JP3147054B2 - Microprocessor diagnostic device - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a microprocessor diagnostic device which can collectively diagnose a clock function, an arithmetic function, and an input / output function of a microprocessor by simple diagnostic means.

[0002]

2. Description of the Related Art Generally, in-vehicle control devices such as an airbag device and an antilock brake device control a system based on arithmetic control by a microprocessor.
In order to ensure the reliability of the system control operation, it is very important to carry out a diagnostic operation for checking whether or not the microprocessor is operating abnormally. The conventional microprocessor diagnostic apparatus 1 shown in FIG. 3 is provided with a pair of microprocessors 2 and 3 having an equal relation to each other, and supplies the same signal to each of them to perform the same operation. A configuration is adopted in which each operation result is supplied to a comparator 4 composed of an AND gate, and only those whose operation results match each other are output from the comparator 4, and a watchdog pulse detection built in both microprocessors 2 and 3 is adopted. Vessel 2a. 3a mutually monitors the period of the watchdog pulse sent from each other, and also calculates the operation result comparators 2b, 3 built in both microprocessors 2, 3.
b detects mutual inconsistency in the operation results, and mutually diagnoses whether the microprocessors 2 and 3 are abnormal.

When the microprocessors 2 and 3 are both normal, the microprocessor diagnostic device 1 calculates the results of the two microprocessors 2 and 3 so that they match.
It is output after confirming the coincidence by the comparator 4, and at the same time, fail-safe is secured by monitoring the period of the watchdog pulse by the watchdog pulse detectors 2a and 3a and comparing the operation results by the operation result comparators 2b and 3b. Was to be done. On the other hand, when a failure occurs in at least one of the microprocessors 2 or 3, or when a failure occurs in the input / output function or the arithmetic function, the arithmetic outputs of the microprocessors 2 and 3 do not match. Both of the operation result comparators 2b and 3b are determined to be abnormal, and the operation output is cut off. Also, when a failure occurs in the timer function or the time measurement function, the watchdog pulse detectors 2a and 3a detect the disorder of the period of the watchdog pulse, and determine the failure.

Although the configuration is slightly different from that of the above-described microprocessor diagnostic apparatus 1, a main microprocessor 6 for performing calculations for control and system diagnosis, such as a microprocessor diagnostic apparatus 5 shown in FIG. And a fail-safe microprocessor 7 for performing simple calculations relating to control and diagnosing the system, detecting an abnormal output state of the main microprocessor 6 based on the result, and performing a fail-safe operation. Mutually monitor the period of the watchdog pulse output by
The fail-safe microprocessor 7 that has detected the operation abnormality of the main microprocessor 6 issues an output inhibit signal,
There has also been proposed a configuration in which the output of the main microprocessor 6 is inhibited by acting on the pre-driver 8 for pre-amplifying the output.

[0005]

The conventional microprocessor diagnostic devices 1 and 5 are composed of microprocessors 2 and 3 which perform equivalent operations from the viewpoint of ensuring system reliability at the time of microprocessor diagnosis. A fail-safe microprocessor 7 that is provided or that performs simple calculations and diagnoses outside the main microprocessor 6
The diagnosis is performed using a total of two microprocessors 2, 3 or 6, 7. Generally, a microprocessor prepared for fail-safe use, for example, 3 or 8, requires corresponding functions and performance, so that it is necessary to use a 16-bit or 8-bit microprocessor which is an expensive electronic component. Therefore, the conventional microprocessor diagnostic devices 1 and 5 have a problem that it is difficult to reduce the manufacturing cost.

The present invention has been made in view of the above-mentioned conventional problems, and has as its object to enable easy and inexpensive diagnosis of a microprocessor with reliability equal to or higher than that of a conventional system. is there.

[0007]

In order to achieve the above object, the present invention provides a microprocessor for controlling a system to be controlled, a diagnostic signal having a predetermined waveform supplied to the microprocessor to measure a duty, A diagnosis for diagnosing the clocking function of the microprocessor based on the measurement result, causing the microprocessor to execute a previously prepared calculation using the duty measurement result, and diagnosing the calculation function of the microprocessor based on the calculation result. Means.

The diagnostic means may determine a predetermined period of time from the time when the diagnostic signal is supplied to the microprocessor as a diagnostic period, and determine that there is an abnormality if a correct calculation result cannot be obtained within the predetermined time. It is a feature.

Further, when the diagnosis means finds an abnormality in the microprocessor by the diagnosis,
A fail-safe device for forcing the control output of the microprocessor to a safe side is provided.

[0010]

BRIEF DESCRIPTION OF THE DRAWINGS FIG.
This will be described with reference to FIG. FIG. 1 is a block diagram showing an embodiment of a microprocessor diagnostic device according to the present invention, and FIG. 2 is a flowchart for explaining a microprocessor diagnostic operation by the microprocessor diagnostic device shown in FIG.

The microprocessor diagnostic apparatus 1 shown in FIG.
Reference numeral 1 designates a diagnosis unit for diagnosing a microprocessor 12 which performs various calculations necessary for the operation of a vehicle safety control system such as an airbag device and an antilock brake device. The calculation unit 12a, the interrupt timer unit 12b, and the input / output unit 12c
Is diagnosed by dedicated diagnostic means provided outside the microprocessor 12. The diagnostic means shown in the present embodiment is connected between the diagnostic signal output device 13 and the operation result determination device 15 in addition to the diagnosis signal output device 13, the operation selection device 14 and the operation result determination device 15 connected to the microprocessor 12. And a fail-safe processing device 17 connected to the calculation result determination device 15.

The diagnostic signal output device 13 outputs a diagnostic signal having a specific duty for diagnosis to the microprocessor 12, and outputs the diagnostic signal to the arithmetic unit 12 a via the interrupt timer unit 12 b of the microprocessor 12. Output, and at the same time, triggers the time measurement device 16 and the calculation result determination device 15, respectively. The operation selecting device 14 prepares several kinds of predetermined operations, selects an operation to be executed by the microprocessor 12 from among these operations, and selects an operation in the microprocessor 12 through the input / output unit 12c. It serves to input to the section 12a. The microprocessor 12 measures the duty of the diagnostic signal supplied via the interrupt timer unit 12b, executes the calculation supplied from the calculation selecting device 14 using the measurement result of the duty, and outputs the calculation result to the input / output unit. 12c
And outputs it to the calculation result determination device 15 via. More specifically, the duty measurement result d is calculated using, for example, an arithmetic expression f (D) =
A method of performing an operation by substituting into a variable parameter D of D × (1-D) is adopted.

The operation result judging device 15 judges the operation result of the microprocessor 12 on the basis of the outputs of the diagnostic waveform output device 13 and the operation selecting device 14, and the operation function of the microprocessor 12 is determined here. Is done. The time measuring device 16 starts the timing operation when the diagnostic signal output device 13 outputs the diagnostic signal to the microprocessor 12, and sends a time limit signal to the calculation result determining device 15 when a certain time T has elapsed. Supply.
The fail-safe processing device 17 is supplied with an abnormality determination signal from the calculation result determination device 15 when the calculation result determination device 15 does not make a normal determination before the time limit signal is supplied from the time measurement device 16. Drive the output to the safe side to achieve fail-safe.

Here, the diagnosis by the diagnosis means is performed with respect to the clock function, the arithmetic function, and the input / output function of the microprocessor 12, and specifically, according to the flowchart shown in FIG. As for the timekeeping function, the microprocessor 12 measures the duty of the diagnostic signal output from the diagnostic signal output device 13, and the timer function and the interrupt processing function of the microprocessor 12 are diagnosed from the measured value. The arithmetic function is diagnosed by the microprocessor 12 executing an operation specified by the operation selecting device 14 from among several types of predetermined operations based on the measured duty, and monitoring the operation result. You. Further, the input / output function is diagnosed based on the time required from when the diagnostic signal output device 13 outputs the diagnostic signal to when the correct arithmetic result is output from the microprocessor 12 to the arithmetic result determination device 15.

Hereinafter, the diagnostic operation of the microprocessor 12 will be described with reference to FIG. The waveform duty d of the diagnostic signal output by the diagnostic signal output device 13 needs to be at least two types, for example, 40% or 50%, and the operation f (D) selected by the operation selecting device 14 is sufficient. It is sufficient if there are two types of the normal values are fixed to one type. The purpose of preparing a plurality of types of waveform duty d and calculation f (D) is to eliminate erroneous diagnosis due to accidental coincidence.
By changing at any time, the diagnostic accuracy can be increased.

During operation of the system, the microprocessor 12
When the diagnosis time comes, first, in step (201) shown in FIG. 2, the diagnostic signal output device 13 selects the waveform duty of the diagnostic signal used for the diagnosis of the microprocessor 12 from several types prepared in advance. . Next, in step (202), the selected diagnostic signal is output to the microprocessor 12. At the same time as outputting the diagnostic signal, in step (203), the time measuring device 16 starts the time counting operation. Further, in the following step (204), the operation selecting device 14 selects a specific operation from the plurality of prepared operations, and outputs the selected operation via the input / output unit 12c of the microprocessor 12.
a.

On the other hand, when the microprocessor 12 receives the diagnostic signal issued in the step (202), the microprocessor 12 executes the duty measurement of the received signal in the step (301) by using the interrupt function, the timer function and the arithmetic function. I do. Furthermore, the step (20)
When the operation selected in 4) is supplied, this operation is determined in step (302), and is executed in the following step (303). That is, the microprocessor 12 executes the calculation determined in the step (302) based on the duty measured in the step (301), and after the execution of the calculation, the microprocessor 12 sends the calculation result to the calculation result determination device 15 as shown in the step (304). Outputs the operation result.

The operation result determination device 15 supplied with the operation result from the microprocessor 12 executes the step (205).
The result of the calculation is read in
In 6), the result of the operation is determined to be correct. Here, if it is determined that there is no error in the calculation result, the diagnosis is finished as it is. If it is determined that there is an error in the calculation result, it is determined in the following determination step (207) whether the time limit of the diagnosis time has arrived. Make a decision. In other words, after the diagnostic signal output device 13 outputs the diagnostic signal to the microprocessor 12 until the predetermined time T elapses, after performing the step (204), the steps (205) to (207) are performed. Is repeatedly executed. Therefore, before the predetermined time T elapses, the microprocessor 12
If a correct diagnosis result is obtained from, it is determined that there is no abnormality, and the same diagnostic operation as before is periodically performed thereafter. However, if the determination of normality is not obtained until a certain time T has elapsed after the start of the diagnosis, the determination step (2)
In step (208) following step 07), the fail-safe processing unit 17 is operated to stop the system safely.

As described above, the microprocessor diagnostic apparatus 11 supplies a diagnostic signal having a predetermined waveform to the microprocessor 12 for controlling the system to be controlled to measure the duty, and based on the duty measurement result, the microprocessor 12 Since the timekeeping function is diagnosed, the microprocessor 12 executes a previously prepared operation using the duty measurement result, and diagnoses the operation function of the microprocessor 12 based on the operation result.
Various functions of the microprocessor 12 relating to the operation reliability of the control target system can be diagnosed by a series of operations. Further, even if a microprocessor having the same number of bits as the microprocessor 12 to be diagnosed is not prepared, for example, a low-function and low-cost fail-safe microprocessor of about 4 bits or an electronic component other than the microprocessor 12 is used. The reliability of the system can be ensured, and the system can be reduced in size and cost can be reduced only by preparing the diagnostic means configured as described above.

The diagnostic means includes a microprocessor 1
2 is set as a diagnostic period from the time when the diagnostic signal is supplied to the diagnostic signal, and if a correct calculation result cannot be obtained within the predetermined time, it is determined that there is an abnormality. By providing a certain limit on the diagnosis time while diagnosing, even if a correct operation result is obtained, if the time limit T is exceeded, the input / output function of the microprocessor 12 is abnormal. Even if an erroneous operation result is obtained, the abnormality judgment is deferred until a correct operation result is obtained before the fixed time T has elapsed, so that the operation can be carefully and accurately performed. Diagnosis is possible.

Further, the diagnostic means includes a fail-safe device 17 for forcing the control output of the microprocessor 12 to a safe side when an abnormality of the microprocessor 12 is found by the diagnosis. Even if an abnormality is found in the processor 12,
The fail-safe device 17 is operated to set the system on the safe side to perform the fail-safe process, thereby ensuring thorough safety measures until the abnormality of the microprocessor 12 is repaired.

[0022]

As described above, the present invention supplies a diagnostic signal having a predetermined waveform to a microprocessor for controlling a system to be controlled and measures the duty. Based on the result of the duty measurement, the microprocessor has a timer function. In addition to diagnosing the operation of the microprocessor, the microprocessor performs an operation prepared in advance using the duty measurement result and diagnoses the operation function of the microprocessor based on the operation result. Various functions of the processor can be diagnosed by a series of operations, and even if a microprocessor having the same number of bits as the microprocessor to be diagnosed is not prepared,
For example, only by preparing a low-function and low-cost fail-safe microprocessor of about 4 bits or a diagnostic means composed of electronic components other than the microprocessor, the reliability of the system can be ensured, and the size and cost of the system can be reduced. Down can be planned.

Further, the diagnosis means is configured such that a predetermined time is set as a diagnosis period from the time when the diagnosis signal is supplied to the microprocessor, and if a correct operation result cannot be obtained within the predetermined time, it is determined that there is an abnormality. By diagnosing the timekeeping function and the calculation function of the microprocessor while providing a certain limit on the diagnosis time, if the correct calculation result is obtained, but the time limit is exceeded, the microprocessor input / output It is possible to judge that a malfunction has occurred in the function, and even if an incorrect operation result is obtained, defer the abnormality judgment until the correct operation result is obtained within a certain period of time, unless the predetermined time has elapsed Therefore, it is possible to perform a careful and accurate diagnosis.

Further, when the diagnosis means finds an abnormality in the microprocessor by the diagnosis,
Since a fail-safe device for forcing the control output of the microprocessor to the safe side is provided, even if an abnormality is found in the microprocessor as a result of the diagnosis, the fail-safe device operates to set the system to the safe side. Fail-safe processing can be performed, and effects such as thorough safety measures until the abnormality of the microprocessor is repaired can be obtained.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an embodiment of a microprocessor diagnostic device according to the present invention.

FIG. 2 is a flowchart for explaining a microprocessor diagnostic operation by the microprocessor diagnostic apparatus shown in FIG. 1;

FIG. 3 is a block diagram showing an example of a conventional microprocessor diagnostic device.

FIG. 4 is a block diagram showing another example of a conventional microprocessor diagnostic device.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 11 Microprocessor diagnostic device 12 Microprocessor 12a Operation part 12b Interrupt timer part 12c Input / output part 13 Diagnostic signal output device 14 Operation selection device 15 Operation result judgment device 16 Time measuring device 17 Fail safe processing device

──────────────────────────────────────────────────続 き Continued on the front page (58) Field surveyed (Int.Cl. ⁷ , DB name) G06F 11/22-11/277 G06F 15/78 G01R 31/28 G05B 23/00-23/02

Claims (3)

(57) [Claims] 1. A microprocessor for controlling a system to be controlled, a diagnostic signal having a predetermined waveform supplied to the microprocessor, the duty is measured, and a clock function of the microprocessor is diagnosed based on the duty measurement result. Diagnostic means for causing the microprocessor to execute an operation prepared in advance using the duty measurement result, and diagnosing the operation function of the microprocessor based on the operation result. 2. The diagnostic device according to claim 1, wherein a predetermined period is set as a diagnosis period from a point in time when the diagnosis signal is supplied to the microprocessor, and when a correct operation result cannot be obtained within the predetermined period, it is determined that there is an abnormality. The microprocessor diagnostic device according to claim 1, wherein: 3. The fail-safe device according to claim 1, wherein the diagnostic means includes a fail-safe device for forcing a control output of the microprocessor to a safe side when an abnormality of the microprocessor is found by the diagnosis. A microprocessor diagnostic device as described.