JP2906789B2 - Runaway monitoring circuit of multiple microcomputers - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a runaway monitoring circuit for a plurality of microcomputers used in an electronic control circuit for controlling a running state of an automobile.

[0002]

2. Description of the Related Art An antilock control circuit (hereinafter referred to as an ABS control circuit) for controlling a brake is one of the electronic control circuits for controlling the running state of an automobile. Such ABS
When a signal indicating the running state is input, the control circuit or the like sends a control signal to an electromagnetic valve or the like that performs brake control based on the signal, and controls the brake efficiently.

In such an ABS control circuit, a circuit for processing an input signal and sending out a control signal is generally constituted by two or more microcomputers, and the wheel speed information from the wheel speed sensor is converted into a binarized circuit. After converting to a pulse signal, the pulse signal is divided into two systems for input processing,
In the respective systems, various identical calculations are performed in parallel in the microcomputer based on the speed information of the pulse signal, and the control signal from one of the systems controls the actuator (electromagnetic valve) of the hydraulic circuit and the like. Is configured.

In a control method using a plurality of microcomputers, a control signal generated by calculating a control signal from another microcomputer with a control signal from another microcomputer with respect to a control signal from a main microcomputer is output as an output signal. Control the main microcomputer control signal as long as they match, and if they do not match, activate the fail-safe relay to deactivate the actuator and monitor the control of the main computer with the other computer, or If the output signals of the microcomputers do not match, logic control is performed so as to be on the safer control operation side according to the duration of the mismatch, and if there is a mismatch of more than a predetermined value Followed by a failsafe There are various methods such as a method in which a non-operation of the actuator by operating the over.

In any of these control circuits, each microcomputer issues a watchdog pulse from its internal reference signal in order to detect whether or not the control operation is normal. In addition to the timer, it is triggered at regular intervals during the execution of the calculation. In this case, conventionally, generally, a watchdog timer is provided independently for each microcomputer so as to monitor the operation of the microcomputer for each system.

[0006] When an abnormal state occurs in which one of the microcomputers goes out of control or stops, the watchdog pulse is not output from the microcomputer and the watchdog timer is not triggered. Is detected and the operation of the actuator is stopped.

[0007]

However, in such a conventional microcomputer monitoring method using a watchdog, the watchdog timer requires the same number as the microcomputer and has a large number of parts.

The output of the watchdog timer is sent to the actuator by an OR circuit, and if any one microcomputer is abnormal, the function of the actuator is stopped. Therefore, even when the power supply voltage is temporarily and abnormally lowered, the function of the actuator is also stopped.

However, since an abnormality such as a power supply voltage occurs simultaneously in all microcomputers simultaneously and is a temporary accident, it is not necessary to immediately stop the function of the actuator in such a case. It is enough to reset the inside of the microcomputer.

The present invention takes into consideration the above-mentioned state of the art of monitoring the abnormality of a plurality of microcomputers, and considers a case where one or some of the plurality of microcomputers becomes abnormal due to a failure or the like. It is an object of the present invention to provide a runaway monitoring circuit that separately provides a monitoring circuit that distinguishes a case where a microcomputer temporarily and abnormally becomes temporarily in an abnormal state of a power supply voltage, and that can appropriately cope with any abnormal state.

[0011]

In order to solve the above-mentioned problems, the present invention binarizes an input signal representing speed information and the like,
After branching the pulse signal and performing parallel input processing by a plurality of systems, a microcomputer provided for each system calculates according to a predetermined program and outputs a control signal based on the calculation result. Mutual monitoring circuits for monitoring the abnormal operation of each microcomputer are provided in other microcomputers, and the watchdog signals generated by the microcomputers are mutually monitored by the monitoring circuits in the other microcomputers. The output signal is output to the load shedding mechanism to be controlled via the OR circuit, and the watchdog signal of each microcomputer is sent to the runaway monitoring circuit provided outside the system via the AND circuit, and all the microcomputers are output. Reset signal from runaway monitoring circuit to all microcomputers only when abnormal Than it was runaway monitoring circuit of the plurality of microcomputers comprising configured to send.

[0012]

Since the runaway monitoring circuit of the present invention has the above-described configuration, if any or some of the plurality of microcomputers becomes abnormal due to a failure or the like, the mutual monitoring circuit in the normal microcomputer detects the abnormal state. The function of the actuator to be controlled is stopped by the output signal.

When all microcomputers are temporarily and accidentally brought into an abnormal state for a moment, when the abnormal state is recovered, a reset signal from the runaway monitoring circuit is output to all microcomputers, and all microcomputers are initialized. Restart.

[0014]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a schematic block diagram in which a runaway monitoring circuit according to the embodiment is provided as an example of an in-vehicle ABS control circuit. The ABS control circuit shown in FIG.
This is the control circuit disclosed in Japanese Patent Publication No. 01, and therefore the control circuit will be briefly described here.

The ABS control circuit includes a wheel speed sensor S ₁
Feeding the wheel speed information signals from to S ₄ to the electronic control circuit 10, and converted into a pulse signal by the binarization circuit 1, the predetermined various operations at 12 and 12 'is branched into two systems in two microcomputers And outputs a control signal based on the operation result to the output determination logic circuit 13 and supplies the output signal determined by the logic circuit 13 to the drive circuit 2, whereby the solenoid valve 3 in the brake hydraulic circuit is Is configured to be driven.

The output decision logic circuit 13 is composed of a combination of an AND logic element and an OR logic element, and there are various combinations other than those shown. In this circuit, for example, when the output of the microcomputer is one of a pressurization command and a decompression command, if the outputs of both computers are the same, they are output as they are. In the logic element, the output is determined to be slightly reduced.

The power supply + B is supplied to the solenoid valve 3 via the fail-safe relay 4, and the power supply is turned on by turning on the IGN (ignition) as long as the two microcomputers 12 and 12 'are normal.

FIG. 2 shows an embodiment of a circuit for monitoring runaway of two microcomputers of the above ABS control circuit. In this monitoring circuit, mutual monitoring circuits 21 and 21 ′ for monitoring operation abnormalities of the microcomputers 12 and 12 ′ themselves are provided in the other microcomputers, and a watchdog signal generated by itself is transmitted to the mutual communication circuit 22. Mutual monitoring is performed by the mutual monitoring circuits 21 and 21 ′ in other microcomputers via the other microcomputers. The output signals of the respective monitoring circuits 21 and 21 ′
And a circuit for outputting to the drive circuit 24 via the. In this example, the mutual monitoring circuits 21 and 21 'are provided in the microcomputers 12 and 12' of each other, but may be provided outside the system (with a built-in program). A watchdog timer having a function corresponding to this can be provided. In this case, the timer width is set to a time width wider than the generation cycle width of the watchdog pulse, and as long as the microcomputer is normal, a signal of H is always output using the watchdog pulse as a trigger signal. Becomes

The AND logic element 23 is connected to the mutual monitoring circuit 2
Microcomputer 1 by mutual monitoring by 1, 21 '
If both 2 and 12 'are normal, the fail-safe relay 4 is excited and turned on via the drive circuit 24. If any microcomputer runs away, monitoring within the normal microcomputer is performed. Runaway is detected by the circuit and the fail-safe relay 4 is shut off.

Further, this monitoring circuit outputs a watchdog signal of each microcomputer 12, 12 'to an O.
The signal is sent to the runaway monitoring circuit 26 provided outside the control system via the R logic element 25, and the two microcomputers 12 and 12 '
Is provided with a circuit for sending a reset signal from the runaway monitoring circuit 26 to both the microcomputers 12 and 12 'only when both are abnormal. Runaway monitoring circuit 26 can also be a watchdog timer similar to monitoring circuits 21 and 21 '.

Two microcomputers 12, 12 '
Is input as a trigger signal via the OR logic circuit 25, so that the trigger signal is input as long as one of the microcomputers is normal, in which case it is merely monitored. is there. However, when both microcomputers run away temporarily, the mutual monitoring circuit does not operate. Since no watchdog pulse is generated from both microcomputers, no trigger signal is input to runaway monitor circuit 26. At this time, the runaway monitoring circuit 26 sends a reset signal to both the microcomputers 12 and 12 'to perform initialization, and the microcomputer 1
By returning and restarting 2, 12 ', normal operation can be restored without stopping the function of the actuator.

In the above description, JP-A-63-233 describes
The ABS control circuit disclosed in Japanese Patent Publication No. 401 is cited as an example.
There are various types of BS control circuits in addition to the above.
It will be apparent to those skilled in the art that any of them can be provided with the runaway monitoring circuit of this embodiment.

[0023]

As described in detail above, the runaway monitoring circuit according to the present invention detects a failure in the normal monitoring circuit in a normal microcomputer when any one or some of the plurality of microcomputers goes out of control. The microcomputer is restarted by a reset signal from the runaway monitoring circuit in the case of an abnormal condition such as the instantaneous power supply voltage that occurs temporarily and accidentally, so that any runaway condition of the microcomputer is detected. In this case, an advantage can be obtained that an optimum response can be made to this and the reliability of the control circuit can be improved.

[Brief description of the drawings]

FIG. 1 is an overall schematic block diagram including a runaway monitoring circuit according to an embodiment in an ABS control circuit described as an example;

[Explanation of symbols]

 Reference Signs List 4 fail-safe relay 10 electronic control circuit 12, 12 'microcomputer 21, 21' mutual monitoring circuit 22 mutual communication circuit 23 AND logic element 25 OR logic element 26 runaway monitoring circuit

Claims (1)

(57) [Claims] 1. An input signal representing speed information or the like is binarized, the pulse signal is branched and input processing is performed in parallel by a plurality of systems, and then a microcomputer provided for each system performs an arithmetic operation according to a predetermined program. For an electronic control circuit that outputs a control signal based on the operation result, a mutual monitoring circuit that monitors abnormal operation of each microcomputer itself is provided in another microcomputer, and a watchdog signal generated by itself is output to another microcomputer. The monitoring circuits in the microcomputer monitor each other, and the output signals of each monitoring circuit are output to the load shedding mechanism to be controlled via the OR circuit, and the watchdog signal of each microcomputer is output to the AND circuit. Via the runaway monitoring circuit provided outside the system, and only when all microcomputers are abnormal, the runaway monitor A runaway monitoring circuit for a plurality of microcomputers configured to send a reset signal from the visual circuit to all microcomputers.