JP2020177357A - Watchdog timer - Google Patents

Abstract

To appropriately detect frequency abnormality.SOLUTION: A watchdog timer 173 includes a first frequency abnormality detection part 173a of a trigger type, a second frequency abnormality detection part 173b of a communication interruption detection type, and a third frequency abnormality detection part 173c of a Q&A type, and selectively uses the respective frequency abnormality detection parts 173a to 173c. For example, the watchdog timer 173 switches the respective frequency abnormality detection parts 173a to 173c in accordance with a state of a system. Specifically, the first frequency abnormality detection part 173a is prioritized when the system is in a first state, the second frequency abnormality detection part 173b is prioritized when the system is in a second state of a load lighter than in the first state, and the third frequency abnormality detection part 173c is prioritized when the system is in a third state of a load much lighter than in the second state.SELECTED DRAWING: Figure 5

Description

The invention disclosed herein relates to a monitoring device (particularly the watchdog timer used herein).

In recent years, monitoring devices (so-called monitoring ICs) that monitor various voltages and clock signals and detect their abnormalities have been used in various applications.

As an example of the prior art related to the above, Patent Document 1 can be mentioned.

International Publication No. 2013/08427

However, in the above-mentioned conventional monitoring device, there is room for further improvement in the frequency abnormality detection operation of the watchdog timer.

In particular, in recent years, in-vehicle ICs have been required to comply with ISO 26262 (international standard for functional safety related to automobile electricity / electronics), and in-vehicle monitoring ICs are also required to comply with fail-safe. The reliability design placed is important.

The invention disclosed in the present specification provides a watchdog timer capable of appropriately detecting a frequency abnormality in view of the above-mentioned problems found by the inventor of the present application, and a monitoring device using the watchdog timer. The purpose is to do.

The watchdog timer disclosed in the present specification includes a trigger type first frequency abnormality detection unit, a communication interruption detection type second frequency abnormality detection unit, and a Q & A type third frequency abnormality detection unit. It has a configuration in which each frequency abnormality detection unit is selectively used (first configuration).

The watchdog timer having the first configuration may have a configuration (second configuration) in which each frequency abnormality detection unit can be switched according to the state of the system.

For example, in the watchdog timer having the second configuration, when the system is in the first state, the first frequency abnormality detection unit is prioritized, and the system is in the second state with a lighter load than the first state. In some cases, the second frequency abnormality detection unit is prioritized, and when the system is in the third state with a lighter load than the second state, the third frequency abnormality detection unit is prioritized (third configuration). It is good to set it to.

Further, the watchdog timer having the first configuration may have a configuration (fourth configuration) in which each frequency abnormality detection unit is switched according to the user setting.

In the watchdog timer having any of the first to fourth configurations, the first frequency abnormality detection unit monitors, for example, a periodic pulse edge to detect a frequency abnormality (fifth configuration). ).

Further, in the watchdog timer having any of the first to fifth configurations, the second frequency abnormality detection unit monitors, for example, periodic communication access to detect a frequency abnormality (sixth configuration). ).

Further, in the watchdog timer having any of the first to sixth configurations, the third frequency abnormality detection unit may, for example, monitor a periodic Q & A event to detect a frequency abnormality (seventh configuration). ).

Further, the monitoring device disclosed in the present specification has a configuration (eighth configuration) having a watchdog timer having any of the above-mentioned first to seventh configurations.

Further, the electronic device disclosed in the present specification is configured to have a monitoring device having the eighth configuration (nineth configuration).

Further, the vehicle disclosed in the present specification has a configuration having an electronic device having the ninth configuration (tenth configuration).

According to the invention disclosed in the present specification, it is possible to provide a watchdog timer capable of appropriately detecting a frequency abnormality and a monitoring device using the watchdog timer.

Diagram showing the overall configuration of electronic devices The figure which shows the package appearance of the monitoring IC The figure which shows the pin arrangement of a monitoring IC The figure which shows the 1st Embodiment of a monitoring IC The figure which shows the 2nd Embodiment (details of a watchdog timer) of a monitoring IC Timing chart showing an example of dynamic switching control of frequency abnormality detection operation Timing chart showing an example of trigger type WDT operation Timing chart showing an example of communication interruption detection type WDT operation Timing chart showing an example of Q & A type WDT operation Flow chart showing an example of Q & A type WDT operation The figure which shows one configuration example of the 3rd frequency abnormality detection part The figure which shows one configuration example of the question signal generation part The figure which shows one configuration example of the answer signal generation part External view of the vehicle

<Electronic equipment>
FIG. 1 is a diagram showing an overall configuration of an electronic device. The electronic device 1 of this configuration example includes a monitoring IC 100, a power management IC 200, and a microcomputer 300. Further, the electronic device 1 has resistors R1 to R10 and R12 to R16, and capacitors C1 and C2 as discrete components externally attached to the semiconductor devices 100 to 300.

The monitoring IC 100 is a semiconductor integrated circuit device that operates by receiving a power supply voltage VDD (= output voltage VO1) from the power management IC 200, and monitors various output voltages of the power management IC 200 and output frequencies of the microcomputer 300, respectively. Abnormality detection is performed. The monitoring IC 100 has a plurality of external terminals (VDD pin, GND pin, CT pin, MISO pin, MOSI pin, SCLK pin, XSCS pin, WDIN pin, DIN1) as a means for establishing an electrical connection with the outside of the IC. ~ DIN4 pin, PG1 to PG4 pin, XRSTIN pin, and XRSTOUT pin).

The power management IC 200 is a semiconductor integrated circuit device that operates by being supplied with a battery voltage VBAT, and generates a plurality of output voltages VO1 to VO5 and supplies them to each part of the electronic device 1. Instead of the multi-output power management IC 200, it is also possible to use a plurality of single-output DC / DC converters, LDO [low drop-out] regulators, and the like.

The microcomputer 300 is a semiconductor integrated circuit device that operates by receiving a power supply voltage VDD (= output voltage VO1) from the power management IC 200, and comprehensively controls the operation of the entire electronic device 1 including the monitoring IC 100 and the power management IC 200. To do.

The microcomputer 300 is reset by the reset output signal XRSTOUT input from the monitoring IC 100. More specifically, the microcomputer 300 is in the reset state (= disabled state) when the reset output signal XRSTOUT is at the low level, and is in the reset release state (= enabled state) when the reset output signal XRSTOUT is at the high level. ).

Further, in the microcomputer 300, the output voltage VOx of the power management IC 200 is normal according to the logic level of the power good signal PGx (however, x = 1, 2, 3, 4 and the same applies hereinafter) input from the monitoring IC 100. It has a function to judge whether or not it is. More specifically, the microcomputer 300 determines that the output voltage VOx is normal when the power good signal PGx is at a high level, and the output voltage VOx is abnormal (when the power good signal PGx is at a low level). For example, it is determined that the overvoltage abnormality or the undervoltage abnormality).

Further, the microcomputer 300 has a function of outputting a watchdog input signal WDIN (= reset pulse signal of several tens of Hz) to the WDIN pin of the monitoring IC 100.

Further, the monitoring IC 100 and the microcomputer 300 each have a function of bidirectional communication via the SPI [serial peripheral interface] bus, with the microcomputer 300 as the master and the monitoring IC 100 as the slave. For example, the microcomputer 300 has a function of controlling the oscillation frequency of the oscillator and enabling the watchdog timer by controlling the register of the monitoring IC 100 by SPI communication. Further, the microcomputer 300 also has a function of determining a match between the set value ordered to be written by the watchdog enable register and the stored value read from the monitoring IC 100.

The resistors R1 and R2 are connected in series between the output end and the ground end of the output voltage VO1 and function as a voltage dividing circuit of the output voltage VO1. The connection node between the resistors R1 and R2 (= the output end of the voltage divider circuit) is connected to the XRSTIN pin of the monitoring IC 100.

The resistors R3 and R4 are connected in series between the output end and the ground end of the output voltage VO2, and function as a voltage dividing circuit of the output voltage VO2. The connection node between the resistors R3 and R4 (= the output end of the voltage divider circuit) is connected to the DIN1 pin of the monitoring IC 100.

The resistors R5 and R6 are connected in series between the output end and the ground end of the output voltage VO3, and function as a voltage dividing circuit of the output voltage VO3. The connection node between the resistors R5 and R6 (= the output end of the voltage divider circuit) is connected to the DIN2 pin of the monitoring IC 100.

The resistors R7 and R8 are connected in series between the output end and the ground end of the output voltage VO4, and function as a voltage dividing circuit of the output voltage VO4. The connection node between the resistors R7 and R8 (= the output end of the voltage divider circuit) is connected to the DIN3 pin of the monitoring IC 100.

The resistors R9 and R10 are connected in series between the output end and the ground end of the output voltage VO5, and function as a voltage dividing circuit of the output voltage VO5. The connection node between the resistors R9 and R10 (= the output end of the voltage divider circuit) is connected to the DIN4 pin of the monitoring IC 100.

The resistor R12 is connected between the XRSTOUT pin of the monitoring IC 100 and the power supply end, and functions as a pull-up resistor for lifting the reset output signal XRSTOUT from the monitoring IC 100 to the microcomputer 300 to the power supply voltage VDD.

The resistor R13 is connected between the PG1 pin of the monitoring IC 100 and the power supply end, and functions as a pull-up resistor for lifting the power good signal PG1 from the monitoring IC 100 to the microcomputer 300 to the power supply voltage VDD.

The resistor R14 is connected between the PG2 pin of the monitoring IC 100 and the power supply end, and functions as a pull-up resistor for lifting the power good signal PG2 from the monitoring IC 100 to the microcomputer 300 to the power supply voltage VDD.

The resistor R15 is connected between the PG3 pin of the monitoring IC 100 and the power supply end, and functions as a pull-up resistor for lifting the power good signal PG3 from the monitoring IC 100 to the microcomputer 300 to the power supply voltage VDD.

The resistor R16 is connected between the PG4 pin of the monitoring IC 100 and the power supply end, and functions as a pull-up resistor for lifting the power good signal PG4 from the monitoring IC 100 to the microcomputer 300 to the power supply voltage VDD.

The capacitor C1 is connected between the VDD pin of the monitoring IC 100 and the ground end, and functions as a smoothing means for the output voltage VO1 (= power supply voltage VDD).

The capacitor C2 is connected between the CT pin of the monitoring IC 100 and the ground end, and functions as a reset time setting element.

<Monitoring IC (package)>
FIG. 2 is a diagram showing the package appearance (top surface and bottom surface) of the monitoring IC 100. As shown in this figure, for example, a VQFN [very thin quad flat non-leaded] package may be adopted as the package of the monitoring IC 100.

More specifically, the monitoring IC 100 has a resin encapsulant 101 having a rectangular shape in a plan view, and on its bottom surface, there are a total of 20 resin encapsulants, 5 on each side without protruding from the resin encapsulant 101. The external terminal 102 is exposed. With such a non-lead VQFN package, it is possible to reduce the mounting area as compared with a package having leads (QFP [quad flat package] or the like).

The resin sealant 101 is tapered from the side surface to the bottom surface so that the bottom surface thereof is slightly smaller than the top surface. Further, the external terminal 102 is exposed from the bottom surface to the side surface of the resin sealing body 101. With such a configuration, mounting work on a printed wiring board (not shown) can be easily and reliably performed.

Further, on the bottom surface of the resin sealing body 101, the back surface (= the back side of the chip mounting surface) of the island on which the semiconductor chip (not shown) of the monitoring IC 100 is mounted is exposed as the heat dissipation pad 103. With such a configuration, it is possible to improve the heat dissipation of the monitoring IC 100.

It is preferable that at least one of the four corners of the heat radiating pad 103 is provided with a notch 103a. With such a configuration, it is possible to improve the adhesion with the resin sealing body 101 and prevent the heat radiating pad 103 (= island) from falling off.

<Monitoring IC (pin arrangement)>
FIG. 3 is a diagram showing a pin arrangement of the monitoring IC 100 (when 20-pin VQFN is adopted). On the first side (lower side of this figure) of the monitoring IC 100, five external terminals (pins 1 to 5) are arranged in order from left to right in this figure. Pin 1 is a power supply terminal (VDD pin). Pin 2 is an unused terminal (NC [non-connection] pin). Pin 3 is a ground terminal (GND pin). Pin 4 is an unused terminal (NC pin). Pin 5 is a reset time setting terminal (CT pin).

On the second side (right side of this figure) of the monitoring IC 100, five external terminals (6 pins to 10 pins) are arranged in order from the bottom to the top of this figure. Pin 6 is an SPI data output terminal (MIMO pin). Pin 7 is an SPI data input terminal (MOSI pin). Pin 8 is an SPI clock terminal (SCLK pin). Pin 9 is an SPI chip select terminal (XSCS pin). Pin 10 is a watchdog input terminal (WDIN pin).

On the third side (upper side of this figure) of the monitoring IC 100, five external terminals (pins 11 to 15) are arranged in order from right to left in this figure. Pin 11 is a first monitoring input pin (DIN1 pin). Pin 12 is the first power good output terminal (PG1 pin). Pin 13 is a second monitoring input pin (DIN2 pin). Pin 14 is a second power good output terminal (PG2 pin). Pin 15 is a third monitoring input pin (DIN3 pin).

On the fourth side (left side of this figure) of the monitoring IC 100, five external terminals (16 pins to 20 pins) are arranged in order from the top to the bottom of this figure. Pin 16 is a third power good output terminal (PG3 pin). Pin 17 is a fourth monitoring input pin (DIN4 pin). Pin 18 is a fourth power good output terminal (PG4 pin). Pin 19 is a reset monitoring input pin (XRSTIN pin). Pin 20 is a reset output terminal (XRSTOUT pin).

<Monitoring IC (1st embodiment)>
FIG. 4 is a diagram showing a first embodiment (basic configuration) of the monitoring IC 100. The monitoring IC 100 of the present embodiment includes a reference voltage generation unit 111, a sub-reference voltage generation unit 112, a reference voltage detection unit 120, a UVLO [under voltage locked-out] unit 130, and a threshold voltage generation unit 140 to 149. , Comparator 150 to 159, oscillators 161 and 162, digital processing unit 170, N-channel type MOS [metal oxide semiconductor] field effect transistors 180 to 184, and SPI interface 190 are integrated.

The reference voltage generation unit 111 generates a predetermined reference voltage VREF from the power supply voltage VDD input to the VDD pin.

The sub-reference voltage generation unit 112 generates a predetermined sub-reference voltage VREF2 from the power supply voltage VDD.

The reference voltage detection unit 120 operates by receiving the supply of the power supply voltage VDD, detects whether or not the reference voltage VREF and the sub-reference voltage VREF2 are normally rising, and generates the reference voltage detection signal VREF_DET. The reference voltage detection signal VREF_DET becomes a low level when both the reference voltage VREF and the sub reference voltage VREF2 normally rise, and becomes a high level when at least one of them does not normally rise. Further, a BIST [built-in self test] enable signal BIST_EN is input to the reference voltage detection unit 120. That is, the reference voltage detection unit 120 corresponds to a monitoring unit (or one of a plurality of monitoring mechanisms included therein) that is subject to self-diagnosis when the monitoring IC 100 is started.

The UVLO unit 130 detects a low voltage abnormality of the power supply voltage VDD and outputs a low voltage abnormality signal UVLO. The low voltage abnormality signal UVLO becomes a high level when the power supply voltage VDD becomes higher than the low voltage abnormality release value UVLO_OFF, and becomes a low level when the power supply voltage VDD becomes lower than the low voltage abnormality detection value UVLO_ON.

The threshold voltage generation units 140 and 141 divide the reference voltage VREF to generate the upper threshold voltage Vth0H (for example, 0.88V) and the lower threshold voltage Vth0L (for example, 0.72V), respectively.

The threshold voltage generation units 142 and 143 divide the reference voltage VREF to generate the upper threshold voltage Vth1H (for example, 0.88V) and the lower threshold voltage Vth1L (for example, 0.72V), respectively.

The threshold voltage generation units 144 and 145 divide the reference voltage VREF to generate the upper threshold voltage Vth2H (for example, 0.88V) and the lower threshold voltage Vth2L (for example, 0.72V), respectively.

The threshold voltage generation units 146 and 147 divide the reference voltage VREF to generate the upper threshold voltage Vth3H (for example, 0.88V) and the lower threshold voltage Vth3L (for example, 0.72V), respectively.

The threshold voltage generation units 148 and 149 divide the reference voltage VREF to generate the upper threshold voltage Vth4H (for example, 0.88V) and the lower threshold voltage Vth4L (for example, 0.72V), respectively.

The comparator 150 operates by receiving the supply of the power supply voltage VDD, and is input to the input voltage V0 input from the XRSTIN pin to the non-inverting input terminal (+) and to the inverting input terminal (-) from the threshold voltage generator 140. The comparison signal RSSOVD is generated by comparing with the upper threshold voltage Vth0H. The comparison signal RSTOVD has a high level when V0> Vth0H and a low level when V0 <Vth0H.

The comparator 151 operates by receiving the supply of the power supply voltage VDD, and is input to the input voltage V0 input from the XRSTIN pin to the inverting input terminal (-) and to the non-inverting input terminal (-) from the threshold voltage generator 141. The comparison signal RSTUVD is generated by comparing with the lower threshold voltage Vth0L. The comparison signal RSTUVD has a low level when V0> Vth0L and a high level when V0 <Vth0L.

The comparator 152 operates by receiving the supply of the power supply voltage VDD, and is input to the input voltage V1 input from the DIN1 pin to the non-inverting input terminal (+) and to the inverting input terminal (-) from the threshold voltage generator 142. The comparison signal DIN1OVD is generated by comparing with the upper threshold voltage Vth1H. The comparison signal DIN1OVD has a high level when V1> Vth1H and a low level when V1 <Vth1H.

The comparator 153 operates by receiving the supply of the power supply voltage VDD, and is input to the input voltage V1 input from the DIN1 pin to the inverting input terminal (-) and to the non-inverting input terminal (-) from the threshold voltage generator 143. The comparison signal DIN1UVD is generated by comparing with the lower threshold voltage Vth1L. The comparison signal DIN1UVD has a low level when V1> Vth1L and a high level when V1 <Vth1L.

The comparator 154 operates by receiving the supply of the power supply voltage VDD, and is input to the input voltage V2 input from the DIN2 pin to the non-inverting input terminal (+) and to the inverting input terminal (-) from the threshold voltage generator 144. The comparison signal DIN2OVD is generated by comparing with the upper threshold voltage Vth2H. The comparison signal DIN2OVD has a high level when V2> Vth2H and a low level when V2 <Vth2H.

The comparator 155 operates by receiving the supply of the power supply voltage VDD, and is input to the input voltage V2 input from the DIN2 pin to the inverting input terminal (-) and to the non-inverting input terminal (-) from the threshold voltage generator 145. The comparison signal DIN2UVD is generated by comparing with the lower threshold voltage Vth2L. The comparison signal DIN2UVD has a low level when V2> Vth2L and a high level when V2 <Vth2L.

The comparator 156 operates by receiving the supply of the power supply voltage VDD, and is input to the input voltage V3 input from the DIN3 pin to the non-inverting input terminal (+) and to the inverting input terminal (-) from the threshold voltage generator 146. The comparison signal DIN3OVD is generated by comparing with the upper threshold voltage Vth3H. The comparison signal DIN3OVD has a high level when V3> Vth3H and a low level when V3 <Vth3H.

The comparator 157 operates by receiving the supply of the power supply voltage VDD, and is input to the input voltage V3 input from the DIN3 pin to the inverting input terminal (-) and to the non-inverting input terminal (-) from the threshold voltage generator 147. The comparison signal DIN3UVD is generated by comparing with the lower threshold voltage Vth3L. The comparison signal DIN3UVD has a low level when V3> Vth3L and a high level when V3 <Vth3L.

The comparator 158 operates by receiving the supply of the power supply voltage VDD, and is input to the input voltage V4 input from the DIN4 pin to the non-inverting input terminal (+) and to the inverting input terminal (-) from the threshold voltage generator 148. The comparison signal DIN4OVD is generated by comparing with the upper threshold voltage Vth4H. The comparison signal DIN4OVD has a high level when V4> Vth4H and a low level when V4 <Vth4H.

The comparator 159 operates by receiving the supply of the power supply voltage VDD, and is input to the input voltage V4 input from the DIN4 pin to the inverting input terminal (-) and to the non-inverting input terminal (-) from the threshold voltage generator 149. The comparison signal DIN4UVD is generated by comparing with the lower threshold voltage Vth4L. The comparison signal DIN4UVD has a low level when V4> Vth4L and a high level when V4 <Vth4L.

The BIST enable signal BIST_EN is input to each of the above-mentioned comparators 151 to 159. That is, each of the comparators 151 to 159 corresponds to a monitoring unit (or one of a plurality of monitoring mechanisms included therein) that is a self-diagnosis target when the monitoring IC 100 is activated.

The oscillator 161 operates by receiving the supply of the power supply voltage VDD and the reference voltage VREF, and generates the clock signal CLK1 having the oscillation frequency f1 (for example, f1 = 2.2 MHz) used in the digital processing unit 170.

The oscillator 162 operates by receiving the supply of the power supply voltage VDD and the reference voltage VREF, and generates the clock signal CLK2 having the oscillation frequency f2 (for example, f2 = 500 kHz) used in the digital processing unit 170 (particularly the watchdog timer 173). The oscillation frequency f2 of the clock signal CLK2 can be arbitrarily adjusted by SPI communication.

Further, the oscillators 161 and 162 are reset by the low voltage abnormality signal UVLO, respectively. More specifically, the oscillators 161 and 162 are in the reset state (= disabled state) when the low voltage abnormal signal UVLO is at a low level, and are reset when the low voltage abnormal signal UVLO is at a high level, respectively. It becomes the release state (= enable state).

The digital processing unit 170 operates by receiving the supply of the power supply voltage VDD, and performs monitoring processing of various input signals and generation processing of various output signals. Further, the digital processing unit 170 is reset by the low voltage abnormality signal UVLO. More specifically, the digital processing unit 170 is in a reset state (= disabled state) when the low voltage abnormal signal UVLO is at a low level, and is in a reset release state when the low voltage abnormal signal UVLO is at a high level. (= Enabled state). The internal configuration and operation of the digital processing unit 170 will be described later.

The transistor 180 is connected between the XRSTOUT pin (= output terminal of the reset output signal XRSTOUT) and the ground end, and is turned on / off according to the gate signal G0 input from the digital processing unit 170. The reset output signal XRSTOUT becomes a low level (= logic level at the time of reset) when the transistor 181 is on, and becomes a high level (= logic level at the time of reset release) when the transistor 181 is off.

The transistor 181 is connected between the PG1 pin (= output terminal of the power good signal PG1) and the ground end, and is turned on / off according to the gate signal G1 input from the digital processing unit 170. The power good signal PG1 has a low level (= logic level at the time of abnormality) when the transistor 181 is on, and a high level (= logic level at the time of normal) when the transistor 181 is off.

The transistor 182 is connected between the PG2 pin (= output terminal of the power good signal PG2) and the ground end, and is turned on / off according to the gate signal G2 input from the digital processing unit 170. The power good signal PG2 has a low level (= logic level at the time of abnormality) when the transistor 182 is on, and a high level (= logic level at the time of normal) when the transistor 182 is off.

The transistor 183 is connected between the PG3 pin (= output terminal of the power good signal PG3) and the ground end, and is turned on / off according to the gate signal G3 input from the digital processing unit 170. The power good signal PG3 has a low level (= logic level at the time of abnormality) when the transistor 183 is on, and a high level (= logic level at the time of normal) when the transistor 183 is off.

The transistor 184 is connected between the PG4 pin (= output terminal of the power good signal PG4) and the ground end, and is turned on / off according to the gate signal G4 input from the digital processing unit 170. The power good signal PG4 has a low level (= logic level at the time of abnormality) when the transistor 184 is on, and a high level (= logic level at the time of normal) when the transistor 184 is off.

The SPI interface 190 is connected to the XSCS pin, the SCLK pin, the MOSI pin, and the MISO pin, and enables bidirectional communication between the monitoring IC 100 (particularly the digital processing unit 170) and the microcomputer 300 via the SPI bus. Do.

<Digital processing unit>
Subsequently, the internal configuration of the digital processing unit 170 will be described with reference to FIG. The digital processing unit 170 of this configuration example includes a self-diagnosis unit 171, a clock detection unit 172, a watchdog timer 173, filters FLT0 to FLT4, counters CNT0 to CNT4, and OR gates OR0 to OR4 and OR10 to OR14. And, including.

When the monitoring IC 100 is started, the self-diagnosis unit 171 checks the reference voltage detection signal VREF_DET and the comparison signal (RSTOVD, RSTUVD, DINxOVD, DINxUVD), so that the reference voltage detection unit 120 and the comparators 150 to 159 are normal, respectively. Performs a self-diagnosis operation (hereinafter abbreviated as BIST) as to whether or not it is functioning, and generates a BIST error signal BIST_ERROR. The BIST error signal BIST_ERROR becomes a high level when an abnormality is detected by any of the reference voltage detection unit 120 and the comparators 150 to 159.

Further, the self-diagnosis unit 171 generates the BIST enable signal BIST_EN and sends it to the reference voltage detection unit 120 and the comparators 150 to 159, respectively. The BIST enable signal BIST_EN becomes a high level during execution of BIST.

The clock detection unit 172 detects the frequency abnormality of the clock signals CLK1 and CLK2 and generates the clock detection signal CLK_DET. The clock detection signal CLK_DET becomes a high level when a frequency abnormality of the clock signal CLK1 or CLK2 is detected.

The watchdog timer 173 detects a frequency abnormality (SLOW abnormality and FAST abnormality) of the microcomputer 300 and generates a watchdog detection signal WDT_DET. The watchdog detection signal WDT_DET becomes a high level when a frequency abnormality of the microcomputer 30 is detected. The WDIN pin is pulled down inside the monitoring IC 100.

The OR gate OR0 performs an OR operation on the comparison signals RSTOVED and RSTUVD. Therefore, the output signal of the OR gate OR0 becomes high level when at least one of the comparison signals RSTOVD and RSTUVD is high level, and becomes low level when both the comparison signals RSTOVD and RSTUVD are low level.

The OR1 gate OR1 performs an OR operation on the comparison signals DIN1OVD and DIN1UVD. Therefore, the output signal of the OR1 gate becomes high level when at least one of the comparison signals DIN1OVD and DIN1UVD is high level, and becomes low level when both the comparison signals DIN1OVD and DIN1UVD are low level.

The OR2 gate OR2 performs an OR operation on the comparison signals DIN2OVD and DIN2UVD. Therefore, the output signal of the OR2 gate OR2 becomes high level when at least one of the comparison signals DIN2OVD and DIN2UVD is high level, and becomes low level when both the comparison signals DIN2OVD and DIN2UVD are low level.

The OR gate OR3 performs an OR operation on the comparison signals DIN3OVD and DIN3UVD. Therefore, the output signal of the OR gate OR3 becomes high level when at least one of the comparison signals DIN3OVD and DIN3UVD is high level, and becomes low level when both the comparison signals DIN3OVD and DIN3UVD are low level.

The OR gate OR4 performs an OR operation on the comparison signals DIN4OVD and DIN4UVD. Therefore, the output signal of the OR4 gate becomes high level when at least one of the comparison signals DIN4OVD and DIN4UVD is high level, and becomes low level when both the comparison signals DIN4OVD and DIN4UVD are low level.

The filters FLT0 to FLT4 perform predetermined filtering processing on the output signals of the OR gates OR0 to OR4, respectively, and output them to the subsequent stage. However, the filters FLT0 to FLT4 are not essential components, and if there is no concern about noise or the like, the filters FLT0 to FLT4 may be omitted and the output signals of the OR gates OR0 to OR4 may be passed through to the subsequent stage. ..

The counters CNT0 to CNT4 perform predetermined counter processing on the output signals of the filters FLT0 to FLT4, respectively, and output them to the subsequent stage. The output signal of the counter CNT0 is output to the OR gate OR10 as a reset input detection signal RSTIN_DET. However, the counters CNT0 to CNT4 are not essential components, and if there is no concern about noise or the like, the counters CNT0 to CNT4 are omitted and the output signals of the OR gates OR0 to OR4 (or the outputs of the filters FLT0 to FLT4) are omitted. The signal) may be passed through to the subsequent stage.

The OR10 gate OR10 performs a logical sum operation of the reference voltage detection signal VREF_DET, the reset input detection signal RSTIN_DET, the BIST error signal BIST_ERROR, the watchdog detection signal WDT_DET, and the clock detection signal CLK_DET to generate the reset output detection signal RSTOUT_DET. Generate. Therefore, the reset output detection signal RSTOUT_DET becomes high level when any one of the plurality of input signals is high level, and becomes low level when all of them are low level. The reset output detection signal RSTOUT_DET is output to the gate of the transistor 180 as the gate signal G0 described above.

The OR gates OR11 to OR14 generate power good detection signals PG1_DET to PG4_DET by performing an OR operation on the output signals of the counters CNT1 to CNT4 and the reference voltage detection signal VREF_DET, respectively. Therefore, when the reference voltage detection signal VREF_DET is at a low level, the output signals of the counters CNT1 to CNT4 are directly output as power good detection signals PG1_DET to PG4_DET. On the other hand, when the reference voltage detection signal VREF_DET is at a high level, the power good detection signals PG1_DET to PG4_DET are all fixed at a high level regardless of the output signals of the counters CNT1 to CNT4. The power good detection signals PG1_DET to PG4_DET are output to the gates of the transistors 181 to 184 as the gate signals G1 to G4 described above.

<Monitoring IC (second embodiment)>
FIG. 5 is a diagram showing a second embodiment of the monitoring IC 100 (particularly, details of the watchdog timer 173). In the monitoring IC 100 of the present embodiment, the watchdog timer 173 includes a trigger type first frequency abnormality detection unit 173a, a communication interruption detection type second frequency abnormality detection unit 173b, and a Q & A type third frequency abnormality detection unit 173c. And have.

The first frequency abnormality detection unit 173a monitors the periodic pulse edge of the watchdog input signal WDIN input from the microcomputer 300 to detect the frequency abnormality of the microcomputer 300. Hereinafter, the frequency abnormality detection operation of the first frequency abnormality detection unit 173a is referred to as "trigger type WDT operation (details will be described later)".

The second frequency abnormality detection unit 173b monitors periodic SPI communication access (= data writing to a predetermined register) from the microcomputer 300 to detect the frequency abnormality of the microcomputer 300. Hereinafter, the frequency abnormality detection operation of the second frequency abnormality detection unit 173b is referred to as "communication interruption detection type WDT operation (details will be described later)".

The third frequency abnormality detection unit 173c monitors a periodic Q & A event by SPI communication with the microcomputer 300 and detects a frequency abnormality of the microcomputer 300. Hereinafter, the frequency abnormality detection operation of the third frequency abnormality detection unit 173c is referred to as "Q & A type WDT operation (details will be described later)".

Further, in the watchdog timer 173, each frequency abnormality detection unit 173a to 173c depends on the user setting (register setting) or the state of the system on which the monitoring IC 100 is mounted (for example, the magnitude of the SPI communication load). Is selectively used.

In this way, if the watchdog timer 173 is a composite type, it is possible to appropriately detect a frequency abnormality by switching the frequency abnormality detection operation in consideration of the characteristics of each frequency abnormality detection unit 173a to 173c. Become.

<Dynamic switching control>
FIG. 6 is a timing chart showing an example of dynamic switching control of the frequency abnormality detection operation, and in order from the top, the system startup state (= power supply voltage VDD), watchdog input signal WDIN, SPI communication access, and system average load. (For example, SPI communication load), anomaly detection sensitivity, and priority WDT operation are depicted.

First, in the first state (time t1 to t2) where the average system load is the heaviest, it is preferable to give priority to the trigger type WDT operation of the first frequency abnormality detection unit 173a. As a result, although the abnormality detection sensitivity (and thus the degree of risk reduction) is sacrificed to some extent, it becomes possible to detect the frequency abnormality of the microcomputer 300 without requiring SPI communication. The first state may be when the system is started or when the configuration is changed.

On the other hand, in the second state (time t2 to t3) with a light load rather than the first state, it is preferable to give priority to the communication interruption detection type WDT operation of the second frequency abnormality detection unit 173b. As a result, it is possible to increase the abnormality detection sensitivity as compared with the first state.

Further, in the third state (time t3 to t4) with a lighter load than the second state, it is preferable to give priority to the Q & A type WDT operation of the third frequency abnormality detection unit 173c. As a result, the SPI communication load becomes heavy, but the abnormality detection sensitivity can be maximized.

In this way, if each frequency abnormality detection unit 173a to 173c is dynamically switched according to the load, it is possible to appropriately detect the frequency abnormality while balancing the abnormality detection sensitivity and the load. Become.

The dynamic switching control of the frequency abnormality detection operation described above may be performed inside the monitoring IC 100. Further, as the load detection method, for example, the SPI communication load may be determined according to the amount of SPI communication data transmitted / received per unit time (watchdog cycle or a period in which n multiplication thereof is one unit).

Regarding the amount of data for SPI communication, for example, the edge of the SPI clock signal SCLK may be counted regardless of the logic level of the SPI chip select signal XSCS (and whether or not the monitoring IC 100 is in a receivable state). This is because it is presumed that the SPI communication load will be heavy if the data is flowing in the SPI bus even if the data is not transmitted to the monitoring IC 100.

<Trigger type WDT operation>
FIG. 7 is a timing chart showing an example of the trigger type WDT operation, in that order from the top, the internal count value CNT, the watchdog input signal IN, the fail count value WD_FC, the trigger type WDT enable signal WDTRGEN, and the reset output signal XRSTOUT. Is depicted.

The trigger type WDT enable signal WDTRGEN is an enable control register value of the trigger type WDT operation, and is "1 (high level)" when enabled and "0 (low level)" when disabled. The trigger type WDT enable signal WDTRGEN can be arbitrarily rewritten by, for example, SPI communication.

The internal count value CNT is incremented at a predetermined clock cycle during the high level period (time t10 to t15 and after time t18) of the trigger type WDT enable signal WDTRGEN, while the pulse edge (rising edge) of the watchdog input signal WDIN. The edge and falling edge) are triggered to reset to zero (see time t11, t12, t13, t14, t19).

Here, when the internal count value CNT immediately before reset is larger than the lower threshold CNTL (= FastNG detection threshold) and smaller than the upper threshold CNT (= SlowNG detection threshold), the high level period of the watchdog input signal IN It is determined that both the low level period and the low level period are within the normal range (OK state), and one fail count value WD_FC is decremented (see time t11 and t13).

On the other hand, when the internal count value CNT is reset but the internal count value CNT immediately before the reset is larger than the upper threshold CNTH, the high level period or low level period of the watchdog input signal IN is abnormally long (SlowNG state). Is determined, and the fail count value WD_FC is incremented by two (see time t12). At this time, "1" is set in the status register WDT_SLOW.

Further, when the internal count value CNT is reset but the internal count value CNT immediately before the reset is smaller than the lower threshold value CNT, the high level period or the low level period of the watchdog input signal IN is abnormally short (FastNG state). ), And the fail count value WD_FC is incremented by two (see time t14, t19). At this time, "1" is set in the status register WDT_FAST.

When the fail count value WD_FC becomes equal to or higher than a predetermined threshold value (for example, "6") by repeating the above series of increments / decrements, the reset output signal XRSTOUT has a low level (=) over the reset holding time tRSTL (for example, 10 ms). It is lowered to the logical level at the time of reset (see time t15 to t17). At this time, it is advisable to set the trigger type WDT error register WD_TRG_ERROR to "1" to notify the microcomputer 300 of the abnormality.

Further, when the fail count value WD_FC becomes equal to or higher than a predetermined threshold value, the trigger type WDT enable signal WDTRGEN is also lowered to a low level (= logical level at the time of disabling) (see time t15). While WDTRGEN = L, the pulse edge of the watchdog input signal WDIN is ignored.

As described above, in the trigger type WDT operation, by monitoring whether or not the pulse edge of the watchdog input signal WDIN arrives within the window section set by the upper threshold value CNTH and the lower threshold value CNTL. A frequency abnormality of the microcomputer 300 is detected. It is desirable that the upper threshold value CNT and the lower threshold value CNTL are variable values according to the window interval setting register WD_detect_time (for example, 2 bits), respectively.

<Communication interruption detection type WDT operation>
FIG. 8 is a timing chart showing an example of the communication interruption detection type WDT operation, in order from the top, the internal count value CNT, the SPI communication access state, the fail count value WD_FC, the communication interruption detection type WDT enable signal WDSPIEN, and the reset. The output signal XRSTOUT is depicted.

The communication disconnection detection type WDT enable signal WDSPIEN is an enable control register value of the communication disconnection detection type WDT operation, and is "1 (high level)" when enabled and "0 (low level)" when disabled. The communication interruption detection type WDT enable signal WDSPIEN can be arbitrarily rewritten by, for example, SPI communication.

The internal count value CNT is incremented at a predetermined clock cycle during the high level period (time t20 to t25 and after time t28) of the communication disconnection detection type WDT enable signal WDSPIEN, while the communication disconnection detection reset register SPI_DISCON_RST is used. The SPI communication access (= writing of the data value "1") is completed, or the internal count value CNT reaches the upper threshold CNT, and the value is reset to the zero value (time t21, t22, t23, t24). , T29).

Here, when the internal count value CNT immediately before reset is larger than the lower threshold value CNT (= FastNG detection threshold value) and smaller than the upper threshold value CNT (= SlowNG detection threshold value), the SPI communication access cycle is within the normal range. It is determined that the state is within the range (OK state), and one fail count value WD_FC is decremented (see time t21 and t23).

On the other hand, when the internal count value CNT reaches the upper threshold value CNT without being reset, it is determined that the SPI communication access is delayed or disconnected (Slow NG state), and the fail count value WD_FC is incremented by two. (See time t22). At this time, "1" is set in the status register WDT_SLOW.

Further, when the internal count value CNT is reset but the internal count value CNT immediately before the reset is smaller than the lower threshold value CNT, it is determined that the SPI communication access is abnormally fast (FastNG state), and the fail count is performed. The value WD_FC is incremented by two (see time t24, t29). At this time, "1" is set in the status register WDT_FAST.

When the fail count value WD_FC becomes equal to or higher than a predetermined threshold value (for example, "6") by repeating the above series of increments / decrements, the reset output signal XRSTOUT has a low level (=) over the reset holding time tRSTL (for example, 10 ms). It is lowered to the logical level at the time of reset (see time t25 to t27). At this time, it is advisable to set the communication cutoff WDT error register WD_SPI_ERROR to "1" to notify the microcomputer 300 of the abnormality.

Further, when the fail count value WD_FC becomes equal to or higher than a predetermined threshold value, the communication interruption detection type WDT enable signal WDSPIEN is also lowered to a low level (= logical level at the time of disabling) (see time t25).

As described above, in the communication interruption detection type WDT operation, the microcomputer 300 is monitored by monitoring whether or not SPI communication access is completed within the window section set by the upper threshold value CNT and the lower threshold value CNTL. Frequency anomaly is detected. As described above, it is desirable that the upper threshold value CNT and the lower threshold value CNTL have variable values according to the window interval setting register WD_detect_time (for example, 2 bits), respectively.

<Q & A type WDT operation>
FIG. 9 is a timing chart showing an example of the Q & A type WDT operation, in which the internal count value CNT, SPI communication access state, fail count value WD_FC, Q & A type WDT enable signal WDQAEN, and reset output signal XRSTOUT are displayed in order from the top. It is depicted.

The Q & A type WDT enable signal WDQAEN is an enable control register value of the Q & A type WDT operation, and is "1 (high level)" when enabled and "0 (low level)" when disabled. The Q & A type WDT enable signal WDQAEN can be arbitrarily rewritten by, for example, SPI communication.

The internal count value CNT is incremented at a predetermined clock cycle during the high level period (time t30 to t35 and after time t38) of the Q & A type WDT enable signal WDQAEN, while the Q & A event (= question signal) by SPI communication. Inquiries and replies, as well as answer signal generation and answer matching will be described in detail later), or the internal count value CNT has reached the upper threshold CNT, and the value is reset to zero (time t31). , T32, t34, t39).

Here, when the answer signal written from the microcomputer 300 is the correct answer and the internal count value CNT immediately before the reset satisfies CNT <CNT <CNTH, it is determined as a good event (OK state) and the fail count. One value WD_FC is decremented (see time t31).

On the other hand, when the Q & A event is not completed and the upper threshold value CNT is reached without resetting the internal count value CNT, it is determined that the event is a bad event (SlowNG state), and the fail count value WD_FC is incremented by two (time). See t32). At this time, "1" is set in the status register WDT_SLOW.

Further, when the answer signal written from the microcomputer 300 is an incorrect answer, even if the internal count value CNT immediately before the reset satisfies CNT <CNT <CNTH, it is determined to be a bad event (wrong answer NG state). Then, the fail count value WD_FC is incremented by two (see time t34).

Alternatively, even if the answer signal written from the microcomputer 300 is a correct answer, if the internal count value CNT immediately before reset is smaller than the lower threshold CNTL, it is determined to be a bad event (FastNG state) and the fail count value. WD_FC is incremented by two (see time t39). At this time, "1" is set in the status register WDT_FAST.

In addition to the above, the types of bad events include (1) when there is no inquiry for a question signal within a predetermined time, and (2) when the answer signal is correct but not written within a predetermined time. 3) Examples include cases where multi-byte answer signals are not written in the correct byte order. In these cases, it is determined that the event is a bad event, and the fail count value WD_FC is incremented by two.

When the fail count value WD_FC becomes equal to or higher than a predetermined threshold value (for example, "6") by repeating the above series of increments / decrements, the reset output signal XRSTOUT has a low level (=) over the reset holding time tRSTL (for example, 10 ms). It is lowered to (logical level at reset) (see time t35-t37). At this time, it is advisable to set the Q & A type WDT error register WD_QA_ERROR to "1" to notify the microcomputer 300 of the abnormality.

Further, when the fail count value WD_FC becomes equal to or higher than a predetermined threshold value, the Q & A type WDT enable signal WDQAEN is also lowered to a low level (= logical level at the time of disabling) (see time t35).

As described above, in the Q & A type WDT operation, the frequency abnormality of the microcomputer 300 is abnormal by monitoring whether or not the correct answer signal is written in the window section set by the upper threshold value CNT and the lower threshold value CNTL. Is detected. As described above, it is desirable that the upper threshold value CNT and the lower threshold value CNTL have variable values according to the window interval setting register WD_detect_time (for example, 2 bits), respectively.

FIG. 10 is a flowchart showing an example of the Q & A type WDT operation. In this figure, the step "S1 **" in the 100s is a step in which the monitoring IC 100 (particularly the Q & A type third frequency monitoring unit 173c) is the main operating unit. On the other hand, the step "S3 **" in the 300 series is a step in which the microcomputer 300 is the main operating body. In addition, bidirectional communication between the monitoring IC 100 and the microcomputer 300 is carried out by SPI communication.

First, in step S310, the microcomputer 300 issues a question signal (Question (token)) inquiry command to the monitoring IC 100. The monitoring IC 100 that has received the inquiry command returns a question signal to the microcomputer 300 in step S110. The reply of the question signal is performed by writing the value of the question signal to a predetermined register (WD_Question) and reading it from the microcomputer 300.

The microcomputer 300 that has received the reply of the question signal generates an answer signal (Answer (response (s)) corresponding to the question signal in step S320, and in the subsequent step S330, the answer signal is set to a predetermined register (WD_Answer) of the monitoring IC100. ).

On the other hand, in step S120, the monitoring IC 100 also generates an answer signal (Light_Answer) corresponding to the question signal, and in the following step S130, the answer signal written from the microcomputer 300 and the answer signal generated by itself are answered. Make a match.

The above series of steps (steps surrounded by a large broken line in this figure) are required to be completed within the window section described above.

In the following step S140, a path determination is performed as to whether or not the Q & A event by the above series of steps is the above-mentioned good event. Here, if a yes determination is made, the flow proceeds to step S150. On the other hand, if no determination is made, the flow proceeds to step S160.

In step S150, a predetermined good event process is executed. More specifically, in step S151, one fail count value WD_FC is decremented and a new question signal is generated. After that, when the flow is returned to step S110, the monitoring IC 100 is in a state of waiting for a question signal inquiry command from the microcomputer 300.

On the other hand, in step S160, a predetermined bad event process is executed. More specifically, in step S161, the fail count value WD_FC is incremented by two. At that time, a new question signal is not generated and the previous value is maintained.

The microcomputer 300 can refer to the fail count value WD_FC at an arbitrary timing (step S340 in this figure).

Next, in step S162, it is determined whether or not the fail count value WD_FC has reached a predetermined threshold value (WD_FCset). Here, if no determination is made, the flow is returned to step S110, so that the monitoring IC 100 is in a state of waiting for a question signal inquiry command from the microcomputer 300.

On the other hand, if a yes determination is made, the flow proceeds to step S163, and predetermined interrupt processing (= data writing to the Q & A type WDT error register WD_QA_ERROR) is performed. The microcomputer 300 that has received such interrupt processing can take measures such as system reboot in step S350.

<Third frequency abnormality detection unit (Q & A type)>
FIG. 11 is a diagram showing a configuration example of the third frequency abnormality detection unit 173c. The third frequency abnormality detection unit 173c of this configuration example includes a question signal generation unit c100, an answer signal generation unit c200, an event determination unit c300, a fail counter c400, and an error output unit c500.

First, prior to the description of the above components, various registers (WD_SEED, WD_Qcfg, WD_Question, Right_Answer, WD_Answer, WD_FC, WD_FCset, WD_QA_ERROR) in this figure will be briefly described.

The register WD_SEED is a register (for example, 5 bits) prepared for initializing the question signal generation unit c100 (particularly its linear feedback shift register).

The register WD_Qcfg is a register (for example, 4 bits) prepared for setting the question signal generation unit c100 (particularly its logical operation unit).

The register WD_Question is a register (for example, 4 bits) prepared for storing the output value of the question signal generation unit c100. Since it is sufficient for the register WD_Question to be able to read the question signal from the microcomputer 300, access from the outside of the monitoring IC 100 is restricted to read-only.

The register Right_Answer is a register (for example, 8 bits) prepared for storing the output value of the answer signal generation unit c200.

The register WD_Answer is a register (for example, 8 bits) prepared for writing an answer signal from the microcomputer 300.

The register WD_FC is a register (for example, 3 bits) prepared for storing the output value of the fail counter c400.

The register WD_FCset is a register (for example, 2 bits) prepared for storing a threshold value (for example, 6, 4, 2) to be compared with the output value of the fail counter c400.

The register WD_QA_ERROR is a register (1 bit) prepared for storing the output value of the error output unit c500. Since it is sufficient for the register WD_QA_ERROR to be able to read the detection result of the Q & A type WDT operation from the microcomputer 300, access from the outside of the monitoring IC 100 is restricted to read-only.

The question signal generation unit c100 generates a question signal based on the data values stored in the register WD_SEED and the register WD_Qcfg, and writes the question signal in the register WD_Question (see steps S110 and S151 in FIG. 10).

The answer signal generation unit c200 generates an answer signal based on the data value (= question signal) stored in the register WD_Question, and writes this in the register Right_Answer (see step S120 in FIG. 10).

The event determination unit c300 compares the data values stored in the register Right_Answer and the register WD_Answer, and determines the path of the Q & A event (= determines whether or not the correct answer signal is returned within the predetermined window section, FIG. 10). Steps S130 and S140) are performed to increment / decrement the fail counter c400. More specifically, the event determination unit c300 increments the fail counter c400 by two at the time of bad determination, and decrements one fail counter c400 at the time of good determination (see steps S151 and S161 in FIG. 10).

The fail counter c400 writes an output value (= fail count value) that is incremented / decremented based on the determination result of the event determination unit c300 to the register WD_FC (see steps S151 and S161 in FIG. 10).

The error output unit c500 compares the data values stored in the register WD_FC and the register WD_FCset, and sets "1" in the register WD_QA_ERROR when WD_FC ≧ WDFC set (steps S162 and S163 in FIG. 10). reference).

FIG. 12 is a diagram showing a configuration example of the question signal generation unit c100. The question signal generation unit c100 of this configuration example includes D flip-flops c101 to c105 and XOR gates c106 to c110.

The data input end (D) of the D flip-flop c101 is connected to the output end of the XOR gate c106. The output end (Q) of the D flip-flop c101 is connected to the data input end (D) of the D flip-flop c102 as the output end of the logic signal X1. The output end (Q) of the D flip-flop c102 is connected to the data input end (D) of the D flip-flop c103 as the output end of the logic signal X2. The output end (Q) of the D flip-flop c103 is connected to the data input end (D) of the D flip-flop c104 and the first input end of the XOR gate c106 as the output end of the logic signal X3. The output end (Q) of the D flip-flop c104 is connected to the data input end (D) of the D flip-flop c105 as an output end of the logic signal X4. The output end (Q) of the D flip-flop c105 is connected to the second input end of the XOR gate c106 as the output end of the logic signal X5.

The D flip-flops c101 to c105 and the XOR gate c106 connected in this way function as a 5-bit linear feedback shift register and are represented by the feedback polynomial X ⁵ + X ³ + 1 (31 cycles) in synchronization with the clock input. Pseudo-random values (X1X2X3X4X5) are sequentially generated. As for the data value (5 bits) stored in the register WD_SEED, the value of each digit is used as the initial output value of each of the D flip-flops c101 to c105.

The XOR gate c107 performs an exclusive OR operation on the logical signal X5 and the bit value [3] of the fourth digit (most significant bit) stored in the register WD_Qcfg, and outputs the output value to the fourth digit of the register WD_Question. Store in.

The XOR gate c108 performs an exclusive OR operation between the logical signal X4 and the bit value [2] of the third digit stored in the register WD_Qcfg, and stores the output value in the third digit of the register WD_Question.

The XOR gate c109 performs an exclusive OR operation between the logical signal X3 and the bit value [1] of the second digit stored in the register WD_Qcfg, and stores the output value in the second digit of the register WD_Question.

The XOR gate c110 performs an exclusive OR operation between the logical signal X2 and the bit value [0] of the first digit (lowest) stored in the register WD_Qcfg, and outputs the output value to the first digit of the register WD_Question. Store in.

As described above, the XOR gates c107 to c110 function as a logical operation unit that generates a question signal based on the pseudo random number value generated by the linear feedback shift register and the stored value of the register WD_Qcfg.

However, the logical operation processing for generating the question signal is not limited to the above, and can be arbitrarily changed.

FIG. 13 is a diagram showing a configuration example of the answer signal generation unit c200. The answer signal generation unit c200 of this configuration example includes XOR gates c201 to c208 and INV gate c209.

The XOR gate c201 performs an exclusive OR operation of the bit value [x] of the arbitrary digit and the bit value [3] of the fourth digit stored in the register WD_Question, and outputs the output value via the INV gate c209. It is stored in the 8th digit of the register Right_Answer.

The XOR gate c202 performs an exclusive OR operation on the bit value [x] of the arbitrary digit and the bit value [2] of the third digit stored in the register WD_Question, and outputs the output value via the INV gate c209. It is stored in the 7th digit of the register Right_Answer.

The XOR gate c203 performs an exclusive OR operation on the bit value [x] of the arbitrary digit stored in the register WD_Question and the bit value [1] of the second digit, and outputs the output value via the INV gate c209. It is stored in the 6th digit of the register Right_Answer.

The XOR gate c204 performs an exclusive OR operation on the bit value [x] of the arbitrary digit stored in the register WD_Question and the bit value [0] of the first digit, and outputs the output value via the INV gate c209. It is stored in the 5th digit of the register Right_Answer.

The XOR gate c205 performs an exclusive OR operation on the bit value [x] of the arbitrary digit and the bit value [3] of the fourth digit stored in the register WD_Question, and outputs the output value via the INV gate c209. It is stored in the 4th digit of the register Right_Answer.

The XOR gate c206 performs an exclusive OR operation on the bit value [x] of the arbitrary digit and the bit value [2] of the third digit stored in the register WD_Question, and outputs the output value via the INV gate c209. It is stored in the third digit of the register Right_Answer.

The XOR gate c207 performs an exclusive OR operation on the bit value [x] of the arbitrary digit stored in the register WD_Question and the bit value [1] of the second digit, and outputs the output value via the INV gate c209. It is stored in the second digit of the register Right_Answer.

The XOR gate c208 performs an exclusive OR operation on the bit value [x] of the arbitrary digit stored in the register WD_Question and the bit value [0] of the first digit, and outputs the output value via the INV gate c209. It is stored in the first digit of the register Right_Answer.

The INV gate 209 logically inverts the output values of the XOR gates c201 to c208, and then writes the output values to the register Right_Answer.

In this way, the answer signal generation unit c200 of this configuration example generates an answer signal by bit combination processing of the question signal stored in the register WD_Question, and stores this in the register Right_Answer.

However, the logical operation processing for generating the answer signal is not limited to the above, and can be arbitrarily changed.

<Application to vehicles>
FIG. 14 is an external view showing a configuration example of the vehicle X. The vehicle X of this configuration example is equipped with various electronic devices (vehicle-mounted devices) X11 to X18 that operate by receiving electric power from a battery. Note that the mounting positions of the electronic devices X11 to X18 in this figure may differ from the actual ones for convenience of illustration.

The electronic device X11 is an engine control unit that performs control related to the engine (injection control, electronic throttle control, idling control, oxygen sensor heater control, auto cruise control, etc.).

The electronic device X12 is a lamp control unit that controls turning on and off such as HID [high intensity discharged lamp] and DRL [daytime running lamp].

The electronic device X13 is a transmission control unit that performs control related to the transmission.

The electronic device X14 is a braking unit that performs controls related to the movement of the vehicle X (ABS [anti-lock brake system] control, EPS [electric power steering] control, electronic suspension control, etc.).

The electronic device X15 is a security control unit that controls drive such as a door lock and a security alarm.

The electronic device X16 is an electronic device incorporated in the vehicle X at the factory shipment stage as standard equipment such as a wiper, an electric door mirror, a power window, a damper (shock absorber), an electric sunroof, and an electric seat as a manufacturer's option. Is.

The electronic device X17 is an electronic device that is optionally mounted on the vehicle X as a user option such as an in-vehicle A / V [audio / visual] device, a car navigation system, and an ETC [electronic toll collection system].

The electronic device X18 is an electronic device provided with a high withstand voltage motor such as an in-vehicle blower, an oil pump, a water pump, and a battery cooling fan.

The monitoring IC 100 described above can be incorporated into any of the electronic devices X11 to X18.

<Other variants>
In the above embodiment, the monitoring IC mounted on the in-vehicle device is taken as an example, but the application target is not limited to this, and it can be widely applied to all electronic devices.

In addition to the above embodiments, the various technical features disclosed in the present specification can be modified in various ways without departing from the spirit of the technical creation. That is, it should be considered that the above-described embodiment is exemplary in all respects and is not restrictive, and the technical scope of the present invention is not limited to the above-described embodiment and is claimed. It should be understood that the meaning equal to the scope and all changes belonging to the scope are included.

The invention disclosed in the present specification is used, for example, for all electronic devices (vehicle-mounted cameras, radars, infotainment, lamps, clusters, powertrains, sensor fusions, etc.) for which functional safety is required. Is possible.

1 Electronic equipment 100 Monitoring IC (monitoring device)
101 Resin sealer 102 External terminal 103 Heat dissipation pad 103a Notch 111 Reference voltage generator 112 Sub reference voltage generator 120 Reference voltage detector 130 UVLO section 140 to 149 Threshold voltage generator 150 to 159 Comparator 161 Oscillator (for digital processing) )
162 Oscillator (for watchdog timer)
170 Digital processing unit 171 Self-diagnosis unit 172 Clock detection unit 173 Watchdog timer 173a First frequency abnormality detection unit (trigger type)
173b 2nd frequency abnormality detection unit (communication interruption detection type)
173c Third frequency abnormality detector (Q & A type)
180-184 N-channel MOS field effect transistor 190 SPI interface 200 Power management IC (power supply device)
300 Microcomputer c100 Question signal generator c101 to c105 D flip-flop c106 to c110 XOR gate c200 Answer signal generator c201 to c208 XOR gate c209 INV gate c300 Event judgment unit c400 Fail counter c500 Error output unit C1, C2 Capsule CNT0 to CNT4 FLT0 to FLT4 Filters OR0 to OR4, OR10 to OR14 OR Gates R1 to R10, R12 to R16 Resistance X Vehicles X11 to X18 Electronic Equipment

Claims (10)

Trigger type first frequency abnormality detector and
Communication interruption detection type second frequency abnormality detection unit and
Q & A type 3rd frequency abnormality detector and
Have,
A watchdog timer characterized in that each frequency abnormality detection unit is selectively used. The watchdog timer according to claim 1, wherein each frequency abnormality detection unit is switched according to the state of the system. When the system is in the first state, the first frequency abnormality detection unit is prioritized.
When the system is in the second state with a lighter load than the first state, the second frequency abnormality detection unit has priority.
When the system is in the third state with a lighter load than the second state, the third frequency abnormality detection unit has priority.
The watchdog timer according to claim 2. The watchdog timer according to claim 1, wherein each frequency abnormality detection unit is switched according to a user setting. The watchdog timer according to any one of claims 1 to 4, wherein the first frequency abnormality detecting unit monitors a periodic pulse edge to detect a frequency abnormality. The watchdog timer according to any one of claims 1 to 5, wherein the second frequency abnormality detection unit monitors periodic communication access to detect a frequency abnormality. The watchdog timer according to any one of claims 1 to 6, wherein the third frequency abnormality detection unit monitors a periodic Q & A event to detect a frequency abnormality. A monitoring device having the watchdog timer according to any one of claims 1 to 7. An electronic device having the monitoring device according to claim 8. A vehicle having the electronic device according to claim 9.

Images