above, since the values stored in the data bus diagnostic register 1 (reference numeral 220) and the address bus diagnostic register 1 (reference numeral 215) in step S501 at the interrupt level 1 remain unrewritten, the interrupt level 1 , The safety input / output process 1 processed halfway before the interrupt level 2 process can be continued. Thus, in this embodiment, safe input / output processing can be performed independently at a plurality of interrupt levels.

  In this embodiment, the address bus diagnosis registers 1 to 4 (reference numerals 215 to 218) may be omitted from the configuration of the present embodiment, and only a transfer error on the data bus may be detected. Further, the data bus diagnosis registers 1 to 4 (reference numerals 220 to 223) may be omitted from the configuration of the present embodiment, and only a transfer error on the address bus may be detected.

1a, 1b, 1c CPU, 2 data bus, 3 address bus, 4 write control signal (WRN), 5 read control signal (RDN), 6a, 6b, 6c, 6d integrated circuit, 7 input / output buffer, 81 safety related Register 1, 8N Safety-related register N, 91 Normal register 1, 9M Normal register M, 10 Address decoder, 11 Data selector, 12 Data bus diagnostic register, 13 Address bus diagnostic register, 14 Bus diagnostic address determination unit, 15 Bus diagnostic signal (CHKBUS), 16 register selection signal (REGSEL), 20 interrupt level register, 21 CPU bus diagnostic register group, 22 selection circuit, 30, 35, 36 parity generation circuit, 32, 33, 37 parity error detection circuit, 34 register Group, 210 decoders, 211-214 AND gate, 215 to 218 Address bus diagnostic register, 220 to 223 Data bus diagnostic register, 219, 224 Data selector.

In a control device having a safety-related part, when the central processing unit and the integrated circuit are included in the safety-related part, a dangerous operation occurs due to an erroneous transfer of safety-related data exchanged between the two. In order to prevent this, it is common to diagnose a data transfer error by adding a parity bit or ECC bit to the data bus of the central processing unit. In order to make such a diagnosis, it is necessary to have a diagnosis function such as a parity check in the central processing unit. On the other hand, most recently developed central processing units for high-performance embedded applications have external data Since the bus does not have a diagnostic function such as parity check, this method cannot be taken. Incidentally, safety-related parts and is that of failure or erroneous circuits and software portions hazardous machine operation to the user to perform a safety function to prevent the occurrence in the system to malfunction due to operation.

Claims (6)

An integrated circuit;
A central processing unit connected to the integrated circuit by a data bus;
A control device having a data bus diagnostic function having
The integrated circuit comprises:
A safety-related storage unit that is accessed from the central processing unit and stores data defining an operation state of a predetermined safety-related unit;
A non-safety-related storage unit that is accessed from the central processing unit and stores data defining an operation state of a predetermined non-safety-related unit;
A data bus diagnostic storage unit;
A bus diagnostic address determination unit,
The bus diagnosis address determination unit supplies a bus diagnosis signal to the data bus diagnosis storage unit when the access destination of the central processing unit is the safety-related storage unit based on the access destination address of the central processing unit When the access destination of the central processing unit is the non-safety related storage unit, the bus diagnostic signal is not supplied to the data bus diagnostic storage unit,
The data bus diagnosis storage unit that has received the bus diagnosis signal from the bus diagnosis address determination unit stores the data stored in the safety-related storage unit,
After the data stored in the safety-related storage unit is stored in the data bus diagnosis storage unit, the central processing unit stores the data stored in the data bus diagnosis storage unit and the data stored in the safety-related unit. A data bus diagnosis function, wherein a transfer error on the data bus is detected by comparing the data stored in the data bus diagnosis storage unit with the data stored in the safety-related storage unit. Control device. A control device having a data bus diagnostic function according to claim 1,
A plurality of the data bus diagnostic storage units of the integrated circuit are provided corresponding to the number of interrupt levels of the central processing unit,
The integrated circuit further comprises:
An interrupt level storage unit for storing data indicating an interrupt level when the central processing unit accesses the safety-related storage unit;
Based on the data stored in the interrupt level storage unit, one of the plurality of data bus diagnostic storage units is selected, and the selected bus diagnostic address determination unit includes the bus diagnostic address determination unit. A selection circuit for supplying the bus diagnostic signal supplied from
A control device having a data bus diagnostic function. An integrated circuit;
A central processing unit connected to the integrated circuit by an address bus;
A control device having an address bus diagnosis function having
The integrated circuit comprises:
A safety-related storage unit that is accessed from the central processing unit and stores data defining an operation state of a predetermined safety-related unit;
A non-safety related storage unit that is accessed from the central processing unit and stores data that defines the operating state of a predetermined non-safety related unit;
An address bus diagnostic storage unit;
A bus diagnostic address determination unit,
The bus diagnosis address determination unit supplies a bus diagnosis signal to the address bus diagnosis storage unit when the access destination of the central processing unit is the safety-related storage unit based on the access destination address of the central processing unit When the access destination of the central processing unit is the non-safety related storage unit, the bus diagnostic signal is not supplied to the address bus diagnostic storage unit,
The address bus diagnosis storage unit that has received the bus diagnosis signal from the bus diagnosis address determination unit stores the address of the safety-related storage unit supplied from the central processing unit,
After the address of the safety-related storage unit is stored in the address bus diagnosis storage unit, the central processing unit reads the address stored in the address bus diagnosis storage unit and stores it in the address bus diagnosis storage unit A control device having an address bus diagnosis function, wherein a transfer error on an address bus is detected by comparing an address with an address of the safety-related storage unit. A control device having an address bus diagnosis function according to claim 3,
A plurality of the address bus diagnosis storage units of the integrated circuit are provided corresponding to the number of interrupt levels of the central processing unit,
The integrated circuit further comprises:
An interrupt level storage unit for storing data indicating an interrupt level when the central processing unit accesses the safety-related storage unit;
Based on the data stored in the interrupt level storage unit, any one of the plurality of address bus diagnosis storage units is selected, and the bus diagnosis address determination unit is added to the selected one address bus diagnosis storage unit. A selection circuit for supplying the bus diagnostic signal supplied from
A control device having an address bus diagnosis function. An integrated circuit;
A central processing unit connected to the integrated circuit by a data bus and an address bus;
A control device having a data bus and address bus diagnosis function,
The integrated circuit comprises:
A safety-related storage unit that is accessed from the central processing unit and stores data defining an operation state of a predetermined safety-related unit;
A non-safety-related storage unit that is accessed from the central processing unit and stores data defining an operation state of a predetermined non-safety-related unit;
A data bus diagnostic storage unit;
An address bus diagnostic storage unit;
A bus diagnostic address determination unit,
The bus diagnosis address determination unit is based on the access destination address of the central processing unit, and when the access destination of the central processing unit is the safety-related storage unit, the data bus diagnosis storage unit and the address bus diagnosis storage unit When the bus diagnostic signal is supplied to the central processing unit and the access destination is the non-safety related storage unit, the bus diagnostic signal is not supplied to the data bus diagnostic storage unit and the address bus diagnostic storage unit,
The data bus diagnosis storage unit that has received the bus diagnosis signal from the bus diagnosis address determination unit stores the data stored in the safety-related storage unit,
The address bus diagnosis storage unit that has received the bus diagnosis signal from the bus diagnosis address determination unit stores the address of the safety-related storage unit supplied from the central processing unit,
After the data stored in the safety-related storage unit is stored in the data bus diagnostic storage unit, and the address of the safety-related storage unit is stored in the address bus diagnostic storage unit, the central processing unit Data stored in the diagnostic storage unit, addresses stored in the address bus diagnostic storage unit, and data stored in the safety related unit are read, and data stored in the data bus diagnostic storage unit and the safety related storage unit A transfer error on the data bus is detected by comparing the data stored in the address bus, and a transfer error on the address bus is detected by comparing the address stored in the address bus diagnostic storage unit with the address of the safety-related storage unit. A control device having a data bus and an address diagnosis function. A control device having a data bus and address bus diagnosis function according to claim 5,
A plurality of the data bus diagnosis storage unit and the address bus diagnosis storage unit of the integrated circuit are provided corresponding to the number of interrupt levels of the central processing unit,
The integrated circuit further comprises:
An interrupt level storage unit for storing data indicating an interrupt level when the central processing unit accesses the safety-related storage unit;
Based on the data stored in the interrupt level storage unit, select any one of the plurality of data bus diagnosis storage units, select any one from the plurality of address bus diagnosis storage units, and select A selection circuit for supplying the bus diagnosis signal supplied from the bus diagnosis address determination unit to a set of the one data bus diagnosis storage unit and the address bus diagnosis storage unit,
A control device having a data bus and address bus diagnosis function.

Images