JP2015197729A - Microprocessor failure diagnostic method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the time required for diagnosing a microprocessor.SOLUTION: A microprocessor failure diagnostic method includes: diagnosing comparators 16 by repeating diagnosis a number of times corresponding to the number of comparators 16 included in a comparator group 14, without intervention of a monitoring circuit 32 and a fail-safe circuit 34; and then diagnosing the monitoring circuit 32 and the fail-safe circuit 34. There is no need to repeat diagnosis on the monitoring circuit 32 and the fail-safe circuit 34, thereby reducing the diagnosis time as compared with a conventional microprocessor diagnostic method.

Description

  The present invention relates to a microprocessor abnormality diagnosis method.

  In general, in a dual-core microprocessor used in an in-vehicle device, the same calculation is performed in both a master core and a slave core in order to drive redundantly. In normal times, the operation result performed by the master core and the operation result performed by the slave core are always compared by the comparator in the microprocessor by the lock step process, and it is monitored whether the microprocessor is operating normally. The comparison result of the comparator is monitored by a monitoring circuit outside the microprocessor, and if an abnormality such as a difference in the comparison result is detected, a command signal is transmitted from the monitoring circuit to the fail-safe circuit, and the fail-safe process is performed by the fail-safe circuit. Is done. Therefore, before using the microprocessor, it is necessary to confirm that the above circuits and functions are operating normally.

For example, in Patent Document 1, it is confirmed that an error signal is generated by a comparator when working registers having different contents are set in two cores of a microprocessor and these different contents are supplied to the comparator. A method is disclosed.
FIG. 8 shows a conventional abnormality diagnosis method for diagnosing the plurality of comparators 16, the monitoring circuit 32, and the fail safe circuit 34 in the microprocessor 100. In the conventional abnormality diagnosis method, a pseudo fault signal generated by the pseudo fault generation circuit 18 is input to one input side of each comparator 16, and the comparison result of the comparator 16 at this time is monitored via the output interface 24. Output to the circuit 32. Then, the fail safe circuit 34 receives a command from the monitoring circuit 32, and a signal indicating that the fail safe process is performed in the fail safe circuit 34 is received by the failure determination circuit 28 in the microprocessor 100 via the input interface 26. Then, the failure determination circuit 28 performs diagnosis. Such a series of diagnostic processing is repeatedly performed by the number of the plurality of comparators 16.

Special table 2009-516276

However, in the conventional abnormality diagnosis method shown in FIG. 8, the diagnosis time S2 is prolonged because the diagnosis S220 of the monitoring circuit 32 and the diagnosis S230 of the failsafe circuit 34 are included in a series of repeated diagnosis processes S210 to S240. There was a problem that it would end up.
The present invention has been made in view of the above problems, and an object thereof is to shorten the diagnosis time of the microprocessor.

(Aspect of the Invention)
As a means for solving the above-described problems, the present invention provides a microprocessor including two microprocessor cores that can be driven redundantly, a plurality of comparators connected to each of the two microprocessor cores, and a failure determination circuit. An abnormality diagnosis method for a processor, wherein the microprocessor core and the plurality of comparators are monitored for operation by an external monitoring circuit based on a calculation result of the plurality of comparators, and the monitoring circuit is connected to the microprocessor. The failure determination circuit injects a pseudo failure signal for each of the plurality of comparators when the abnormality is detected, and the monitoring is performed without going through the fail safe circuit. Each of the plurality of comparators without going through the circuit and the fail-safe circuit. It is characterized in that to perform.

  Since the present invention is configured as described above, the diagnosis time of the microprocessor can be shortened.

1A and 1B show a microprocessor abnormality diagnosis method according to a first embodiment of the present invention, in which FIG. 1A is a block diagram schematically showing a signal flow, and FIG. 2B is a flowchart showing a processing flow; It is an image figure for demonstrating the diagnostic method of the comparator and monitoring circuit in the abnormality diagnostic method of FIG. FIGS. 4A and 4B show a microprocessor abnormality diagnosis method according to a second embodiment of the present invention, in which FIG. 5A is a block diagram schematically showing a signal flow, and FIG. 5B is a flowchart showing a processing flow. It is an image figure for demonstrating the diagnostic method of the comparator in the abnormality diagnostic method of FIG. It is an image figure for demonstrating the diagnostic method of the monitoring circuit in the abnormality diagnostic method of FIG. It is a block diagram which shows roughly the flow of a signal of the abnormality diagnosis method of the microprocessor which concerns on 3rd Embodiment. It is an image figure for demonstrating the diagnostic method of the comparator in the abnormality diagnostic method of FIG. 2A and 2B show a conventional microprocessor abnormality diagnosis method, in which FIG. 1A is a block diagram schematically showing a signal flow, and FIG. 2B is a flowchart showing a processing flow;

Hereinafter, embodiments will be described with reference to the drawings. 1 to 8, common portions are denoted by the same reference numerals. Further, in the following description, the description “normal time” indicates a state in which the microprocessor is actually used after it is determined to be normal by the abnormality diagnosis of the microprocessor.
1 and 2 show a microprocessor abnormality diagnosis method according to the first embodiment of the present invention. First, with reference to FIG. 1A and FIG. 2, the configuration of the microprocessor 10 to be diagnosed by the abnormality diagnosis method and the vehicle-mounted control device 30 on which the microprocessor 10 is mounted will be described.

  In the example of FIG. 1A, the microprocessor 10 is mounted on an in-vehicle control device 30 such as an engine control unit, for example, and is a dual-core microprocessor having two microprocessor cores, that is, a master core 12a and a slave core 12b. It is a processor. Further, the microprocessor 10 includes a comparator group 14 including a plurality of comparators 16, an OR circuit 22, an output interface 24, an input interface 26, and a failure determination circuit 28. In addition to the microprocessor 10, the in-vehicle control device 30 includes a monitoring circuit 32, a fail safe circuit 34, and the like.

  The comparator group 14 includes a plurality of comparators 16, a pseudo fault generation circuit 18 and a pseudo fault switching circuit 20 provided for each comparator 16. In the example of FIG. 1A, each of the comparators 16 has one input connected to the master core 12 a and the other input connected to the pseudo failure switching circuit 20. Each simulated fault switching circuit 20 is connected to the slave core 12b, and one input to the comparator 16 can be switched between a signal from the slave core 12b and a simulated fault signal generated by the simulated fault generating circuit 18. It is a thing. Note that a pseudo-failure signal generated by the pseudo-failure generation circuit 18 is always set to a signal that does not match when compared with a signal input to each comparator 16 from the master core 12a.

  The OR circuit 22 performs an OR operation on the comparison results input from the plurality of comparators 16. That is, if at least one of the inputs from the plurality of comparators 16 has a comparison result indicating abnormality, a signal indicating abnormality is output. The output interface 24 is for outputting a signal from the microprocessor 10, and in the example of FIG. 1A, is used for outputting the operation result of the OR circuit 22 to the monitoring circuit 32. The input interface 26 is for inputting a signal to the microprocessor 10. In the example of FIG. 1A, the output signal from the monitoring circuit 32 is input to the failure determination circuit 28 in the microprocessor 10. Used to do. The failure determination circuit 28 determines whether or not there is an abnormality from the input signal. In the example of FIG. 1A, the comparator 16 receives a signal from the monitoring circuit 32 and receives a pseudo failure signal. And / or the monitoring circuit 32 is configured to determine whether or not an abnormality has occurred.

  Further, although not shown in FIG. 1A, the microprocessor 10 includes a pin function control means 50 between the OR circuit 22 and the output interface 24 as shown in FIG. . The pin function control means 50 is, for example, a PFC (Pin Function Controller) and can set the function of the output interface 24. In the example of FIG. 2, the pin function control means 50 outputs a signal output from the output interface 24 to the output value of the comparator 16 via the OR circuit 22, the value set in the data register for port output, and any other value. It is possible to switch between output values from these functions.

On the other hand, the monitoring circuit 32 provided outside the microprocessor 10 receives the comparison results by the plurality of comparators 16 via the OR circuit 22 and the output interface 24, and the operation results of the master core 12a and the slave core 12b are It is to monitor that there is no difference. When the monitoring circuit 32 detects that there is a difference in any of the comparison results of the plurality of comparators 16, the monitoring circuit 32 transmits a command signal that causes the fail safe circuit 34 to execute the fail safe process. In the present embodiment, the monitoring circuit 32 is provided inside the sub CPU 40 as shown in FIG.
The fail safe circuit 34 is, for example, a relay cutoff circuit or the like, and receives a command signal from the monitoring circuit 32 and performs fail safe processing. FIG. 1A shows the flow of signals when the comparator 16 and the monitoring circuit 32 are diagnosed by the abnormality diagnosis method. Therefore, the command signal transmitted from the monitoring circuit 32 to the fail-safe circuit 34 is shown in FIG. The flow is not shown.

Next, each processing step of the abnormality diagnosis method for the microprocessor according to the first embodiment of the present invention will be described with reference to FIGS. 1A and 2 along the flowchart shown in FIG. explain.
S10 (Diagnosis of comparator): This is a processing step for diagnosing each comparator 16. Specifically, one of the comparators 16 not yet diagnosed in the comparator group 14 is set as a diagnosis target, and a pseudo failure signal is input (error injection) to the diagnosis target comparator 16. That is, the pseudo fault switching circuit 20 connected to one input of the comparator 16 to be diagnosed causes the pseudo fault generating circuit 18 to generate a signal to be input to the comparator 16 from the signal of the operation result of the slave core 12b. Switch to signal. At this time, not the pseudo failure signal but the signal of the operation result of the slave core 12b is input to the comparator 16 other than the diagnosis target.

  Then, the diagnostic target comparator 16 is made to compare the calculation result signal of the master core 12a with the pseudo failure signal. Here, assuming that the comparator 16 to be diagnosed is operating normally, the comparator 16 to be diagnosed is different because the input operation result signal of the master core 12a is different from the pseudo failure signal. A comparison result (for convenience of explanation, “1”) is output to the OR circuit 22. Further, the comparators 16 other than those to be diagnosed compare the calculation result signal of the master core 12a and the calculation result signal of the slave core 12b, and show a comparison result indicating that there is no difference (for convenience of explanation, it is set to “0”). ) Is output to the OR circuit 22. In this case, since the input from the comparator 16 to be diagnosed is “1” and the input from the comparators 16 other than the diagnosis target is “0”, the OR circuit 22 calculates the calculation result “ 1 "is output.

On the other hand, assuming that the comparator 16 to be diagnosed is not operating normally, the comparator 16 to be diagnosed has a difference between the input operation result signal of the master core 12a and the pseudo failure signal. A comparison result “0” indicating that there is no difference is output to the OR circuit 22. In this case, since the input from the diagnosis target comparator 16 is “0” and the input from the comparator 16 other than the diagnosis target is also “0”, the OR circuit 22 has an operation result “ "0" is output.
That is, the OR circuit 22 outputs a result equal to the comparison result of the diagnostic target comparator 16 as a calculation result, regardless of whether the comparison result of the diagnostic target comparator 16 is “1” or “0”. Become.

  S20 (diagnosis of the monitoring circuit): a processing step for diagnosing the monitoring circuit 32. Specifically, the comparison result of the comparator 16 to be diagnosed in S10 is output to the sub CPU 40 via the OR circuit 22 and the output interface 24. That is, in this abnormality diagnosis method, as shown in FIG. 2, the pin function control means 50 is used so that the calculation result of the OR circuit 22 is output from the output interface 24. In the sub CPU 40, the comparison result of the comparator 16 to be diagnosed output from the microprocessor 10 is received as a port input via the input interface 42 and transmitted to the monitoring circuit 32.

  Here, assuming that both the monitoring circuit 32 and the comparator 16 to be diagnosed are operating normally, the monitoring circuit 32 receives an operation result “1” indicating that there is a difference from the microprocessor 10. Therefore, it is determined that an abnormality has occurred in the microprocessor 10. Next, a signal indicating a determination result by the monitoring circuit 32 is input to the failure determination circuit 28 via the output interface 44 of the sub CPU 40 and the input interface 26 of the microprocessor 10. Then, the failure determination circuit 28 outputs a comparison result indicating that the diagnosis target comparator 16 is different in a state in which a pseudo failure signal is input to the diagnosis target comparator 16, and the monitoring circuit 32 that receives the comparison results in an abnormality. It is determined that the determination result of occurrence has been output. Therefore, the failure determination circuit 28 determines that both the comparator 16 to be diagnosed and the monitoring circuit 32 are operating normally.

  On the other hand, assuming that the monitoring circuit 32 operates normally and the comparator 16 to be diagnosed does not operate normally, the monitoring circuit 32 receives an operation result “0” indicating that there is no difference from the microprocessor 10. Therefore, it is determined that no abnormality has occurred in the microprocessor 10, and a signal indicating the determination result is output to the failure determination circuit 28. Further, assuming that the comparator 16 to be diagnosed operates normally and the monitoring circuit 32 does not operate normally, the monitoring circuit 32 receives an operation result “1” indicating that there is a difference from the microprocessor 10. Nevertheless, it is determined that no abnormality has occurred in the microprocessor 10, and a signal indicating the determination result is output to the failure determination circuit 28. In any of the above-described cases, since a signal indicating that no abnormality has occurred in the microprocessor 10 is received even though a pseudo failure signal is input to the comparator 16 to be diagnosed, failure determination is performed. The circuit 28 determines that the comparator 16 or the monitoring circuit 32 to be diagnosed is not operating normally.

As described above, in the present embodiment, the diagnosis of the diagnosis target comparator 16 and the monitoring circuit 32 is performed by combining the processing steps of S10 and S20.
Note that the input from the monitoring circuit 32 to the failure determination circuit 28 described above may be performed via a communication line between CPUs between the microprocessor 10 and the sub CPU 40.

  S30 (diagnosis count addition): After performing the processing steps of S10 and S20, the diagnosis count is incremented by one.

  S40 (diagnosis count determination): The diagnosis count is compared with the quantity of the plurality of comparators 16 included in the comparator group 14. If the number of diagnoses is less than the quantity of the comparator 16 (NO), the process returns to S10, and if the number of diagnoses reaches the quantity of the comparator 16 (YES), the process proceeds to S50. That is, the processing steps S10 to S30 are repeated until all the comparators 16 included in the comparator group 14 are diagnosed.

  S50 (diagnosis of fail-safe circuit): This is a processing step for diagnosing the fail-safe circuit 34. Specifically, for example, the signal output from the monitoring circuit 32 is input to the fail-safe circuit 34 as in the signal flow of the conventional microprocessor abnormality diagnosis method shown in FIG. In response, the signal output from the fail-safe circuit 34 is input to the failure determination circuit 28 of the microprocessor 10. That is, a pseudo failure signal is input from the pseudo failure generation circuit 18 to any of the comparators 16 determined to be operating normally in the processing steps of S10 and S20, and the comparison result of the comparator 16 is The data is input to the monitoring circuit 32 via the OR circuit 22 and the output interface 24. At this time, since the comparator 16 is operating normally, the calculation result “1” indicating that there is a difference is input to the monitoring circuit 32. Upon receiving this input, the monitoring circuit 32 detects that the comparator 16 is abnormal while operating normally. At this time, a command signal for executing fail-safe processing, which is output from the monitoring circuit 32, is input to the fail-safe circuit 34. Then, a signal indicating whether or not the fail safe process is executed is input from the fail safe circuit 34 to the failure determination circuit 28 via the input interface 26.

  Here, assuming that the fail-safe circuit 34 is operating normally, the fail-safe circuit 34 receives the command signal from the monitoring circuit 32 and enters a state in which the fail-safe process is executed. A signal indicating that the fail-safe process is executed is input to the failure determination circuit 28. At this time, the failure determination circuit 28 determines that the fail-safe circuit 34 performs the fail-safe process because the pseudo-failure signal is input to one of the comparators 16. Therefore, it is determined by the failure determination circuit 28 that the fail safe circuit 34 is operating normally.

  On the other hand, assuming that the fail-safe circuit 34 is not operating normally, the fail-safe circuit 34 does not enter a state in which fail-safe processing is executed even if it receives a command signal from the monitoring circuit 32. No signal indicating that the fail-safe process is executed is not input to the failure determination circuit 28. At this time, the failure determination circuit 28 determines that the fail-safe circuit 34 does not execute the fail-safe process even though the pseudo failure signal is input to one of the comparators 16. Therefore, the failure determination circuit 28 determines that the fail safe circuit 34 is not operating normally.

  As described above, the abnormality diagnosis method for the microprocessor according to the first embodiment of the present invention performs diagnosis of each of the plurality of comparators 16 without using the fail-safe circuit 34, as shown in FIG. In other words, a signal for diagnosis of each of the plurality of comparators 16 is output from the monitoring circuit 32 and input to the failure determination circuit 28. That is, after a series of diagnosis (S10 and S20) of the comparator 16 and the monitoring circuit 32 is repeated by the number of the comparators 16 included in the comparator group 14 (S40), the diagnosis of the failsafe circuit 34 (S50) is performed. . On the other hand, in the conventional microprocessor abnormality diagnosis method shown in FIG. 8, a series of diagnosis (S210 to S230) of the comparator 16, the monitoring circuit 32, and the fail-safe circuit 34 is performed by the comparator 16 included in the comparator group 14. This is repeated for the quantity (S250). Therefore, the microprocessor abnormality diagnosis method according to the first embodiment of the present invention does not require repeated diagnosis of the failsafe circuit 34 as compared with the conventional microprocessor abnormality diagnosis method. It can be shortened.

Furthermore, in the microprocessor abnormality diagnosis method according to the first embodiment of the present invention, in the diagnosis step (S50) of the fail-safe circuit 34, the comparator 16 that is implemented last is used as the comparator 16 that inputs a pseudo failure signal. If the comparator 16 determined to be operating normally by inputting a pseudo failure signal in the diagnosis step (S10) is used continuously, the setting of the comparator 16 for inputting the pseudo failure signal or the pseudo failure Since it is not necessary to input a signal again, the diagnosis time can be further shortened.
The microprocessor abnormality diagnosis method according to the first embodiment of the present invention performs diagnosis of the plurality of comparators 16 and the monitoring circuit 32 without using the fail-safe circuit 34, so that a conventional microprocessor is used. Compared with the abnormality diagnosis method, the location of the abnormality can be easily identified.

  Next, a microprocessor abnormality diagnosis method according to the second embodiment of the present invention will be described with reference to FIGS. The microprocessor abnormality diagnosis method according to the second embodiment of the present invention is compared with the microprocessor abnormality diagnosis method according to the first embodiment of the present invention shown in FIGS. The configuration is the same except for part of the signal flow and part of the processing flow. Therefore, the description of the configuration and processing of the same parts as those of the microprocessor abnormality diagnosis method according to the first embodiment of the present invention will be omitted.

  3A and 4, the output interface 24 is used to output the operation result of the OR circuit 22 to the outside of the microprocessor 10 ′, and the input interface 26 is used for the microprocessor 10. The operation result of the OR circuit 22 output to the outside of 'is used to input to the failure determination circuit 28 in the microprocessor 10'. That is, the operation result of the OR circuit 22 is output to the outside of the microprocessor 10 ′ through the output interface 24, and then input to the inside of the microprocessor 10 ′ again through the input interface 26. The failure determination circuit 28 is configured to receive the calculation result from the OR circuit 22 and determine whether or not an abnormality has occurred in the comparator 16 to which a pseudo failure signal is input.

  The monitoring circuit 32 normally receives the comparison results from the plurality of comparators 16 and monitors that there is no difference in the calculation results between the master core 12a and the slave core 12b. The fail safe circuit 34 performs fail safe processing when receiving a command signal from the monitoring circuit 32. 3A shows the flow of signals when the comparator 16 is diagnosed by this abnormality diagnosis method, so that signals input from the microprocessor 10 ′ to the monitoring circuit 32 at normal times, The flow of the command signal transmitted from the monitoring circuit 32 to the fail safe circuit 34 is not shown.

Subsequently, according to the flowchart shown in FIG. 3 (b), referring to FIGS. 3 (a), 4 and 5, each of the microprocessor abnormality diagnosis method according to the second embodiment of the invention is described. Processing steps will be described.
S110 (Diagnosis of comparator): The same processing as S10 in FIG. Thereafter, the operation result of the OR circuit 22 is input to the failure determination circuit 28 via the output interface 24 and the input interface 26. That is, in this processing step, as shown in FIG. 4, setting is made so that the operation result of the OR circuit 22 is output from the output interface 24 using the pin function control means 50.

  Here, assuming that the comparator 16 to be diagnosed is operating normally, the failure determination circuit 28 receives an operation result “1” indicating that there is a difference from the OR circuit 22. Then, the failure determination circuit 28 determines that the diagnosis target comparator 16 has output a comparison result indicating a difference because the pseudo failure signal is input to the diagnosis target comparator 16. Therefore, the failure determination circuit 28 determines that the comparator 16 to be diagnosed is operating normally.

  On the other hand, assuming that the diagnostic target comparator 16 is not operating normally, the failure determination circuit 28 receives from the OR circuit 22 the operation result “0” indicating that there is no difference. Then, the failure determination circuit 28 determines that the diagnosis target comparator 16 has output a comparison result indicating that there is no difference, even though a pseudo failure signal is input to the diagnosis target comparator 16. . For this reason, the failure determination circuit 28 determines that the diagnostic target comparator 16 is not operating normally.

S120 (Diagnosis count addition): After performing the processing step of S110, the diagnosis count is incremented by one.
S130 (diagnosis count determination): The diagnosis count and the quantity of the plurality of comparators 16 included in the comparator group 14 are compared. If the number of diagnoses is less than the quantity of the comparator 16 (NO), the process returns to S110, and if the number of diagnoses reaches the quantity of the comparator 16 (YES), the process proceeds to S140. In other words, the processing steps S110 and S120 are repeated until all the comparators 16 included in the comparator group 14 are diagnosed.

  S140 (diagnosis of the monitoring circuit): As shown in FIG. 5, using the pin function control means 50, the output interface 24 is set so that the set value of the data register for port output is output. At this time, the same value as the value output when the comparator 16 indicates a difference is set in the data register for port output. Then, the set value of the data register is input to the monitoring circuit 32 via the output interface 24 and the input interface 42 of the sub CPU 40.

  Here, assuming that the monitoring circuit 32 is operating normally, the monitoring circuit 32 receives a signal indicating that there is a difference from the microprocessor 10 ′, and therefore determines that there is an abnormality in the microprocessor 10 ′. To do. Next, a signal indicating the determination result by the monitoring circuit 32 is input to the failure determination circuit 28 via the output interface 44 of the sub CPU 40 and the input interface 26 of the microprocessor 10 ′. Then, the failure determination circuit 28 receives the set value of the data register for port output in which the same value as the value output when the comparator 16 indicates a difference is received, and the monitoring circuit 32 outputs the determination result of occurrence of abnormality. Judge that For this reason, it is determined by the failure determination circuit 28 that the monitoring circuit 32 is operating normally.

On the other hand, assuming that the monitoring circuit 32 is not operating normally, the monitoring circuit 32 receives a comparison result indicating that there is a difference from the microprocessor 10 ′, but the microprocessor 10 ′ has an abnormality. Not determined to be. For this reason, when a signal indicating this determination result is input to the failure determination circuit 28, the failure determination circuit 28 sets the same value as the value output when the comparator 16 indicates a difference, and sets the data register for port output. Although the value is output, the monitoring circuit 32 determines that the signal indicating that there is an abnormality is not output, and determines that the monitoring circuit 32 is not operating normally.
Note that the input from the monitoring circuit 32 to the failure determination circuit 28 described above may be performed via a communication line between CPUs between the microprocessor 10 ′ and the sub CPU 40.

  S150 (fail-safe circuit diagnosis): A process similar to S50 of FIG. 1B is executed. At this time, the signal output from the output interface 24 is switched using the pin function control means 50 to the set value of the data register for port output in which the same value as that output when the comparator 16 indicates a difference is set. The fail safe circuit 34 may be diagnosed.

  As described above, in the microprocessor abnormality diagnosis method according to the second embodiment of the present invention, as shown in FIG. 3, each of the plurality of comparators 16 is diagnosed by the monitoring circuit 32 and the fail-safe circuit 34. This is done without intervention. That is, after the diagnosis of the comparator 16 (S110) is repeated by the number of the comparators 16 included in the comparator group 14 (S130), the diagnosis of the monitoring circuit 32 (S140) and the diagnosis of the failsafe circuit 34 (S150) are performed. Is what you do. Therefore, the microprocessor abnormality diagnosis method according to the second embodiment of the present invention does not require repeated diagnosis of the monitoring circuit 32, and therefore the microprocessor abnormality diagnosis according to the first embodiment of the present invention. The diagnosis time can be further shortened than the method.

  Furthermore, in the microprocessor abnormality diagnosis method according to the second embodiment of the present invention, the diagnosis of the plurality of comparators 16 is performed without going through the monitoring circuit 32 and the fail-safe circuit 34. In other words, the plurality of comparators 16 The failure determination circuit 28 inputs a signal output from the microprocessor for each diagnosis. For this reason, an abnormality occurrence location can be separated among the comparators 16, the monitoring circuit 32, and the fail safe circuit 34.

  Next, a microprocessor abnormality diagnosis method according to the third embodiment will be described with reference to FIGS. The microprocessor abnormality diagnosis method according to the third embodiment is different from the microprocessor abnormality diagnosis method according to the second embodiment of the present invention shown in FIGS. 22 except that the output from 22 is not output to the outside of the microprocessor 10 ″. For this reason, the microprocessor abnormality diagnosis method according to the second embodiment of the present invention is similar. The description of the configuration and processing of the parts is omitted.

  6 and 7, the microprocessor 10 ″ can refer to the state of the output interface 24 inside the microprocessor 10 ″. Therefore, the failure determination circuit 28 of the microprocessor 10 ″ can refer to the operation result of the OR circuit 22 and the like from the output interface 24. The output interface 24 is used for diagnosis of the monitoring circuit 32 and the failsafe circuit 34 at normal times. At times, the calculation result of the OR circuit 22 and the set value of the register for port output are used to output from the microprocessor 10 ″ to the monitoring circuit 32.

  The processing flow of the microprocessor abnormality diagnosis method according to the third embodiment is the same as the processing flow of the microprocessor abnormality diagnosis method according to the second embodiment of the present invention shown in FIG. It is the same. However, in the comparator diagnosis (S110), the failure determination circuit 28 refers directly to the calculation result of the OR circuit 22 from the output interface 24 without going outside the microprocessor 10 ″.

  As described above, in the microprocessor abnormality diagnosis method according to the third embodiment, as shown in FIGS. 6 and 7, the calculation result of the OR circuit 22, that is, the diagnosis target, is provided inside the microprocessor 10 ″. The comparison result of the comparator 16 is directly referred to from the output interface 24 by the failure determination circuit 28 to diagnose the comparator 16 to be diagnosed.Therefore, the abnormality diagnosis method for the microprocessor according to the third embodiment is as follows. Compared with the microprocessor abnormality diagnosis method according to the second embodiment of the present invention, the comparison result of the comparator 16 to be diagnosed is output to the outside of the microprocessor 10 ″, and then the microprocessor 10 ″ again. Since it is not necessary to input inside, it is possible to further shorten the diagnosis time.

  Note that the expression “input interface” in the above description is used in a functional sense for inputting a signal to a microprocessor or a sub CPU. Therefore, even if the number of input interfaces shown in the figure is one, there may be a case where a plurality of pins are physically used, and even input interfaces indicated by the same reference numerals may be used. In some cases, physically different pins are used. The same applies to the expression “output interface” in the above description.

  10, 10 ', 10 ": Microprocessor, 12a: Master core, 12b: Slave core, 16: Comparator, 32: Monitoring circuit, 34: Fail-safe circuit

Claims (1)

A microprocessor abnormality diagnosis method including two microprocessor cores that can be driven redundantly, a plurality of comparators connected to each of the two microprocessor cores, and a failure determination circuit,
The microprocessor core and the plurality of comparators are monitored for operation by an external monitoring circuit based on the calculation results of the plurality of comparators, and the monitoring circuit fails to detect a failure in the microprocessor. To perform safe processing,
The failure determination circuit injects a pseudo failure signal for each of the plurality of comparators, without passing through the fail-safe circuit, or without passing through the monitoring circuit and the fail-safe circuit. A method for diagnosing an abnormality in a microprocessor, comprising performing a diagnosis.

Images